870 files changed, 48908 insertions, 24593 deletions

diff --git a/drivers/Makefile b/drivers/Makefile
index ae473445ad6d..a2aea53a75ed 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -50,7 +50,7 @@ obj-$(CONFIG_SPI)		+= spi/
 obj-y                           += net/
 obj-$(CONFIG_ATM)               += atm/
 obj-$(CONFIG_FUSION)            += message/
-obj-$(CONFIG_FIREWIRE)          += firewire/
+obj-y                           += firewire/
 obj-y                           += ieee1394/
 obj-$(CONFIG_UIO)               += uio/
 obj-y                           += cdrom/
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index b811f2173f6f..88681aca88c5 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -105,7 +105,7 @@ config ACPI_EC_DEBUGFS
 
           Be aware that using this interface can confuse your Embedded
           Controller in a way that a normal reboot is not enough. You then
-          have to power of your system, and remove the laptop battery for
+          have to power off your system, and remove the laptop battery for
           some seconds.
           An Embedded Controller typically is available on laptops and reads
           sensor values like battery state and temperature.
diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index b76848c80be3..6b115f6c4313 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -382,31 +382,32 @@ static void acpi_pad_remove_sysfs(struct acpi_device *device)
         device_remove_file(&device->dev, &dev_attr_rrtime);
 }
 
-/* Query firmware how many CPUs should be idle */
-static int acpi_pad_pur(acpi_handle handle, int *num_cpus)
+/*
+ * Query firmware how many CPUs should be idle
+ * return -1 on failure
+ */
+static int acpi_pad_pur(acpi_handle handle)
 {
         struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
         union acpi_object *package;
-        int rev, num, ret = -EINVAL;
+        int num = -1;
 
         if (ACPI_FAILURE(acpi_evaluate_object(handle, "_PUR", NULL, &buffer)))
-                return -EINVAL;
+                return num;
 
         if (!buffer.length || !buffer.pointer)
-                return -EINVAL;
+                return num;
 
         package = buffer.pointer;
-        if (package->type != ACPI_TYPE_PACKAGE || package->package.count != 2)
-                goto out;
-        rev = package->package.elements[0].integer.value;
-        num = package->package.elements[1].integer.value;
-        if (rev != 1 || num < 0)
-                goto out;
-        *num_cpus = num;
-        ret = 0;
-out:
+
+        if (package->type == ACPI_TYPE_PACKAGE &&
+                package->package.count == 2 &&
+                package->package.elements[0].integer.value == 1) /* rev 1 */
+
+                num = package->package.elements[1].integer.value;
+
         kfree(buffer.pointer);
-        return ret;
+        return num;
 }
 
 /* Notify firmware how many CPUs are idle */
@@ -433,7 +434,8 @@ static void acpi_pad_handle_notify(acpi_handle handle)
         uint32_t idle_cpus;
 
         mutex_lock(&isolated_cpus_lock);
-        if (acpi_pad_pur(handle, &num_cpus)) {
+        num_cpus = acpi_pad_pur(handle);
+        if (num_cpus < 0) {
                 mutex_unlock(&isolated_cpus_lock);
                 return;
         }
diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index df85b53a674f..7dad9160f209 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -854,6 +854,7 @@ struct acpi_bit_register_info {
         ACPI_BITMASK_POWER_BUTTON_STATUS   | \
         ACPI_BITMASK_SLEEP_BUTTON_STATUS   | \
         ACPI_BITMASK_RT_CLOCK_STATUS       | \
+        ACPI_BITMASK_PCIEXP_WAKE_DISABLE   | \
         ACPI_BITMASK_WAKE_STATUS)
 
 #define ACPI_BITMASK_TIMER_ENABLE               0x0001
diff --git a/drivers/acpi/acpica/exutils.c b/drivers/acpi/acpica/exutils.c
index 74c24d517f81..4093522eed45 100644
--- a/drivers/acpi/acpica/exutils.c
+++ b/drivers/acpi/acpica/exutils.c
@@ -109,7 +109,7 @@ void acpi_ex_enter_interpreter(void)
  *
  * DESCRIPTION: Reacquire the interpreter execution region from within the
  *              interpreter code. Failure to enter the interpreter region is a
- *              fatal system error. Used in  conjuction with
+ *              fatal system error. Used in  conjunction with
  *              relinquish_interpreter
  *
  ******************************************************************************/
diff --git a/drivers/acpi/acpica/rsutils.c b/drivers/acpi/acpica/rsutils.c
index 22cfcfbd9fff..491191e6cf69 100644
--- a/drivers/acpi/acpica/rsutils.c
+++ b/drivers/acpi/acpica/rsutils.c
@@ -149,7 +149,7 @@ acpi_rs_move_data(void *destination, void *source, u16 item_count, u8 move_type)
 
                         /*
                          * 16-, 32-, and 64-bit cases must use the move macros that perform
-                         * endian conversion and/or accomodate hardware that cannot perform
+                         * endian conversion and/or accommodate hardware that cannot perform
                          * misaligned memory transfers
                          */
                 case ACPI_RSC_MOVE16:
diff --git a/drivers/acpi/apei/Kconfig b/drivers/acpi/apei/Kconfig
index 907e350f1c7d..fca34ccfd294 100644
--- a/drivers/acpi/apei/Kconfig
+++ b/drivers/acpi/apei/Kconfig
@@ -34,6 +34,6 @@ config ACPI_APEI_ERST_DEBUG
         depends on ACPI_APEI
         help
           ERST is a way provided by APEI to save and retrieve hardware
-          error infomation to and from a persistent store. Enable this
+          error information to and from a persistent store. Enable this
           if you want to debugging and testing the ERST kernel support
           and firmware implementation.
diff --git a/drivers/acpi/apei/apei-base.c b/drivers/acpi/apei/apei-base.c
index 73fd0c7487c1..4a904a4bf05f 100644
--- a/drivers/acpi/apei/apei-base.c
+++ b/drivers/acpi/apei/apei-base.c
@@ -445,11 +445,15 @@ EXPORT_SYMBOL_GPL(apei_resources_sub);
 int apei_resources_request(struct apei_resources *resources,
                            const char *desc)
 {
-        struct apei_res *res, *res_bak;
+        struct apei_res *res, *res_bak = NULL;
         struct resource *r;
+        int rc;
 
-        apei_resources_sub(resources, &apei_resources_all);
+        rc = apei_resources_sub(resources, &apei_resources_all);
+        if (rc)
+                return rc;
 
+        rc = -EINVAL;
         list_for_each_entry(res, &resources->iomem, list) {
                 r = request_mem_region(res->start, res->end - res->start,
                                        desc);
@@ -475,7 +479,11 @@ int apei_resources_request(struct apei_resources *resources,
                 }
         }
 
-        apei_resources_merge(&apei_resources_all, resources);
+        rc = apei_resources_merge(&apei_resources_all, resources);
+        if (rc) {
+                pr_err(APEI_PFX "Fail to merge resources!\n");
+                goto err_unmap_ioport;
+        }
 
         return 0;
 err_unmap_ioport:
@@ -491,12 +499,13 @@ err_unmap_iomem:
                         break;
                 release_mem_region(res->start, res->end - res->start);
         }
-        return -EINVAL;
+        return rc;
 }
 EXPORT_SYMBOL_GPL(apei_resources_request);
 
 void apei_resources_release(struct apei_resources *resources)
 {
+        int rc;
         struct apei_res *res;
 
         list_for_each_entry(res, &resources->iomem, list)
@@ -504,7 +513,9 @@ void apei_resources_release(struct apei_resources *resources)
         list_for_each_entry(res, &resources->ioport, list)
                 release_region(res->start, res->end - res->start);
 
-        apei_resources_sub(&apei_resources_all, resources);
+        rc = apei_resources_sub(&apei_resources_all, resources);
+        if (rc)
+                pr_err(APEI_PFX "Fail to sub resources!\n");
 }
 EXPORT_SYMBOL_GPL(apei_resources_release);
 
diff --git a/drivers/acpi/apei/einj.c b/drivers/acpi/apei/einj.c
index 465c885938ee..cf29df69380b 100644
--- a/drivers/acpi/apei/einj.c
+++ b/drivers/acpi/apei/einj.c
@@ -426,7 +426,9 @@ DEFINE_SIMPLE_ATTRIBUTE(error_inject_fops, NULL,
 
 static int einj_check_table(struct acpi_table_einj *einj_tab)
 {
-        if (einj_tab->header_length != sizeof(struct acpi_table_einj))
+        if ((einj_tab->header_length !=
+             (sizeof(struct acpi_table_einj) - sizeof(einj_tab->header)))
+            && (einj_tab->header_length != sizeof(struct acpi_table_einj)))
                 return -EINVAL;
         if (einj_tab->header.length < sizeof(struct acpi_table_einj))
                 return -EINVAL;
diff --git a/drivers/acpi/apei/erst-dbg.c b/drivers/acpi/apei/erst-dbg.c
index 5281ddda2777..da1228a9a544 100644
--- a/drivers/acpi/apei/erst-dbg.c
+++ b/drivers/acpi/apei/erst-dbg.c
@@ -2,7 +2,7 @@
  * APEI Error Record Serialization Table debug support
  *
  * ERST is a way provided by APEI to save and retrieve hardware error
- * infomation to and from a persistent store. This file provide the
+ * information to and from a persistent store. This file provide the
  * debugging/testing support for ERST kernel support and firmware
  * implementation.
  *
@@ -111,11 +111,13 @@ retry:
                 goto out;
         }
         if (len > erst_dbg_buf_len) {
-                kfree(erst_dbg_buf);
+                void *p;
                 rc = -ENOMEM;
-                erst_dbg_buf = kmalloc(len, GFP_KERNEL);
-                if (!erst_dbg_buf)
+                p = kmalloc(len, GFP_KERNEL);
+                if (!p)
                         goto out;
+                kfree(erst_dbg_buf);
+                erst_dbg_buf = p;
                 erst_dbg_buf_len = len;
                 goto retry;
         }
@@ -150,11 +152,13 @@ static ssize_t erst_dbg_write(struct file *filp, const char __user *ubuf,
         if (mutex_lock_interruptible(&erst_dbg_mutex))
                 return -EINTR;
         if (usize > erst_dbg_buf_len) {
-                kfree(erst_dbg_buf);
+                void *p;
                 rc = -ENOMEM;
-                erst_dbg_buf = kmalloc(usize, GFP_KERNEL);
-                if (!erst_dbg_buf)
+                p = kmalloc(usize, GFP_KERNEL);
+                if (!p)
                         goto out;
+                kfree(erst_dbg_buf);
+                erst_dbg_buf = p;
                 erst_dbg_buf_len = usize;
         }
         rc = copy_from_user(erst_dbg_buf, ubuf, usize);
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 18645f4e83cd..1211c03149e8 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -2,7 +2,7 @@
  * APEI Error Record Serialization Table support
  *
  * ERST is a way provided by APEI to save and retrieve hardware error
- * infomation to and from a persistent store.
+ * information to and from a persistent store.
  *
  * For more information about ERST, please refer to ACPI Specification
  * version 4.0, section 17.4.
@@ -266,13 +266,30 @@ static int erst_exec_move_data(struct apei_exec_context *ctx,
 {
         int rc;
         u64 offset;
+        void *src, *dst;
+
+        /* ioremap does not work in interrupt context */
+        if (in_interrupt()) {
+                pr_warning(ERST_PFX
+                           "MOVE_DATA can not be used in interrupt context");
+                return -EBUSY;
+        }
 
         rc = __apei_exec_read_register(entry, &offset);
         if (rc)
                 return rc;
-        memmove((void *)ctx->dst_base + offset,
-                (void *)ctx->src_base + offset,
-                ctx->var2);
+
+        src = ioremap(ctx->src_base + offset, ctx->var2);
+        if (!src)
+                return -ENOMEM;
+        dst = ioremap(ctx->dst_base + offset, ctx->var2);
+        if (!dst)
+                return -ENOMEM;
+
+        memmove(dst, src, ctx->var2);
+
+        iounmap(src);
+        iounmap(dst);
 
         return 0;
 }
@@ -750,7 +767,9 @@ __setup("erst_disable", setup_erst_disable);
 
 static int erst_check_table(struct acpi_table_erst *erst_tab)
 {
-        if (erst_tab->header_length != sizeof(struct acpi_table_erst))
+        if ((erst_tab->header_length !=
+             (sizeof(struct acpi_table_erst) - sizeof(erst_tab->header)))
+            && (erst_tab->header_length != sizeof(struct acpi_table_einj)))
                 return -EINVAL;
         if (erst_tab->header.length < sizeof(struct acpi_table_erst))
                 return -EINVAL;
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 385a6059714a..0d505e59214d 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -302,7 +302,7 @@ static int __devinit ghes_probe(struct platform_device *ghes_dev)
         struct ghes *ghes = NULL;
         int rc = -EINVAL;
 
-        generic = ghes_dev->dev.platform_data;
+        generic = *(struct acpi_hest_generic **)ghes_dev->dev.platform_data;
         if (!generic->enabled)
                 return -ENODEV;
 
diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
index 343168d18266..1a3508a7fe03 100644
--- a/drivers/acpi/apei/hest.c
+++ b/drivers/acpi/apei/hest.c
@@ -137,20 +137,23 @@ static int hest_parse_ghes_count(struct acpi_hest_header *hest_hdr, void *data)
 
 static int hest_parse_ghes(struct acpi_hest_header *hest_hdr, void *data)
 {
-        struct acpi_hest_generic *generic;
         struct platform_device *ghes_dev;
         struct ghes_arr *ghes_arr = data;
         int rc;
 
         if (hest_hdr->type != ACPI_HEST_TYPE_GENERIC_ERROR)
                 return 0;
-        generic = (struct acpi_hest_generic *)hest_hdr;
-        if (!generic->enabled)
+
+        if (!((struct acpi_hest_generic *)hest_hdr)->enabled)
                 return 0;
         ghes_dev = platform_device_alloc("GHES", hest_hdr->source_id);
         if (!ghes_dev)
                 return -ENOMEM;
-        ghes_dev->dev.platform_data = generic;
+
+        rc = platform_device_add_data(ghes_dev, &hest_hdr, sizeof(void *));
+        if (rc)
+                goto err;
+
         rc = platform_device_add(ghes_dev);
         if (rc)
                 goto err;
diff --git a/drivers/acpi/atomicio.c b/drivers/acpi/atomicio.c
index 8f8bd736d4ff..542e53903891 100644
--- a/drivers/acpi/atomicio.c
+++ b/drivers/acpi/atomicio.c
@@ -142,7 +142,7 @@ static void __iomem *acpi_pre_map(phys_addr_t paddr,
         list_add_tail_rcu(&map->list, &acpi_iomaps);
         spin_unlock_irqrestore(&acpi_iomaps_lock, flags);
 
-        return vaddr + (paddr - pg_off);
+        return map->vaddr + (paddr - map->paddr);
 err_unmap:
         iounmap(vaddr);
         return NULL;
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index dc58402b0a17..98417201e9ce 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -273,7 +273,6 @@ static enum power_supply_property energy_battery_props[] = {
         POWER_SUPPLY_PROP_CYCLE_COUNT,
         POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN,
         POWER_SUPPLY_PROP_VOLTAGE_NOW,
-        POWER_SUPPLY_PROP_CURRENT_NOW,
         POWER_SUPPLY_PROP_POWER_NOW,
         POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN,
         POWER_SUPPLY_PROP_ENERGY_FULL,
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index 2bb28b9d91c4..f7619600270a 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -183,6 +183,8 @@ static int __init dmi_disable_osi_vista(const struct dmi_system_id *d)
 {
         printk(KERN_NOTICE PREFIX "DMI detected: %s\n", d->ident);
         acpi_osi_setup("!Windows 2006");
+        acpi_osi_setup("!Windows 2006 SP1");
+        acpi_osi_setup("!Windows 2006 SP2");
         return 0;
 }
 static int __init dmi_disable_osi_win7(const struct dmi_system_id *d)
@@ -226,6 +228,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                 },
         },
         {
+        .callback = dmi_disable_osi_vista,
+        .ident = "Toshiba Satellite L355",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "Satellite L355"),
+                },
+        },
+        {
         .callback = dmi_disable_osi_win7,
         .ident = "ASUS K50IJ",
         .matches = {
@@ -233,6 +243,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                      DMI_MATCH(DMI_PRODUCT_NAME, "K50IJ"),
                 },
         },
+        {
+        .callback = dmi_disable_osi_vista,
+        .ident = "Toshiba P305D",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P305D"),
+                },
+        },
 
         /*
          * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 5c221ab535d5..310e3b9749cb 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -55,7 +55,7 @@ EXPORT_SYMBOL(acpi_root_dir);
 static int set_power_nocheck(const struct dmi_system_id *id)
 {
         printk(KERN_NOTICE PREFIX "%s detected - "
-                "disable power check in power transistion\n", id->ident);
+                "disable power check in power transition\n", id->ident);
         acpi_power_nocheck = 1;
         return 0;
 }
@@ -80,23 +80,15 @@ static int set_copy_dsdt(const struct dmi_system_id *id)
 
 static struct dmi_system_id dsdt_dmi_table[] __initdata = {
         /*
-         * Insyde BIOS on some TOSHIBA machines corrupt the DSDT.
+         * Invoke DSDT corruption work-around on all Toshiba Satellite.
          * https://bugzilla.kernel.org/show_bug.cgi?id=14679
          */
         {
          .callback = set_copy_dsdt,
-         .ident = "TOSHIBA Satellite A505",
+         .ident = "TOSHIBA Satellite",
          .matches = {
                 DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "Satellite A505"),
-                },
-        },
-        {
-         .callback = set_copy_dsdt,
-         .ident = "TOSHIBA Satellite L505D",
-         .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "Satellite L505D"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Satellite"),
                 },
         },
         {}
@@ -1027,7 +1019,7 @@ static int __init acpi_init(void)
 
         /*
          * If the laptop falls into the DMI check table, the power state check
-         * will be disabled in the course of device power transistion.
+         * will be disabled in the course of device power transition.
          */
         dmi_check_system(power_nocheck_dmi_table);
 
diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c
index 8a3b840c0bb2..d94d2953c974 100644
--- a/drivers/acpi/fan.c
+++ b/drivers/acpi/fan.c
@@ -369,7 +369,9 @@ static void __exit acpi_fan_exit(void)
 
         acpi_bus_unregister_driver(&acpi_fan_driver);
 
+#ifdef CONFIG_ACPI_PROCFS
         remove_proc_entry(ACPI_FAN_CLASS, acpi_root_dir);
+#endif
 
         return;
 }
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index e9699aaed109..b618f888d66b 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -29,12 +29,6 @@ static int set_no_mwait(const struct dmi_system_id *id)
 
 static struct dmi_system_id __cpuinitdata processor_idle_dmi_table[] = {
         {
-        set_no_mwait, "IFL91 board", {
-        DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"),
-        DMI_MATCH(DMI_SYS_VENDOR, "ZEPTO"),
-        DMI_MATCH(DMI_PRODUCT_VERSION, "3215W"),
-        DMI_MATCH(DMI_BOARD_NAME, "IFL91") }, NULL},
-        {
         set_no_mwait, "Extensa 5220", {
         DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
         DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index 156021892389..347eb21b2353 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -850,7 +850,7 @@ static int __init acpi_processor_init(void)
                 printk(KERN_DEBUG "ACPI: %s registered with cpuidle\n",
                         acpi_idle_driver.name);
         } else {
-                printk(KERN_DEBUG "ACPI: acpi_idle yielding to %s",
+                printk(KERN_DEBUG "ACPI: acpi_idle yielding to %s\n",
                         cpuidle_get_driver()->name);
         }
 
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index ba1bd263d903..3a73a93596e8 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -447,8 +447,8 @@ int acpi_processor_notify_smm(struct module *calling_module)
         if (!try_module_get(calling_module))
                 return -EINVAL;
 
-        /* is_done is set to negative if an error occured,
-         * and to postitive if _no_ error occured, but SMM
+        /* is_done is set to negative if an error occurred,
+         * and to postitive if _no_ error occurred, but SMM
          * was already notified. This avoids double notification
          * which might lead to unexpected results...
          */
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index cf82989ae756..4754ff6e70e6 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -363,6 +363,12 @@ static int __init init_old_suspend_ordering(const struct dmi_system_id *d)
         return 0;
 }
 
+static int __init init_nvs_nosave(const struct dmi_system_id *d)
+{
+        acpi_nvs_nosave();
+        return 0;
+}
+
 static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
         {
         .callback = init_old_suspend_ordering,
@@ -397,6 +403,22 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
                 DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
                 },
         },
+        {
+        .callback = init_nvs_nosave,
+        .ident = "Sony Vaio VGN-SR11M",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "VGN-SR11M"),
+                },
+        },
+        {
+        .callback = init_nvs_nosave,
+        .ident = "Everex StepNote Series",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Everex Systems, Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Everex StepNote Series"),
+                },
+        },
         {},
 };
 #endif /* CONFIG_SUSPEND */
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index 68e2e4582fa2..f8588f81048a 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -100,7 +100,7 @@ static const struct acpi_dlevel acpi_debug_levels[] = {
         ACPI_DEBUG_INIT(ACPI_LV_EVENTS),
 };
 
-static int param_get_debug_layer(char *buffer, struct kernel_param *kp)
+static int param_get_debug_layer(char *buffer, const struct kernel_param *kp)
 {
         int result = 0;
         int i;
@@ -128,7 +128,7 @@ static int param_get_debug_layer(char *buffer, struct kernel_param *kp)
         return result;
 }
 
-static int param_get_debug_level(char *buffer, struct kernel_param *kp)
+static int param_get_debug_level(char *buffer, const struct kernel_param *kp)
 {
         int result = 0;
         int i;
@@ -149,10 +149,18 @@ static int param_get_debug_level(char *buffer, struct kernel_param *kp)
         return result;
 }
 
-module_param_call(debug_layer, param_set_uint, param_get_debug_layer,
-                  &acpi_dbg_layer, 0644);
-module_param_call(debug_level, param_set_uint, param_get_debug_level,
-                  &acpi_dbg_level, 0644);
+static struct kernel_param_ops param_ops_debug_layer = {
+        .set = param_set_uint,
+        .get = param_get_debug_layer,
+};
+
+static struct kernel_param_ops param_ops_debug_level = {
+        .set = param_set_uint,
+        .get = param_get_debug_level,
+};
+
+module_param_cb(debug_layer, &param_ops_debug_layer, &acpi_dbg_layer, 0644);
+module_param_cb(debug_level, &param_ops_debug_level, &acpi_dbg_level, 0644);
 
 static char trace_method_name[6];
 module_param_string(trace_method_name, trace_method_name, 6, 0644);
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index c5fef01b3c95..b83676126598 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -59,8 +59,8 @@ acpi_backlight_cap_match(acpi_handle handle, u32 level, void *context,
                                   "support\n"));
                 *cap |= ACPI_VIDEO_BACKLIGHT;
                 if (ACPI_FAILURE(acpi_get_handle(handle, "_BQC", &h_dummy)))
-                        printk(KERN_WARNING FW_BUG PREFIX "ACPI brightness "
-                                        "control misses _BQC function\n");
+                        printk(KERN_WARNING FW_BUG PREFIX "No _BQC method, "
+                                "cannot determine initial brightness\n");
                 /* We have backlight support, no need to scan further */
                 return AE_CTRL_TERMINATE;
         }
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 013727b20417..99d0e5a51148 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -90,6 +90,10 @@ static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg);
 static int ahci_pci_device_resume(struct pci_dev *pdev);
 #endif
 
+static struct scsi_host_template ahci_sht = {
+        AHCI_SHT("ahci"),
+};
+
 static struct ata_port_operations ahci_vt8251_ops = {
         .inherits               = &ahci_ops,
         .hardreset              = ahci_vt8251_hardreset,
@@ -253,6 +257,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x1c05), board_ahci }, /* CPT RAID */
         { PCI_VDEVICE(INTEL, 0x1c06), board_ahci }, /* CPT RAID */
         { PCI_VDEVICE(INTEL, 0x1c07), board_ahci }, /* CPT RAID */
+        { PCI_VDEVICE(INTEL, 0x1d02), board_ahci }, /* PBG AHCI */
+        { PCI_VDEVICE(INTEL, 0x1d04), board_ahci }, /* PBG RAID */
+        { PCI_VDEVICE(INTEL, 0x1d06), board_ahci }, /* PBG RAID */
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index 474427b6f99f..e5fdeebf9ef0 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -298,7 +298,17 @@ struct ahci_host_priv {
 
 extern int ahci_ignore_sss;
 
-extern struct scsi_host_template ahci_sht;
+extern struct device_attribute *ahci_shost_attrs[];
+extern struct device_attribute *ahci_sdev_attrs[];
+
+#define AHCI_SHT(drv_name)                                              \
+        ATA_NCQ_SHT(drv_name),                                          \
+        .can_queue              = AHCI_MAX_CMDS - 1,                    \
+        .sg_tablesize           = AHCI_MAX_SG,                          \
+        .dma_boundary           = AHCI_DMA_BOUNDARY,                    \
+        .shost_attrs            = ahci_shost_attrs,                     \
+        .sdev_attrs             = ahci_sdev_attrs
+
 extern struct ata_port_operations ahci_ops;
 
 void ahci_save_initial_config(struct device *dev,
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index 4e97f33cca44..84b643270e7a 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -23,6 +23,10 @@
 #include <linux/ahci_platform.h>
 #include "ahci.h"
 
+static struct scsi_host_template ahci_platform_sht = {
+        AHCI_SHT("ahci_platform"),
+};
+
 static int __init ahci_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
@@ -145,7 +149,7 @@ static int __init ahci_probe(struct platform_device *pdev)
         ahci_print_info(host, "platform");
 
         rc = ata_host_activate(host, irq, ahci_interrupt, IRQF_SHARED,
-                               &ahci_sht);
+                               &ahci_platform_sht);
         if (rc)
                 goto err0;
 
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 3971bc0a4838..d712675d0a96 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -302,6 +302,10 @@ static const struct pci_device_id piix_pci_tbl[] = {
         { 0x8086, 0x1c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
         /* SATA Controller IDE (CPT) */
         { 0x8086, 0x1c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        /* SATA Controller IDE (PBG) */
+        { 0x8086, 0x1d00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
+        /* SATA Controller IDE (PBG) */
+        { 0x8086, 0x1d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
         { }     /* terminate list */
 };
 
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 666850d31df2..8eea309ea212 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -121,7 +121,7 @@ static DEVICE_ATTR(ahci_port_cmd, S_IRUGO, ahci_show_port_cmd, NULL);
 static DEVICE_ATTR(em_buffer, S_IWUSR | S_IRUGO,
                    ahci_read_em_buffer, ahci_store_em_buffer);
 
-static struct device_attribute *ahci_shost_attrs[] = {
+struct device_attribute *ahci_shost_attrs[] = {
         &dev_attr_link_power_management_policy,
         &dev_attr_em_message_type,
         &dev_attr_em_message,
@@ -132,22 +132,14 @@ static struct device_attribute *ahci_shost_attrs[] = {
         &dev_attr_em_buffer,
         NULL
 };
+EXPORT_SYMBOL_GPL(ahci_shost_attrs);
 
-static struct device_attribute *ahci_sdev_attrs[] = {
+struct device_attribute *ahci_sdev_attrs[] = {
         &dev_attr_sw_activity,
         &dev_attr_unload_heads,
         NULL
 };
-
-struct scsi_host_template ahci_sht = {
-        ATA_NCQ_SHT("ahci"),
-        .can_queue              = AHCI_MAX_CMDS - 1,
-        .sg_tablesize           = AHCI_MAX_SG,
-        .dma_boundary           = AHCI_DMA_BOUNDARY,
-        .shost_attrs            = ahci_shost_attrs,
-        .sdev_attrs             = ahci_sdev_attrs,
-};
-EXPORT_SYMBOL_GPL(ahci_sht);
+EXPORT_SYMBOL_GPL(ahci_sdev_attrs);
 
 struct ata_port_operations ahci_ops = {
         .inherits               = &sata_pmp_port_ops,
@@ -1326,7 +1318,7 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
         /* issue the first D2H Register FIS */
         msecs = 0;
         now = jiffies;
-        if (time_after(now, deadline))
+        if (time_after(deadline, now))
                 msecs = jiffies_to_msecs(deadline - now);
 
         tf.ctl |= ATA_SRST;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index c035b3d041ee..932eaee50245 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5418,6 +5418,7 @@ static int ata_host_request_pm(struct ata_host *host, pm_message_t mesg,
  */
 int ata_host_suspend(struct ata_host *host, pm_message_t mesg)
 {
+        unsigned int ehi_flags = ATA_EHI_QUIET;
         int rc;
 
         /*
@@ -5426,7 +5427,18 @@ int ata_host_suspend(struct ata_host *host, pm_message_t mesg)
          */
         ata_lpm_enable(host);
 
-        rc = ata_host_request_pm(host, mesg, 0, ATA_EHI_QUIET, 1);
+        /*
+         * On some hardware, device fails to respond after spun down
+         * for suspend.  As the device won't be used before being
+         * resumed, we don't need to touch the device.  Ask EH to skip
+         * the usual stuff and proceed directly to suspend.
+         *
+         * http://thread.gmane.org/gmane.linux.ide/46764
+         */
+        if (mesg.event == PM_EVENT_SUSPEND)
+                ehi_flags |= ATA_EHI_NO_AUTOPSY | ATA_EHI_NO_RECOVERY;
+
+        rc = ata_host_request_pm(host, mesg, 0, ehi_flags, 1);
         if (rc == 0)
                 host->dev->power.power_state = mesg;
         return rc;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index c9ae299b8342..e48302eae55f 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -3235,6 +3235,10 @@ static int ata_eh_skip_recovery(struct ata_link *link)
         if (link->flags & ATA_LFLAG_DISABLED)
                 return 1;
 
+        /* skip if explicitly requested */
+        if (ehc->i.flags & ATA_EHI_NO_RECOVERY)
+                return 1;
+
         /* thaw frozen port and recover failed devices */
         if ((ap->pflags & ATA_PFLAG_FROZEN) || ata_link_nr_enabled(link))
                 return 0;
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 3b82d8ef76f0..e30c537cce32 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -418,6 +418,7 @@ void ata_sff_tf_load(struct ata_port *ap, const struct ata_taskfile *tf)
                 if (ioaddr->ctl_addr)
                         iowrite8(tf->ctl, ioaddr->ctl_addr);
                 ap->last_ctl = tf->ctl;
+                ata_wait_idle(ap);
         }
 
         if (is_addr && (tf->flags & ATA_TFLAG_LBA48)) {
@@ -453,6 +454,8 @@ void ata_sff_tf_load(struct ata_port *ap, const struct ata_taskfile *tf)
                 iowrite8(tf->device, ioaddr->device_addr);
                 VPRINTK("device 0x%X\n", tf->device);
         }
+
+        ata_wait_idle(ap);
 }
 EXPORT_SYMBOL_GPL(ata_sff_tf_load);
 
@@ -1042,7 +1045,8 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
 int ata_sff_hsm_move(struct ata_port *ap, struct ata_queued_cmd *qc,
                      u8 status, int in_wq)
 {
-        struct ata_eh_info *ehi = &ap->link.eh_info;
+        struct ata_link *link = qc->dev->link;
+        struct ata_eh_info *ehi = &link->eh_info;
         unsigned long flags = 0;
         int poll_next;
 
@@ -1298,8 +1302,14 @@ fsm_start:
 }
 EXPORT_SYMBOL_GPL(ata_sff_hsm_move);
 
-void ata_sff_queue_pio_task(struct ata_port *ap, unsigned long delay)
+void ata_sff_queue_pio_task(struct ata_link *link, unsigned long delay)
 {
+        struct ata_port *ap = link->ap;
+
+        WARN_ON((ap->sff_pio_task_link != NULL) &&
+                (ap->sff_pio_task_link != link));
+        ap->sff_pio_task_link = link;
+
         /* may fail if ata_sff_flush_pio_task() in progress */
         queue_delayed_work(ata_sff_wq, &ap->sff_pio_task,
                            msecs_to_jiffies(delay));
@@ -1321,14 +1331,18 @@ static void ata_sff_pio_task(struct work_struct *work)
 {
         struct ata_port *ap =
                 container_of(work, struct ata_port, sff_pio_task.work);
+        struct ata_link *link = ap->sff_pio_task_link;
         struct ata_queued_cmd *qc;
         u8 status;
         int poll_next;
 
+        BUG_ON(ap->sff_pio_task_link == NULL); 
         /* qc can be NULL if timeout occurred */
-        qc = ata_qc_from_tag(ap, ap->link.active_tag);
-        if (!qc)
+        qc = ata_qc_from_tag(ap, link->active_tag);
+        if (!qc) {
+                ap->sff_pio_task_link = NULL;
                 return;
+        }
 
 fsm_start:
         WARN_ON_ONCE(ap->hsm_task_state == HSM_ST_IDLE);
@@ -1345,11 +1359,16 @@ fsm_start:
                 msleep(2);
                 status = ata_sff_busy_wait(ap, ATA_BUSY, 10);
                 if (status & ATA_BUSY) {
-                        ata_sff_queue_pio_task(ap, ATA_SHORT_PAUSE);
+                        ata_sff_queue_pio_task(link, ATA_SHORT_PAUSE);
                         return;
                 }
         }
 
+        /*
+         * hsm_move() may trigger another command to be processed.
+         * clean the link beforehand.
+         */
+        ap->sff_pio_task_link = NULL;
         /* move the HSM */
         poll_next = ata_sff_hsm_move(ap, qc, status, 1);
 
@@ -1376,6 +1395,7 @@ fsm_start:
 unsigned int ata_sff_qc_issue(struct ata_queued_cmd *qc)
 {
         struct ata_port *ap = qc->ap;
+        struct ata_link *link = qc->dev->link;
 
         /* Use polling pio if the LLD doesn't handle
          * interrupt driven pio and atapi CDB interrupt.
@@ -1396,7 +1416,7 @@ unsigned int ata_sff_qc_issue(struct ata_queued_cmd *qc)
                 ap->hsm_task_state = HSM_ST_LAST;
 
                 if (qc->tf.flags & ATA_TFLAG_POLLING)
-                        ata_sff_queue_pio_task(ap, 0);
+                        ata_sff_queue_pio_task(link, 0);
 
                 break;
 
@@ -1409,7 +1429,7 @@ unsigned int ata_sff_qc_issue(struct ata_queued_cmd *qc)
                 if (qc->tf.flags & ATA_TFLAG_WRITE) {
                         /* PIO data out protocol */
                         ap->hsm_task_state = HSM_ST_FIRST;
-                        ata_sff_queue_pio_task(ap, 0);
+                        ata_sff_queue_pio_task(link, 0);
 
                         /* always send first data block using the
                          * ata_sff_pio_task() codepath.
@@ -1419,7 +1439,7 @@ unsigned int ata_sff_qc_issue(struct ata_queued_cmd *qc)
                         ap->hsm_task_state = HSM_ST;
 
                         if (qc->tf.flags & ATA_TFLAG_POLLING)
-                                ata_sff_queue_pio_task(ap, 0);
+                                ata_sff_queue_pio_task(link, 0);
 
                         /* if polling, ata_sff_pio_task() handles the
                          * rest.  otherwise, interrupt handler takes
@@ -1441,7 +1461,7 @@ unsigned int ata_sff_qc_issue(struct ata_queued_cmd *qc)
                 /* send cdb by polling if no cdb interrupt */
                 if ((!(qc->dev->flags & ATA_DFLAG_CDB_INTR)) ||
                     (qc->tf.flags & ATA_TFLAG_POLLING))
-                        ata_sff_queue_pio_task(ap, 0);
+                        ata_sff_queue_pio_task(link, 0);
                 break;
 
         default:
@@ -2734,6 +2754,7 @@ EXPORT_SYMBOL_GPL(ata_bmdma_dumb_qc_prep);
 unsigned int ata_bmdma_qc_issue(struct ata_queued_cmd *qc)
 {
         struct ata_port *ap = qc->ap;
+        struct ata_link *link = qc->dev->link;
 
         /* defer PIO handling to sff_qc_issue */
         if (!ata_is_dma(qc->tf.protocol))
@@ -2762,7 +2783,7 @@ unsigned int ata_bmdma_qc_issue(struct ata_queued_cmd *qc)
 
                 /* send cdb by polling if no cdb interrupt */
                 if (!(qc->dev->flags & ATA_DFLAG_CDB_INTR))
-                        ata_sff_queue_pio_task(ap, 0);
+                        ata_sff_queue_pio_task(link, 0);
                 break;
 
         default:
diff --git a/drivers/ata/pata_artop.c b/drivers/ata/pata_artop.c
index ba43f0f8c880..2215632e4b31 100644
--- a/drivers/ata/pata_artop.c
+++ b/drivers/ata/pata_artop.c
@@ -74,7 +74,8 @@ static int artop6260_pre_reset(struct ata_link *link, unsigned long deadline)
         struct pci_dev *pdev = to_pci_dev(ap->host->dev);
 
         /* Odd numbered device ids are the units with enable bits (the -R cards) */
-        if (pdev->device % 1 && !pci_test_config_bits(pdev, &artop_enable_bits[ap->port_no]))
+        if ((pdev->device & 1) &&
+            !pci_test_config_bits(pdev, &artop_enable_bits[ap->port_no]))
                 return -ENOENT;
 
         return ata_sff_prereset(link, deadline);
diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c
index 5e659885de16..ac8d7d97e408 100644
--- a/drivers/ata/pata_via.c
+++ b/drivers/ata/pata_via.c
@@ -417,6 +417,8 @@ static void via_tf_load(struct ata_port *ap, const struct ata_taskfile *tf)
                         tf->lbam,
                         tf->lbah);
         }
+
+        ata_wait_idle(ap);
 }
 
 static int via_port_start(struct ata_port *ap)
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 81982594a014..a9fd9709c262 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -2284,7 +2284,7 @@ static unsigned int mv_qc_issue_fis(struct ata_queued_cmd *qc)
         }
 
         if (qc->tf.flags & ATA_TFLAG_POLLING)
-                ata_sff_queue_pio_task(ap, 0);
+                ata_sff_queue_pio_task(link, 0);
         return 0;
 }
 
diff --git a/drivers/atm/Makefile b/drivers/atm/Makefile
index 62c3cc1075ae..c6c9ee9f5da2 100644
--- a/drivers/atm/Makefile
+++ b/drivers/atm/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the Linux network (ATM) device drivers.
 #
 
-fore_200e-objs  := fore200e.o
+fore_200e-y     := fore200e.o
 
 obj-$(CONFIG_ATM_ZATM)          += zatm.o uPD98402.o
 obj-$(CONFIG_ATM_NICSTAR)       += nicstar.o
diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
index 54720baa7363..a95790452a68 100644
--- a/drivers/atm/horizon.c
+++ b/drivers/atm/horizon.c
@@ -1645,10 +1645,8 @@ static int hrz_send (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
     unsigned short d = 0;
     char * s = skb->data;
     if (*s++ == 'D') {
-      for (i = 0; i < 4; ++i) {
-        d = (d<<4) | ((*s <= '9') ? (*s - '0') : (*s - 'a' + 10));
-        ++s;
-      }
+        for (i = 0; i < 4; ++i)
+                d = (d << 4) | hex_to_bin(*s++);
       PRINTK (KERN_INFO, "debug bitmap is now %hx", debug = d);
     }
   }
diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index 1679cbf0c584..bce57328ddde 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -3152,7 +3152,7 @@ deinit_card(struct idt77252_dev *card)
 }
 
 
-static int __devinit
+static void __devinit
 init_sram(struct idt77252_dev *card)
 {
         int i;
@@ -3298,7 +3298,6 @@ init_sram(struct idt77252_dev *card)
                SAR_REG_RXFD);
 
         IPRINTK("%s: SRAM initialization complete.\n", card->name);
-        return 0;
 }
 
 static int __devinit
@@ -3410,8 +3409,7 @@ init_card(struct atm_dev *dev)
 
         writel(readl(SAR_REG_CFG) | conf, SAR_REG_CFG);
 
-        if (init_sram(card) < 0)
-                return -1;
+        init_sram(card);
 
 /********************************************************************/
 /*  A L L O C   R A M   A N D   S E T   V A R I O U S   T H I N G S */
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index 8b358d7d958f..9309d4724e13 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -3156,7 +3156,6 @@ static int __devinit ia_init_one(struct pci_dev *pdev,
 {  
         struct atm_dev *dev;  
         IADEV *iadev;  
-        unsigned long flags;
         int ret;
 
         iadev = kzalloc(sizeof(*iadev), GFP_KERNEL);
@@ -3188,19 +3187,14 @@ static int __devinit ia_init_one(struct pci_dev *pdev,
         ia_dev[iadev_count] = iadev;
         _ia_dev[iadev_count] = dev;
         iadev_count++;
-        spin_lock_init(&iadev->misc_lock);
-        /* First fixes first. I don't want to think about this now. */
-        spin_lock_irqsave(&iadev->misc_lock, flags); 
         if (ia_init(dev) || ia_start(dev)) {  
                 IF_INIT(printk("IA register failed!\n");)
                 iadev_count--;
                 ia_dev[iadev_count] = NULL;
                 _ia_dev[iadev_count] = NULL;
-                spin_unlock_irqrestore(&iadev->misc_lock, flags); 
                 ret = -EINVAL;
                 goto err_out_deregister_dev;
         }
-        spin_unlock_irqrestore(&iadev->misc_lock, flags); 
         IF_EVENT(printk("iadev_count = %d\n", iadev_count);)
 
         iadev->next_board = ia_boards;  
diff --git a/drivers/atm/iphase.h b/drivers/atm/iphase.h
index b2cd20f549cb..077735e0e04b 100644
--- a/drivers/atm/iphase.h
+++ b/drivers/atm/iphase.h
@@ -1022,7 +1022,7 @@ typedef struct iadev_t {
         struct dle_q rx_dle_q;  
         struct free_desc_q *rx_free_desc_qhead;  
         struct sk_buff_head rx_dma_q;  
-        spinlock_t rx_lock, misc_lock;
+        spinlock_t rx_lock;
         struct atm_vcc **rx_open;       /* list of all open VCs */  
         u16 num_rx_desc, rx_buf_sz, rxing;
         u32 rx_pkt_ram, rx_tmp_cnt;
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index f916ddf63938..f46138ab38b6 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -444,6 +444,7 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
         struct atm_dev *atmdev = container_of(dev, struct atm_dev, class_dev);
         struct solos_card *card = atmdev->dev_data;
         struct sk_buff *skb;
+        unsigned int len;
 
         spin_lock(&card->cli_queue_lock);
         skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]);
@@ -451,11 +452,12 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
         if(skb == NULL)
                 return sprintf(buf, "No data.\n");
 
-        memcpy(buf, skb->data, skb->len);
-        dev_dbg(&card->dev->dev, "len: %d\n", skb->len);
+        len = skb->len;
+        memcpy(buf, skb->data, len);
+        dev_dbg(&card->dev->dev, "len: %d\n", len);
 
         kfree_skb(skb);
-        return skb->len;
+        return len;
 }
 
 static int send_command(struct solos_card *card, int dev, const char *buf, size_t size)
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 5419a49ff135..276d5a701dc3 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -59,6 +59,7 @@ void device_pm_init(struct device *dev)
 {
         dev->power.status = DPM_ON;
         init_completion(&dev->power.completion);
+        complete_all(&dev->power.completion);
         dev->power.wakeup_count = 0;
         pm_runtime_init(dev);
 }
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 31064df1370a..5e4fadcdece9 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -297,6 +297,8 @@ static void enqueue_cmd_and_start_io(ctlr_info_t *h,
         spin_lock_irqsave(&h->lock, flags);
         addQ(&h->reqQ, c);
         h->Qdepth++;
+        if (h->Qdepth > h->maxQsinceinit)
+                h->maxQsinceinit = h->Qdepth;
         start_io(h);
         spin_unlock_irqrestore(&h->lock, flags);
 }
@@ -4519,6 +4521,12 @@ static __devinit int cciss_kdump_hard_reset_controller(struct pci_dev *pdev)
         misc_fw_support = readl(&cfgtable->misc_fw_support);
         use_doorbell = misc_fw_support & MISC_FW_DOORBELL_RESET;
 
+        /* The doorbell reset seems to cause lockups on some Smart
+         * Arrays (e.g. P410, P410i, maybe others).  Until this is
+         * fixed or at least isolated, avoid the doorbell reset.
+         */
+        use_doorbell = 0;
+
         rc = cciss_controller_hard_reset(pdev, vaddr, use_doorbell);
         if (rc)
                 goto unmap_cfgtable;
@@ -4712,6 +4720,9 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
         h->scatter_list = kmalloc(h->max_commands *
                                                 sizeof(struct scatterlist *),
                                                 GFP_KERNEL);
+        if (!h->scatter_list)
+                goto clean4;
+
         for (k = 0; k < h->nr_cmds; k++) {
                 h->scatter_list[k] = kmalloc(sizeof(struct scatterlist) *
                                                         h->maxsgentries,
@@ -4781,7 +4792,7 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
 clean4:
         kfree(h->cmd_pool_bits);
         /* Free up sg elements */
-        for (k = 0; k < h->nr_cmds; k++)
+        for (k-- ; k >= 0; k--)
                 kfree(h->scatter_list[k]);
         kfree(h->scatter_list);
         cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index f3c636d23718..91797bbbe702 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -477,7 +477,7 @@ static int do_bio_filebacked(struct loop_device *lo, struct bio *bio)
         pos = ((loff_t) bio->bi_sector << 9) + lo->lo_offset;
 
         if (bio_rw(bio) == WRITE) {
-                bool barrier = (bio->bi_rw & REQ_HARDBARRIER);
+                bool barrier = !!(bio->bi_rw & REQ_HARDBARRIER);
                 struct file *file = lo->lo_backing_file;
 
                 if (barrier) {
diff --git a/drivers/block/mg_disk.c b/drivers/block/mg_disk.c
index b82c5ce5e9df..76fa3deaee84 100644
--- a/drivers/block/mg_disk.c
+++ b/drivers/block/mg_disk.c
@@ -974,8 +974,7 @@ static int mg_probe(struct platform_device *plat_dev)
         host->breq->queuedata = host;
 
         /* mflash is random device, thanx for the noop */
-        elevator_exit(host->breq->elevator);
-        err = elevator_init(host->breq, "noop");
+        err = elevator_change(host->breq, "noop");
         if (err) {
                 printk(KERN_ERR "%s:%d (elevator_init) fail\n",
                                 __func__, __LINE__);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index b1cbeb59bb76..37a2bb595076 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -2369,7 +2369,7 @@ static void pkt_release_dev(struct pktcdvd_device *pd, int flush)
         pkt_shrink_pktlist(pd);
 }
 
-static struct pktcdvd_device *pkt_find_dev_from_minor(int dev_minor)
+static struct pktcdvd_device *pkt_find_dev_from_minor(unsigned int dev_minor)
 {
         if (dev_minor >= MAX_WRITERS)
                 return NULL;
diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index 0d32ec82e9bf..548d1d9e4dda 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -117,8 +117,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
                                 (event->data[2] == MODULE_ALREADY_UP)) ?
                                 "Bring-up succeed" : "Bring-up failed");
 
-                        if (event->length > 3)
-                                priv->btmrvl_dev.dev_type = event->data[3];
+                        if (event->length > 3 && event->data[3])
+                                priv->btmrvl_dev.dev_type = HCI_AMP;
                         else
                                 priv->btmrvl_dev.dev_type = HCI_BREDR;
 
diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
index 76e5127884f0..792e32d29a1d 100644
--- a/drivers/bluetooth/btsdio.c
+++ b/drivers/bluetooth/btsdio.c
@@ -46,6 +46,9 @@ static const struct sdio_device_id btsdio_table[] = {
         /* Generic Bluetooth Type-B SDIO device */
         { SDIO_DEVICE_CLASS(SDIO_CLASS_BT_B) },
 
+        /* Generic Bluetooth AMP controller */
+        { SDIO_DEVICE_CLASS(SDIO_CLASS_BT_AMP) },
+
         { }     /* Terminating entry */
 };
 
@@ -329,6 +332,11 @@ static int btsdio_probe(struct sdio_func *func,
         hdev->bus = HCI_SDIO;
         hdev->driver_data = data;
 
+        if (id->class == SDIO_CLASS_BT_AMP)
+                hdev->dev_type = HCI_AMP;
+        else
+                hdev->dev_type = HCI_BREDR;
+
         data->hdev = hdev;
 
         SET_HCIDEV_DEV(hdev, &func->dev);
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index d22ce3cc611e..d120a5c1c093 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -59,9 +59,15 @@ static struct usb_device_id btusb_table[] = {
         /* Generic Bluetooth USB device */
         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
 
+        /* Apple MacBookPro 7,1 */
+        { USB_DEVICE(0x05ac, 0x8213) },
+
         /* Apple iMac11,1 */
         { USB_DEVICE(0x05ac, 0x8215) },
 
+        /* Apple MacBookPro6,2 */
+        { USB_DEVICE(0x05ac, 0x8218) },
+
         /* AVM BlueFRITZ! USB v2.0 */
         { USB_DEVICE(0x057c, 0x3800) },
 
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 998833d93c13..74cb6f3e86c5 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -101,7 +101,7 @@ static inline void hci_uart_tx_complete(struct hci_uart *hu, int pkt_type)
                 break;
 
         case HCI_SCODATA_PKT:
-                hdev->stat.cmd_tx++;
+                hdev->stat.sco_tx++;
                 break;
         }
 }
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index eab58db5f91c..cd18493c9527 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -806,6 +806,8 @@ static const struct intel_driver_description {
             "G45/G43", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_B43_HB, PCI_DEVICE_ID_INTEL_B43_IG,
             "B43", NULL, &intel_i965_driver },
+        { PCI_DEVICE_ID_INTEL_B43_1_HB, PCI_DEVICE_ID_INTEL_B43_1_IG,
+            "B43", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_G41_HB, PCI_DEVICE_ID_INTEL_G41_IG,
             "G41", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG,
diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
index ee189c74d345..d09b1ab7e8ab 100644
--- a/drivers/char/agp/intel-agp.h
+++ b/drivers/char/agp/intel-agp.h
@@ -186,6 +186,8 @@
 #define PCI_DEVICE_ID_INTEL_Q33_IG          0x29D2
 #define PCI_DEVICE_ID_INTEL_B43_HB          0x2E40
 #define PCI_DEVICE_ID_INTEL_B43_IG          0x2E42
+#define PCI_DEVICE_ID_INTEL_B43_1_HB        0x2E90
+#define PCI_DEVICE_ID_INTEL_B43_1_IG        0x2E92
 #define PCI_DEVICE_ID_INTEL_GM45_HB         0x2A40
 #define PCI_DEVICE_ID_INTEL_GM45_IG         0x2A42
 #define PCI_DEVICE_ID_INTEL_EAGLELAKE_HB        0x2E00
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 3822b4f49c84..7bd7c45b53ef 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -305,6 +305,9 @@ static int num_force_kipmid;
 #ifdef CONFIG_PCI
 static int pci_registered;
 #endif
+#ifdef CONFIG_ACPI
+static int pnp_registered;
+#endif
 #ifdef CONFIG_PPC_OF
 static int of_registered;
 #endif
@@ -2126,7 +2129,7 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
 {
         struct acpi_device *acpi_dev;
         struct smi_info *info;
-        struct resource *res;
+        struct resource *res, *res_second;
         acpi_handle handle;
         acpi_status status;
         unsigned long long tmp;
@@ -2182,13 +2185,13 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
         info->io.addr_data = res->start;
 
         info->io.regspacing = DEFAULT_REGSPACING;
-        res = pnp_get_resource(dev,
+        res_second = pnp_get_resource(dev,
                                (info->io.addr_type == IPMI_IO_ADDR_SPACE) ?
                                         IORESOURCE_IO : IORESOURCE_MEM,
                                1);
-        if (res) {
-                if (res->start > info->io.addr_data)
-                        info->io.regspacing = res->start - info->io.addr_data;
+        if (res_second) {
+                if (res_second->start > info->io.addr_data)
+                        info->io.regspacing = res_second->start - info->io.addr_data;
         }
         info->io.regsize = DEFAULT_REGSPACING;
         info->io.regshift = 0;
@@ -3359,6 +3362,7 @@ static __devinit int init_ipmi_si(void)
 
 #ifdef CONFIG_ACPI
         pnp_register_driver(&ipmi_pnp_driver);
+        pnp_registered = 1;
 #endif
 
 #ifdef CONFIG_DMI
@@ -3526,7 +3530,8 @@ static __exit void cleanup_ipmi_si(void)
                 pci_unregister_driver(&ipmi_pci_driver);
 #endif
 #ifdef CONFIG_ACPI
-        pnp_unregister_driver(&ipmi_pnp_driver);
+        if (pnp_registered)
+                pnp_unregister_driver(&ipmi_pnp_driver);
 #endif
 
 #ifdef CONFIG_PPC_OF
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index a398ecdbd758..1f528fad3516 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -788,10 +788,11 @@ static const struct file_operations zero_fops = {
 /*
  * capabilities for /dev/zero
  * - permits private mappings, "copies" are taken of the source of zeros
+ * - no writeback happens
  */
 static struct backing_dev_info zero_bdi = {
         .name           = "char/mem",
-        .capabilities   = BDI_CAP_MAP_COPY,
+        .capabilities   = BDI_CAP_MAP_COPY | BDI_CAP_NO_ACCT_AND_WRITEBACK,
 };
 
 static const struct file_operations full_fops = {
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 942a9826bd23..c810481a5bc2 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -596,6 +596,10 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
         ssize_t ret;
         bool nonblock;
 
+        /* Userspace could be out to fool us */
+        if (!count)
+                return 0;
+
         port = filp->private_data;
 
         nonblock = filp->f_flags & O_NONBLOCK;
@@ -642,7 +646,7 @@ static unsigned int port_fops_poll(struct file *filp, poll_table *wait)
         poll_wait(filp, &port->waitqueue, wait);
 
         ret = 0;
-        if (port->inbuf)
+        if (!will_read_block(port))
                 ret |= POLLIN | POLLRDNORM;
         if (!will_write_block(port))
                 ret |= POLLOUT;
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 2bbeaaea46e9..38df8c19e74c 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -533,11 +533,14 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
         case KIOCSOUND:
                 if (!perm)
                         goto eperm;
-                /* FIXME: This is an old broken API but we need to keep it
-                   supported and somehow separate the historic advertised
-                   tick rate from any real one */
+                /*
+                 * The use of PIT_TICK_RATE is historic, it used to be
+                 * the platform-dependent CLOCK_TICK_RATE between 2.6.12
+                 * and 2.6.36, which was a minor but unfortunate ABI
+                 * change.
+                 */
                 if (arg)
-                        arg = CLOCK_TICK_RATE / arg;
+                        arg = PIT_TICK_RATE / arg;
                 kd_mksound(arg, 0);
                 break;
 
@@ -553,11 +556,8 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                  */
                 ticks = HZ * ((arg >> 16) & 0xffff) / 1000;
                 count = ticks ? (arg & 0xffff) : 0;
-                /* FIXME: This is an old broken API but we need to keep it
-                   supported and somehow separate the historic advertised
-                   tick rate from any real one */
                 if (count)
-                        count = CLOCK_TICK_RATE / count;
+                        count = PIT_TICK_RATE / count;
                 kd_mksound(count, ticks);
                 break;
         }
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index c2408bbe9c2e..f508690eb958 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -80,7 +80,7 @@
  * Limiting Performance Impact
  * ---------------------------
  * C states, especially those with large exit latencies, can have a real
- * noticable impact on workloads, which is not acceptable for most sysadmins,
+ * noticeable impact on workloads, which is not acceptable for most sysadmins,
  * and in addition, less performance has a power price of its own.
  *
  * As a general rule of thumb, menu assumes that the following heuristic
diff --git a/drivers/dca/dca-core.c b/drivers/dca/dca-core.c
index 8661c84a105d..b98c67664ae7 100644
--- a/drivers/dca/dca-core.c
+++ b/drivers/dca/dca-core.c
@@ -39,6 +39,10 @@ static DEFINE_SPINLOCK(dca_lock);
 
 static LIST_HEAD(dca_domains);
 
+static BLOCKING_NOTIFIER_HEAD(dca_provider_chain);
+
+static int dca_providers_blocked;
+
 static struct pci_bus *dca_pci_rc_from_dev(struct device *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
@@ -70,6 +74,60 @@ static void dca_free_domain(struct dca_domain *domain)
         kfree(domain);
 }
 
+static int dca_provider_ioat_ver_3_0(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+
+        return ((pdev->vendor == PCI_VENDOR_ID_INTEL) &&
+                ((pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG0) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG1) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG2) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG3) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG4) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG5) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG6) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG7)));
+}
+
+static void unregister_dca_providers(void)
+{
+        struct dca_provider *dca, *_dca;
+        struct list_head unregistered_providers;
+        struct dca_domain *domain;
+        unsigned long flags;
+
+        blocking_notifier_call_chain(&dca_provider_chain,
+                                     DCA_PROVIDER_REMOVE, NULL);
+
+        INIT_LIST_HEAD(&unregistered_providers);
+
+        spin_lock_irqsave(&dca_lock, flags);
+
+        if (list_empty(&dca_domains)) {
+                spin_unlock_irqrestore(&dca_lock, flags);
+                return;
+        }
+
+        /* at this point only one domain in the list is expected */
+        domain = list_first_entry(&dca_domains, struct dca_domain, node);
+        if (!domain)
+                return;
+
+        list_for_each_entry_safe(dca, _dca, &domain->dca_providers, node) {
+                list_del(&dca->node);
+                list_add(&dca->node, &unregistered_providers);
+        }
+
+        dca_free_domain(domain);
+
+        spin_unlock_irqrestore(&dca_lock, flags);
+
+        list_for_each_entry_safe(dca, _dca, &unregistered_providers, node) {
+                dca_sysfs_remove_provider(dca);
+                list_del(&dca->node);
+        }
+}
+
 static struct dca_domain *dca_find_domain(struct pci_bus *rc)
 {
         struct dca_domain *domain;
@@ -90,9 +148,13 @@ static struct dca_domain *dca_get_domain(struct device *dev)
         domain = dca_find_domain(rc);
 
         if (!domain) {
-                domain = dca_allocate_domain(rc);
-                if (domain)
-                        list_add(&domain->node, &dca_domains);
+                if (dca_provider_ioat_ver_3_0(dev) && !list_empty(&dca_domains)) {
+                        dca_providers_blocked = 1;
+                } else {
+                        domain = dca_allocate_domain(rc);
+                        if (domain)
+                                list_add(&domain->node, &dca_domains);
+                }
         }
 
         return domain;
@@ -293,8 +355,6 @@ void free_dca_provider(struct dca_provider *dca)
 }
 EXPORT_SYMBOL_GPL(free_dca_provider);
 
-static BLOCKING_NOTIFIER_HEAD(dca_provider_chain);
-
 /**
  * register_dca_provider - register a dca provider
  * @dca - struct created by alloc_dca_provider()
@@ -306,6 +366,13 @@ int register_dca_provider(struct dca_provider *dca, struct device *dev)
         unsigned long flags;
         struct dca_domain *domain;
 
+        spin_lock_irqsave(&dca_lock, flags);
+        if (dca_providers_blocked) {
+                spin_unlock_irqrestore(&dca_lock, flags);
+                return -ENODEV;
+        }
+        spin_unlock_irqrestore(&dca_lock, flags);
+
         err = dca_sysfs_add_provider(dca, dev);
         if (err)
                 return err;
@@ -313,7 +380,13 @@ int register_dca_provider(struct dca_provider *dca, struct device *dev)
         spin_lock_irqsave(&dca_lock, flags);
         domain = dca_get_domain(dev);
         if (!domain) {
-                spin_unlock_irqrestore(&dca_lock, flags);
+                if (dca_providers_blocked) {
+                        spin_unlock_irqrestore(&dca_lock, flags);
+                        dca_sysfs_remove_provider(dca);
+                        unregister_dca_providers();
+                } else {
+                        spin_unlock_irqrestore(&dca_lock, flags);
+                }
                 return -ENODEV;
         }
         list_add(&dca->node, &domain->dca_providers);
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 86c5ae9fde34..411d5bf50fc4 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -162,7 +162,7 @@ static int mv_is_err_intr(u32 intr_cause)
 
 static void mv_xor_device_clear_eoc_cause(struct mv_xor_chan *chan)
 {
-        u32 val = (1 << (1 + (chan->idx * 16)));
+        u32 val = ~(1 << (chan->idx * 16));
         dev_dbg(chan->device->common.dev, "%s, val 0x%08x\n", __func__, val);
         __raw_writel(val, XOR_INTR_CAUSE(chan));
 }
diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index fb64cf36ba61..eb6b54dbb806 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -580,7 +580,6 @@ static struct dma_async_tx_descriptor *sh_dmae_prep_slave_sg(
 
         sh_chan = to_sh_chan(chan);
         param = chan->private;
-        slave_addr = param->config->addr;
 
         /* Someone calling slave DMA on a public channel? */
         if (!param || !sg_len) {
@@ -589,6 +588,8 @@ static struct dma_async_tx_descriptor *sh_dmae_prep_slave_sg(
                 return NULL;
         }
 
+        slave_addr = param->config->addr;
+
         /*
          * if (param != NULL), this is a successfully requested slave channel,
          * therefore param->config != NULL too.
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 3630308e7b81..6b21e25f7a84 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -339,6 +339,9 @@ static void edac_mc_workq_teardown(struct mem_ctl_info *mci)
 {
         int status;
 
+        if (mci->op_state != OP_RUNNING_POLL)
+                return;
+
         status = cancel_delayed_work(&mci->work);
         if (status == 0) {
                 debugf0("%s() not canceled, flush the queue\n",
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index e0187d16dd7c..0fd5b85a0f75 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1140,6 +1140,7 @@ static struct mcidev_sysfs_attribute i7core_udimm_counters_attrs[] = {
         ATTR_COUNTER(0),
         ATTR_COUNTER(1),
         ATTR_COUNTER(2),
+        { .attr = { .name = NULL } }
 };
 
 static struct mcidev_sysfs_group i7core_udimm_counters = {
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index be29b0bb2471..1b05896648bc 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -263,6 +263,7 @@ static const struct {
         {PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB38X_FW, QUIRK_NO_MSI},
         {PCI_VENDOR_ID_NEC,     PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
         {PCI_VENDOR_ID_VIA,     PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
+        {PCI_VENDOR_ID_RICOH,   PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
         {PCI_VENDOR_ID_APPLE,   PCI_DEVICE_ID_APPLE_UNI_N_FW, QUIRK_BE_HEADERS},
 };
 
diff --git a/drivers/gpio/sx150x.c b/drivers/gpio/sx150x.c
index b42f42ca70c3..823559ab0e24 100644
--- a/drivers/gpio/sx150x.c
+++ b/drivers/gpio/sx150x.c
@@ -459,17 +459,33 @@ static int sx150x_init_io(struct sx150x_chip *chip, u8 base, u16 cfg)
         return err;
 }
 
-static int sx150x_init_hw(struct sx150x_chip *chip,
-                        struct sx150x_platform_data *pdata)
+static int sx150x_reset(struct sx150x_chip *chip)
 {
-        int err = 0;
+        int err;
 
-        err = i2c_smbus_write_word_data(chip->client,
+        err = i2c_smbus_write_byte_data(chip->client,
                                         chip->dev_cfg->reg_reset,
-                                        0x3412);
+                                        0x12);
         if (err < 0)
                 return err;
 
+        err = i2c_smbus_write_byte_data(chip->client,
+                                        chip->dev_cfg->reg_reset,
+                                        0x34);
+        return err;
+}
+
+static int sx150x_init_hw(struct sx150x_chip *chip,
+                        struct sx150x_platform_data *pdata)
+{
+        int err = 0;
+
+        if (pdata->reset_during_probe) {
+                err = sx150x_reset(chip);
+                if (err < 0)
+                        return err;
+        }
+
         err = sx150x_i2c_write(chip->client,
                         chip->dev_cfg->reg_misc,
                         0x01);
diff --git a/drivers/gpu/drm/drm_buffer.c b/drivers/gpu/drm/drm_buffer.c
index 55d03ed05000..529a0dbe9fc6 100644
--- a/drivers/gpu/drm/drm_buffer.c
+++ b/drivers/gpu/drm/drm_buffer.c
@@ -98,8 +98,8 @@ EXPORT_SYMBOL(drm_buffer_alloc);
  *   user_data: A pointer the data that is copied to the buffer.
  *   size: The Number of bytes to copy.
  */
-extern int drm_buffer_copy_from_user(struct drm_buffer *buf,
-                void __user *user_data, int size)
+int drm_buffer_copy_from_user(struct drm_buffer *buf,
+                              void __user *user_data, int size)
 {
         int nr_pages = size / PAGE_SIZE + 1;
         int idx;
@@ -163,7 +163,7 @@ void *drm_buffer_read_object(struct drm_buffer *buf,
 {
         int idx = drm_buffer_index(buf);
         int page = drm_buffer_page(buf);
-        void *obj = 0;
+        void *obj = NULL;
 
         if (idx + objsize <= PAGE_SIZE) {
                 obj = &buf->data[page][idx];
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index d2ab01e90a96..dcbeb98f195a 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -103,8 +103,8 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
                 if (connector->funcs->force)
                         connector->funcs->force(connector);
         } else {
-                connector->status = connector->funcs->detect(connector);
-                drm_helper_hpd_irq_event(dev);
+                connector->status = connector->funcs->detect(connector, true);
+                drm_kms_helper_poll_enable(dev);
         }
 
         if (connector->status == connector_status_disconnected) {
@@ -637,13 +637,13 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                 mode_changed = true;
 
         if (mode_changed) {
-                old_fb = set->crtc->fb;
-                set->crtc->fb = set->fb;
                 set->crtc->enabled = (set->mode != NULL);
                 if (set->mode != NULL) {
                         DRM_DEBUG_KMS("attempting to set mode from"
                                         " userspace\n");
                         drm_mode_debug_printmodeline(set->mode);
+                        old_fb = set->crtc->fb;
+                        set->crtc->fb = set->fb;
                         if (!drm_crtc_helper_set_mode(set->crtc, set->mode,
                                                       set->x, set->y,
                                                       old_fb)) {
@@ -866,7 +866,7 @@ static void output_poll_execute(struct work_struct *work)
                     !(connector->polled & DRM_CONNECTOR_POLL_HPD))
                         continue;
 
-                status = connector->funcs->detect(connector);
+                status = connector->funcs->detect(connector, false);
                 if (old_status != status)
                         changed = true;
         }
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index bf92d07510df..5663d2719063 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -148,7 +148,7 @@ int drm_gem_object_init(struct drm_device *dev,
                 return -ENOMEM;
 
         kref_init(&obj->refcount);
-        kref_init(&obj->handlecount);
+        atomic_set(&obj->handle_count, 0);
         obj->size = size;
 
         atomic_inc(&dev->object_count);
@@ -462,28 +462,6 @@ drm_gem_object_free(struct kref *kref)
 }
 EXPORT_SYMBOL(drm_gem_object_free);
 
-/**
- * Called after the last reference to the object has been lost.
- * Must be called without holding struct_mutex
- *
- * Frees the object
- */
-void
-drm_gem_object_free_unlocked(struct kref *kref)
-{
-        struct drm_gem_object *obj = (struct drm_gem_object *) kref;
-        struct drm_device *dev = obj->dev;
-
-        if (dev->driver->gem_free_object_unlocked != NULL)
-                dev->driver->gem_free_object_unlocked(obj);
-        else if (dev->driver->gem_free_object != NULL) {
-                mutex_lock(&dev->struct_mutex);
-                dev->driver->gem_free_object(obj);
-                mutex_unlock(&dev->struct_mutex);
-        }
-}
-EXPORT_SYMBOL(drm_gem_object_free_unlocked);
-
 static void drm_gem_object_ref_bug(struct kref *list_kref)
 {
         BUG();
@@ -496,12 +474,8 @@ static void drm_gem_object_ref_bug(struct kref *list_kref)
  * called before drm_gem_object_free or we'll be touching
  * freed memory
  */
-void
-drm_gem_object_handle_free(struct kref *kref)
+void drm_gem_object_handle_free(struct drm_gem_object *obj)
 {
-        struct drm_gem_object *obj = container_of(kref,
-                                                  struct drm_gem_object,
-                                                  handlecount);
         struct drm_device *dev = obj->dev;
 
         /* Remove any name for this object */
@@ -528,6 +502,10 @@ void drm_gem_vm_open(struct vm_area_struct *vma)
         struct drm_gem_object *obj = vma->vm_private_data;
 
         drm_gem_object_reference(obj);
+
+        mutex_lock(&obj->dev->struct_mutex);
+        drm_vm_open_locked(vma);
+        mutex_unlock(&obj->dev->struct_mutex);
 }
 EXPORT_SYMBOL(drm_gem_vm_open);
 
@@ -535,7 +513,10 @@ void drm_gem_vm_close(struct vm_area_struct *vma)
 {
         struct drm_gem_object *obj = vma->vm_private_data;
 
-        drm_gem_object_unreference_unlocked(obj);
+        mutex_lock(&obj->dev->struct_mutex);
+        drm_vm_close_locked(vma);
+        drm_gem_object_unreference(obj);
+        mutex_unlock(&obj->dev->struct_mutex);
 }
 EXPORT_SYMBOL(drm_gem_vm_close);
 
diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
index 2ef2c7827243..974e970ce3f8 100644
--- a/drivers/gpu/drm/drm_info.c
+++ b/drivers/gpu/drm/drm_info.c
@@ -255,7 +255,7 @@ int drm_gem_one_name_info(int id, void *ptr, void *data)
 
         seq_printf(m, "%6d %8zd %7d %8d\n",
                    obj->name, obj->size,
-                   atomic_read(&obj->handlecount.refcount),
+                   atomic_read(&obj->handle_count),
                    atomic_read(&obj->refcount.refcount));
         return 0;
 }
diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c
index e20f78b542a7..f5bd9e590c80 100644
--- a/drivers/gpu/drm/drm_pci.c
+++ b/drivers/gpu/drm/drm_pci.c
@@ -164,6 +164,8 @@ int drm_get_pci_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
         dev->hose = pdev->sysdata;
 #endif
 
+        mutex_lock(&drm_global_mutex);
+
         if ((ret = drm_fill_in_dev(dev, ent, driver))) {
                 printk(KERN_ERR "DRM: Fill_in_dev failed.\n");
                 goto err_g2;
@@ -199,6 +201,7 @@ int drm_get_pci_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
                  driver->name, driver->major, driver->minor, driver->patchlevel,
                  driver->date, pci_name(pdev), dev->primary->index);
 
+        mutex_unlock(&drm_global_mutex);
         return 0;
 
 err_g4:
@@ -210,6 +213,7 @@ err_g2:
         pci_disable_device(pdev);
 err_g1:
         kfree(dev);
+        mutex_unlock(&drm_global_mutex);
         return ret;
 }
 EXPORT_SYMBOL(drm_get_pci_dev);
diff --git a/drivers/gpu/drm/drm_platform.c b/drivers/gpu/drm/drm_platform.c
index 460e9a3afa8d..92d1d0fb7b75 100644
--- a/drivers/gpu/drm/drm_platform.c
+++ b/drivers/gpu/drm/drm_platform.c
@@ -53,6 +53,8 @@ int drm_get_platform_dev(struct platform_device *platdev,
         dev->platformdev = platdev;
         dev->dev = &platdev->dev;
 
+        mutex_lock(&drm_global_mutex);
+
         ret = drm_fill_in_dev(dev, NULL, driver);
 
         if (ret) {
@@ -87,6 +89,8 @@ int drm_get_platform_dev(struct platform_device *platdev,
 
         list_add_tail(&dev->driver_item, &driver->device_list);
 
+        mutex_unlock(&drm_global_mutex);
+
         DRM_INFO("Initialized %s %d.%d.%d %s on minor %d\n",
                  driver->name, driver->major, driver->minor, driver->patchlevel,
                  driver->date, dev->primary->index);
@@ -100,6 +104,7 @@ err_g2:
                 drm_put_minor(&dev->control);
 err_g1:
         kfree(dev);
+        mutex_unlock(&drm_global_mutex);
         return ret;
 }
 EXPORT_SYMBOL(drm_get_platform_dev);
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 86118a742231..85da4c40694c 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -159,7 +159,7 @@ static ssize_t status_show(struct device *device,
         struct drm_connector *connector = to_drm_connector(device);
         enum drm_connector_status status;
 
-        status = connector->funcs->detect(connector);
+        status = connector->funcs->detect(connector, true);
         return snprintf(buf, PAGE_SIZE, "%s\n",
                         drm_get_connector_status_name(status));
 }
diff --git a/drivers/gpu/drm/drm_vm.c b/drivers/gpu/drm/drm_vm.c
index fda67468e603..5df450683aab 100644
--- a/drivers/gpu/drm/drm_vm.c
+++ b/drivers/gpu/drm/drm_vm.c
@@ -433,15 +433,7 @@ static void drm_vm_open(struct vm_area_struct *vma)
         mutex_unlock(&dev->struct_mutex);
 }
 
-/**
- * \c close method for all virtual memory types.
- *
- * \param vma virtual memory area.
- *
- * Search the \p vma private data entry in drm_device::vmalist, unlink it, and
- * free it.
- */
-static void drm_vm_close(struct vm_area_struct *vma)
+void drm_vm_close_locked(struct vm_area_struct *vma)
 {
         struct drm_file *priv = vma->vm_file->private_data;
         struct drm_device *dev = priv->minor->dev;
@@ -451,7 +443,6 @@ static void drm_vm_close(struct vm_area_struct *vma)
                   vma->vm_start, vma->vm_end - vma->vm_start);
         atomic_dec(&dev->vma_count);
 
-        mutex_lock(&dev->struct_mutex);
         list_for_each_entry_safe(pt, temp, &dev->vmalist, head) {
                 if (pt->vma == vma) {
                         list_del(&pt->head);
@@ -459,6 +450,23 @@ static void drm_vm_close(struct vm_area_struct *vma)
                         break;
                 }
         }
+}
+
+/**
+ * \c close method for all virtual memory types.
+ *
+ * \param vma virtual memory area.
+ *
+ * Search the \p vma private data entry in drm_device::vmalist, unlink it, and
+ * free it.
+ */
+static void drm_vm_close(struct vm_area_struct *vma)
+{
+        struct drm_file *priv = vma->vm_file->private_data;
+        struct drm_device *dev = priv->minor->dev;
+
+        mutex_lock(&dev->struct_mutex);
+        drm_vm_close_locked(vma);
         mutex_unlock(&dev->struct_mutex);
 }
 
diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
index 61b4caf220fa..fb07e73581e8 100644
--- a/drivers/gpu/drm/i810/i810_dma.c
+++ b/drivers/gpu/drm/i810/i810_dma.c
@@ -116,7 +116,7 @@ static int i810_mmap_buffers(struct file *filp, struct vm_area_struct *vma)
 static const struct file_operations i810_buffer_fops = {
         .open = drm_open,
         .release = drm_release,
-        .unlocked_ioctl = drm_ioctl,
+        .unlocked_ioctl = i810_ioctl,
         .mmap = i810_mmap_buffers,
         .fasync = drm_fasync,
 };
diff --git a/drivers/gpu/drm/i830/i830_dma.c b/drivers/gpu/drm/i830/i830_dma.c
index 671aa18415ac..cc92c7e6236f 100644
--- a/drivers/gpu/drm/i830/i830_dma.c
+++ b/drivers/gpu/drm/i830/i830_dma.c
@@ -118,7 +118,7 @@ static int i830_mmap_buffers(struct file *filp, struct vm_area_struct *vma)
 static const struct file_operations i830_buffer_fops = {
         .open = drm_open,
         .release = drm_release,
-        .unlocked_ioctl = drm_ioctl,
+        .unlocked_ioctl = i830_ioctl,
         .mmap = i830_mmap_buffers,
         .fasync = drm_fasync,
 };
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 9d67b4853030..c74e4e8006d4 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1787,9 +1787,9 @@ unsigned long i915_chipset_val(struct drm_i915_private *dev_priv)
                 }
         }
 
-        div_u64(diff, diff1);
+        diff = div_u64(diff, diff1);
         ret = ((m * diff) + c);
-        div_u64(ret, 10);
+        ret = div_u64(ret, 10);
 
         dev_priv->last_count1 = total_count;
         dev_priv->last_time1 = now;
@@ -1858,7 +1858,7 @@ void i915_update_gfx_val(struct drm_i915_private *dev_priv)
 
         /* More magic constants... */
         diff = diff * 1181;
-        div_u64(diff, diffms * 10);
+        diff = div_u64(diff, diffms * 10);
         dev_priv->gfx_power = diff;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 216deb579785..6dbe14cc4f74 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -170,6 +170,7 @@ static const struct pci_device_id pciidlist[] = {		/* aka */
         INTEL_VGA_DEVICE(0x2e22, &intel_g45_info),              /* G45_G */
         INTEL_VGA_DEVICE(0x2e32, &intel_g45_info),              /* G41_G */
         INTEL_VGA_DEVICE(0x2e42, &intel_g45_info),              /* B43_G */
+        INTEL_VGA_DEVICE(0x2e92, &intel_g45_info),              /* B43_G.1 */
         INTEL_VGA_DEVICE(0xa001, &intel_pineview_info),
         INTEL_VGA_DEVICE(0xa011, &intel_pineview_info),
         INTEL_VGA_DEVICE(0x0042, &intel_ironlake_d_info),
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 16fca1d1799a..90b1d6753b9d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -136,14 +136,12 @@ i915_gem_create_ioctl(struct drm_device *dev, void *data,
                 return -ENOMEM;
 
         ret = drm_gem_handle_create(file_priv, obj, &handle);
+        /* drop reference from allocate - handle holds it now */
+        drm_gem_object_unreference_unlocked(obj);
         if (ret) {
-                drm_gem_object_unreference_unlocked(obj);
                 return ret;
         }
 
-        /* Sink the floating reference from kref_init(handlecount) */
-        drm_gem_object_handle_unreference_unlocked(obj);
-
         args->handle = handle;
         return 0;
 }
@@ -471,14 +469,17 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                 return -ENOENT;
         obj_priv = to_intel_bo(obj);
 
-        /* Bounds check source.
-         *
-         * XXX: This could use review for overflow issues...
-         */
-        if (args->offset > obj->size || args->size > obj->size ||
-            args->offset + args->size > obj->size) {
-                drm_gem_object_unreference_unlocked(obj);
-                return -EINVAL;
+        /* Bounds check source.  */
+        if (args->offset > obj->size || args->size > obj->size - args->offset) {
+                ret = -EINVAL;
+                goto err;
+        }
+
+        if (!access_ok(VERIFY_WRITE,
+                       (char __user *)(uintptr_t)args->data_ptr,
+                       args->size)) {
+                ret = -EFAULT;
+                goto err;
         }
 
         if (i915_gem_object_needs_bit17_swizzle(obj)) {
@@ -490,8 +491,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                                                         file_priv);
         }
 
+err:
         drm_gem_object_unreference_unlocked(obj);
-
         return ret;
 }
 
@@ -580,8 +581,6 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
 
         user_data = (char __user *) (uintptr_t) args->data_ptr;
         remain = args->size;
-        if (!access_ok(VERIFY_READ, user_data, remain))
-                return -EFAULT;
 
 
         mutex_lock(&dev->struct_mutex);
@@ -934,14 +933,17 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                 return -ENOENT;
         obj_priv = to_intel_bo(obj);
 
-        /* Bounds check destination.
-         *
-         * XXX: This could use review for overflow issues...
-         */
-        if (args->offset > obj->size || args->size > obj->size ||
-            args->offset + args->size > obj->size) {
-                drm_gem_object_unreference_unlocked(obj);
-                return -EINVAL;
+        /* Bounds check destination. */
+        if (args->offset > obj->size || args->size > obj->size - args->offset) {
+                ret = -EINVAL;
+                goto err;
+        }
+
+        if (!access_ok(VERIFY_READ,
+                       (char __user *)(uintptr_t)args->data_ptr,
+                       args->size)) {
+                ret = -EFAULT;
+                goto err;
         }
 
         /* We can only do the GTT pwrite on untiled buffers, as otherwise
@@ -975,8 +977,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                 DRM_INFO("pwrite failed %d\n", ret);
 #endif
 
+err:
         drm_gem_object_unreference_unlocked(obj);
-
         return ret;
 }
 
@@ -2351,14 +2353,21 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
 
         reg->obj = obj;
 
-        if (IS_GEN6(dev))
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
                 sandybridge_write_fence_reg(reg);
-        else if (IS_I965G(dev))
+                break;
+        case 5:
+        case 4:
                 i965_write_fence_reg(reg);
-        else if (IS_I9XX(dev))
+                break;
+        case 3:
                 i915_write_fence_reg(reg);
-        else
+                break;
+        case 2:
                 i830_write_fence_reg(reg);
+                break;
+        }
 
         trace_i915_gem_object_get_fence(obj, obj_priv->fence_reg,
                         obj_priv->tiling_mode);
@@ -2381,22 +2390,26 @@ i915_gem_clear_fence_reg(struct drm_gem_object *obj)
         struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         struct drm_i915_fence_reg *reg =
                 &dev_priv->fence_regs[obj_priv->fence_reg];
+        uint32_t fence_reg;
 
-        if (IS_GEN6(dev)) {
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
                 I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 +
                              (obj_priv->fence_reg * 8), 0);
-        } else if (IS_I965G(dev)) {
+                break;
+        case 5:
+        case 4:
                 I915_WRITE64(FENCE_REG_965_0 + (obj_priv->fence_reg * 8), 0);
-        } else {
-                uint32_t fence_reg;
-
-                if (obj_priv->fence_reg < 8)
-                        fence_reg = FENCE_REG_830_0 + obj_priv->fence_reg * 4;
+                break;
+        case 3:
+                if (obj_priv->fence_reg >= 8)
+                        fence_reg = FENCE_REG_945_8 + (obj_priv->fence_reg - 8) * 4;
                 else
-                        fence_reg = FENCE_REG_945_8 + (obj_priv->fence_reg -
-                                                       8) * 4;
+        case 2:
+                        fence_reg = FENCE_REG_830_0 + obj_priv->fence_reg * 4;
 
                 I915_WRITE(fence_reg, 0);
+                break;
         }
 
         reg->obj = NULL;
@@ -3247,6 +3260,8 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                                   (int) reloc->offset,
                                   reloc->read_domains,
                                   reloc->write_domain);
+                        drm_gem_object_unreference(target_obj);
+                        i915_gem_object_unpin(obj);
                         return -EINVAL;
                 }
                 if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index 72cae3cccad8..5c428fa3e0b3 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -79,6 +79,7 @@ mark_free(struct drm_i915_gem_object *obj_priv,
            struct list_head *unwind)
 {
         list_add(&obj_priv->evict_list, unwind);
+        drm_gem_object_reference(&obj_priv->base);
         return drm_mm_scan_add_block(obj_priv->gtt_space);
 }
 
@@ -92,7 +93,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct list_head eviction_list, unwind_list;
-        struct drm_i915_gem_object *obj_priv, *tmp_obj_priv;
+        struct drm_i915_gem_object *obj_priv;
         struct list_head *render_iter, *bsd_iter;
         int ret = 0;
 
@@ -165,6 +166,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
         list_for_each_entry(obj_priv, &unwind_list, evict_list) {
                 ret = drm_mm_scan_remove_block(obj_priv->gtt_space);
                 BUG_ON(ret);
+                drm_gem_object_unreference(&obj_priv->base);
         }
 
         /* We expect the caller to unpin, evict all and try again, or give up.
@@ -173,36 +175,34 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
         return -ENOSPC;
 
 found:
+        /* drm_mm doesn't allow any other other operations while
+         * scanning, therefore store to be evicted objects on a
+         * temporary list. */
         INIT_LIST_HEAD(&eviction_list);
-        list_for_each_entry_safe(obj_priv, tmp_obj_priv,
-                                 &unwind_list, evict_list) {
+        while (!list_empty(&unwind_list)) {
+                obj_priv = list_first_entry(&unwind_list,
+                                            struct drm_i915_gem_object,
+                                            evict_list);
                 if (drm_mm_scan_remove_block(obj_priv->gtt_space)) {
-                        /* drm_mm doesn't allow any other other operations while
-                         * scanning, therefore store to be evicted objects on a
-                         * temporary list. */
                         list_move(&obj_priv->evict_list, &eviction_list);
+                        continue;
                 }
+                list_del(&obj_priv->evict_list);
+                drm_gem_object_unreference(&obj_priv->base);
         }
 
         /* Unbinding will emit any required flushes */
-        list_for_each_entry_safe(obj_priv, tmp_obj_priv,
-                                 &eviction_list, evict_list) {
-#if WATCH_LRU
-                DRM_INFO("%s: evicting %p\n", __func__, obj);
-#endif
-                ret = i915_gem_object_unbind(&obj_priv->base);
-                if (ret)
-                        return ret;
+        while (!list_empty(&eviction_list)) {
+                obj_priv = list_first_entry(&eviction_list,
+                                            struct drm_i915_gem_object,
+                                            evict_list);
+                if (ret == 0)
+                        ret = i915_gem_object_unbind(&obj_priv->base);
+                list_del(&obj_priv->evict_list);
+                drm_gem_object_unreference(&obj_priv->base);
         }
 
-        /* The just created free hole should be on the top of the free stack
-         * maintained by drm_mm, so this BUG_ON actually executes in O(1).
-         * Furthermore all accessed data has just recently been used, so it
-         * should be really fast, too. */
-        BUG_ON(!drm_mm_search_free(&dev_priv->mm.gtt_space, min_size,
-                                   alignment, 0));
-
-        return 0;
+        return ret;
 }
 
 int
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 59457e83b011..744225ebb4b2 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1350,17 +1350,25 @@ void i915_hangcheck_elapsed(unsigned long data)
                 i915_seqno_passed(i915_get_gem_seqno(dev,
                                 &dev_priv->render_ring),
                         i915_get_tail_request(dev)->seqno)) {
+                bool missed_wakeup = false;
+
                 dev_priv->hangcheck_count = 0;
 
                 /* Issue a wake-up to catch stuck h/w. */
-                if (dev_priv->render_ring.waiting_gem_seqno |
-                    dev_priv->bsd_ring.waiting_gem_seqno) {
-                        DRM_ERROR("Hangcheck timer elapsed... GPU idle, missed IRQ.\n");
-                        if (dev_priv->render_ring.waiting_gem_seqno)
-                                DRM_WAKEUP(&dev_priv->render_ring.irq_queue);
-                        if (dev_priv->bsd_ring.waiting_gem_seqno)
-                                DRM_WAKEUP(&dev_priv->bsd_ring.irq_queue);
+                if (dev_priv->render_ring.waiting_gem_seqno &&
+                    waitqueue_active(&dev_priv->render_ring.irq_queue)) {
+                        DRM_WAKEUP(&dev_priv->render_ring.irq_queue);
+                        missed_wakeup = true;
+                }
+
+                if (dev_priv->bsd_ring.waiting_gem_seqno &&
+                    waitqueue_active(&dev_priv->bsd_ring.irq_queue)) {
+                        DRM_WAKEUP(&dev_priv->bsd_ring.irq_queue);
+                        missed_wakeup = true;
                 }
+
+                if (missed_wakeup)
+                        DRM_ERROR("Hangcheck timer elapsed... GPU idle, missed IRQ.\n");
                 return;
         }
 
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index d094e9129223..4f5e15577e89 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -2206,9 +2206,17 @@
 #define  WM1_LP_SR_EN           (1<<31)
 #define  WM1_LP_LATENCY_SHIFT   24
 #define  WM1_LP_LATENCY_MASK    (0x7f<<24)
+#define  WM1_LP_FBC_LP1_MASK    (0xf<<20)
+#define  WM1_LP_FBC_LP1_SHIFT   20
 #define  WM1_LP_SR_MASK         (0x1ff<<8)
 #define  WM1_LP_SR_SHIFT        8
 #define  WM1_LP_CURSOR_MASK     (0x3f)
+#define WM2_LP_ILK              0x4510c
+#define  WM2_LP_EN              (1<<31)
+#define WM3_LP_ILK              0x45110
+#define  WM3_LP_EN              (1<<31)
+#define WM1S_LP_ILK             0x45120
+#define  WM1S_LP_EN             (1<<31)
 
 /* Memory latency timer register */
 #define MLTR_ILK                0x11222
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 2c6b98f2440e..31f08581e93a 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -789,16 +789,25 @@ int i915_save_state(struct drm_device *dev)
                 dev_priv->saveSWF2[i] = I915_READ(SWF30 + (i << 2));
 
         /* Fences */
-        if (IS_I965G(dev)) {
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
+                for (i = 0; i < 16; i++)
+                        dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_SANDYBRIDGE_0 + (i * 8));
+                break;
+        case 5:
+        case 4:
                 for (i = 0; i < 16; i++)
                         dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_965_0 + (i * 8));
-        } else {
-                for (i = 0; i < 8; i++)
-                        dev_priv->saveFENCE[i] = I915_READ(FENCE_REG_830_0 + (i * 4));
-
+                break;
+        case 3:
                 if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
                         for (i = 0; i < 8; i++)
                                 dev_priv->saveFENCE[i+8] = I915_READ(FENCE_REG_945_8 + (i * 4));
+        case 2:
+                for (i = 0; i < 8; i++)
+                        dev_priv->saveFENCE[i] = I915_READ(FENCE_REG_830_0 + (i * 4));
+                break;
+
         }
 
         return 0;
@@ -815,15 +824,24 @@ int i915_restore_state(struct drm_device *dev)
         I915_WRITE(HWS_PGA, dev_priv->saveHWS);
 
         /* Fences */
-        if (IS_I965G(dev)) {
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
+                for (i = 0; i < 16; i++)
+                        I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 + (i * 8), dev_priv->saveFENCE[i]);
+                break;
+        case 5:
+        case 4:
                 for (i = 0; i < 16; i++)
                         I915_WRITE64(FENCE_REG_965_0 + (i * 8), dev_priv->saveFENCE[i]);
-        } else {
-                for (i = 0; i < 8; i++)
-                        I915_WRITE(FENCE_REG_830_0 + (i * 4), dev_priv->saveFENCE[i]);
+                break;
+        case 3:
+        case 2:
                 if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
                         for (i = 0; i < 8; i++)
                                 I915_WRITE(FENCE_REG_945_8 + (i * 4), dev_priv->saveFENCE[i+8]);
+                for (i = 0; i < 8; i++)
+                        I915_WRITE(FENCE_REG_830_0 + (i * 4), dev_priv->saveFENCE[i]);
+                break;
         }
 
         i915_restore_display(dev);
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 4b7735196cd5..197d4f32585a 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -188,7 +188,7 @@ static bool intel_ironlake_crt_detect_hotplug(struct drm_connector *connector)
 
         if (wait_for((I915_READ(PCH_ADPA) & ADPA_CRT_HOTPLUG_FORCE_TRIGGER) == 0,
                      1000, 1))
-                DRM_ERROR("timed out waiting for FORCE_TRIGGER");
+                DRM_DEBUG_KMS("timed out waiting for FORCE_TRIGGER");
 
         if (turn_off_dac) {
                 I915_WRITE(PCH_ADPA, temp);
@@ -245,7 +245,7 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
                 if (wait_for((I915_READ(PORT_HOTPLUG_EN) &
                               CRT_HOTPLUG_FORCE_DETECT) == 0,
                              1000, 1))
-                        DRM_ERROR("timed out waiting for FORCE_DETECT to go off");
+                        DRM_DEBUG_KMS("timed out waiting for FORCE_DETECT to go off");
         }
 
         stat = I915_READ(PORT_HOTPLUG_STAT);
@@ -400,7 +400,8 @@ intel_crt_load_detect(struct drm_crtc *crtc, struct intel_encoder *intel_encoder
         return status;
 }
 
-static enum drm_connector_status intel_crt_detect(struct drm_connector *connector)
+static enum drm_connector_status
+intel_crt_detect(struct drm_connector *connector, bool force)
 {
         struct drm_device *dev = connector->dev;
         struct drm_encoder *encoder = intel_attached_encoder(connector);
@@ -419,6 +420,9 @@ static enum drm_connector_status intel_crt_detect(struct drm_connector *connecto
         if (intel_crt_detect_ddc(encoder))
                 return connector_status_connected;
 
+        if (!force)
+                return connector->status;
+
         /* for pre-945g platforms use load detect */
         if (encoder->crtc && encoder->crtc->enabled) {
                 status = intel_crt_load_detect(encoder->crtc, intel_encoder);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 40cc5da264a9..979228594599 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1013,8 +1013,8 @@ void intel_wait_for_vblank(struct drm_device *dev, int pipe)
                 DRM_DEBUG_KMS("vblank wait timed out\n");
 }
 
-/**
- * intel_wait_for_vblank_off - wait for vblank after disabling a pipe
+/*
+ * intel_wait_for_pipe_off - wait for pipe to turn off
  * @dev: drm device
  * @pipe: pipe to wait for
  *
@@ -1022,25 +1022,39 @@ void intel_wait_for_vblank(struct drm_device *dev, int pipe)
  * spinning on the vblank interrupt status bit, since we won't actually
  * see an interrupt when the pipe is disabled.
  *
- * So this function waits for the display line value to settle (it
- * usually ends up stopping at the start of the next frame).
+ * On Gen4 and above:
+ *   wait for the pipe register state bit to turn off
+ *
+ * Otherwise:
+ *   wait for the display line value to settle (it usually
+ *   ends up stopping at the start of the next frame).
+ *  
  */
-void intel_wait_for_vblank_off(struct drm_device *dev, int pipe)
+static void intel_wait_for_pipe_off(struct drm_device *dev, int pipe)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        int pipedsl_reg = (pipe == 0 ? PIPEADSL : PIPEBDSL);
-        unsigned long timeout = jiffies + msecs_to_jiffies(100);
-        u32 last_line;
-
-        /* Wait for the display line to settle */
-        do {
-                last_line = I915_READ(pipedsl_reg) & DSL_LINEMASK;
-                mdelay(5);
-        } while (((I915_READ(pipedsl_reg) & DSL_LINEMASK) != last_line) &&
-                 time_after(timeout, jiffies));
-
-        if (time_after(jiffies, timeout))
-                DRM_DEBUG_KMS("vblank wait timed out\n");
+
+        if (INTEL_INFO(dev)->gen >= 4) {
+                int pipeconf_reg = (pipe == 0 ? PIPEACONF : PIPEBCONF);
+
+                /* Wait for the Pipe State to go off */
+                if (wait_for((I915_READ(pipeconf_reg) & I965_PIPECONF_ACTIVE) == 0,
+                             100, 0))
+                        DRM_DEBUG_KMS("pipe_off wait timed out\n");
+        } else {
+                u32 last_line;
+                int pipedsl_reg = (pipe == 0 ? PIPEADSL : PIPEBDSL);
+                unsigned long timeout = jiffies + msecs_to_jiffies(100);
+
+                /* Wait for the display line to settle */
+                do {
+                        last_line = I915_READ(pipedsl_reg) & DSL_LINEMASK;
+                        mdelay(5);
+                } while (((I915_READ(pipedsl_reg) & DSL_LINEMASK) != last_line) &&
+                         time_after(timeout, jiffies));
+                if (time_after(jiffies, timeout))
+                        DRM_DEBUG_KMS("pipe_off wait timed out\n");
+        }
 }
 
 /* Parameters have changed, update FBC info */
@@ -2328,13 +2342,13 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
                         I915_READ(dspbase_reg);
                 }
 
-                /* Wait for vblank for the disable to take effect */
-                intel_wait_for_vblank_off(dev, pipe);
-
                 /* Don't disable pipe A or pipe A PLLs if needed */
                 if (pipeconf_reg == PIPEACONF &&
-                    (dev_priv->quirks & QUIRK_PIPEA_FORCE))
+                    (dev_priv->quirks & QUIRK_PIPEA_FORCE)) {
+                        /* Wait for vblank for the disable to take effect */
+                        intel_wait_for_vblank(dev, pipe);
                         goto skip_pipe_off;
+                }
 
                 /* Next, disable display pipes */
                 temp = I915_READ(pipeconf_reg);
@@ -2343,8 +2357,8 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
                         I915_READ(pipeconf_reg);
                 }
 
-                /* Wait for vblank for the disable to take effect. */
-                intel_wait_for_vblank_off(dev, pipe);
+                /* Wait for the pipe to turn off */
+                intel_wait_for_pipe_off(dev, pipe);
 
                 temp = I915_READ(dpll_reg);
                 if ((temp & DPLL_VCO_ENABLE) != 0) {
@@ -2463,11 +2477,19 @@ static bool intel_crtc_mode_fixup(struct drm_crtc *crtc,
                                   struct drm_display_mode *adjusted_mode)
 {
         struct drm_device *dev = crtc->dev;
+
         if (HAS_PCH_SPLIT(dev)) {
                 /* FDI link clock is fixed at 2.7G */
                 if (mode->clock * 3 > IRONLAKE_FDI_FREQ * 4)
                         return false;
         }
+
+        /* XXX some encoders set the crtcinfo, others don't.
+         * Obviously we need some form of conflict resolution here...
+         */
+        if (adjusted_mode->crtc_htotal == 0)
+                drm_mode_set_crtcinfo(adjusted_mode, 0);
+
         return true;
 }
 
@@ -2767,14 +2789,8 @@ static unsigned long intel_calculate_wm(unsigned long clock_in_khz,
         /* Don't promote wm_size to unsigned... */
         if (wm_size > (long)wm->max_wm)
                 wm_size = wm->max_wm;
-        if (wm_size <= 0) {
+        if (wm_size <= 0)
                 wm_size = wm->default_wm;
-                DRM_ERROR("Insufficient FIFO for plane, expect flickering:"
-                          " entries required = %ld, available = %lu.\n",
-                          entries_required + wm->guard_size,
-                          wm->fifo_size);
-        }
-
         return wm_size;
 }
 
@@ -3388,8 +3404,7 @@ static void ironlake_update_wm(struct drm_device *dev,  int planea_clock,
                 reg_value = I915_READ(WM1_LP_ILK);
                 reg_value &= ~(WM1_LP_LATENCY_MASK | WM1_LP_SR_MASK |
                                WM1_LP_CURSOR_MASK);
-                reg_value |= WM1_LP_SR_EN |
-                             (ilk_sr_latency << WM1_LP_LATENCY_SHIFT) |
+                reg_value |= (ilk_sr_latency << WM1_LP_LATENCY_SHIFT) |
                              (sr_wm << WM1_LP_SR_SHIFT) | cursor_wm;
 
                 I915_WRITE(WM1_LP_ILK, reg_value);
@@ -5675,6 +5690,9 @@ void intel_init_clock_gating(struct drm_device *dev)
                         I915_WRITE(DISP_ARB_CTL,
                                         (I915_READ(DISP_ARB_CTL) |
                                                 DISP_FBC_WM_DIS));
+                I915_WRITE(WM3_LP_ILK, 0);
+                I915_WRITE(WM2_LP_ILK, 0);
+                I915_WRITE(WM1_LP_ILK, 0);
                 }
                 /*
                  * Based on the document from hardware guys the following bits
@@ -5696,8 +5714,7 @@ void intel_init_clock_gating(struct drm_device *dev)
                                    ILK_DPFC_DIS2 |
                                    ILK_CLK_FBC);
                 }
-                if (IS_GEN6(dev))
-                        return;
+                return;
         } else if (IS_G4X(dev)) {
                 uint32_t dspclk_gate;
                 I915_WRITE(RENCLK_GATE_D1, 0);
@@ -5758,11 +5775,9 @@ void intel_init_clock_gating(struct drm_device *dev)
                                 OUT_RING(MI_FLUSH);
                                 ADVANCE_LP_RING();
                         }
-                } else {
+                } else
                         DRM_DEBUG_KMS("Failed to allocate render context."
-                                      "Disable RC6\n");
-                        return;
-                }
+                                       "Disable RC6\n");
         }
 
         if (I915_HAS_RC6(dev) && drm_core_check_feature(dev, DRIVER_MODESET)) {
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 51d142939a26..9ab8708ac6ba 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1138,18 +1138,14 @@ static bool
 intel_dp_set_link_train(struct intel_dp *intel_dp,
                         uint32_t dp_reg_value,
                         uint8_t dp_train_pat,
-                        uint8_t train_set[4],
-                        bool first)
+                        uint8_t train_set[4])
 {
         struct drm_device *dev = intel_dp->base.enc.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.enc.crtc);
         int ret;
 
         I915_WRITE(intel_dp->output_reg, dp_reg_value);
         POSTING_READ(intel_dp->output_reg);
-        if (first)
-                intel_wait_for_vblank(dev, intel_crtc->pipe);
 
         intel_dp_aux_native_write_1(intel_dp,
                                     DP_TRAINING_PATTERN_SET,
@@ -1174,10 +1170,15 @@ intel_dp_link_train(struct intel_dp *intel_dp)
         uint8_t voltage;
         bool clock_recovery = false;
         bool channel_eq = false;
-        bool first = true;
         int tries;
         u32 reg;
         uint32_t DP = intel_dp->DP;
+        struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.enc.crtc);
+
+        /* Enable output, wait for it to become active */
+        I915_WRITE(intel_dp->output_reg, intel_dp->DP);
+        POSTING_READ(intel_dp->output_reg);
+        intel_wait_for_vblank(dev, intel_crtc->pipe);
 
         /* Write the link configuration data */
         intel_dp_aux_native_write(intel_dp, DP_LINK_BW_SET,
@@ -1210,9 +1211,8 @@ intel_dp_link_train(struct intel_dp *intel_dp)
                         reg = DP | DP_LINK_TRAIN_PAT_1;
 
                 if (!intel_dp_set_link_train(intel_dp, reg,
-                                             DP_TRAINING_PATTERN_1, train_set, first))
+                                             DP_TRAINING_PATTERN_1, train_set))
                         break;
-                first = false;
                 /* Set training pattern 1 */
 
                 udelay(100);
@@ -1266,8 +1266,7 @@ intel_dp_link_train(struct intel_dp *intel_dp)
 
                 /* channel eq pattern */
                 if (!intel_dp_set_link_train(intel_dp, reg,
-                                             DP_TRAINING_PATTERN_2, train_set,
-                                             false))
+                                             DP_TRAINING_PATTERN_2, train_set))
                         break;
 
                 udelay(400);
@@ -1386,7 +1385,7 @@ ironlake_dp_detect(struct drm_connector *connector)
  * \return false if DP port is disconnected.
  */
 static enum drm_connector_status
-intel_dp_detect(struct drm_connector *connector)
+intel_dp_detect(struct drm_connector *connector, bool force)
 {
         struct drm_encoder *encoder = intel_attached_encoder(connector);
         struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index ad312ca6b3e5..8828b3ac6414 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -229,7 +229,6 @@ extern struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
                                                     struct drm_crtc *crtc);
 int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
                                 struct drm_file *file_priv);
-extern void intel_wait_for_vblank_off(struct drm_device *dev, int pipe);
 extern void intel_wait_for_vblank(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_load_detect_pipe(struct intel_encoder *intel_encoder,
diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index a399f4b2c1c5..7c9ec1472d46 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -221,7 +221,8 @@ static void intel_dvo_mode_set(struct drm_encoder *encoder,
  *
  * Unimplemented.
  */
-static enum drm_connector_status intel_dvo_detect(struct drm_connector *connector)
+static enum drm_connector_status
+intel_dvo_detect(struct drm_connector *connector, bool force)
 {
         struct drm_encoder *encoder = intel_attached_encoder(connector);
         struct intel_dvo *intel_dvo = enc_to_intel_dvo(encoder);
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 7bdc96256bf5..56ad9df2ccb5 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -237,8 +237,10 @@ int intel_fbdev_destroy(struct drm_device *dev,
         drm_fb_helper_fini(&ifbdev->helper);
 
         drm_framebuffer_cleanup(&ifb->base);
-        if (ifb->obj)
+        if (ifb->obj) {
+                drm_gem_object_handle_unreference(ifb->obj);
                 drm_gem_object_unreference(ifb->obj);
+        }
 
         return 0;
 }
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index ccd4c97e6524..926934a482ec 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -139,7 +139,7 @@ static bool intel_hdmi_mode_fixup(struct drm_encoder *encoder,
 }
 
 static enum drm_connector_status
-intel_hdmi_detect(struct drm_connector *connector)
+intel_hdmi_detect(struct drm_connector *connector, bool force)
 {
         struct drm_encoder *encoder = intel_attached_encoder(connector);
         struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index b819c1081147..6ec39a86ed06 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -445,7 +445,8 @@ static void intel_lvds_mode_set(struct drm_encoder *encoder,
  * connected and closed means disconnected.  We also send hotplug events as
  * needed, using lid status notification from the input layer.
  */
-static enum drm_connector_status intel_lvds_detect(struct drm_connector *connector)
+static enum drm_connector_status
+intel_lvds_detect(struct drm_connector *connector, bool force)
 {
         struct drm_device *dev = connector->dev;
         enum drm_connector_status status = connector_status_connected;
@@ -540,7 +541,9 @@ static int intel_lid_notify(struct notifier_block *nb, unsigned long val,
          * the LID nofication event.
          */
         if (connector)
-                connector->status = connector->funcs->detect(connector);
+                connector->status = connector->funcs->detect(connector,
+                                                             false);
+
         /* Don't force modeset on machines where it causes a GPU lockup */
         if (dmi_check_system(intel_no_modeset_on_lid))
                 return NOTIFY_OK;
@@ -875,8 +878,6 @@ void intel_lvds_init(struct drm_device *dev)
 
         intel_encoder->clone_mask = (1 << INTEL_LVDS_CLONE_BIT);
         intel_encoder->crtc_mask = (1 << 1);
-        if (IS_I965G(dev))
-                intel_encoder->crtc_mask |= (1 << 0);
         drm_encoder_helper_add(encoder, &intel_lvds_helper_funcs);
         drm_connector_helper_add(connector, &intel_lvds_connector_helper_funcs);
         connector->display_info.subpixel_order = SubPixelHorizontalRGB;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index e3b7a7ee39cb..ee73e428a84a 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -1417,7 +1417,7 @@ intel_analog_is_connected(struct drm_device *dev)
         if (!analog_connector)
                 return false;
 
-        if (analog_connector->funcs->detect(analog_connector) ==
+        if (analog_connector->funcs->detect(analog_connector, false) ==
                         connector_status_disconnected)
                 return false;
 
@@ -1486,7 +1486,8 @@ intel_sdvo_hdmi_sink_detect(struct drm_connector *connector)
         return status;
 }
 
-static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connector)
+static enum drm_connector_status
+intel_sdvo_detect(struct drm_connector *connector, bool force)
 {
         uint16_t response;
         struct drm_encoder *encoder = intel_attached_encoder(connector);
@@ -2169,8 +2170,7 @@ intel_sdvo_tv_init(struct intel_sdvo *intel_sdvo, int type)
         return true;
 
 err:
-        intel_sdvo_destroy_enhance_property(connector);
-        kfree(intel_sdvo_connector);
+        intel_sdvo_destroy(connector);
         return false;
 }
 
@@ -2242,8 +2242,7 @@ intel_sdvo_lvds_init(struct intel_sdvo *intel_sdvo, int device)
         return true;
 
 err:
-        intel_sdvo_destroy_enhance_property(connector);
-        kfree(intel_sdvo_connector);
+        intel_sdvo_destroy(connector);
         return false;
 }
 
@@ -2521,11 +2520,10 @@ static bool intel_sdvo_create_enhance_property(struct intel_sdvo *intel_sdvo,
                 uint16_t response;
         } enhancements;
 
-        if (!intel_sdvo_get_value(intel_sdvo,
-                                  SDVO_CMD_GET_SUPPORTED_ENHANCEMENTS,
-                                  &enhancements, sizeof(enhancements)))
-                return false;
-
+        enhancements.response = 0;
+        intel_sdvo_get_value(intel_sdvo,
+                             SDVO_CMD_GET_SUPPORTED_ENHANCEMENTS,
+                             &enhancements, sizeof(enhancements));
         if (enhancements.response == 0) {
                 DRM_DEBUG_KMS("No enhancement is supported\n");
                 return true;
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index c671f60ce80b..4a117e318a73 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1341,7 +1341,7 @@ static void intel_tv_find_better_format(struct drm_connector *connector)
  * we have a pipe programmed in order to probe the TV.
  */
 static enum drm_connector_status
-intel_tv_detect(struct drm_connector *connector)
+intel_tv_detect(struct drm_connector *connector, bool force)
 {
         struct drm_display_mode mode;
         struct drm_encoder *encoder = intel_attached_encoder(connector);
@@ -1353,7 +1353,7 @@ intel_tv_detect(struct drm_connector *connector)
 
         if (encoder->crtc && encoder->crtc->enabled) {
                 type = intel_tv_detect_type(intel_tv);
-        } else {
+        } else if (force) {
                 struct drm_crtc *crtc;
                 int dpms_mode;
 
@@ -1364,10 +1364,9 @@ intel_tv_detect(struct drm_connector *connector)
                         intel_release_load_detect_pipe(&intel_tv->base, connector,
                                                        dpms_mode);
                 } else
-                        type = -1;
-        }
-
-        intel_tv->type = type;
+                        return connector_status_unknown;
+        } else
+                return connector->status;
 
         if (type < 0)
                 return connector_status_disconnected;
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index a1473fff06ac..fc737037f751 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -168,7 +168,7 @@ nouveau_connector_set_encoder(struct drm_connector *connector,
 }
 
 static enum drm_connector_status
-nouveau_connector_detect(struct drm_connector *connector)
+nouveau_connector_detect(struct drm_connector *connector, bool force)
 {
         struct drm_device *dev = connector->dev;
         struct nouveau_connector *nv_connector = nouveau_connector(connector);
@@ -246,7 +246,7 @@ detect_analog:
 }
 
 static enum drm_connector_status
-nouveau_connector_detect_lvds(struct drm_connector *connector)
+nouveau_connector_detect_lvds(struct drm_connector *connector, bool force)
 {
         struct drm_device *dev = connector->dev;
         struct drm_nouveau_private *dev_priv = dev->dev_private;
@@ -267,7 +267,7 @@ nouveau_connector_detect_lvds(struct drm_connector *connector)
 
         /* Try retrieving EDID via DDC */
         if (!dev_priv->vbios.fp_no_ddc) {
-                status = nouveau_connector_detect(connector);
+                status = nouveau_connector_detect(connector, force);
                 if (status == connector_status_connected)
                         goto out;
         }
@@ -558,8 +558,10 @@ nouveau_connector_get_modes(struct drm_connector *connector)
         if (nv_encoder->dcb->type == OUTPUT_LVDS &&
             (nv_encoder->dcb->lvdsconf.use_straps_for_mode ||
              dev_priv->vbios.fp_no_ddc) && nouveau_bios_fp_mode(dev, NULL)) {
-                nv_connector->native_mode = drm_mode_create(dev);
-                nouveau_bios_fp_mode(dev, nv_connector->native_mode);
+                struct drm_display_mode mode;
+
+                nouveau_bios_fp_mode(dev, &mode);
+                nv_connector->native_mode = drm_mode_duplicate(dev, &mode);
         }
 
         /* Find the native mode if this is a digital panel, if we didn't
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index dbd30b2e43fd..d2047713dc59 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -352,6 +352,7 @@ nouveau_fbcon_destroy(struct drm_device *dev, struct nouveau_fbdev *nfbdev)
 
         if (nouveau_fb->nvbo) {
                 nouveau_bo_unmap(nouveau_fb->nvbo);
+                drm_gem_object_handle_unreference_unlocked(nouveau_fb->nvbo->gem);
                 drm_gem_object_unreference_unlocked(nouveau_fb->nvbo->gem);
                 nouveau_fb->nvbo = NULL;
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index ead7b8fc53fc..19620a6709f5 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -167,11 +167,9 @@ nouveau_gem_ioctl_new(struct drm_device *dev, void *data,
                 goto out;
 
         ret = drm_gem_handle_create(file_priv, nvbo->gem, &req->info.handle);
+        /* drop reference from allocate - handle holds it now */
+        drm_gem_object_unreference_unlocked(nvbo->gem);
 out:
-        drm_gem_object_handle_unreference_unlocked(nvbo->gem);
-
-        if (ret)
-                drm_gem_object_unreference_unlocked(nvbo->gem);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index 3ec181ff50ce..3c9964a8fbad 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -79,6 +79,7 @@ nouveau_notifier_takedown_channel(struct nouveau_channel *chan)
         mutex_lock(&dev->struct_mutex);
         nouveau_bo_unpin(chan->notifier_bo);
         mutex_unlock(&dev->struct_mutex);
+        drm_gem_object_handle_unreference_unlocked(chan->notifier_bo->gem);
         drm_gem_object_unreference_unlocked(chan->notifier_bo->gem);
         drm_mm_takedown(&chan->notifier_heap);
 }
diff --git a/drivers/gpu/drm/radeon/atombios.h b/drivers/gpu/drm/radeon/atombios.h
index 1bc72c3190a9..fe359a239df3 100644
--- a/drivers/gpu/drm/radeon/atombios.h
+++ b/drivers/gpu/drm/radeon/atombios.h
@@ -4999,7 +4999,7 @@ typedef struct _SW_I2C_IO_DATA_PARAMETERS
 #define SW_I2C_CNTL_WRITE1BIT 6
 
 //==============================VESA definition Portion===============================
-#define VESA_OEM_PRODUCT_REV                                '01.00'
+#define VESA_OEM_PRODUCT_REV                                "01.00"
 #define VESA_MODE_ATTRIBUTE_MODE_SUPPORT             0xBB       //refer to VBE spec p.32, no TTY support
 #define VESA_MODE_WIN_ATTRIBUTE                                              7
 #define VESA_WIN_SIZE                                                                                        64
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 464a81a1990f..cd0290f946cf 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -539,14 +539,15 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                         pll->algo = PLL_ALGO_LEGACY;
                                         pll->flags |= RADEON_PLL_PREFER_CLOSEST_LOWER;
                                 }
-                                /* There is some evidence (often anecdotal) that RV515 LVDS
+                                /* There is some evidence (often anecdotal) that RV515/RV620 LVDS
                                  * (on some boards at least) prefers the legacy algo.  I'm not
                                  * sure whether this should handled generically or on a
                                  * case-by-case quirk basis.  Both algos should work fine in the
                                  * majority of cases.
                                  */
                                 if ((radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) &&
-                                    (rdev->family == CHIP_RV515)) {
+                                    ((rdev->family == CHIP_RV515) ||
+                                     (rdev->family == CHIP_RV620))) {
                                         /* allow the user to overrride just in case */
                                         if (radeon_new_pll == 1)
                                                 pll->algo = PLL_ALGO_NEW;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index b8b7f010b25f..79082d4398ae 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1160,14 +1160,25 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
                                                                         EVERGREEN_MAX_BACKENDS_MASK));
                         break;
                 }
-        } else
-                gb_backend_map =
-                        evergreen_get_tile_pipe_to_backend_map(rdev,
-                                                               rdev->config.evergreen.max_tile_pipes,
-                                                               rdev->config.evergreen.max_backends,
-                                                               ((EVERGREEN_MAX_BACKENDS_MASK <<
-                                                                 rdev->config.evergreen.max_backends) &
-                                                                EVERGREEN_MAX_BACKENDS_MASK));
+        } else {
+                switch (rdev->family) {
+                case CHIP_CYPRESS:
+                case CHIP_HEMLOCK:
+                        gb_backend_map = 0x66442200;
+                        break;
+                case CHIP_JUNIPER:
+                        gb_backend_map = 0x00006420;
+                        break;
+                default:
+                        gb_backend_map =
+                                evergreen_get_tile_pipe_to_backend_map(rdev,
+                                                                       rdev->config.evergreen.max_tile_pipes,
+                                                                       rdev->config.evergreen.max_backends,
+                                                                       ((EVERGREEN_MAX_BACKENDS_MASK <<
+                                                                         rdev->config.evergreen.max_backends) &
+                                                                        EVERGREEN_MAX_BACKENDS_MASK));
+                }
+        }
 
         rdev->config.evergreen.tile_config = gb_addr_config;
         WREG32(GB_BACKEND_MAP, gb_backend_map);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index e817a0bb5eb4..e151f16a8f86 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2020,18 +2020,7 @@ bool r100_gpu_cp_is_lockup(struct radeon_device *rdev, struct r100_gpu_lockup *l
                 return false;
         }
         elapsed = jiffies_to_msecs(cjiffies - lockup->last_jiffies);
-        if (elapsed >= 3000) {
-                /* very likely the improbable case where current
-                 * rptr is equal to last recorded, a while ago, rptr
-                 * this is more likely a false positive update tracking
-                 * information which should force us to be recall at
-                 * latter point
-                 */
-                lockup->last_cp_rptr = cp->rptr;
-                lockup->last_jiffies = jiffies;
-                return false;
-        }
-        if (elapsed >= 1000) {
+        if (elapsed >= 10000) {
                 dev_err(rdev->dev, "GPU lockup CP stall for more than %lumsec\n", elapsed);
                 return true;
         }
@@ -3308,13 +3297,14 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
         unsigned long size;
         unsigned prim_walk;
         unsigned nverts;
+        unsigned num_cb = track->num_cb;
 
-        for (i = 0; i < track->num_cb; i++) {
+        if (!track->zb_cb_clear && !track->color_channel_mask &&
+            !track->blend_read_enable)
+                num_cb = 0;
+
+        for (i = 0; i < num_cb; i++) {
                 if (track->cb[i].robj == NULL) {
-                        if (!(track->zb_cb_clear || track->color_channel_mask ||
-                              track->blend_read_enable)) {
-                                continue;
-                        }
                         DRM_ERROR("[drm] No buffer for color buffer %d !\n", i);
                         return -EINVAL;
                 }
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index afc18d87fdca..7a04959ba0ee 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2729,7 +2729,7 @@ int r600_ib_test(struct radeon_device *rdev)
         if (i < rdev->usec_timeout) {
                 DRM_INFO("ib test succeeded in %u usecs\n", i);
         } else {
-                DRM_ERROR("radeon: ib test failed (sracth(0x%04X)=0x%08X)\n",
+                DRM_ERROR("radeon: ib test failed (scratch(0x%04X)=0x%08X)\n",
                           scratch, tmp);
                 r = -EINVAL;
         }
@@ -3528,7 +3528,8 @@ void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo)
         /* r7xx hw bug.  write to HDP_DEBUG1 followed by fb read
          * rather than write to HDP_REG_COHERENCY_FLUSH_CNTL
          */
-        if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740)) {
+        if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740) &&
+            rdev->vram_scratch.ptr) {
                 void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
                 u32 tmp;
 
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index d13622ae74e9..9ceb2a1ce799 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -1,3 +1,28 @@
+/*
+ * Copyright 2009 Advanced Micro Devices, Inc.
+ * Copyright 2009 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ */
+
 #include "drmP.h"
 #include "drm.h"
 #include "radeon_drm.h"
diff --git a/drivers/gpu/drm/radeon/r600_blit_shaders.h b/drivers/gpu/drm/radeon/r600_blit_shaders.h
index fdc3b378cbb0..f437d36dd98c 100644
--- a/drivers/gpu/drm/radeon/r600_blit_shaders.h
+++ b/drivers/gpu/drm/radeon/r600_blit_shaders.h
@@ -1,3 +1,27 @@
+/*
+ * Copyright 2009 Advanced Micro Devices, Inc.
+ * Copyright 2009 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ */
 
 #ifndef R600_BLIT_SHADERS_H
 #define R600_BLIT_SHADERS_H
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index d8864949e387..250a3a918193 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1170,9 +1170,8 @@ static inline int r600_check_texture_resource(struct radeon_cs_parser *p,  u32 i
         /* using get ib will give us the offset into the mipmap bo */
         word0 = radeon_get_ib_value(p, idx + 3) << 8;
         if ((mipmap_size + word0) > radeon_bo_size(mipmap)) {
-                dev_warn(p->dev, "mipmap bo too small (%d %d %d %d %d %d -> %d have %ld)\n",
-                        w0, h0, bpe, blevel, nlevels, word0, mipmap_size, radeon_bo_size(texture));
-                return -EINVAL;
+                /*dev_warn(p->dev, "mipmap bo too small (%d %d %d %d %d %d -> %d have %ld)\n",
+                  w0, h0, bpe, blevel, nlevels, word0, mipmap_size, radeon_bo_size(texture));*/
         }
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index ebae14c4b768..68932ba7b8a4 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -317,6 +317,15 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                         *connector_type = DRM_MODE_CONNECTOR_DVID;
         }
 
+        /* MSI K9A2GM V2/V3 board has no HDMI or DVI */
+        if ((dev->pdev->device == 0x796e) &&
+            (dev->pdev->subsystem_vendor == 0x1462) &&
+            (dev->pdev->subsystem_device == 0x7302)) {
+                if ((supported_device == ATOM_DEVICE_DFP2_SUPPORT) ||
+                    (supported_device == ATOM_DEVICE_DFP3_SUPPORT))
+                        return false;
+        }
+
         /* a-bit f-i90hd - ciaranm on #radeonhd - this board has no DVI */
         if ((dev->pdev->device == 0x7941) &&
             (dev->pdev->subsystem_vendor == 0x147b) &&
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index bd74e428bd14..a04b7a6ad95f 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -1485,6 +1485,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
                         /* PowerMac8,1 ? */
                         /* imac g5 isight */
                         rdev->mode_info.connector_table = CT_IMAC_G5_ISIGHT;
+                } else if ((rdev->pdev->device == 0x4a48) &&
+                           (rdev->pdev->subsystem_vendor == 0x1002) &&
+                           (rdev->pdev->subsystem_device == 0x4a48)) {
+                        /* Mac X800 */
+                        rdev->mode_info.connector_table = CT_MAC_X800;
                 } else
 #endif /* CONFIG_PPC_PMAC */
 #ifdef CONFIG_PPC64
@@ -1961,6 +1966,48 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
                                             CONNECTOR_OBJECT_ID_VGA,
                                             &hpd);
                 break;
+        case CT_MAC_X800:
+                DRM_INFO("Connector Table: %d (mac x800)\n",
+                         rdev->mode_info.connector_table);
+                /* DVI - primary dac, internal tmds */
+                ddc_i2c = combios_setup_i2c_bus(rdev, DDC_DVI, 0, 0);
+                hpd.hpd = RADEON_HPD_1; /* ??? */
+                radeon_add_legacy_encoder(dev,
+                                          radeon_get_encoder_enum(dev,
+                                                                  ATOM_DEVICE_DFP1_SUPPORT,
+                                                                  0),
+                                          ATOM_DEVICE_DFP1_SUPPORT);
+                radeon_add_legacy_encoder(dev,
+                                          radeon_get_encoder_enum(dev,
+                                                                  ATOM_DEVICE_CRT1_SUPPORT,
+                                                                  1),
+                                          ATOM_DEVICE_CRT1_SUPPORT);
+                radeon_add_legacy_connector(dev, 0,
+                                            ATOM_DEVICE_DFP1_SUPPORT |
+                                            ATOM_DEVICE_CRT1_SUPPORT,
+                                            DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
+                                            CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
+                                            &hpd);
+                /* DVI - tv dac, dvo */
+                ddc_i2c = combios_setup_i2c_bus(rdev, DDC_MONID, 0, 0);
+                hpd.hpd = RADEON_HPD_2; /* ??? */
+                radeon_add_legacy_encoder(dev,
+                                          radeon_get_encoder_enum(dev,
+                                                                  ATOM_DEVICE_DFP2_SUPPORT,
+                                                                  0),
+                                          ATOM_DEVICE_DFP2_SUPPORT);
+                radeon_add_legacy_encoder(dev,
+                                          radeon_get_encoder_enum(dev,
+                                                                  ATOM_DEVICE_CRT2_SUPPORT,
+                                                                  2),
+                                          ATOM_DEVICE_CRT2_SUPPORT);
+                radeon_add_legacy_connector(dev, 1,
+                                            ATOM_DEVICE_DFP2_SUPPORT |
+                                            ATOM_DEVICE_CRT2_SUPPORT,
+                                            DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
+                                            CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I,
+                                            &hpd);
+                break;
         default:
                 DRM_INFO("Connector table: %d (invalid)\n",
                          rdev->mode_info.connector_table);
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index a9dd7847d96e..ecc1a8fafbfd 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -481,7 +481,8 @@ static int radeon_lvds_mode_valid(struct drm_connector *connector,
         return MODE_OK;
 }
 
-static enum drm_connector_status radeon_lvds_detect(struct drm_connector *connector)
+static enum drm_connector_status
+radeon_lvds_detect(struct drm_connector *connector, bool force)
 {
         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
         struct drm_encoder *encoder = radeon_best_single_encoder(connector);
@@ -594,7 +595,8 @@ static int radeon_vga_mode_valid(struct drm_connector *connector,
         return MODE_OK;
 }
 
-static enum drm_connector_status radeon_vga_detect(struct drm_connector *connector)
+static enum drm_connector_status
+radeon_vga_detect(struct drm_connector *connector, bool force)
 {
         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
         struct drm_encoder *encoder;
@@ -691,7 +693,8 @@ static int radeon_tv_mode_valid(struct drm_connector *connector,
         return MODE_OK;
 }
 
-static enum drm_connector_status radeon_tv_detect(struct drm_connector *connector)
+static enum drm_connector_status
+radeon_tv_detect(struct drm_connector *connector, bool force)
 {
         struct drm_encoder *encoder;
         struct drm_encoder_helper_funcs *encoder_funcs;
@@ -748,7 +751,8 @@ static int radeon_dvi_get_modes(struct drm_connector *connector)
  * we have to check if this analog encoder is shared with anyone else (TV)
  * if its shared we have to set the other connector to disconnected.
  */
-static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connector)
+static enum drm_connector_status
+radeon_dvi_detect(struct drm_connector *connector, bool force)
 {
         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
         struct drm_encoder *encoder = NULL;
@@ -972,7 +976,8 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
         return ret;
 }
 
-static enum drm_connector_status radeon_dp_detect(struct drm_connector *connector)
+static enum drm_connector_status
+radeon_dp_detect(struct drm_connector *connector, bool force)
 {
         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
         enum drm_connector_status ret = connector_status_disconnected;
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 6dd434ad2429..b92d2f2fcbed 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -349,6 +349,8 @@ static void radeon_print_display_setup(struct drm_device *dev)
                                         DRM_INFO("    DFP4: %s\n", encoder_names[radeon_encoder->encoder_id]);
                                 if (devices & ATOM_DEVICE_DFP5_SUPPORT)
                                         DRM_INFO("    DFP5: %s\n", encoder_names[radeon_encoder->encoder_id]);
+                                if (devices & ATOM_DEVICE_DFP6_SUPPORT)
+                                        DRM_INFO("    DFP6: %s\n", encoder_names[radeon_encoder->encoder_id]);
                                 if (devices & ATOM_DEVICE_TV1_SUPPORT)
                                         DRM_INFO("    TV1: %s\n", encoder_names[radeon_encoder->encoder_id]);
                                 if (devices & ATOM_DEVICE_CV_SUPPORT)
@@ -841,8 +843,9 @@ static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb)
 {
         struct radeon_framebuffer *radeon_fb = to_radeon_framebuffer(fb);
 
-        if (radeon_fb->obj)
+        if (radeon_fb->obj) {
                 drm_gem_object_unreference_unlocked(radeon_fb->obj);
+        }
         drm_framebuffer_cleanup(fb);
         kfree(radeon_fb);
 }
@@ -1140,17 +1143,18 @@ bool radeon_crtc_scaling_mode_fixup(struct drm_crtc *crtc,
                                 radeon_crtc->rmx_type = radeon_encoder->rmx_type;
                         else
                                 radeon_crtc->rmx_type = RMX_OFF;
-                        src_v = crtc->mode.vdisplay;
-                        dst_v = radeon_crtc->native_mode.vdisplay;
-                        src_h = crtc->mode.hdisplay;
-                        dst_h = radeon_crtc->native_mode.vdisplay;
                         /* copy native mode */
                         memcpy(&radeon_crtc->native_mode,
                                &radeon_encoder->native_mode,
                                 sizeof(struct drm_display_mode));
+                        src_v = crtc->mode.vdisplay;
+                        dst_v = radeon_crtc->native_mode.vdisplay;
+                        src_h = crtc->mode.hdisplay;
+                        dst_h = radeon_crtc->native_mode.hdisplay;
 
                         /* fix up for overscan on hdmi */
                         if (ASIC_IS_AVIVO(rdev) &&
+                            (!(mode->flags & DRM_MODE_FLAG_INTERLACE)) &&
                             ((radeon_encoder->underscan_type == UNDERSCAN_ON) ||
                              ((radeon_encoder->underscan_type == UNDERSCAN_AUTO) &&
                               drm_detect_hdmi_monitor(radeon_connector->edid) &&
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index c74a8b20d941..9cdf6a35bc2c 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -94,8 +94,10 @@ static void radeonfb_destroy_pinned_object(struct drm_gem_object *gobj)
         ret = radeon_bo_reserve(rbo, false);
         if (likely(ret == 0)) {
                 radeon_bo_kunmap(rbo);
+                radeon_bo_unpin(rbo);
                 radeon_bo_unreserve(rbo);
         }
+        drm_gem_object_handle_unreference(gobj);
         drm_gem_object_unreference_unlocked(gobj);
 }
 
@@ -325,8 +327,6 @@ static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfb
 {
         struct fb_info *info;
         struct radeon_framebuffer *rfb = &rfbdev->rfb;
-        struct radeon_bo *rbo;
-        int r;
 
         if (rfbdev->helper.fbdev) {
                 info = rfbdev->helper.fbdev;
@@ -338,14 +338,8 @@ static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfb
         }
 
         if (rfb->obj) {
-                rbo = rfb->obj->driver_private;
-                r = radeon_bo_reserve(rbo, false);
-                if (likely(r == 0)) {
-                        radeon_bo_kunmap(rbo);
-                        radeon_bo_unpin(rbo);
-                        radeon_bo_unreserve(rbo);
-                }
-                drm_gem_object_unreference_unlocked(rfb->obj);
+                radeonfb_destroy_pinned_object(rfb->obj);
+                rfb->obj = NULL;
         }
         drm_fb_helper_fini(&rfbdev->helper);
         drm_framebuffer_cleanup(&rfb->base);
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index c578f265b24c..d1e595d91723 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -201,11 +201,11 @@ int radeon_gem_create_ioctl(struct drm_device *dev, void *data,
                 return r;
         }
         r = drm_gem_handle_create(filp, gobj, &handle);
+        /* drop reference from allocate - handle holds it now */
+        drm_gem_object_unreference_unlocked(gobj);
         if (r) {
-                drm_gem_object_unreference_unlocked(gobj);
                 return r;
         }
-        drm_gem_object_handle_unreference_unlocked(gobj);
         args->handle = handle;
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 5eee3c41d124..8fbbe1c6ebbd 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -203,6 +203,10 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
  */
 int radeon_driver_firstopen_kms(struct drm_device *dev)
 {
+        struct radeon_device *rdev = dev->dev_private;
+
+        if (rdev->powered_down)
+                return -EINVAL;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index efbe975312dc..17a6602b5885 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -204,7 +204,7 @@ struct radeon_i2c_chan {
 
 /* mostly for macs, but really any system without connector tables */
 enum radeon_connector_table {
-        CT_NONE,
+        CT_NONE = 0,
         CT_GENERIC,
         CT_IBOOK,
         CT_POWERBOOK_EXTERNAL,
@@ -215,6 +215,7 @@ enum radeon_connector_table {
         CT_IMAC_G5_ISIGHT,
         CT_EMAC,
         CT_RN50_POWER,
+        CT_MAC_X800,
 };
 
 enum radeon_dvo_chip {
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 7cffb3e04232..3451a82adba7 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -351,6 +351,7 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
         INIT_LIST_HEAD(&fbo->lru);
         INIT_LIST_HEAD(&fbo->swap);
         fbo->vm_node = NULL;
+        atomic_set(&fbo->cpu_writers, 0);
 
         fbo->sync_obj = driver->sync_obj_ref(bo->sync_obj);
         kref_init(&fbo->list_kref);
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index ca904799f018..b1e02fffd3cc 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -69,7 +69,7 @@ struct ttm_page_pool {
         spinlock_t              lock;
         bool                    fill_lock;
         struct list_head        list;
-        int                     gfp_flags;
+        gfp_t                   gfp_flags;
         unsigned                npages;
         char                    *name;
         unsigned long           nfrees;
@@ -475,7 +475,7 @@ static void ttm_handle_caching_state_failure(struct list_head *pages,
  * This function is reentrant if caller updates count depending on number of
  * pages returned in pages array.
  */
-static int ttm_alloc_new_pages(struct list_head *pages, int gfp_flags,
+static int ttm_alloc_new_pages(struct list_head *pages, gfp_t gfp_flags,
                 int ttm_flags, enum ttm_caching_state cstate, unsigned count)
 {
         struct page **caching_array;
@@ -666,7 +666,7 @@ int ttm_get_pages(struct list_head *pages, int flags,
 {
         struct ttm_page_pool *pool = ttm_get_pool(flags, cstate);
         struct page *p = NULL;
-        int gfp_flags = GFP_USER;
+        gfp_t gfp_flags = GFP_USER;
         int r;
 
         /* set zero flag for page allocation if required */
@@ -818,7 +818,7 @@ int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages)
         return 0;
 }
 
-void ttm_page_alloc_fini()
+void ttm_page_alloc_fini(void)
 {
         int i;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 72ec2e2b6e97..a96ed6d9d010 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -148,13 +148,16 @@ static struct pci_device_id vmw_pci_id_list[] = {
         {0, 0, 0}
 };
 
-static char *vmw_devname = "vmwgfx";
+static int enable_fbdev;
 
 static int vmw_probe(struct pci_dev *, const struct pci_device_id *);
 static void vmw_master_init(struct vmw_master *);
 static int vmwgfx_pm_notifier(struct notifier_block *nb, unsigned long val,
                               void *ptr);
 
+MODULE_PARM_DESC(enable_fbdev, "Enable vmwgfx fbdev");
+module_param_named(enable_fbdev, enable_fbdev, int, 0600);
+
 static void vmw_print_capabilities(uint32_t capabilities)
 {
         DRM_INFO("Capabilities:\n");
@@ -192,8 +195,6 @@ static int vmw_request_device(struct vmw_private *dev_priv)
 {
         int ret;
 
-        vmw_kms_save_vga(dev_priv);
-
         ret = vmw_fifo_init(dev_priv, &dev_priv->fifo);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Unable to initialize FIFO.\n");
@@ -206,9 +207,35 @@ static int vmw_request_device(struct vmw_private *dev_priv)
 static void vmw_release_device(struct vmw_private *dev_priv)
 {
         vmw_fifo_release(dev_priv, &dev_priv->fifo);
-        vmw_kms_restore_vga(dev_priv);
 }
 
+int vmw_3d_resource_inc(struct vmw_private *dev_priv)
+{
+        int ret = 0;
+
+        mutex_lock(&dev_priv->release_mutex);
+        if (unlikely(dev_priv->num_3d_resources++ == 0)) {
+                ret = vmw_request_device(dev_priv);
+                if (unlikely(ret != 0))
+                        --dev_priv->num_3d_resources;
+        }
+        mutex_unlock(&dev_priv->release_mutex);
+        return ret;
+}
+
+
+void vmw_3d_resource_dec(struct vmw_private *dev_priv)
+{
+        int32_t n3d;
+
+        mutex_lock(&dev_priv->release_mutex);
+        if (unlikely(--dev_priv->num_3d_resources == 0))
+                vmw_release_device(dev_priv);
+        n3d = (int32_t) dev_priv->num_3d_resources;
+        mutex_unlock(&dev_priv->release_mutex);
+
+        BUG_ON(n3d < 0);
+}
 
 static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
 {
@@ -228,6 +255,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
         dev_priv->last_read_sequence = (uint32_t) -100;
         mutex_init(&dev_priv->hw_mutex);
         mutex_init(&dev_priv->cmdbuf_mutex);
+        mutex_init(&dev_priv->release_mutex);
         rwlock_init(&dev_priv->resource_lock);
         idr_init(&dev_priv->context_idr);
         idr_init(&dev_priv->surface_idr);
@@ -244,6 +272,8 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
         dev_priv->vram_start = pci_resource_start(dev->pdev, 1);
         dev_priv->mmio_start = pci_resource_start(dev->pdev, 2);
 
+        dev_priv->enable_fb = enable_fbdev;
+
         mutex_lock(&dev_priv->hw_mutex);
 
         vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
@@ -343,17 +373,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
 
         dev->dev_private = dev_priv;
 
-        if (!dev->devname)
-                dev->devname = vmw_devname;
-
-        if (dev_priv->capabilities & SVGA_CAP_IRQMASK) {
-                ret = drm_irq_install(dev);
-                if (unlikely(ret != 0)) {
-                        DRM_ERROR("Failed installing irq: %d\n", ret);
-                        goto out_no_irq;
-                }
-        }
-
         ret = pci_request_regions(dev->pdev, "vmwgfx probe");
         dev_priv->stealth = (ret != 0);
         if (dev_priv->stealth) {
@@ -369,26 +388,52 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                         goto out_no_device;
                 }
         }
-        ret = vmw_request_device(dev_priv);
+        ret = vmw_kms_init(dev_priv);
         if (unlikely(ret != 0))
-                goto out_no_device;
-        vmw_kms_init(dev_priv);
+                goto out_no_kms;
         vmw_overlay_init(dev_priv);
-        vmw_fb_init(dev_priv);
+        if (dev_priv->enable_fb) {
+                ret = vmw_3d_resource_inc(dev_priv);
+                if (unlikely(ret != 0))
+                        goto out_no_fifo;
+                vmw_kms_save_vga(dev_priv);
+                vmw_fb_init(dev_priv);
+                DRM_INFO("%s", vmw_fifo_have_3d(dev_priv) ?
+                         "Detected device 3D availability.\n" :
+                         "Detected no device 3D availability.\n");
+        } else {
+                DRM_INFO("Delayed 3D detection since we're not "
+                         "running the device in SVGA mode yet.\n");
+        }
+
+        if (dev_priv->capabilities & SVGA_CAP_IRQMASK) {
+                ret = drm_irq_install(dev);
+                if (unlikely(ret != 0)) {
+                        DRM_ERROR("Failed installing irq: %d\n", ret);
+                        goto out_no_irq;
+                }
+        }
 
         dev_priv->pm_nb.notifier_call = vmwgfx_pm_notifier;
         register_pm_notifier(&dev_priv->pm_nb);
 
-        DRM_INFO("%s", vmw_fifo_have_3d(dev_priv) ? "Have 3D\n" : "No 3D\n");
-
         return 0;
 
-out_no_device:
-        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
-                drm_irq_uninstall(dev_priv->dev);
-        if (dev->devname == vmw_devname)
-                dev->devname = NULL;
 out_no_irq:
+        if (dev_priv->enable_fb) {
+                vmw_fb_close(dev_priv);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
+out_no_fifo:
+        vmw_overlay_close(dev_priv);
+        vmw_kms_close(dev_priv);
+out_no_kms:
+        if (dev_priv->stealth)
+                pci_release_region(dev->pdev, 2);
+        else
+                pci_release_regions(dev->pdev);
+out_no_device:
         ttm_object_device_release(&dev_priv->tdev);
 out_err4:
         iounmap(dev_priv->mmio_virt);
@@ -415,19 +460,20 @@ static int vmw_driver_unload(struct drm_device *dev)
 
         unregister_pm_notifier(&dev_priv->pm_nb);
 
-        vmw_fb_close(dev_priv);
+        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
+                drm_irq_uninstall(dev_priv->dev);
+        if (dev_priv->enable_fb) {
+                vmw_fb_close(dev_priv);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
         vmw_kms_close(dev_priv);
         vmw_overlay_close(dev_priv);
-        vmw_release_device(dev_priv);
         if (dev_priv->stealth)
                 pci_release_region(dev->pdev, 2);
         else
                 pci_release_regions(dev->pdev);
 
-        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
-                drm_irq_uninstall(dev_priv->dev);
-        if (dev->devname == vmw_devname)
-                dev->devname = NULL;
         ttm_object_device_release(&dev_priv->tdev);
         iounmap(dev_priv->mmio_virt);
         drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start,
@@ -500,7 +546,7 @@ static long vmw_unlocked_ioctl(struct file *filp, unsigned int cmd,
                 struct drm_ioctl_desc *ioctl =
                     &vmw_ioctls[nr - DRM_COMMAND_BASE];
 
-                if (unlikely(ioctl->cmd != cmd)) {
+                if (unlikely(ioctl->cmd_drv != cmd)) {
                         DRM_ERROR("Invalid command format, ioctl %d\n",
                                   nr - DRM_COMMAND_BASE);
                         return -EINVAL;
@@ -589,6 +635,16 @@ static int vmw_master_set(struct drm_device *dev,
         struct vmw_master *vmaster = vmw_master(file_priv->master);
         int ret = 0;
 
+        if (!dev_priv->enable_fb) {
+                ret = vmw_3d_resource_inc(dev_priv);
+                if (unlikely(ret != 0))
+                        return ret;
+                vmw_kms_save_vga(dev_priv);
+                mutex_lock(&dev_priv->hw_mutex);
+                vmw_write(dev_priv, SVGA_REG_TRACES, 0);
+                mutex_unlock(&dev_priv->hw_mutex);
+        }
+
         if (active) {
                 BUG_ON(active != &dev_priv->fbdev_master);
                 ret = ttm_vt_lock(&active->lock, false, vmw_fp->tfile);
@@ -617,7 +673,13 @@ static int vmw_master_set(struct drm_device *dev,
         return 0;
 
 out_no_active_lock:
-        vmw_release_device(dev_priv);
+        if (!dev_priv->enable_fb) {
+                mutex_lock(&dev_priv->hw_mutex);
+                vmw_write(dev_priv, SVGA_REG_TRACES, 1);
+                mutex_unlock(&dev_priv->hw_mutex);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
         return ret;
 }
 
@@ -645,11 +707,23 @@ static void vmw_master_drop(struct drm_device *dev,
 
         ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
 
+        if (!dev_priv->enable_fb) {
+                ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM);
+                if (unlikely(ret != 0))
+                        DRM_ERROR("Unable to clean VRAM on master drop.\n");
+                mutex_lock(&dev_priv->hw_mutex);
+                vmw_write(dev_priv, SVGA_REG_TRACES, 1);
+                mutex_unlock(&dev_priv->hw_mutex);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
+
         dev_priv->active_master = &dev_priv->fbdev_master;
         ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM);
         ttm_vt_unlock(&dev_priv->fbdev_master.lock);
 
-        vmw_fb_on(dev_priv);
+        if (dev_priv->enable_fb)
+                vmw_fb_on(dev_priv);
 }
 
 
@@ -722,6 +796,7 @@ static struct drm_driver driver = {
         .irq_postinstall = vmw_irq_postinstall,
         .irq_uninstall = vmw_irq_uninstall,
         .irq_handler = vmw_irq_handler,
+        .get_vblank_counter = vmw_get_vblank_counter,
         .reclaim_buffers_locked = NULL,
         .get_map_ofs = drm_core_get_map_ofs,
         .get_reg_ofs = drm_core_get_reg_ofs,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 429f917b60bf..58de6393f611 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -277,6 +277,7 @@ struct vmw_private {
 
         bool stealth;
         bool is_opened;
+        bool enable_fb;
 
         /**
          * Master management.
@@ -285,6 +286,9 @@ struct vmw_private {
         struct vmw_master *active_master;
         struct vmw_master fbdev_master;
         struct notifier_block pm_nb;
+
+        struct mutex release_mutex;
+        uint32_t num_3d_resources;
 };
 
 static inline struct vmw_private *vmw_priv(struct drm_device *dev)
@@ -319,6 +323,9 @@ static inline uint32_t vmw_read(struct vmw_private *dev_priv,
         return val;
 }
 
+int vmw_3d_resource_inc(struct vmw_private *dev_priv);
+void vmw_3d_resource_dec(struct vmw_private *dev_priv);
+
 /**
  * GMR utilities - vmwgfx_gmr.c
  */
@@ -511,6 +518,7 @@ void vmw_kms_write_svga(struct vmw_private *vmw_priv,
                         unsigned bbp, unsigned depth);
 int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                 struct drm_file *file_priv);
+u32 vmw_get_vblank_counter(struct drm_device *dev, int crtc);
 
 /**
  * Overlay control - vmwgfx_overlay.c
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index 870967a97c15..409e172f4abf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -615,6 +615,11 @@ int vmw_dmabuf_to_start_of_vram(struct vmw_private *vmw_priv,
         if (unlikely(ret != 0))
                 goto err_unlock;
 
+        if (bo->mem.mem_type == TTM_PL_VRAM &&
+            bo->mem.mm_node->start < bo->num_pages)
+                (void) ttm_bo_validate(bo, &vmw_sys_placement, false,
+                                       false, false);
+
         ret = ttm_bo_validate(bo, &ne_placement, false, false, false);
 
         /* Could probably bug on */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index e6a1eb7ea954..0fe31766e4cf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -106,6 +106,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
         mutex_lock(&dev_priv->hw_mutex);
         dev_priv->enable_state = vmw_read(dev_priv, SVGA_REG_ENABLE);
         dev_priv->config_done_state = vmw_read(dev_priv, SVGA_REG_CONFIG_DONE);
+        dev_priv->traces_state = vmw_read(dev_priv, SVGA_REG_TRACES);
         vmw_write(dev_priv, SVGA_REG_ENABLE, 1);
 
         min = 4;
@@ -175,6 +176,8 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
                   dev_priv->config_done_state);
         vmw_write(dev_priv, SVGA_REG_ENABLE,
                   dev_priv->enable_state);
+        vmw_write(dev_priv, SVGA_REG_TRACES,
+                  dev_priv->traces_state);
 
         mutex_unlock(&dev_priv->hw_mutex);
         vmw_fence_queue_takedown(&fifo->fence_queue);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 64d7f47df868..e882ba099f0c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -898,7 +898,19 @@ int vmw_kms_save_vga(struct vmw_private *vmw_priv)
                 save->width = vmw_read(vmw_priv, SVGA_REG_DISPLAY_WIDTH);
                 save->height = vmw_read(vmw_priv, SVGA_REG_DISPLAY_HEIGHT);
                 vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+                if (i == 0 && vmw_priv->num_displays == 1 &&
+                    save->width == 0 && save->height == 0) {
+
+                        /*
+                         * It should be fairly safe to assume that these
+                         * values are uninitialized.
+                         */
+
+                        save->width = vmw_priv->vga_width - save->pos_x;
+                        save->height = vmw_priv->vga_height - save->pos_y;
+                }
         }
+
         return 0;
 }
 
@@ -984,3 +996,8 @@ out_unlock:
         ttm_read_unlock(&vmaster->lock);
         return ret;
 }
+
+u32 vmw_get_vblank_counter(struct drm_device *dev, int crtc)
+{
+        return 0;
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 2ff5cf78235f..11cb39e3accb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -27,6 +27,8 @@
 
 #include "vmwgfx_kms.h"
 
+#define VMWGFX_LDU_NUM_DU 8
+
 #define vmw_crtc_to_ldu(x) \
         container_of(x, struct vmw_legacy_display_unit, base.crtc)
 #define vmw_encoder_to_ldu(x) \
@@ -335,7 +337,8 @@ static void vmw_ldu_connector_restore(struct drm_connector *connector)
 }
 
 static enum drm_connector_status
-        vmw_ldu_connector_detect(struct drm_connector *connector)
+        vmw_ldu_connector_detect(struct drm_connector *connector,
+                                 bool force)
 {
         if (vmw_connector_to_ldu(connector)->pref_active)
                 return connector_status_connected;
@@ -516,7 +519,7 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
 
         drm_connector_init(dev, connector, &vmw_legacy_connector_funcs,
                            DRM_MODE_CONNECTOR_LVDS);
-        connector->status = vmw_ldu_connector_detect(connector);
+        connector->status = vmw_ldu_connector_detect(connector, true);
 
         drm_encoder_init(dev, encoder, &vmw_legacy_encoder_funcs,
                          DRM_MODE_ENCODER_LVDS);
@@ -535,6 +538,10 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
 
 int vmw_kms_init_legacy_display_system(struct vmw_private *dev_priv)
 {
+        struct drm_device *dev = dev_priv->dev;
+        int i;
+        int ret;
+
         if (dev_priv->ldu_priv) {
                 DRM_INFO("ldu system already on\n");
                 return -EINVAL;
@@ -552,23 +559,24 @@ int vmw_kms_init_legacy_display_system(struct vmw_private *dev_priv)
 
         drm_mode_create_dirty_info_property(dev_priv->dev);
 
-        vmw_ldu_init(dev_priv, 0);
-        /* for old hardware without multimon only enable one display */
         if (dev_priv->capabilities & SVGA_CAP_MULTIMON) {
-                vmw_ldu_init(dev_priv, 1);
-                vmw_ldu_init(dev_priv, 2);
-                vmw_ldu_init(dev_priv, 3);
-                vmw_ldu_init(dev_priv, 4);
-                vmw_ldu_init(dev_priv, 5);
-                vmw_ldu_init(dev_priv, 6);
-                vmw_ldu_init(dev_priv, 7);
+                for (i = 0; i < VMWGFX_LDU_NUM_DU; ++i)
+                        vmw_ldu_init(dev_priv, i);
+                ret = drm_vblank_init(dev, VMWGFX_LDU_NUM_DU);
+        } else {
+                /* for old hardware without multimon only enable one display */
+                vmw_ldu_init(dev_priv, 0);
+                ret = drm_vblank_init(dev, 1);
         }
 
-        return 0;
+        return ret;
 }
 
 int vmw_kms_close_legacy_display_system(struct vmw_private *dev_priv)
 {
+        struct drm_device *dev = dev_priv->dev;
+
+        drm_vblank_cleanup(dev);
         if (!dev_priv->ldu_priv)
                 return -ENOSYS;
 
@@ -610,7 +618,7 @@ int vmw_kms_ldu_update_layout(struct vmw_private *dev_priv, unsigned num,
                         ldu->pref_height = 600;
                         ldu->pref_active = false;
                 }
-                con->status = vmw_ldu_connector_detect(con);
+                con->status = vmw_ldu_connector_detect(con, true);
         }
 
         mutex_unlock(&dev->mode_config.mutex);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 5f2d5df01e5c..c8c40e9979db 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -211,6 +211,7 @@ static void vmw_hw_context_destroy(struct vmw_resource *res)
         cmd->body.cid = cpu_to_le32(res->id);
 
         vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        vmw_3d_resource_dec(dev_priv);
 }
 
 static int vmw_context_init(struct vmw_private *dev_priv,
@@ -247,6 +248,7 @@ static int vmw_context_init(struct vmw_private *dev_priv,
         cmd->body.cid = cpu_to_le32(res->id);
 
         vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        (void) vmw_3d_resource_inc(dev_priv);
         vmw_resource_activate(res, vmw_hw_context_destroy);
         return 0;
 }
@@ -406,6 +408,7 @@ static void vmw_hw_surface_destroy(struct vmw_resource *res)
         cmd->body.sid = cpu_to_le32(res->id);
 
         vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        vmw_3d_resource_dec(dev_priv);
 }
 
 void vmw_surface_res_free(struct vmw_resource *res)
@@ -473,6 +476,7 @@ int vmw_surface_init(struct vmw_private *dev_priv,
         }
 
         vmw_fifo_commit(dev_priv, submit_size);
+        (void) vmw_3d_resource_inc(dev_priv);
         vmw_resource_activate(res, vmw_hw_surface_destroy);
         return 0;
 }
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index b87569e96b16..f366f968155a 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -598,7 +598,7 @@ static inline void vga_update_device_decodes(struct vga_device *vgadev,
         pr_debug("vgaarb: decoding count now is: %d\n", vga_decode_count);
 }
 
-void __vga_set_legacy_decoding(struct pci_dev *pdev, unsigned int decodes, bool userspace)
+static void __vga_set_legacy_decoding(struct pci_dev *pdev, unsigned int decodes, bool userspace)
 {
         struct vga_device *vgadev;
         unsigned long flags;
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 0c52899be964..3f7292486024 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1285,8 +1285,11 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_T91MT) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUSTEK_MULTITOUCH_YFO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
@@ -1578,7 +1581,6 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_AIPTEK, USB_DEVICE_ID_AIPTEK_24) },
         { HID_USB_DEVICE(USB_VENDOR_ID_AIRCABLE, USB_DEVICE_ID_AIRCABLE1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ALCOR, USB_DEVICE_ID_ALCOR_USBRS232) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_T91MT)},
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_LCM)},
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_LCM2)},
         { HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 85c6d13c9ffa..765a4f53eb5c 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -105,6 +105,7 @@
 
 #define USB_VENDOR_ID_ASUS              0x0486
 #define USB_DEVICE_ID_ASUS_T91MT        0x0185
+#define USB_DEVICE_ID_ASUSTEK_MULTITOUCH_YFO    0x0186
 
 #define USB_VENDOR_ID_ASUSTEK           0x0b05
 #define USB_DEVICE_ID_ASUSTEK_LCM       0x1726
@@ -128,6 +129,7 @@
 
 #define USB_VENDOR_ID_BTC               0x046e
 #define USB_DEVICE_ID_BTC_EMPREX_REMOTE 0x5578
+#define USB_DEVICE_ID_BTC_EMPREX_REMOTE_2       0x5577
 
 #define USB_VENDOR_ID_CANDO             0x2087
 #define USB_DEVICE_ID_CANDO_MULTI_TOUCH 0x0a01
@@ -149,6 +151,7 @@
 
 #define USB_VENDOR_ID_CHICONY           0x04f2
 #define USB_DEVICE_ID_CHICONY_TACTICAL_PAD      0x0418
+#define USB_DEVICE_ID_CHICONY_MULTI_TOUCH       0xb19d
 
 #define USB_VENDOR_ID_CIDC              0x1677
 
@@ -507,6 +510,7 @@
 #define USB_VENDOR_ID_UCLOGIC           0x5543
 #define USB_DEVICE_ID_UCLOGIC_TABLET_PF1209     0x0042
 #define USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U    0x0003
+#define USB_DEVICE_ID_UCLOGIC_TABLET_KNA5       0x6001
 
 #define USB_VENDOR_ID_VERNIER           0x08f7
 #define USB_DEVICE_ID_VERNIER_LABPRO    0x0001
diff --git a/drivers/hid/hid-mosart.c b/drivers/hid/hid-mosart.c
index e91437c18906..ac5421d568f1 100644
--- a/drivers/hid/hid-mosart.c
+++ b/drivers/hid/hid-mosart.c
@@ -239,6 +239,7 @@ static void mosart_remove(struct hid_device *hdev)
 
 static const struct hid_device_id mosart_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_T91MT) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUSTEK_MULTITOUCH_YFO) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, mosart_devices);
diff --git a/drivers/hid/hid-topseed.c b/drivers/hid/hid-topseed.c
index 5771f851f856..956ed9ac19d4 100644
--- a/drivers/hid/hid-topseed.c
+++ b/drivers/hid/hid-topseed.c
@@ -64,6 +64,7 @@ static int ts_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 static const struct hid_device_id ts_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
         { }
 };
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index b729c0286679..599041a7f670 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -828,6 +828,7 @@ static int usbhid_output_raw_report(struct hid_device *hid, __u8 *buf, size_t co
                 }
         } else {
                 int skipped_report_id = 0;
+                int report_id = buf[0];
                 if (buf[0] == 0x0) {
                         /* Don't send the Report ID */
                         buf++;
@@ -837,7 +838,7 @@ static int usbhid_output_raw_report(struct hid_device *hid, __u8 *buf, size_t co
                 ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
                         HID_REQ_SET_REPORT,
                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
-                        ((report_type + 1) << 8) | *buf,
+                        ((report_type + 1) << 8) | report_id,
                         interface->desc.bInterfaceNumber, buf, count,
                         USB_CTRL_SET_TIMEOUT);
                 /* count also the report id, if this was a numbered report. */
@@ -1445,6 +1446,11 @@ static const struct hid_device_id hid_usb_table[] = {
         { }
 };
 
+struct usb_interface *usbhid_find_interface(int minor)
+{
+        return usb_find_interface(&hid_driver, minor);
+}
+
 static struct hid_driver hid_usb_driver = {
         .name = "generic-usb",
         .id_table = hid_usb_table,
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 2643d3147621..70da3181c8a0 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -33,6 +33,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_AASHIMA, USB_DEVICE_ID_AASHIMA_PREDATOR, HID_QUIRK_BADPAD },
         { USB_VENDOR_ID_ALPS, USB_DEVICE_ID_IBM_GAMEPAD, HID_QUIRK_BADPAD },
         { USB_VENDOR_ID_CHIC, USB_DEVICE_ID_CHIC_GAMEPAD, HID_QUIRK_BADPAD },
+        { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER, HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_MOJO, USB_DEVICE_ID_RETRO_ADAPTER, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
@@ -69,6 +70,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_KEYBOARD, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_PF1209, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD, HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT | HID_QUIRK_SKIP_OUTPUT_REPORTS },
         { USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD, HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
 
@@ -77,6 +79,8 @@ static const struct hid_blacklist {
 
         { USB_VENDOR_ID_PI_ENGINEERING, USB_DEVICE_ID_PI_ENGINEERING_VEC_USB_FOOTPEDAL, HID_QUIRK_HIDINPUT_FORCE },
 
+        { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH, HID_QUIRK_MULTI_INPUT },
+
         { 0, 0 }
 };
 
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 0a29c51114aa..681e620eb95b 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -270,7 +270,7 @@ static int hiddev_open(struct inode *inode, struct file *file)
         struct hiddev *hiddev;
         int res;
 
-        intf = usb_find_interface(&hiddev_driver, iminor(inode));
+        intf = usbhid_find_interface(iminor(inode));
         if (!intf)
                 return -ENODEV;
         hid = usb_get_intfdata(intf);
diff --git a/drivers/hid/usbhid/usbhid.h b/drivers/hid/usbhid/usbhid.h
index 693fd3e720df..89d2e847dcc6 100644
--- a/drivers/hid/usbhid/usbhid.h
+++ b/drivers/hid/usbhid/usbhid.h
@@ -42,6 +42,7 @@ void usbhid_submit_report
 (struct hid_device *hid, struct hid_report *report, unsigned char dir);
 int usbhid_get_power(struct hid_device *hid);
 void usbhid_put_power(struct hid_device *hid);
+struct usb_interface *usbhid_find_interface(int minor);
 
 /* iofl flags */
 #define HID_CTRL_RUNNING        1
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 4d4d09bdec0a..97499d00615a 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -409,7 +409,7 @@ config SENSORS_CORETEMP
 
 config SENSORS_PKGTEMP
         tristate "Intel processor package temperature sensor"
-        depends on X86 && PCI && EXPERIMENTAL
+        depends on X86 && EXPERIMENTAL
         help
           If you say yes here you get support for the package level temperature
           sensor inside your CPU. Check documentation/driver for details.
diff --git a/drivers/hwmon/adm1031.c b/drivers/hwmon/adm1031.c
index 15c1a9616af3..0683e6be662c 100644
--- a/drivers/hwmon/adm1031.c
+++ b/drivers/hwmon/adm1031.c
@@ -79,7 +79,7 @@ struct adm1031_data {
         int chip_type;
         char valid;             /* !=0 if following fields are valid */
         unsigned long last_updated;     /* In jiffies */
-        unsigned int update_rate;       /* In milliseconds */
+        unsigned int update_interval;   /* In milliseconds */
         /* The chan_select_table contains the possible configurations for
          * auto fan control.
          */
@@ -743,23 +743,23 @@ static SENSOR_DEVICE_ATTR(temp3_crit_alarm, S_IRUGO, show_alarm, NULL, 12);
 static SENSOR_DEVICE_ATTR(temp3_fault, S_IRUGO, show_alarm, NULL, 13);
 static SENSOR_DEVICE_ATTR(temp1_crit_alarm, S_IRUGO, show_alarm, NULL, 14);
 
-/* Update Rate */
-static const unsigned int update_rates[] = {
+/* Update Interval */
+static const unsigned int update_intervals[] = {
         16000, 8000, 4000, 2000, 1000, 500, 250, 125,
 };
 
-static ssize_t show_update_rate(struct device *dev,
-                                struct device_attribute *attr, char *buf)
+static ssize_t show_update_interval(struct device *dev,
+                                    struct device_attribute *attr, char *buf)
 {
         struct i2c_client *client = to_i2c_client(dev);
         struct adm1031_data *data = i2c_get_clientdata(client);
 
-        return sprintf(buf, "%u\n", data->update_rate);
+        return sprintf(buf, "%u\n", data->update_interval);
 }
 
-static ssize_t set_update_rate(struct device *dev,
-                               struct device_attribute *attr,
-                               const char *buf, size_t count)
+static ssize_t set_update_interval(struct device *dev,
+                                   struct device_attribute *attr,
+                                   const char *buf, size_t count)
 {
         struct i2c_client *client = to_i2c_client(dev);
         struct adm1031_data *data = i2c_get_clientdata(client);
@@ -771,12 +771,15 @@ static ssize_t set_update_rate(struct device *dev,
         if (err)
                 return err;
 
-        /* find the nearest update rate from the table */
-        for (i = 0; i < ARRAY_SIZE(update_rates) - 1; i++) {
-                if (val >= update_rates[i])
+        /*
+         * Find the nearest update interval from the table.
+         * Use it to determine the matching update rate.
+         */
+        for (i = 0; i < ARRAY_SIZE(update_intervals) - 1; i++) {
+                if (val >= update_intervals[i])
                         break;
         }
-        /* if not found, we point to the last entry (lowest update rate) */
+        /* if not found, we point to the last entry (lowest update interval) */
 
         /* set the new update rate while preserving other settings */
         reg = adm1031_read_value(client, ADM1031_REG_FAN_FILTER);
@@ -785,14 +788,14 @@ static ssize_t set_update_rate(struct device *dev,
         adm1031_write_value(client, ADM1031_REG_FAN_FILTER, reg);
 
         mutex_lock(&data->update_lock);
-        data->update_rate = update_rates[i];
+        data->update_interval = update_intervals[i];
         mutex_unlock(&data->update_lock);
 
         return count;
 }
 
-static DEVICE_ATTR(update_rate, S_IRUGO | S_IWUSR, show_update_rate,
-                   set_update_rate);
+static DEVICE_ATTR(update_interval, S_IRUGO | S_IWUSR, show_update_interval,
+                   set_update_interval);
 
 static struct attribute *adm1031_attributes[] = {
         &sensor_dev_attr_fan1_input.dev_attr.attr,
@@ -830,7 +833,7 @@ static struct attribute *adm1031_attributes[] = {
 
         &sensor_dev_attr_auto_fan1_min_pwm.dev_attr.attr,
 
-        &dev_attr_update_rate.attr,
+        &dev_attr_update_interval.attr,
         &dev_attr_alarms.attr,
 
         NULL
@@ -981,7 +984,8 @@ static void adm1031_init_client(struct i2c_client *client)
         mask = ADM1031_UPDATE_RATE_MASK;
         read_val = adm1031_read_value(client, ADM1031_REG_FAN_FILTER);
         i = (read_val & mask) >> ADM1031_UPDATE_RATE_SHIFT;
-        data->update_rate = update_rates[i];
+        /* Save it as update interval */
+        data->update_interval = update_intervals[i];
 }
 
 static struct adm1031_data *adm1031_update_device(struct device *dev)
@@ -993,7 +997,8 @@ static struct adm1031_data *adm1031_update_device(struct device *dev)
 
         mutex_lock(&data->update_lock);
 
-        next_update = data->last_updated + msecs_to_jiffies(data->update_rate);
+        next_update = data->last_updated
+          + msecs_to_jiffies(data->update_interval);
         if (time_after(jiffies, next_update) || !data->valid) {
 
                 dev_dbg(&client->dev, "Starting adm1031 update\n");
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index de8111114f46..a23b17a78ace 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -36,6 +36,7 @@
 #include <linux/pci.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
+#include <asm/smp.h>
 
 #define DRVNAME "coretemp"
 
@@ -423,9 +424,18 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
         int err;
         struct platform_device *pdev;
         struct pdev_entry *pdev_entry;
-#ifdef CONFIG_SMP
         struct cpuinfo_x86 *c = &cpu_data(cpu);
-#endif
+
+        /*
+         * CPUID.06H.EAX[0] indicates whether the CPU has thermal
+         * sensors. We check this bit only, all the early CPUs
+         * without thermal sensors will be filtered out.
+         */
+        if (!cpu_has(c, X86_FEATURE_DTS)) {
+                printk(KERN_INFO DRVNAME ": CPU (model=0x%x)"
+                       " has no thermal sensor.\n", c->x86_model);
+                return 0;
+        }
 
         mutex_lock(&pdev_list_mutex);
 
@@ -482,14 +492,22 @@ exit:
 
 static void coretemp_device_remove(unsigned int cpu)
 {
-        struct pdev_entry *p, *n;
+        struct pdev_entry *p;
+        unsigned int i;
+
         mutex_lock(&pdev_list_mutex);
-        list_for_each_entry_safe(p, n, &pdev_list, list) {
-                if (p->cpu == cpu) {
-                        platform_device_unregister(p->pdev);
-                        list_del(&p->list);
-                        kfree(p);
-                }
+        list_for_each_entry(p, &pdev_list, list) {
+                if (p->cpu != cpu)
+                        continue;
+
+                platform_device_unregister(p->pdev);
+                list_del(&p->list);
+                mutex_unlock(&pdev_list_mutex);
+                kfree(p);
+                for_each_cpu(i, cpu_sibling_mask(cpu))
+                        if (i != cpu && !coretemp_device_add(i))
+                                break;
+                return;
         }
         mutex_unlock(&pdev_list_mutex);
 }
@@ -527,30 +545,21 @@ static int __init coretemp_init(void)
         if (err)
                 goto exit;
 
-        for_each_online_cpu(i) {
-                struct cpuinfo_x86 *c = &cpu_data(i);
-                /*
-                 * CPUID.06H.EAX[0] indicates whether the CPU has thermal
-                 * sensors. We check this bit only, all the early CPUs
-                 * without thermal sensors will be filtered out.
-                 */
-                if (c->cpuid_level >= 6 && (cpuid_eax(0x06) & 0x01))
-                        coretemp_device_add(i);
-                else {
-                        printk(KERN_INFO DRVNAME ": CPU (model=0x%x)"
-                                " has no thermal sensor.\n", c->x86_model);
-                }
-        }
+        for_each_online_cpu(i)
+                coretemp_device_add(i);
+
+#ifndef CONFIG_HOTPLUG_CPU
         if (list_empty(&pdev_list)) {
                 err = -ENODEV;
                 goto exit_driver_unreg;
         }
+#endif
 
         register_hotcpu_notifier(&coretemp_cpu_notifier);
         return 0;
 
-exit_driver_unreg:
 #ifndef CONFIG_HOTPLUG_CPU
+exit_driver_unreg:
         platform_driver_unregister(&coretemp_driver);
 #endif
 exit:
diff --git a/drivers/hwmon/emc1403.c b/drivers/hwmon/emc1403.c
index 5b58b20dead1..8dee3f38fdfb 100644
--- a/drivers/hwmon/emc1403.c
+++ b/drivers/hwmon/emc1403.c
@@ -308,7 +308,6 @@ static int emc1403_probe(struct i2c_client *client,
         res = sysfs_create_group(&client->dev.kobj, &m_thermal_gr);
         if (res) {
                 dev_warn(&client->dev, "create group failed\n");
-                hwmon_device_unregister(data->hwmon_dev);
                 goto thermal_error1;
         }
         data->hwmon_dev = hwmon_device_register(&client->dev);
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index 537841ef44b9..75afb3b0e076 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -111,7 +111,7 @@ static struct platform_device *f71882fg_pdev;
 /* Super-I/O Function prototypes */
 static inline int superio_inb(int base, int reg);
 static inline int superio_inw(int base, int reg);
-static inline void superio_enter(int base);
+static inline int superio_enter(int base);
 static inline void superio_select(int base, int ld);
 static inline void superio_exit(int base);
 
@@ -861,11 +861,20 @@ static int superio_inw(int base, int reg)
         return val;
 }
 
-static inline void superio_enter(int base)
+static inline int superio_enter(int base)
 {
+        /* Don't step on other drivers' I/O space by accident */
+        if (!request_muxed_region(base, 2, DRVNAME)) {
+                printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
+                                base);
+                return -EBUSY;
+        }
+
         /* according to the datasheet the key must be send twice! */
         outb(SIO_UNLOCK_KEY, base);
         outb(SIO_UNLOCK_KEY, base);
+
+        return 0;
 }
 
 static inline void superio_select(int base, int ld)
@@ -877,6 +886,7 @@ static inline void superio_select(int base, int ld)
 static inline void superio_exit(int base)
 {
         outb(SIO_LOCK_KEY, base);
+        release_region(base, 2);
 }
 
 static inline int fan_from_reg(u16 reg)
@@ -2175,21 +2185,15 @@ static int f71882fg_remove(struct platform_device *pdev)
 static int __init f71882fg_find(int sioaddr, unsigned short *address,
         struct f71882fg_sio_data *sio_data)
 {
-        int err = -ENODEV;
         u16 devid;
-
-        /* Don't step on other drivers' I/O space by accident */
-        if (!request_region(sioaddr, 2, DRVNAME)) {
-                printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
-                                (int)sioaddr);
-                return -EBUSY;
-        }
-
-        superio_enter(sioaddr);
+        int err = superio_enter(sioaddr);
+        if (err)
+                return err;
 
         devid = superio_inw(sioaddr, SIO_REG_MANID);
         if (devid != SIO_FINTEK_ID) {
                 pr_debug(DRVNAME ": Not a Fintek device\n");
+                err = -ENODEV;
                 goto exit;
         }
 
@@ -2213,6 +2217,7 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
         default:
                 printk(KERN_INFO DRVNAME ": Unsupported Fintek device: %04x\n",
                        (unsigned int)devid);
+                err = -ENODEV;
                 goto exit;
         }
 
@@ -2223,12 +2228,14 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
 
         if (!(superio_inb(sioaddr, SIO_REG_ENABLE) & 0x01)) {
                 printk(KERN_WARNING DRVNAME ": Device not activated\n");
+                err = -ENODEV;
                 goto exit;
         }
 
         *address = superio_inw(sioaddr, SIO_REG_ADDR);
         if (*address == 0) {
                 printk(KERN_WARNING DRVNAME ": Base address not set\n");
+                err = -ENODEV;
                 goto exit;
         }
         *address &= ~(REGION_LENGTH - 1);       /* Ignore 3 LSB */
@@ -2239,7 +2246,6 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
                 (int)superio_inb(sioaddr, SIO_REG_DEVREV));
 exit:
         superio_exit(sioaddr);
-        release_region(sioaddr, 2);
         return err;
 }
 
diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
index 0f58ecc5334d..9638d58f99fd 100644
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -79,7 +79,7 @@ enum chips { f75373, f75375 };
 #define F75375_REG_PWM2_DROP_DUTY       0x6C
 
 #define FAN_CTRL_LINEAR(nr)             (4 + nr)
-#define FAN_CTRL_MODE(nr)               (5 + ((nr) * 2))
+#define FAN_CTRL_MODE(nr)               (4 + ((nr) * 2))
 
 /*
  * Data structures and manipulation thereof
@@ -298,7 +298,7 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                 return -EINVAL;
 
         fanmode = f75375_read8(client, F75375_REG_FAN_TIMER);
-        fanmode = ~(3 << FAN_CTRL_MODE(nr));
+        fanmode &= ~(3 << FAN_CTRL_MODE(nr));
 
         switch (val) {
         case 0: /* Full speed */
@@ -350,7 +350,7 @@ static ssize_t set_pwm_mode(struct device *dev, struct device_attribute *attr,
 
         mutex_lock(&data->update_lock);
         conf = f75375_read8(client, F75375_REG_CONFIG1);
-        conf = ~(1 << FAN_CTRL_LINEAR(nr));
+        conf &= ~(1 << FAN_CTRL_LINEAR(nr));
 
         if (val == 0)
                 conf |= (1 << FAN_CTRL_LINEAR(nr)) ;
diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
index 7580f55e67e3..36e957532230 100644
--- a/drivers/hwmon/hp_accel.c
+++ b/drivers/hwmon/hp_accel.c
@@ -221,6 +221,8 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
         AXIS_DMI_MATCH("HPB442x", "HP ProBook 442", xy_rotated_left),
         AXIS_DMI_MATCH("HPB452x", "HP ProBook 452", y_inverted),
         AXIS_DMI_MATCH("HPB522x", "HP ProBook 522", xy_swap),
+        AXIS_DMI_MATCH("HPB532x", "HP ProBook 532", y_inverted),
+        AXIS_DMI_MATCH("Mini5102", "HP Mini 5102", xy_rotated_left_usd),
         { NULL, }
 /* Laptop models without axis info (yet):
  * "NC6910" "HP Compaq 6910"
diff --git a/drivers/hwmon/lis3lv02d.c b/drivers/hwmon/lis3lv02d.c
index 6138f036b159..fc591ae53107 100644
--- a/drivers/hwmon/lis3lv02d.c
+++ b/drivers/hwmon/lis3lv02d.c
@@ -277,7 +277,7 @@ static irqreturn_t lis302dl_interrupt(int irq, void *dummy)
         wake_up_interruptible(&lis3_dev.misc_wait);
         kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
 out:
-        if (lis3_dev.whoami == WAI_8B && lis3_dev.idev &&
+        if (lis3_dev.pdata && lis3_dev.whoami == WAI_8B && lis3_dev.idev &&
             lis3_dev.idev->input->users)
                 return IRQ_WAKE_THREAD;
         return IRQ_HANDLED;
@@ -718,7 +718,7 @@ int lis3lv02d_init_device(struct lis3lv02d *dev)
          * io-apic is not configurable (and generates a warning) but I keep it
          * in case of support for other hardware.
          */
-        if (dev->whoami == WAI_8B)
+        if (dev->pdata && dev->whoami == WAI_8B)
                 thread_fn = lis302dl_interrupt_thread1_8b;
         else
                 thread_fn = NULL;
diff --git a/drivers/hwmon/lis3lv02d_i2c.c b/drivers/hwmon/lis3lv02d_i2c.c
index dc1f5402c1d7..8e5933b72d19 100644
--- a/drivers/hwmon/lis3lv02d_i2c.c
+++ b/drivers/hwmon/lis3lv02d_i2c.c
@@ -121,7 +121,7 @@ static int lis3lv02d_i2c_suspend(struct i2c_client *client, pm_message_t mesg)
 {
         struct lis3lv02d *lis3 = i2c_get_clientdata(client);
 
-        if (!lis3->pdata->wakeup_flags)
+        if (!lis3->pdata || !lis3->pdata->wakeup_flags)
                 lis3lv02d_poweroff(lis3);
         return 0;
 }
@@ -130,7 +130,7 @@ static int lis3lv02d_i2c_resume(struct i2c_client *client)
 {
         struct lis3lv02d *lis3 = i2c_get_clientdata(client);
 
-        if (!lis3->pdata->wakeup_flags)
+        if (!lis3->pdata || !lis3->pdata->wakeup_flags)
                 lis3lv02d_poweron(lis3);
         return 0;
 }
diff --git a/drivers/hwmon/lis3lv02d_spi.c b/drivers/hwmon/lis3lv02d_spi.c
index 82b16808a274..b9be5e3a22b3 100644
--- a/drivers/hwmon/lis3lv02d_spi.c
+++ b/drivers/hwmon/lis3lv02d_spi.c
@@ -92,7 +92,7 @@ static int lis3lv02d_spi_suspend(struct spi_device *spi, pm_message_t mesg)
 {
         struct lis3lv02d *lis3 = spi_get_drvdata(spi);
 
-        if (!lis3->pdata->wakeup_flags)
+        if (!lis3->pdata || !lis3->pdata->wakeup_flags)
                 lis3lv02d_poweroff(&lis3_dev);
 
         return 0;
@@ -102,7 +102,7 @@ static int lis3lv02d_spi_resume(struct spi_device *spi)
 {
         struct lis3lv02d *lis3 = spi_get_drvdata(spi);
 
-        if (!lis3->pdata->wakeup_flags)
+        if (!lis3->pdata || !lis3->pdata->wakeup_flags)
                 lis3lv02d_poweron(lis3);
 
         return 0;
diff --git a/drivers/hwmon/lm95241.c b/drivers/hwmon/lm95241.c
index 94741d42112d..464340f25496 100644
--- a/drivers/hwmon/lm95241.c
+++ b/drivers/hwmon/lm95241.c
@@ -91,7 +91,7 @@ static struct lm95241_data *lm95241_update_device(struct device *dev);
 struct lm95241_data {
         struct device *hwmon_dev;
         struct mutex update_lock;
-        unsigned long last_updated, rate; /* in jiffies */
+        unsigned long last_updated, interval; /* in jiffies */
         char valid; /* zero until following fields are valid */
         /* registers values */
         u8 local_h, local_l; /* local */
@@ -114,23 +114,23 @@ show_temp(local);
 show_temp(remote1);
 show_temp(remote2);
 
-static ssize_t show_rate(struct device *dev, struct device_attribute *attr,
+static ssize_t show_interval(struct device *dev, struct device_attribute *attr,
                          char *buf)
 {
         struct lm95241_data *data = lm95241_update_device(dev);
 
-        snprintf(buf, PAGE_SIZE - 1, "%lu\n", 1000 * data->rate / HZ);
+        snprintf(buf, PAGE_SIZE - 1, "%lu\n", 1000 * data->interval / HZ);
         return strlen(buf);
 }
 
-static ssize_t set_rate(struct device *dev, struct device_attribute *attr,
+static ssize_t set_interval(struct device *dev, struct device_attribute *attr,
                         const char *buf, size_t count)
 {
         struct i2c_client *client = to_i2c_client(dev);
         struct lm95241_data *data = i2c_get_clientdata(client);
 
-        strict_strtol(buf, 10, &data->rate);
-        data->rate = data->rate * HZ / 1000;
+        strict_strtol(buf, 10, &data->interval);
+        data->interval = data->interval * HZ / 1000;
 
         return count;
 }
@@ -286,7 +286,8 @@ static DEVICE_ATTR(temp2_min, S_IWUSR | S_IRUGO, show_min1, set_min1);
 static DEVICE_ATTR(temp3_min, S_IWUSR | S_IRUGO, show_min2, set_min2);
 static DEVICE_ATTR(temp2_max, S_IWUSR | S_IRUGO, show_max1, set_max1);
 static DEVICE_ATTR(temp3_max, S_IWUSR | S_IRUGO, show_max2, set_max2);
-static DEVICE_ATTR(rate, S_IWUSR | S_IRUGO, show_rate, set_rate);
+static DEVICE_ATTR(update_interval, S_IWUSR | S_IRUGO, show_interval,
+                   set_interval);
 
 static struct attribute *lm95241_attributes[] = {
         &dev_attr_temp1_input.attr,
@@ -298,7 +299,7 @@ static struct attribute *lm95241_attributes[] = {
         &dev_attr_temp3_min.attr,
         &dev_attr_temp2_max.attr,
         &dev_attr_temp3_max.attr,
-        &dev_attr_rate.attr,
+        &dev_attr_update_interval.attr,
         NULL
 };
 
@@ -376,7 +377,7 @@ static void lm95241_init_client(struct i2c_client *client)
 {
         struct lm95241_data *data = i2c_get_clientdata(client);
 
-        data->rate = HZ;    /* 1 sec default */
+        data->interval = HZ;    /* 1 sec default */
         data->valid = 0;
         data->config = CFG_CR0076;
         data->model = 0;
@@ -410,7 +411,7 @@ static struct lm95241_data *lm95241_update_device(struct device *dev)
 
         mutex_lock(&data->update_lock);
 
-        if (time_after(jiffies, data->last_updated + data->rate) ||
+        if (time_after(jiffies, data->last_updated + data->interval) ||
             !data->valid) {
                 dev_dbg(&client->dev, "Updating lm95241 data.\n");
                 data->local_h =
diff --git a/drivers/hwmon/pkgtemp.c b/drivers/hwmon/pkgtemp.c
index 74157fcda6ed..f11903936c8b 100644
--- a/drivers/hwmon/pkgtemp.c
+++ b/drivers/hwmon/pkgtemp.c
@@ -33,7 +33,6 @@
 #include <linux/list.h>
 #include <linux/platform_device.h>
 #include <linux/cpu.h>
-#include <linux/pci.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
 
@@ -224,7 +223,7 @@ static int __devinit pkgtemp_probe(struct platform_device *pdev)
 
         err = sysfs_create_group(&pdev->dev.kobj, &pkgtemp_group);
         if (err)
-                goto exit_free;
+                goto exit_dev;
 
         data->hwmon_dev = hwmon_device_register(&pdev->dev);
         if (IS_ERR(data->hwmon_dev)) {
@@ -238,6 +237,8 @@ static int __devinit pkgtemp_probe(struct platform_device *pdev)
 
 exit_class:
         sysfs_remove_group(&pdev->dev.kobj, &pkgtemp_group);
+exit_dev:
+        device_remove_file(&pdev->dev, &sensor_dev_attr_temp1_max.dev_attr);
 exit_free:
         kfree(data);
 exit:
@@ -250,6 +251,7 @@ static int __devexit pkgtemp_remove(struct platform_device *pdev)
 
         hwmon_device_unregister(data->hwmon_dev);
         sysfs_remove_group(&pdev->dev.kobj, &pkgtemp_group);
+        device_remove_file(&pdev->dev, &sensor_dev_attr_temp1_max.dev_attr);
         platform_set_drvdata(pdev, NULL);
         kfree(data);
         return 0;
@@ -281,9 +283,10 @@ static int __cpuinit pkgtemp_device_add(unsigned int cpu)
         int err;
         struct platform_device *pdev;
         struct pdev_entry *pdev_entry;
-#ifdef CONFIG_SMP
         struct cpuinfo_x86 *c = &cpu_data(cpu);
-#endif
+
+        if (!cpu_has(c, X86_FEATURE_PTS))
+                return 0;
 
         mutex_lock(&pdev_list_mutex);
 
@@ -339,17 +342,18 @@ exit:
 #ifdef CONFIG_HOTPLUG_CPU
 static void pkgtemp_device_remove(unsigned int cpu)
 {
-        struct pdev_entry *p, *n;
+        struct pdev_entry *p;
         unsigned int i;
         int err;
 
         mutex_lock(&pdev_list_mutex);
-        list_for_each_entry_safe(p, n, &pdev_list, list) {
+        list_for_each_entry(p, &pdev_list, list) {
                 if (p->cpu != cpu)
                         continue;
 
                 platform_device_unregister(p->pdev);
                 list_del(&p->list);
+                mutex_unlock(&pdev_list_mutex);
                 kfree(p);
                 for_each_cpu(i, cpu_core_mask(cpu)) {
                         if (i != cpu) {
@@ -358,7 +362,7 @@ static void pkgtemp_device_remove(unsigned int cpu)
                                         break;
                         }
                 }
-                break;
+                return;
         }
         mutex_unlock(&pdev_list_mutex);
 }
@@ -399,11 +403,6 @@ static int __init pkgtemp_init(void)
                 goto exit;
 
         for_each_online_cpu(i) {
-                struct cpuinfo_x86 *c = &cpu_data(i);
-
-                if (!cpu_has(c, X86_FEATURE_PTS))
-                        continue;
-
                 err = pkgtemp_device_add(i);
                 if (err)
                         goto exit_devices_unreg;
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index e96e69dd36fb..072c58008a63 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -127,6 +127,7 @@ superio_enter(int ioreg)
 static inline void
 superio_exit(int ioreg)
 {
+        outb(0xaa, ioreg);
         outb(0x02, ioreg);
         outb(0x02, ioreg + 1);
 }
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index 2222c87876b9..b8feac5f2ef4 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -357,9 +357,6 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
 
         dev->terminate = 0;
 
-        /* write the data into mode register */
-        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
-
         /*
          * First byte should be set here, not after interrupt,
          * because transmit-data-ready interrupt can come before
@@ -371,6 +368,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
                 dev->buf_len--;
         }
 
+        /* write the data into mode register; start transmitting */
+        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
+
         r = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
                                                       dev->adapter.timeout);
         if (r == 0) {
diff --git a/drivers/i2c/busses/i2c-octeon.c b/drivers/i2c/busses/i2c-octeon.c
index 0e9f85d0a835..56dbe54e8811 100644
--- a/drivers/i2c/busses/i2c-octeon.c
+++ b/drivers/i2c/busses/i2c-octeon.c
@@ -218,7 +218,7 @@ static int octeon_i2c_wait(struct octeon_i2c *i2c)
                 return result;
         } else if (result == 0) {
                 dev_dbg(i2c->dev, "%s: timeout\n", __func__);
-                result = -ETIMEDOUT;
+                return -ETIMEDOUT;
         }
 
         return 0;
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 7674efb55378..b33c78586bfc 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -680,6 +680,8 @@ omap_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
 
         if (r == 0)
                 r = num;
+
+        omap_i2c_wait_for_bb(dev);
 out:
         omap_i2c_idle(dev);
         return r;
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 72902e0bbfa7..bf831bf81587 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -662,8 +662,8 @@ static int s3c24xx_i2c_clockrate(struct s3c24xx_i2c *i2c, unsigned int *got)
                 unsigned long sda_delay;
 
                 if (pdata->sda_delay) {
-                        sda_delay = (freq / 1000) * pdata->sda_delay;
-                        sda_delay /= 1000000;
+                        sda_delay = clkin * pdata->sda_delay;
+                        sda_delay = DIV_ROUND_UP(sda_delay, 1000000);
                         sda_delay = DIV_ROUND_UP(sda_delay, 5);
                         if (sda_delay > 3)
                                 sda_delay = 3;
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 4c3d1bfec0c5..068cef0a987a 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1448,19 +1448,13 @@ int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                 if (hwif == NULL)
                         continue;
 
-                if (hwif->present)
-                        hwif_register_devices(hwif);
-        }
-
-        ide_host_for_each_port(i, hwif, host) {
-                if (hwif == NULL)
-                        continue;
-
                 ide_sysfs_register_port(hwif);
                 ide_proc_register_port(hwif);
 
-                if (hwif->present)
+                if (hwif->present) {
                         ide_proc_port_register_devices(hwif);
+                        hwif_register_devices(hwif);
+                }
         }
 
         return j ? 0 : -1;
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index a10152bb1427..0906fc5b69b9 100755..100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -83,7 +83,7 @@ static unsigned int mwait_substates;
 /* Reliable LAPIC Timer States, bit 1 for C1 etc.  */
 static unsigned int lapic_timer_reliable_states;
 
-static struct cpuidle_device *intel_idle_cpuidle_devices;
+static struct cpuidle_device __percpu *intel_idle_cpuidle_devices;
 static int intel_idle(struct cpuidle_device *dev, struct cpuidle_state *state);
 
 static struct cpuidle_state *cpuidle_state_table;
@@ -108,7 +108,7 @@ static struct cpuidle_state nehalem_cstates[MWAIT_MAX_NUM_CSTATES] = {
                 .name = "NHM-C3",
                 .desc = "MWAIT 0x10",
                 .driver_data = (void *) 0x10,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                 .exit_latency = 20,
                 .power_usage = 500,
                 .target_residency = 80,
@@ -117,7 +117,7 @@ static struct cpuidle_state nehalem_cstates[MWAIT_MAX_NUM_CSTATES] = {
                 .name = "NHM-C6",
                 .desc = "MWAIT 0x20",
                 .driver_data = (void *) 0x20,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                 .exit_latency = 200,
                 .power_usage = 350,
                 .target_residency = 800,
@@ -149,7 +149,7 @@ static struct cpuidle_state atom_cstates[MWAIT_MAX_NUM_CSTATES] = {
                 .name = "ATM-C4",
                 .desc = "MWAIT 0x30",
                 .driver_data = (void *) 0x30,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                 .exit_latency = 100,
                 .power_usage = 250,
                 .target_residency = 400,
@@ -159,7 +159,7 @@ static struct cpuidle_state atom_cstates[MWAIT_MAX_NUM_CSTATES] = {
                 .name = "ATM-C6",
                 .desc = "MWAIT 0x40",
                 .driver_data = (void *) 0x40,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                 .exit_latency = 200,
                 .power_usage = 150,
                 .target_residency = 800,
@@ -185,6 +185,16 @@ static int intel_idle(struct cpuidle_device *dev, struct cpuidle_state *state)
 
         local_irq_disable();
 
+        /*
+         * If the state flag indicates that the TLB will be flushed or if this
+         * is the deepest c-state supported, do a voluntary leave mm to avoid
+         * costly and mostly unnecessary wakeups for flushing the user TLB's
+         * associated with the active mm.
+         */
+        if (state->flags & CPUIDLE_FLAG_TLB_FLUSHED ||
+            (&dev->states[dev->state_count - 1] == state))
+                leave_mm(cpu);
+
         if (!(lapic_timer_reliable_states & (1 << (cstate))))
                 clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu);
 
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.h b/drivers/infiniband/hw/cxgb3/cxio_hal.h
index 8f0caf7d4482..78fbe9ffe7f0 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.h
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.h
@@ -53,7 +53,7 @@
 #define T3_MAX_PBL_SIZE 256
 #define T3_MAX_RQ_SIZE 1024
 #define T3_MAX_QP_DEPTH (T3_MAX_RQ_SIZE-1)
-#define T3_MAX_CQ_DEPTH 262144
+#define T3_MAX_CQ_DEPTH 65536
 #define T3_MAX_NUM_STAG (1<<15)
 #define T3_MAX_MR_SIZE 0x100000000ULL
 #define T3_PAGESIZE_MASK 0xffff000  /* 4KB-128MB */
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index d88077a21994..13c88871dc3b 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -463,7 +463,8 @@ static int send_connect(struct iwch_ep *ep)
             V_MSS_IDX(mtu_idx) |
             V_L2T_IDX(ep->l2t->idx) | V_TX_CHANNEL(ep->l2t->smt_idx);
         opt0l = V_TOS((ep->tos >> 2) & M_TOS) | V_RCV_BUFSIZ(rcv_win>>10);
-        opt2 = V_FLAVORS_VALID(1) | V_CONG_CONTROL_FLAVOR(cong_flavor);
+        opt2 = F_RX_COALESCE_VALID | V_RX_COALESCE(0) | V_FLAVORS_VALID(1) |
+               V_CONG_CONTROL_FLAVOR(cong_flavor);
         skb->priority = CPL_PRIORITY_SETUP;
         set_arp_failure_handler(skb, act_open_req_arp_failure);
 
@@ -1280,7 +1281,8 @@ static void accept_cr(struct iwch_ep *ep, __be32 peer_ip, struct sk_buff *skb)
             V_MSS_IDX(mtu_idx) |
             V_L2T_IDX(ep->l2t->idx) | V_TX_CHANNEL(ep->l2t->smt_idx);
         opt0l = V_TOS((ep->tos >> 2) & M_TOS) | V_RCV_BUFSIZ(rcv_win>>10);
-        opt2 = V_FLAVORS_VALID(1) | V_CONG_CONTROL_FLAVOR(cong_flavor);
+        opt2 = F_RX_COALESCE_VALID | V_RX_COALESCE(0) | V_FLAVORS_VALID(1) |
+               V_CONG_CONTROL_FLAVOR(cong_flavor);
 
         rpl = cplhdr(skb);
         rpl->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
diff --git a/drivers/infiniband/hw/mlx4/Kconfig b/drivers/infiniband/hw/mlx4/Kconfig
index 4175a4bd0c78..bd995b2b50d8 100644
--- a/drivers/infiniband/hw/mlx4/Kconfig
+++ b/drivers/infiniband/hw/mlx4/Kconfig
@@ -1,5 +1,6 @@
 config MLX4_INFINIBAND
         tristate "Mellanox ConnectX HCA support"
+        depends on NETDEVICES && NETDEV_10000 && PCI
         select MLX4_CORE
         ---help---
           This driver provides low-level InfiniBand support for
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index 443cea55daac..6220d9d75b58 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -502,7 +502,9 @@ int schedule_nes_timer(struct nes_cm_node *cm_node, struct sk_buff *skb,
 static void nes_retrans_expired(struct nes_cm_node *cm_node)
 {
         struct iw_cm_id *cm_id = cm_node->cm_id;
-        switch (cm_node->state) {
+        enum nes_cm_node_state state = cm_node->state;
+        cm_node->state = NES_CM_STATE_CLOSED;
+        switch (state) {
         case NES_CM_STATE_SYN_RCVD:
         case NES_CM_STATE_CLOSING:
                 rem_ref_cm_node(cm_node->cm_core, cm_node);
@@ -511,7 +513,6 @@ static void nes_retrans_expired(struct nes_cm_node *cm_node)
         case NES_CM_STATE_FIN_WAIT1:
                 if (cm_node->cm_id)
                         cm_id->rem_ref(cm_id);
-                cm_node->state = NES_CM_STATE_CLOSED;
                 send_reset(cm_node, NULL);
                 break;
         default:
@@ -1439,9 +1440,6 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
                 break;
         case NES_CM_STATE_MPAREQ_RCVD:
                 passive_state = atomic_add_return(1, &cm_node->passive_state);
-                if (passive_state ==  NES_SEND_RESET_EVENT)
-                        create_event(cm_node, NES_CM_EVENT_RESET);
-                cm_node->state = NES_CM_STATE_CLOSED;
                 dev_kfree_skb_any(skb);
                 break;
         case NES_CM_STATE_ESTABLISHED:
@@ -1456,6 +1454,7 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
         case NES_CM_STATE_CLOSED:
                 drop_packet(skb);
                 break;
+        case NES_CM_STATE_FIN_WAIT2:
         case NES_CM_STATE_FIN_WAIT1:
         case NES_CM_STATE_LAST_ACK:
                 cm_node->cm_id->rem_ref(cm_node->cm_id);
@@ -2702,7 +2701,7 @@ static int nes_disconnect(struct nes_qp *nesqp, int abrupt)
         nesibdev = nesvnic->nesibdev;
 
         nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
-                        atomic_read(&nesvnic->netdev->refcnt));
+                        netdev_refcnt_read(nesvnic->netdev));
 
         if (nesqp->active_conn) {
 
@@ -2777,6 +2776,12 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                 return -EINVAL;
         }
 
+        passive_state = atomic_add_return(1, &cm_node->passive_state);
+        if (passive_state == NES_SEND_RESET_EVENT) {
+                rem_ref_cm_node(cm_node->cm_core, cm_node);
+                return -ECONNRESET;
+        }
+
         /* associate the node with the QP */
         nesqp->cm_node = (void *)cm_node;
         cm_node->nesqp = nesqp;
@@ -2786,7 +2791,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         atomic_inc(&cm_accepts);
 
         nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
-                        atomic_read(&nesvnic->netdev->refcnt));
+                        netdev_refcnt_read(nesvnic->netdev));
 
         /* allocate the ietf frame and space for private data */
         nesqp->ietf_frame = pci_alloc_consistent(nesdev->pcidev,
@@ -2979,9 +2984,6 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                 printk(KERN_ERR "%s[%u] OFA CM event_handler returned, "
                         "ret=%d\n", __func__, __LINE__, ret);
 
-        passive_state = atomic_add_return(1, &cm_node->passive_state);
-        if (passive_state == NES_SEND_RESET_EVENT)
-                create_event(cm_node, NES_CM_EVENT_RESET);
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index f8233c851c69..1980a461c499 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -3468,6 +3468,19 @@ static void nes_process_iwarp_aeqe(struct nes_device *nesdev,
                                 return; /* Ignore it, wait for close complete */
 
                         if (atomic_inc_return(&nesqp->close_timer_started) == 1) {
+                                if ((tcp_state == NES_AEQE_TCP_STATE_CLOSE_WAIT) &&
+                                        (nesqp->ibqp_state == IB_QPS_RTS) &&
+                                        ((nesadapter->eeprom_version >> 16) != NES_A0)) {
+                                        spin_lock_irqsave(&nesqp->lock, flags);
+                                        nesqp->hw_iwarp_state = iwarp_state;
+                                        nesqp->hw_tcp_state = tcp_state;
+                                        nesqp->last_aeq = async_event_id;
+                                        next_iwarp_state = NES_CQP_QP_IWARP_STATE_CLOSING;
+                                        nesqp->hw_iwarp_state = NES_AEQE_IWARP_STATE_CLOSING;
+                                        spin_unlock_irqrestore(&nesqp->lock, flags);
+                                        nes_hw_modify_qp(nesdev, nesqp, next_iwarp_state, 0, 0);
+                                        nes_cm_disconn(nesqp);
+                                }
                                 nesqp->cm_id->add_ref(nesqp->cm_id);
                                 schedule_nes_timer(nesqp->cm_node, (struct sk_buff *)nesqp,
                                                 NES_TIMER_TYPE_CLOSE, 1, 0);
@@ -3477,7 +3490,6 @@ static void nes_process_iwarp_aeqe(struct nes_device *nesdev,
                                                 nesqp->hwqp.qp_id, atomic_read(&nesqp->refcount),
                                                 async_event_id, nesqp->last_aeq, tcp_state);
                         }
-
                         break;
                 case NES_AEQE_AEID_LLP_CLOSE_COMPLETE:
                         if (nesqp->term_flags) {
diff --git a/drivers/infiniband/hw/nes/nes_hw.h b/drivers/infiniband/hw/nes/nes_hw.h
index aa9183db32b1..1204c3432b63 100644
--- a/drivers/infiniband/hw/nes/nes_hw.h
+++ b/drivers/infiniband/hw/nes/nes_hw.h
@@ -45,6 +45,7 @@
 #define NES_PHY_TYPE_KR        9
 
 #define NES_MULTICAST_PF_MAX 8
+#define NES_A0 3
 
 enum pci_regs {
         NES_INT_STAT = 0x0000,
diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
index 6dfdd49cdbcf..10560c796fd6 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -1446,14 +1446,14 @@ static int nes_netdev_set_pauseparam(struct net_device *netdev,
                                 NES_IDX_MAC_TX_CONFIG + (nesdev->mac_index*0x200));
                 u32temp |= NES_IDX_MAC_TX_CONFIG_ENABLE_PAUSE;
                 nes_write_indexed(nesdev,
-                                NES_IDX_MAC_TX_CONFIG_ENABLE_PAUSE + (nesdev->mac_index*0x200), u32temp);
+                                NES_IDX_MAC_TX_CONFIG + (nesdev->mac_index*0x200), u32temp);
                 nesdev->disable_tx_flow_control = 0;
         } else if ((et_pauseparam->tx_pause == 0) && (nesdev->disable_tx_flow_control == 0)) {
                 u32temp = nes_read_indexed(nesdev,
                                 NES_IDX_MAC_TX_CONFIG + (nesdev->mac_index*0x200));
                 u32temp &= ~NES_IDX_MAC_TX_CONFIG_ENABLE_PAUSE;
                 nes_write_indexed(nesdev,
-                                NES_IDX_MAC_TX_CONFIG_ENABLE_PAUSE + (nesdev->mac_index*0x200), u32temp);
+                                NES_IDX_MAC_TX_CONFIG + (nesdev->mac_index*0x200), u32temp);
                 nesdev->disable_tx_flow_control = 1;
         }
         if ((et_pauseparam->rx_pause == 1) && (nesdev->disable_rx_flow_control == 1)) {
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 9046e6675686..546fc22405fe 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -785,7 +785,7 @@ static struct ib_pd *nes_alloc_pd(struct ib_device *ibdev,
 
         nes_debug(NES_DBG_PD, "nesvnic=%p, netdev=%p %s, ibdev=%p, context=%p, netdev refcnt=%u\n",
                         nesvnic, nesdev->netdev[0], nesdev->netdev[0]->name, ibdev, context,
-                        atomic_read(&nesvnic->netdev->refcnt));
+                        netdev_refcnt_read(nesvnic->netdev));
 
         err = nes_alloc_resource(nesadapter, nesadapter->allocated_pds,
                         nesadapter->max_pd, &pd_num, &nesadapter->next_pd);
@@ -1416,7 +1416,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
         /* update the QP table */
         nesdev->nesadapter->qp_table[nesqp->hwqp.qp_id-NES_FIRST_QPN] = nesqp;
         nes_debug(NES_DBG_QP, "netdev refcnt=%u\n",
-                        atomic_read(&nesvnic->netdev->refcnt));
+                        netdev_refcnt_read(nesvnic->netdev));
 
         return &nesqp->ibqp;
 }
diff --git a/drivers/input/input.c b/drivers/input/input.c
index a9b025f4147a..ab6982056518 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1599,11 +1599,14 @@ EXPORT_SYMBOL(input_free_device);
  * @dev: input device supporting MT events and finger tracking
  * @num_slots: number of slots used by the device
  *
- * This function allocates all necessary memory for MT slot handling
- * in the input device, and adds ABS_MT_SLOT to the device capabilities.
+ * This function allocates all necessary memory for MT slot handling in the
+ * input device, and adds ABS_MT_SLOT to the device capabilities. All slots
+ * are initially marked as unused iby setting ABS_MT_TRACKING_ID to -1.
  */
 int input_mt_create_slots(struct input_dev *dev, unsigned int num_slots)
 {
+        int i;
+
         if (!num_slots)
                 return 0;
 
@@ -1614,6 +1617,10 @@ int input_mt_create_slots(struct input_dev *dev, unsigned int num_slots)
         dev->mtsize = num_slots;
         input_set_abs_params(dev, ABS_MT_SLOT, 0, num_slots - 1, 0, 0);
 
+        /* Mark slots as 'unused' */
+        for (i = 0; i < num_slots; i++)
+                dev->mt[i].abs[ABS_MT_TRACKING_ID - ABS_MT_FIRST] = -1;
+
         return 0;
 }
 EXPORT_SYMBOL(input_mt_create_slots);
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index ea67c49146a3..b95231763911 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -337,10 +337,14 @@ static void report_finger_data(struct input_dev *input,
                                const struct bcm5974_config *cfg,
                                const struct tp_finger *f)
 {
-        input_report_abs(input, ABS_MT_TOUCH_MAJOR, raw2int(f->force_major));
-        input_report_abs(input, ABS_MT_TOUCH_MINOR, raw2int(f->force_minor));
-        input_report_abs(input, ABS_MT_WIDTH_MAJOR, raw2int(f->size_major));
-        input_report_abs(input, ABS_MT_WIDTH_MINOR, raw2int(f->size_minor));
+        input_report_abs(input, ABS_MT_TOUCH_MAJOR,
+                         raw2int(f->force_major) << 1);
+        input_report_abs(input, ABS_MT_TOUCH_MINOR,
+                         raw2int(f->force_minor) << 1);
+        input_report_abs(input, ABS_MT_WIDTH_MAJOR,
+                         raw2int(f->size_major) << 1);
+        input_report_abs(input, ABS_MT_WIDTH_MINOR,
+                         raw2int(f->size_minor) << 1);
         input_report_abs(input, ABS_MT_ORIENTATION,
                          MAX_FINGER_ORIENTATION - raw2int(f->orientation));
         input_report_abs(input, ABS_MT_POSITION_X, raw2int(f->abs_x));
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 46e4ba0b9246..f58513160480 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -1485,8 +1485,8 @@ static int __init i8042_init(void)
 
 static void __exit i8042_exit(void)
 {
-        platform_driver_unregister(&i8042_driver);
         platform_device_unregister(i8042_platform_device);
+        platform_driver_unregister(&i8042_driver);
         i8042_platform_exit();
 
         panic_blink = NULL;
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 40d77ba8fdc1..6e29badb969e 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -243,10 +243,10 @@ static int wacom_graphire_irq(struct wacom_wac *wacom)
                         if (features->type == WACOM_G4 ||
                                         features->type == WACOM_MO) {
                                 input_report_abs(input, ABS_DISTANCE, data[6] & 0x3f);
-                                rw = (signed)(data[7] & 0x04) - (data[7] & 0x03);
+                                rw = (data[7] & 0x04) - (data[7] & 0x03);
                         } else {
                                 input_report_abs(input, ABS_DISTANCE, data[7] & 0x3f);
-                                rw = -(signed)data[6];
+                                rw = -(signed char)data[6];
                         }
                         input_report_rel(input, REL_WHEEL, rw);
                 }
diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index b054494df846..3acf94cc5acd 100644
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -98,6 +98,16 @@ static inline struct capi_ctr *get_capi_ctr_by_nr(u16 contr)
         return capi_controller[contr - 1];
 }
 
+static inline struct capi20_appl *__get_capi_appl_by_nr(u16 applid)
+{
+        lockdep_assert_held(&capi_controller_lock);
+
+        if (applid - 1 >= CAPI_MAXAPPL)
+                return NULL;
+
+        return capi_applications[applid - 1];
+}
+
 static inline struct capi20_appl *get_capi_appl_by_nr(u16 applid)
 {
         if (applid - 1 >= CAPI_MAXAPPL)
@@ -185,10 +195,9 @@ static void notify_up(u32 contr)
                 ctr->state = CAPI_CTR_RUNNING;
 
                 for (applid = 1; applid <= CAPI_MAXAPPL; applid++) {
-                        ap = get_capi_appl_by_nr(applid);
-                        if (!ap)
-                                continue;
-                        register_appl(ctr, applid, &ap->rparam);
+                        ap = __get_capi_appl_by_nr(applid);
+                        if (ap)
+                                register_appl(ctr, applid, &ap->rparam);
                 }
 
                 wake_up_interruptible_all(&ctr->state_wait_queue);
@@ -215,7 +224,7 @@ static void ctr_down(struct capi_ctr *ctr, int new_state)
         memset(ctr->serial, 0, sizeof(ctr->serial));
 
         for (applid = 1; applid <= CAPI_MAXAPPL; applid++) {
-                ap = get_capi_appl_by_nr(applid);
+                ap = __get_capi_appl_by_nr(applid);
                 if (ap)
                         capi_ctr_put(ctr);
         }
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 707d9c94cf9e..178942a2ee61 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -109,6 +109,9 @@ struct bas_cardstate {
 
         struct urb              *urb_int_in;    /* URB for interrupt pipe */
         unsigned char           *int_in_buf;
+        struct work_struct      int_in_wq;      /* for usb_clear_halt() */
+        struct timer_list       timer_int_in;   /* int read retry delay */
+        int                     retry_int_in;
 
         spinlock_t              lock;           /* locks all following */
         int                     basstate;       /* bitmap (BS_*) */
@@ -169,7 +172,7 @@ static char *get_usb_rcmsg(int rc)
         case -EAGAIN:
                 return "start frame too early or too much scheduled";
         case -EFBIG:
-                return "too many isochronous frames requested";
+                return "too many isoc frames requested";
         case -EPIPE:
                 return "endpoint stalled";
         case -EMSGSIZE:
@@ -200,13 +203,13 @@ static char *get_usb_statmsg(int status)
         case -ENOENT:
                 return "unlinked (sync)";
         case -EINPROGRESS:
-                return "pending";
+                return "URB still pending";
         case -EPROTO:
-                return "bit stuffing error, timeout, or unknown USB error";
+                return "bitstuff error, timeout, or unknown USB error";
         case -EILSEQ:
                 return "CRC mismatch, timeout, or unknown USB error";
         case -ETIME:
-                return "timed out";
+                return "USB response timeout";
         case -EPIPE:
                 return "endpoint stalled";
         case -ECOMM:
@@ -214,15 +217,15 @@ static char *get_usb_statmsg(int status)
         case -ENOSR:
                 return "OUT buffer underrun";
         case -EOVERFLOW:
-                return "too much data";
+                return "endpoint babble";
         case -EREMOTEIO:
-                return "short packet detected";
+                return "short packet";
         case -ENODEV:
                 return "device removed";
         case -EXDEV:
-                return "partial isochronous transfer";
+                return "partial isoc transfer";
         case -EINVAL:
-                return "invalid argument";
+                return "ISO madness";
         case -ECONNRESET:
                 return "unlinked (async)";
         case -ESHUTDOWN:
@@ -350,7 +353,7 @@ static inline void error_hangup(struct bc_state *bcs)
  * reset Gigaset device because of an unrecoverable error
  * This function may be called from any context, and takes care of
  * scheduling the necessary actions for execution outside of interrupt context.
- * cs->lock must not be held.
+ * cs->hw.bas->lock must not be held.
  * argument:
  *      controller state structure
  */
@@ -358,7 +361,9 @@ static inline void error_reset(struct cardstate *cs)
 {
         /* reset interrupt pipe to recover (ignore errors) */
         update_basstate(cs->hw.bas, BS_RESETTING, 0);
-        req_submit(cs->bcs, HD_RESET_INTERRUPT_PIPE, 0, BAS_TIMEOUT);
+        if (req_submit(cs->bcs, HD_RESET_INTERRUPT_PIPE, 0, BAS_TIMEOUT))
+                /* submission failed, escalate to USB port reset */
+                usb_queue_reset_device(cs->hw.bas->interface);
 }
 
 /* check_pending
@@ -438,23 +443,27 @@ static void cmd_in_timeout(unsigned long data)
                 return;
         }
 
-        if (ucs->retry_cmd_in++ < BAS_RETRY) {
-                dev_notice(cs->dev, "control read: timeout, retry %d\n",
-                           ucs->retry_cmd_in);
-                rc = atread_submit(cs, BAS_TIMEOUT);
-                if (rc >= 0 || rc == -ENODEV)
-                        /* resubmitted or disconnected */
-                        /* - bypass regular exit block */
-                        return;
-        } else {
+        if (ucs->retry_cmd_in++ >= BAS_RETRY) {
                 dev_err(cs->dev,
                         "control read: timeout, giving up after %d tries\n",
                         ucs->retry_cmd_in);
+                kfree(ucs->rcvbuf);
+                ucs->rcvbuf = NULL;
+                ucs->rcvbuf_size = 0;
+                error_reset(cs);
+                return;
+        }
+
+        gig_dbg(DEBUG_USBREQ, "%s: timeout, retry %d",
+                __func__, ucs->retry_cmd_in);
+        rc = atread_submit(cs, BAS_TIMEOUT);
+        if (rc < 0) {
+                kfree(ucs->rcvbuf);
+                ucs->rcvbuf = NULL;
+                ucs->rcvbuf_size = 0;
+                if (rc != -ENODEV)
+                        error_reset(cs);
         }
-        kfree(ucs->rcvbuf);
-        ucs->rcvbuf = NULL;
-        ucs->rcvbuf_size = 0;
-        error_reset(cs);
 }
 
 /* read_ctrl_callback
@@ -470,18 +479,11 @@ static void read_ctrl_callback(struct urb *urb)
         struct cardstate *cs = inbuf->cs;
         struct bas_cardstate *ucs = cs->hw.bas;
         int status = urb->status;
-        int have_data = 0;
         unsigned numbytes;
         int rc;
 
         update_basstate(ucs, 0, BS_ATRDPEND);
         wake_up(&ucs->waitqueue);
-
-        if (!ucs->rcvbuf_size) {
-                dev_warn(cs->dev, "%s: no receive in progress\n", __func__);
-                return;
-        }
-
         del_timer(&ucs->timer_cmd_in);
 
         switch (status) {
@@ -495,19 +497,10 @@ static void read_ctrl_callback(struct urb *urb)
                                 numbytes = ucs->rcvbuf_size;
                 }
 
-                /* copy received bytes to inbuf */
-                have_data = gigaset_fill_inbuf(inbuf, ucs->rcvbuf, numbytes);
-
-                if (unlikely(numbytes < ucs->rcvbuf_size)) {
-                        /* incomplete - resubmit for remaining bytes */
-                        ucs->rcvbuf_size -= numbytes;
-                        ucs->retry_cmd_in = 0;
-                        rc = atread_submit(cs, BAS_TIMEOUT);
-                        if (rc >= 0 || rc == -ENODEV)
-                                /* resubmitted or disconnected */
-                                /* - bypass regular exit block */
-                                return;
-                        error_reset(cs);
+                /* copy received bytes to inbuf, notify event layer */
+                if (gigaset_fill_inbuf(inbuf, ucs->rcvbuf, numbytes)) {
+                        gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
+                        gigaset_schedule_event(cs);
                 }
                 break;
 
@@ -516,37 +509,32 @@ static void read_ctrl_callback(struct urb *urb)
         case -EINPROGRESS:              /* pending */
         case -ENODEV:                   /* device removed */
         case -ESHUTDOWN:                /* device shut down */
-                /* no action necessary */
+                /* no further action necessary */
                 gig_dbg(DEBUG_USBREQ, "%s: %s",
                         __func__, get_usb_statmsg(status));
                 break;
 
-        default:                        /* severe trouble */
-                dev_warn(cs->dev, "control read: %s\n",
-                         get_usb_statmsg(status));
+        default:                        /* other errors: retry */
                 if (ucs->retry_cmd_in++ < BAS_RETRY) {
-                        dev_notice(cs->dev, "control read: retry %d\n",
-                                   ucs->retry_cmd_in);
+                        gig_dbg(DEBUG_USBREQ, "%s: %s, retry %d", __func__,
+                                get_usb_statmsg(status), ucs->retry_cmd_in);
                         rc = atread_submit(cs, BAS_TIMEOUT);
-                        if (rc >= 0 || rc == -ENODEV)
-                                /* resubmitted or disconnected */
-                                /* - bypass regular exit block */
+                        if (rc >= 0)
+                                /* successfully resubmitted, skip freeing */
                                 return;
-                } else {
-                        dev_err(cs->dev,
-                                "control read: giving up after %d tries\n",
-                                ucs->retry_cmd_in);
+                        if (rc == -ENODEV)
+                                /* disconnect, no further action necessary */
+                                break;
                 }
+                dev_err(cs->dev, "control read: %s, giving up after %d tries\n",
+                        get_usb_statmsg(status), ucs->retry_cmd_in);
                 error_reset(cs);
         }
 
+        /* read finished, free buffer */
         kfree(ucs->rcvbuf);
         ucs->rcvbuf = NULL;
         ucs->rcvbuf_size = 0;
-        if (have_data) {
-                gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
-                gigaset_schedule_event(cs);
-        }
 }
 
 /* atread_submit
@@ -605,14 +593,67 @@ static int atread_submit(struct cardstate *cs, int timeout)
 
         if (timeout > 0) {
                 gig_dbg(DEBUG_USBREQ, "setting timeout of %d/10 secs", timeout);
-                ucs->timer_cmd_in.expires = jiffies + timeout * HZ / 10;
-                ucs->timer_cmd_in.data = (unsigned long) cs;
-                ucs->timer_cmd_in.function = cmd_in_timeout;
-                add_timer(&ucs->timer_cmd_in);
+                mod_timer(&ucs->timer_cmd_in, jiffies + timeout * HZ / 10);
         }
         return 0;
 }
 
+/* int_in_work
+ * workqueue routine to clear halt on interrupt in endpoint
+ */
+
+static void int_in_work(struct work_struct *work)
+{
+        struct bas_cardstate *ucs =
+                container_of(work, struct bas_cardstate, int_in_wq);
+        struct urb *urb = ucs->urb_int_in;
+        struct cardstate *cs = urb->context;
+        int rc;
+
+        /* clear halt condition */
+        rc = usb_clear_halt(ucs->udev, urb->pipe);
+        gig_dbg(DEBUG_USBREQ, "clear_halt: %s", get_usb_rcmsg(rc));
+        if (rc == 0)
+                /* success, resubmit interrupt read URB */
+                rc = usb_submit_urb(urb, GFP_ATOMIC);
+        if (rc != 0 && rc != -ENODEV) {
+                dev_err(cs->dev, "clear halt failed: %s\n", get_usb_rcmsg(rc));
+                rc = usb_lock_device_for_reset(ucs->udev, ucs->interface);
+                if (rc == 0) {
+                        rc = usb_reset_device(ucs->udev);
+                        usb_unlock_device(ucs->udev);
+                }
+        }
+        ucs->retry_int_in = 0;
+}
+
+/* int_in_resubmit
+ * timer routine for interrupt read delayed resubmit
+ * argument:
+ *      controller state structure
+ */
+static void int_in_resubmit(unsigned long data)
+{
+        struct cardstate *cs = (struct cardstate *) data;
+        struct bas_cardstate *ucs = cs->hw.bas;
+        int rc;
+
+        if (ucs->retry_int_in++ >= BAS_RETRY) {
+                dev_err(cs->dev, "interrupt read: giving up after %d tries\n",
+                        ucs->retry_int_in);
+                usb_queue_reset_device(ucs->interface);
+                return;
+        }
+
+        gig_dbg(DEBUG_USBREQ, "%s: retry %d", __func__, ucs->retry_int_in);
+        rc = usb_submit_urb(ucs->urb_int_in, GFP_ATOMIC);
+        if (rc != 0 && rc != -ENODEV) {
+                dev_err(cs->dev, "could not resubmit interrupt URB: %s\n",
+                        get_usb_rcmsg(rc));
+                usb_queue_reset_device(ucs->interface);
+        }
+}
+
 /* read_int_callback
  * USB completion handler for interrupt pipe input
  * called by the USB subsystem in interrupt context
@@ -633,19 +674,29 @@ static void read_int_callback(struct urb *urb)
 
         switch (status) {
         case 0:                 /* success */
+                ucs->retry_int_in = 0;
                 break;
+        case -EPIPE:                    /* endpoint stalled */
+                schedule_work(&ucs->int_in_wq);
+                /* fall through */
         case -ENOENT:                   /* cancelled */
         case -ECONNRESET:               /* cancelled (async) */
         case -EINPROGRESS:              /* pending */
-                /* ignore silently */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
+                /* no further action necessary */
                 gig_dbg(DEBUG_USBREQ, "%s: %s",
                         __func__, get_usb_statmsg(status));
                 return;
-        case -ENODEV:                   /* device removed */
-        case -ESHUTDOWN:                /* device shut down */
-                gig_dbg(DEBUG_USBREQ, "%s: device disconnected", __func__);
+        case -EPROTO:                   /* protocol error or unplug */
+        case -EILSEQ:
+        case -ETIME:
+                /* resubmit after delay */
+                gig_dbg(DEBUG_USBREQ, "%s: %s",
+                        __func__, get_usb_statmsg(status));
+                mod_timer(&ucs->timer_int_in, jiffies + HZ / 10);
                 return;
-        default:                /* severe trouble */
+        default:                /* other errors: just resubmit */
                 dev_warn(cs->dev, "interrupt read: %s\n",
                          get_usb_statmsg(status));
                 goto resubmit;
@@ -723,6 +774,13 @@ static void read_int_callback(struct urb *urb)
                         break;
                 }
                 spin_lock_irqsave(&cs->lock, flags);
+                if (ucs->basstate & BS_ATRDPEND) {
+                        spin_unlock_irqrestore(&cs->lock, flags);
+                        dev_warn(cs->dev,
+        "HD_RECEIVEATDATA_ACK(%d) during HD_READ_ATMESSAGE(%d) ignored\n",
+                                 l, ucs->rcvbuf_size);
+                        break;
+                }
                 if (ucs->rcvbuf_size) {
                         /* throw away previous buffer - we have no queue */
                         dev_err(cs->dev,
@@ -735,7 +793,6 @@ static void read_int_callback(struct urb *urb)
                 if (ucs->rcvbuf == NULL) {
                         spin_unlock_irqrestore(&cs->lock, flags);
                         dev_err(cs->dev, "out of memory receiving AT data\n");
-                        error_reset(cs);
                         break;
                 }
                 ucs->rcvbuf_size = l;
@@ -745,13 +802,10 @@ static void read_int_callback(struct urb *urb)
                         kfree(ucs->rcvbuf);
                         ucs->rcvbuf = NULL;
                         ucs->rcvbuf_size = 0;
-                        if (rc != -ENODEV) {
-                                spin_unlock_irqrestore(&cs->lock, flags);
-                                error_reset(cs);
-                                break;
-                        }
                 }
                 spin_unlock_irqrestore(&cs->lock, flags);
+                if (rc < 0 && rc != -ENODEV)
+                        error_reset(cs);
                 break;
 
         case HD_RESET_INTERRUPT_PIPE_ACK:
@@ -818,6 +872,7 @@ static void read_iso_callback(struct urb *urb)
                 tasklet_hi_schedule(&ubc->rcvd_tasklet);
         } else {
                 /* tasklet still busy, drop data and resubmit URB */
+                gig_dbg(DEBUG_ISO, "%s: overrun", __func__);
                 ubc->loststatus = status;
                 for (i = 0; i < BAS_NUMFRAMES; i++) {
                         ubc->isoinlost += urb->iso_frame_desc[i].actual_length;
@@ -833,13 +888,11 @@ static void read_iso_callback(struct urb *urb)
                         urb->dev = bcs->cs->hw.bas->udev;
                         urb->transfer_flags = URB_ISO_ASAP;
                         urb->number_of_packets = BAS_NUMFRAMES;
-                        gig_dbg(DEBUG_ISO, "%s: isoc read overrun/resubmit",
-                                __func__);
                         rc = usb_submit_urb(urb, GFP_ATOMIC);
                         if (unlikely(rc != 0 && rc != -ENODEV)) {
                                 dev_err(bcs->cs->dev,
-                                        "could not resubmit isochronous read "
-                                        "URB: %s\n", get_usb_rcmsg(rc));
+                                       "could not resubmit isoc read URB: %s\n",
+                                        get_usb_rcmsg(rc));
                                 dump_urb(DEBUG_ISO, "isoc read", urb);
                                 error_hangup(bcs);
                         }
@@ -1081,7 +1134,7 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
                         gig_dbg(DEBUG_ISO, "%s: disconnected", __func__);
                 else
                         dev_err(ucx->bcs->cs->dev,
-                                "could not submit isochronous write URB: %s\n",
+                                "could not submit isoc write URB: %s\n",
                                 get_usb_rcmsg(rc));
                 return rc;
         }
@@ -1126,7 +1179,7 @@ static void write_iso_tasklet(unsigned long data)
                 ubc->isooutovfl = NULL;
                 spin_unlock_irqrestore(&ubc->isooutlock, flags);
                 if (ovfl) {
-                        dev_err(cs->dev, "isochronous write buffer underrun\n");
+                        dev_err(cs->dev, "isoc write underrun\n");
                         error_hangup(bcs);
                         break;
                 }
@@ -1151,7 +1204,7 @@ static void write_iso_tasklet(unsigned long data)
                                 if (next) {
                                         /* couldn't put it back */
                                         dev_err(cs->dev,
-                                              "losing isochronous write URB\n");
+                                                "losing isoc write URB\n");
                                         error_hangup(bcs);
                                 }
                         }
@@ -1178,10 +1231,10 @@ static void write_iso_tasklet(unsigned long data)
                                 if (ifd->status ||
                                     ifd->actual_length != ifd->length) {
                                         dev_warn(cs->dev,
-                                             "isochronous write: frame %d: %s, "
-                                             "only %d of %d bytes sent\n",
-                                             i, get_usb_statmsg(ifd->status),
-                                             ifd->actual_length, ifd->length);
+                                            "isoc write: frame %d[%d/%d]: %s\n",
+                                                 i, ifd->actual_length,
+                                                 ifd->length,
+                                                 get_usb_statmsg(ifd->status));
                                         offset = (ifd->offset +
                                                   ifd->actual_length)
                                                  % BAS_OUTBUFSIZE;
@@ -1190,11 +1243,11 @@ static void write_iso_tasklet(unsigned long data)
                         }
                         break;
                 case -EPIPE:                    /* stall - probably underrun */
-                        dev_err(cs->dev, "isochronous write stalled\n");
+                        dev_err(cs->dev, "isoc write: stalled\n");
                         error_hangup(bcs);
                         break;
-                default:                        /* severe trouble */
-                        dev_warn(cs->dev, "isochronous write: %s\n",
+                default:                        /* other errors */
+                        dev_warn(cs->dev, "isoc write: %s\n",
                                  get_usb_statmsg(status));
                 }
 
@@ -1250,6 +1303,7 @@ static void read_iso_tasklet(unsigned long data)
         struct cardstate *cs = bcs->cs;
         struct urb *urb;
         int status;
+        struct usb_iso_packet_descriptor *ifd;
         char *rcvbuf;
         unsigned long flags;
         int totleft, numbytes, offset, frame, rc;
@@ -1267,8 +1321,7 @@ static void read_iso_tasklet(unsigned long data)
                 ubc->isoindone = NULL;
                 if (unlikely(ubc->loststatus != -EINPROGRESS)) {
                         dev_warn(cs->dev,
-                                 "isochronous read overrun, "
-                                 "dropped URB with status: %s, %d bytes lost\n",
+                "isoc read overrun, URB dropped (status: %s, %d bytes)\n",
                                  get_usb_statmsg(ubc->loststatus),
                                  ubc->isoinlost);
                         ubc->loststatus = -EINPROGRESS;
@@ -1298,11 +1351,11 @@ static void read_iso_tasklet(unsigned long data)
                                 __func__, get_usb_statmsg(status));
                         continue;               /* -> skip */
                 case -EPIPE:
-                        dev_err(cs->dev, "isochronous read stalled\n");
+                        dev_err(cs->dev, "isoc read: stalled\n");
                         error_hangup(bcs);
                         continue;               /* -> skip */
-                default:                        /* severe trouble */
-                        dev_warn(cs->dev, "isochronous read: %s\n",
+                default:                        /* other error */
+                        dev_warn(cs->dev, "isoc read: %s\n",
                                  get_usb_statmsg(status));
                         goto error;
                 }
@@ -1310,40 +1363,52 @@ static void read_iso_tasklet(unsigned long data)
                 rcvbuf = urb->transfer_buffer;
                 totleft = urb->actual_length;
                 for (frame = 0; totleft > 0 && frame < BAS_NUMFRAMES; frame++) {
-                        numbytes = urb->iso_frame_desc[frame].actual_length;
-                        if (unlikely(urb->iso_frame_desc[frame].status))
+                        ifd = &urb->iso_frame_desc[frame];
+                        numbytes = ifd->actual_length;
+                        switch (ifd->status) {
+                        case 0:                 /* success */
+                                break;
+                        case -EPROTO:           /* protocol error or unplug */
+                        case -EILSEQ:
+                        case -ETIME:
+                                /* probably just disconnected, ignore */
+                                gig_dbg(DEBUG_ISO,
+                                        "isoc read: frame %d[%d]: %s\n",
+                                        frame, numbytes,
+                                        get_usb_statmsg(ifd->status));
+                                break;
+                        default:                /* other error */
+                                /* report, assume transferred bytes are ok */
                                 dev_warn(cs->dev,
-                                         "isochronous read: frame %d[%d]: %s\n",
+                                         "isoc read: frame %d[%d]: %s\n",
                                          frame, numbytes,
-                                         get_usb_statmsg(
-                                            urb->iso_frame_desc[frame].status));
+                                         get_usb_statmsg(ifd->status));
+                        }
                         if (unlikely(numbytes > BAS_MAXFRAME))
                                 dev_warn(cs->dev,
-                                         "isochronous read: frame %d: "
-                                         "numbytes (%d) > BAS_MAXFRAME\n",
-                                         frame, numbytes);
+                                         "isoc read: frame %d[%d]: %s\n",
+                                         frame, numbytes,
+                                         "exceeds max frame size");
                         if (unlikely(numbytes > totleft)) {
                                 dev_warn(cs->dev,
-                                         "isochronous read: frame %d: "
-                                         "numbytes (%d) > totleft (%d)\n",
-                                         frame, numbytes, totleft);
+                                         "isoc read: frame %d[%d]: %s\n",
+                                         frame, numbytes,
+                                         "exceeds total transfer length");
                                 numbytes = totleft;
                         }
-                        offset = urb->iso_frame_desc[frame].offset;
+                        offset = ifd->offset;
                         if (unlikely(offset + numbytes > BAS_INBUFSIZE)) {
                                 dev_warn(cs->dev,
-                                         "isochronous read: frame %d: "
-                                         "offset (%d) + numbytes (%d) "
-                                         "> BAS_INBUFSIZE\n",
-                                         frame, offset, numbytes);
+                                         "isoc read: frame %d[%d]: %s\n",
+                                         frame, numbytes,
+                                         "exceeds end of buffer");
                                 numbytes = BAS_INBUFSIZE - offset;
                         }
                         gigaset_isoc_receive(rcvbuf + offset, numbytes, bcs);
                         totleft -= numbytes;
                 }
                 if (unlikely(totleft > 0))
-                        dev_warn(cs->dev,
-                                 "isochronous read: %d data bytes missing\n",
+                        dev_warn(cs->dev, "isoc read: %d data bytes missing\n",
                                  totleft);
 
 error:
@@ -1359,9 +1424,9 @@ error:
                 rc = usb_submit_urb(urb, GFP_ATOMIC);
                 if (unlikely(rc != 0 && rc != -ENODEV)) {
                         dev_err(cs->dev,
-                                "could not resubmit isochronous read URB: %s\n",
+                                "could not resubmit isoc read URB: %s\n",
                                 get_usb_rcmsg(rc));
-                        dump_urb(DEBUG_ISO, "resubmit iso read", urb);
+                        dump_urb(DEBUG_ISO, "resubmit isoc read", urb);
                         error_hangup(bcs);
                 }
         }
@@ -1373,12 +1438,12 @@ error:
 /* req_timeout
  * timeout routine for control output request
  * argument:
- *      B channel control structure
+ *      controller state structure
  */
 static void req_timeout(unsigned long data)
 {
-        struct bc_state *bcs = (struct bc_state *) data;
-        struct bas_cardstate *ucs = bcs->cs->hw.bas;
+        struct cardstate *cs = (struct cardstate *) data;
+        struct bas_cardstate *ucs = cs->hw.bas;
         int pending;
         unsigned long flags;
 
@@ -1395,38 +1460,44 @@ static void req_timeout(unsigned long data)
                 break;
 
         case HD_OPEN_ATCHANNEL:
-                dev_err(bcs->cs->dev, "timeout opening AT channel\n");
-                error_reset(bcs->cs);
+                dev_err(cs->dev, "timeout opening AT channel\n");
+                error_reset(cs);
                 break;
 
-        case HD_OPEN_B2CHANNEL:
         case HD_OPEN_B1CHANNEL:
-                dev_err(bcs->cs->dev, "timeout opening channel %d\n",
-                        bcs->channel + 1);
-                error_hangup(bcs);
+                dev_err(cs->dev, "timeout opening channel 1\n");
+                error_hangup(&cs->bcs[0]);
+                break;
+
+        case HD_OPEN_B2CHANNEL:
+                dev_err(cs->dev, "timeout opening channel 2\n");
+                error_hangup(&cs->bcs[1]);
                 break;
 
         case HD_CLOSE_ATCHANNEL:
-                dev_err(bcs->cs->dev, "timeout closing AT channel\n");
-                error_reset(bcs->cs);
+                dev_err(cs->dev, "timeout closing AT channel\n");
+                error_reset(cs);
                 break;
 
-        case HD_CLOSE_B2CHANNEL:
         case HD_CLOSE_B1CHANNEL:
-                dev_err(bcs->cs->dev, "timeout closing channel %d\n",
-                        bcs->channel + 1);
-                error_reset(bcs->cs);
+                dev_err(cs->dev, "timeout closing channel 1\n");
+                error_reset(cs);
+                break;
+
+        case HD_CLOSE_B2CHANNEL:
+                dev_err(cs->dev, "timeout closing channel 2\n");
+                error_reset(cs);
                 break;
 
         case HD_RESET_INTERRUPT_PIPE:
                 /* error recovery escalation */
-                dev_err(bcs->cs->dev,
+                dev_err(cs->dev,
                         "reset interrupt pipe timeout, attempting USB reset\n");
-                usb_queue_reset_device(bcs->cs->hw.bas->interface);
+                usb_queue_reset_device(ucs->interface);
                 break;
 
         default:
-                dev_warn(bcs->cs->dev, "request 0x%02x timed out, clearing\n",
+                dev_warn(cs->dev, "request 0x%02x timed out, clearing\n",
                          pending);
         }
 
@@ -1557,10 +1628,7 @@ static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
 
         if (timeout > 0) {
                 gig_dbg(DEBUG_USBREQ, "setting timeout of %d/10 secs", timeout);
-                ucs->timer_ctrl.expires = jiffies + timeout * HZ / 10;
-                ucs->timer_ctrl.data = (unsigned long) bcs;
-                ucs->timer_ctrl.function = req_timeout;
-                add_timer(&ucs->timer_ctrl);
+                mod_timer(&ucs->timer_ctrl, jiffies + timeout * HZ / 10);
         }
 
         spin_unlock_irqrestore(&ucs->lock, flags);
@@ -1590,21 +1658,20 @@ static int gigaset_init_bchannel(struct bc_state *bcs)
 
         if (cs->hw.bas->basstate & BS_SUSPEND) {
                 dev_notice(cs->dev,
-                           "not starting isochronous I/O, "
-                           "suspend in progress\n");
+                           "not starting isoc I/O, suspend in progress\n");
                 spin_unlock_irqrestore(&cs->lock, flags);
                 return -EHOSTUNREACH;
         }
 
         ret = starturbs(bcs);
         if (ret < 0) {
+                spin_unlock_irqrestore(&cs->lock, flags);
                 dev_err(cs->dev,
-                        "could not start isochronous I/O for channel B%d: %s\n",
+                        "could not start isoc I/O for channel B%d: %s\n",
                         bcs->channel + 1,
                         ret == -EFAULT ? "null URB" : get_usb_rcmsg(ret));
                 if (ret != -ENODEV)
                         error_hangup(bcs);
-                spin_unlock_irqrestore(&cs->lock, flags);
                 return ret;
         }
 
@@ -1614,11 +1681,11 @@ static int gigaset_init_bchannel(struct bc_state *bcs)
                 dev_err(cs->dev, "could not open channel B%d\n",
                         bcs->channel + 1);
                 stopurbs(bcs->hw.bas);
-                if (ret != -ENODEV)
-                        error_hangup(bcs);
         }
 
         spin_unlock_irqrestore(&cs->lock, flags);
+        if (ret < 0 && ret != -ENODEV)
+                error_hangup(bcs);
         return ret;
 }
 
@@ -1826,10 +1893,7 @@ static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
         if (!(update_basstate(ucs, BS_ATTIMER, BS_ATREADY) & BS_ATTIMER)) {
                 gig_dbg(DEBUG_OUTPUT, "setting ATREADY timeout of %d/10 secs",
                         ATRDY_TIMEOUT);
-                ucs->timer_atrdy.expires = jiffies + ATRDY_TIMEOUT * HZ / 10;
-                ucs->timer_atrdy.data = (unsigned long) cs;
-                ucs->timer_atrdy.function = atrdy_timeout;
-                add_timer(&ucs->timer_atrdy);
+                mod_timer(&ucs->timer_atrdy, jiffies + ATRDY_TIMEOUT * HZ / 10);
         }
         return 0;
 }
@@ -1914,6 +1978,28 @@ static int gigaset_write_cmd(struct cardstate *cs, struct cmdbuf_t *cb)
          * The next command will reopen the AT channel automatically.
          */
         if (cb->len == 3 && !memcmp(cb->buf, "+++", 3)) {
+                /* If an HD_RECEIVEATDATA_ACK message remains unhandled
+                 * because of an error, the base never sends another one.
+                 * The response channel is thus effectively blocked.
+                 * Closing and reopening the AT channel does *not* clear
+                 * this condition.
+                 * As a stopgap measure, submit a zero-length AT read
+                 * before closing the AT channel. This has the undocumented
+                 * effect of triggering a new HD_RECEIVEATDATA_ACK message
+                 * from the base if necessary.
+                 * The subsequent AT channel close then discards any pending
+                 * messages.
+                 */
+                spin_lock_irqsave(&cs->lock, flags);
+                if (!(cs->hw.bas->basstate & BS_ATRDPEND)) {
+                        kfree(cs->hw.bas->rcvbuf);
+                        cs->hw.bas->rcvbuf = NULL;
+                        cs->hw.bas->rcvbuf_size = 0;
+                        cs->hw.bas->retry_cmd_in = 0;
+                        atread_submit(cs, 0);
+                }
+                spin_unlock_irqrestore(&cs->lock, flags);
+
                 rc = req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
                 if (cb->wake_tasklet)
                         tasklet_schedule(cb->wake_tasklet);
@@ -2010,7 +2096,7 @@ static int gigaset_freebcshw(struct bc_state *bcs)
 
         /* kill URBs and tasklets before freeing - better safe than sorry */
         ubc->running = 0;
-        gig_dbg(DEBUG_INIT, "%s: killing iso URBs", __func__);
+        gig_dbg(DEBUG_INIT, "%s: killing isoc URBs", __func__);
         for (i = 0; i < BAS_OUTURBS; ++i) {
                 usb_kill_urb(ubc->isoouturbs[i].urb);
                 usb_free_urb(ubc->isoouturbs[i].urb);
@@ -2131,10 +2217,12 @@ static int gigaset_initcshw(struct cardstate *cs)
         ucs->pending = 0;
 
         ucs->basstate = 0;
-        init_timer(&ucs->timer_ctrl);
-        init_timer(&ucs->timer_atrdy);
-        init_timer(&ucs->timer_cmd_in);
+        setup_timer(&ucs->timer_ctrl, req_timeout, (unsigned long) cs);
+        setup_timer(&ucs->timer_atrdy, atrdy_timeout, (unsigned long) cs);
+        setup_timer(&ucs->timer_cmd_in, cmd_in_timeout, (unsigned long) cs);
+        setup_timer(&ucs->timer_int_in, int_in_resubmit, (unsigned long) cs);
         init_waitqueue_head(&ucs->waitqueue);
+        INIT_WORK(&ucs->int_in_wq, int_in_work);
 
         return 1;
 }
@@ -2282,6 +2370,7 @@ static int gigaset_probe(struct usb_interface *interface,
                         get_usb_rcmsg(rc));
                 goto error;
         }
+        ucs->retry_int_in = 0;
 
         /* tell the device that the driver is ready */
         rc = req_submit(cs->bcs, HD_DEVICE_INIT_ACK, 0, 0);
@@ -2334,10 +2423,12 @@ static void gigaset_disconnect(struct usb_interface *interface)
         /* stop driver (common part) */
         gigaset_stop(cs);
 
-        /* stop timers and URBs, free ressources */
+        /* stop delayed work and URBs, free ressources */
         del_timer_sync(&ucs->timer_ctrl);
         del_timer_sync(&ucs->timer_atrdy);
         del_timer_sync(&ucs->timer_cmd_in);
+        del_timer_sync(&ucs->timer_int_in);
+        cancel_work_sync(&ucs->int_in_wq);
         freeurbs(cs);
         usb_set_intfdata(interface, NULL);
         kfree(ucs->rcvbuf);
@@ -2400,10 +2491,14 @@ static int gigaset_suspend(struct usb_interface *intf, pm_message_t message)
                 /* in case of timeout, proceed anyway */
         }
 
-        /* kill all URBs and timers that might still be pending */
+        /* kill all URBs and delayed work that might still be pending */
         usb_kill_urb(ucs->urb_ctrl);
         usb_kill_urb(ucs->urb_int_in);
         del_timer_sync(&ucs->timer_ctrl);
+        del_timer_sync(&ucs->timer_atrdy);
+        del_timer_sync(&ucs->timer_cmd_in);
+        del_timer_sync(&ucs->timer_int_in);
+        cancel_work_sync(&ucs->int_in_wq);
 
         gig_dbg(DEBUG_SUSPEND, "suspend complete");
         return 0;
@@ -2425,6 +2520,7 @@ static int gigaset_resume(struct usb_interface *intf)
                         get_usb_rcmsg(rc));
                 return rc;
         }
+        ucs->retry_int_in = 0;
 
         /* clear suspend flag to reallow activity */
         update_basstate(ucs, 0, BS_SUSPEND);
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 3ca561eccd9f..db621db67f61 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -1026,32 +1026,6 @@ struct cardstate *gigaset_get_cs_by_id(int id)
         return ret;
 }
 
-void gigaset_debugdrivers(void)
-{
-        unsigned long flags;
-        static struct cardstate *cs;
-        struct gigaset_driver *drv;
-        unsigned i;
-
-        spin_lock_irqsave(&driver_lock, flags);
-        list_for_each_entry(drv, &drivers, list) {
-                gig_dbg(DEBUG_DRIVER, "driver %p", drv);
-                spin_lock(&drv->lock);
-                for (i = 0; i < drv->minors; ++i) {
-                        gig_dbg(DEBUG_DRIVER, "  index %u", i);
-                        cs = drv->cs + i;
-                        gig_dbg(DEBUG_DRIVER, "    cardstate %p", cs);
-                        gig_dbg(DEBUG_DRIVER, "    flags 0x%02x", cs->flags);
-                        gig_dbg(DEBUG_DRIVER, "    minor_index %u",
-                                cs->minor_index);
-                        gig_dbg(DEBUG_DRIVER, "    driver %p", cs->driver);
-                        gig_dbg(DEBUG_DRIVER, "    i4l id %d", cs->myid);
-                }
-                spin_unlock(&drv->lock);
-        }
-        spin_unlock_irqrestore(&driver_lock, flags);
-}
-
 static struct cardstate *gigaset_get_cs_by_minor(unsigned minor)
 {
         unsigned long flags;
diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
index a69512fb1195..6dd360734cfd 100644
--- a/drivers/isdn/gigaset/gigaset.h
+++ b/drivers/isdn/gigaset/gigaset.h
@@ -70,7 +70,6 @@ enum debuglevel {
         DEBUG_STREAM_DUMP = 0x00080, /* application data stream content */
         DEBUG_LLDATA      = 0x00100, /* sent/received LL data */
         DEBUG_EVENT       = 0x00200, /* event processing */
-        DEBUG_DRIVER      = 0x00400, /* driver structure */
         DEBUG_HDLC        = 0x00800, /* M10x HDLC processing */
         DEBUG_CHANNEL     = 0x01000, /* channel allocation/deallocation */
         DEBUG_TRANSCMD    = 0x02000, /* AT-COMMANDS+RESPONSES */
@@ -727,7 +726,7 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
 
 /* Deallocate driver structure. */
 void gigaset_freedriver(struct gigaset_driver *drv);
-void gigaset_debugdrivers(void);
+
 struct cardstate *gigaset_get_cs_by_tty(struct tty_struct *tty);
 struct cardstate *gigaset_get_cs_by_id(int id);
 void gigaset_blockdriver(struct gigaset_driver *drv);
diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
index 34bca37d65b9..9bec8b969964 100644
--- a/drivers/isdn/gigaset/i4l.c
+++ b/drivers/isdn/gigaset/i4l.c
@@ -201,8 +201,6 @@ static int command_from_LL(isdn_ctrl *cntrl)
         int i;
         size_t l;
 
-        gigaset_debugdrivers();
-
         gig_dbg(DEBUG_CMD, "driver: %d, command: %d, arg: 0x%lx",
                 cntrl->driver, cntrl->command, cntrl->arg);
 
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index 2dfd346fc889..f39ccdf87a17 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -842,13 +842,14 @@ static inline void trans_receive(unsigned char *src, unsigned count,
 
         if (unlikely(bcs->ignore)) {
                 bcs->ignore--;
-                hdlc_flush(bcs);
                 return;
         }
         skb = bcs->rx_skb;
-        if (skb == NULL)
+        if (skb == NULL) {
                 skb = gigaset_new_rx_skb(bcs);
-        bcs->hw.bas->goodbytes += skb->len;
+                if (skb == NULL)
+                        return;
+        }
         dobytes = bcs->rx_bufsize - skb->len;
         while (count > 0) {
                 dst = skb_put(skb, count < dobytes ? count : dobytes);
@@ -860,6 +861,7 @@ static inline void trans_receive(unsigned char *src, unsigned count,
                 if (dobytes == 0) {
                         dump_bytes(DEBUG_STREAM_DUMP,
                                    "rcv data", skb->data, skb->len);
+                        bcs->hw.bas->goodbytes += skb->len;
                         gigaset_skb_rcvd(bcs, skb);
                         skb = gigaset_new_rx_skb(bcs);
                         if (skb == NULL)
diff --git a/drivers/isdn/hardware/eicon/debug.c b/drivers/isdn/hardware/eicon/debug.c
index 33ce89eed65b..362640120886 100644
--- a/drivers/isdn/hardware/eicon/debug.c
+++ b/drivers/isdn/hardware/eicon/debug.c
@@ -862,7 +862,7 @@ void diva_mnt_add_xdi_adapter (const DESCRIPTOR* d) {
   diva_os_spin_lock_magic_t old_irql, old_irql1;
   dword sec, usec, logical, serial, org_mask;
   int id, best_id = 0, free_id = -1;
-  char tmp[256];
+  char tmp[128];
   diva_dbg_entry_head_t* pmsg = NULL;
   int len;
   word size;
diff --git a/drivers/isdn/hardware/eicon/debuglib.h b/drivers/isdn/hardware/eicon/debuglib.h
index 8ea587783e14..02eed6b4354c 100644
--- a/drivers/isdn/hardware/eicon/debuglib.h
+++ b/drivers/isdn/hardware/eicon/debuglib.h
@@ -249,7 +249,7 @@ typedef struct _DbgHandle_
  }     regTime ;  /* timestamp for registration       */
  void               *pIrp ;   /* ptr to pending i/o request       */
  unsigned long       dbgMask ;  /* current debug mask               */
- char                drvName[16] ; /* ASCII name of registered driver  */
+ char                drvName[128] ; /* ASCII name of registered driver  */
  char                drvTag[64] ; /* revision string     */
  DbgEnd              dbg_end ;  /* function for debug closing       */
  DbgLog              dbg_prt ;  /* function for debug appending     */
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index f013ee15327c..c463162843ba 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -14,7 +14,7 @@
 #include <linux/isdn.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include "isdn_common.h"
 #include "isdn_tty.h"
 #ifdef CONFIG_ISDN_AUDIO
@@ -28,6 +28,7 @@
 
 /* Prototypes */
 
+static DEFINE_MUTEX(modem_info_mutex);
 static int isdn_tty_edit_at(const char *, int, modem_info *);
 static void isdn_tty_check_esc(const u_char *, u_char, int, int *, u_long *);
 static void isdn_tty_modem_reset_regs(modem_info *, int);
@@ -1354,14 +1355,14 @@ isdn_tty_tiocmget(struct tty_struct *tty, struct file *file)
         if (tty->flags & (1 << TTY_IO_ERROR))
                 return -EIO;
 
-        lock_kernel();
+        mutex_lock(&modem_info_mutex);
 #ifdef ISDN_DEBUG_MODEM_IOCTL
         printk(KERN_DEBUG "ttyI%d ioctl TIOCMGET\n", info->line);
 #endif
 
         control = info->mcr;
         status = info->msr;
-        unlock_kernel();
+        mutex_unlock(&modem_info_mutex);
         return ((control & UART_MCR_RTS) ? TIOCM_RTS : 0)
             | ((control & UART_MCR_DTR) ? TIOCM_DTR : 0)
             | ((status & UART_MSR_DCD) ? TIOCM_CAR : 0)
@@ -1385,7 +1386,7 @@ isdn_tty_tiocmset(struct tty_struct *tty, struct file *file,
         printk(KERN_DEBUG "ttyI%d ioctl TIOCMxxx: %x %x\n", info->line, set, clear);
 #endif
 
-        lock_kernel();
+        mutex_lock(&modem_info_mutex);
         if (set & TIOCM_RTS)
                 info->mcr |= UART_MCR_RTS;
         if (set & TIOCM_DTR) {
@@ -1407,7 +1408,7 @@ isdn_tty_tiocmset(struct tty_struct *tty, struct file *file,
                         isdn_tty_modem_hup(info, 1);
                 }
         }
-        unlock_kernel();
+        mutex_unlock(&modem_info_mutex);
         return 0;
 }
 
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index b159bd59e64e..a5b632e67552 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -18,7 +18,6 @@
 #include <linux/slab.h>
 #include <linux/mISDNif.h>
 #include <linux/kthread.h>
-#include <linux/smp_lock.h>
 #include "core.h"
 
 static u_int    *debug;
@@ -205,13 +204,7 @@ mISDNStackd(void *data)
         struct mISDNstack *st = data;
         int err = 0;
 
-#ifdef CONFIG_SMP
-        lock_kernel();
-#endif
         sigfillset(&current->blocked);
-#ifdef CONFIG_SMP
-        unlock_kernel();
-#endif
         if (*debug & DEBUG_MSG_THREAD)
                 printk(KERN_DEBUG "mISDNStackd %s started\n",
                     dev_name(&st->dev->dev));
diff --git a/drivers/isdn/pcbit/edss1.c b/drivers/isdn/pcbit/edss1.c
index d5920ae22d73..80c9c16fd5ef 100644
--- a/drivers/isdn/pcbit/edss1.c
+++ b/drivers/isdn/pcbit/edss1.c
@@ -33,7 +33,7 @@
 #include "callbacks.h"
 
 
-char * isdn_state_table[] = {
+const char * const isdn_state_table[] = {
   "Closed",
   "Call initiated",
   "Overlap sending",
diff --git a/drivers/isdn/pcbit/edss1.h b/drivers/isdn/pcbit/edss1.h
index 0b64f97015d8..39f8346e28c5 100644
--- a/drivers/isdn/pcbit/edss1.h
+++ b/drivers/isdn/pcbit/edss1.h
@@ -90,7 +90,7 @@ struct fsm_timer_entry {
         unsigned long timeout;          /* in seconds */
 };
 
-extern char * isdn_state_table[];
+extern const char * const isdn_state_table[];
 
 void pcbit_fsm_event(struct pcbit_dev *, struct pcbit_chan *,
                      unsigned short event, struct callb_data *);
diff --git a/drivers/isdn/sc/interrupt.c b/drivers/isdn/sc/interrupt.c
index 485be8b1e1b3..f0225bc0f267 100644
--- a/drivers/isdn/sc/interrupt.c
+++ b/drivers/isdn/sc/interrupt.c
@@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
                         }
                         else if(callid>=0x0000 && callid<=0x7FFF)
                         {
+                                int len;
+
                                 pr_debug("%s: Got Incoming Call\n",
                                                 sc_adapter[card]->devicename);
-                                strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
-                                strcpy(setup.eazmsn,
-                                        sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
+                                len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
+                                                sizeof(setup.phone));
+                                if (len >= sizeof(setup.phone))
+                                        continue;
+                                len = strlcpy(setup.eazmsn,
+                                                sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+                                                sizeof(setup.eazmsn));
+                                if (len >= sizeof(setup.eazmsn))
+                                        continue;
                                 setup.si1 = 7;
                                 setup.si2 = 0;
                                 setup.plan = 0;
@@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
                  * Handle a GetMyNumber Rsp
                  */
                 if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
-                        strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
+                        strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+                                rcvmsg.msg_data.byte_array,
+                                sizeof(rcvmsg.msg_data.byte_array));
                         continue;
                 }
                         
diff --git a/drivers/leds/leds-ns2.c b/drivers/leds/leds-ns2.c
index 74dce4ba0262..350eb34f049c 100644
--- a/drivers/leds/leds-ns2.c
+++ b/drivers/leds/leds-ns2.c
@@ -81,7 +81,7 @@ static int ns2_led_get_mode(struct ns2_led_data *led_dat,
         int cmd_level;
         int slow_level;
 
-        read_lock(&led_dat->rw_lock);
+        read_lock_irq(&led_dat->rw_lock);
 
         cmd_level = gpio_get_value(led_dat->cmd);
         slow_level = gpio_get_value(led_dat->slow);
@@ -95,7 +95,7 @@ static int ns2_led_get_mode(struct ns2_led_data *led_dat,
                 }
         }
 
-        read_unlock(&led_dat->rw_lock);
+        read_unlock_irq(&led_dat->rw_lock);
 
         return ret;
 }
@@ -104,8 +104,9 @@ static void ns2_led_set_mode(struct ns2_led_data *led_dat,
                              enum ns2_led_modes mode)
 {
         int i;
+        unsigned long flags;
 
-        write_lock(&led_dat->rw_lock);
+        write_lock_irqsave(&led_dat->rw_lock, flags);
 
         for (i = 0; i < ARRAY_SIZE(ns2_led_modval); i++) {
                 if (mode == ns2_led_modval[i].mode) {
@@ -116,7 +117,7 @@ static void ns2_led_set_mode(struct ns2_led_data *led_dat,
                 }
         }
 
-        write_unlock(&led_dat->rw_lock);
+        write_unlock_irqrestore(&led_dat->rw_lock, flags);
 }
 
 static void ns2_led_set(struct led_classdev *led_cdev,
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 43cf9cc9c1df..f20d13e717d5 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1643,7 +1643,9 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
                 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
                 if (rdev->sb_size & bmask)
                         rdev->sb_size = (rdev->sb_size | bmask) + 1;
-        }
+        } else
+                max_dev = le32_to_cpu(sb->max_dev);
+
         for (i=0; i<max_dev;i++)
                 sb->dev_roles[i] = cpu_to_le16(0xfffe);
         
@@ -7069,7 +7071,7 @@ void md_check_recovery(mddev_t *mddev)
         if (mddev->ro && !test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
                 return;
         if ( ! (
-                (mddev->flags && !mddev->external) ||
+                (mddev->flags & ~ (1<<MD_CHANGE_PENDING)) ||
                 test_bit(MD_RECOVERY_NEEDED, &mddev->recovery) ||
                 test_bit(MD_RECOVERY_DONE, &mddev->recovery) ||
                 (mddev->external == 0 && mddev->safemode == 1) ||
diff --git a/drivers/mfd/max8925-core.c b/drivers/mfd/max8925-core.c
index 04028a9ee082..428377a5a6f5 100644
--- a/drivers/mfd/max8925-core.c
+++ b/drivers/mfd/max8925-core.c
@@ -429,24 +429,25 @@ static void max8925_irq_sync_unlock(unsigned int irq)
         irq_tsc = cache_tsc;
         for (i = 0; i < ARRAY_SIZE(max8925_irqs); i++) {
                 irq_data = &max8925_irqs[i];
+                /* 1 -- disable, 0 -- enable */
                 switch (irq_data->mask_reg) {
                 case MAX8925_CHG_IRQ1_MASK:
-                        irq_chg[0] &= irq_data->enable;
+                        irq_chg[0] &= ~irq_data->enable;
                         break;
                 case MAX8925_CHG_IRQ2_MASK:
-                        irq_chg[1] &= irq_data->enable;
+                        irq_chg[1] &= ~irq_data->enable;
                         break;
                 case MAX8925_ON_OFF_IRQ1_MASK:
-                        irq_on[0] &= irq_data->enable;
+                        irq_on[0] &= ~irq_data->enable;
                         break;
                 case MAX8925_ON_OFF_IRQ2_MASK:
-                        irq_on[1] &= irq_data->enable;
+                        irq_on[1] &= ~irq_data->enable;
                         break;
                 case MAX8925_RTC_IRQ_MASK:
-                        irq_rtc &= irq_data->enable;
+                        irq_rtc &= ~irq_data->enable;
                         break;
                 case MAX8925_TSC_IRQ_MASK:
-                        irq_tsc &= irq_data->enable;
+                        irq_tsc &= ~irq_data->enable;
                         break;
                 default:
                         dev_err(chip->dev, "wrong IRQ\n");
diff --git a/drivers/mfd/wm831x-irq.c b/drivers/mfd/wm831x-irq.c
index 7dabe4dbd373..294183b6260b 100644
--- a/drivers/mfd/wm831x-irq.c
+++ b/drivers/mfd/wm831x-irq.c
@@ -394,8 +394,13 @@ static int wm831x_irq_set_type(unsigned int irq, unsigned int type)
 
         irq = irq - wm831x->irq_base;
 
-        if (irq < WM831X_IRQ_GPIO_1 || irq > WM831X_IRQ_GPIO_11)
-                return -EINVAL;
+        if (irq < WM831X_IRQ_GPIO_1 || irq > WM831X_IRQ_GPIO_11) {
+                /* Ignore internal-only IRQs */
+                if (irq >= 0 && irq < WM831X_NUM_IRQS)
+                        return 0;
+                else
+                        return -EINVAL;
+        }
 
         switch (type) {
         case IRQ_TYPE_EDGE_BOTH:
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 0b591b658243..b74331260744 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -368,7 +368,7 @@ config VMWARE_BALLOON
           If unsure, say N.
 
           To compile this driver as a module, choose M here: the
-          module will be called vmware_balloon.
+          module will be called vmw_balloon.
 
 config ARM_CHARLCD
         bool "ARM Ltd. Character LCD Driver"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 255a80dc9d73..42eab95cde2a 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -33,5 +33,5 @@ obj-$(CONFIG_IWMC3200TOP)      += iwmc3200top/
 obj-$(CONFIG_HMC6352)           += hmc6352.o
 obj-y                           += eeprom/
 obj-y                           += cb710/
-obj-$(CONFIG_VMWARE_BALLOON)    += vmware_balloon.o
+obj-$(CONFIG_VMWARE_BALLOON)    += vmw_balloon.o
 obj-$(CONFIG_ARM_CHARLCD)       += arm-charlcd.o
diff --git a/drivers/misc/vmware_balloon.c b/drivers/misc/vmw_balloon.c
index 2a1e804a71aa..2a1e804a71aa 100644
--- a/drivers/misc/vmware_balloon.c
+++ b/drivers/misc/vmw_balloon.c
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index bd2755e8d9a3..f332c52968b7 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -362,9 +362,8 @@ static int mmc_sdio_init_card(struct mmc_host *host, u32 ocr,
                 goto err;
         }
 
-        err = mmc_sd_get_cid(host, host->ocr & ocr, card->raw_cid);
-
-        if (!err) {
+        if (ocr & R4_MEMORY_PRESENT
+            && mmc_sd_get_cid(host, host->ocr & ocr, card->raw_cid) == 0) {
                 card->type = MMC_TYPE_SD_COMBO;
 
                 if (oldcard && (oldcard->type != MMC_TYPE_SD_COMBO ||
diff --git a/drivers/mmc/host/at91_mci.c b/drivers/mmc/host/at91_mci.c
index 5f3a599ead07..87226cd202a5 100644
--- a/drivers/mmc/host/at91_mci.c
+++ b/drivers/mmc/host/at91_mci.c
@@ -66,6 +66,7 @@
 #include <linux/clk.h>
 #include <linux/atmel_pdc.h>
 #include <linux/gfp.h>
+#include <linux/highmem.h>
 
 #include <linux/mmc/host.h>
 
diff --git a/drivers/mmc/host/imxmmc.c b/drivers/mmc/host/imxmmc.c
index 9a68ff4353a2..5a950b16d9e6 100644
--- a/drivers/mmc/host/imxmmc.c
+++ b/drivers/mmc/host/imxmmc.c
@@ -148,11 +148,12 @@ static int imxmci_start_clock(struct imxmci_host *host)
 
                 while (delay--) {
                         reg = readw(host->base + MMC_REG_STATUS);
-                        if (reg & STATUS_CARD_BUS_CLK_RUN)
+                        if (reg & STATUS_CARD_BUS_CLK_RUN) {
                                 /* Check twice before cut */
                                 reg = readw(host->base + MMC_REG_STATUS);
                                 if (reg & STATUS_CARD_BUS_CLK_RUN)
                                         return 0;
+                        }
 
                         if (test_bit(IMXMCI_PEND_STARTED_b, &host->pending_events))
                                 return 0;
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 4a8776f8afdd..4526d2791f29 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -2305,7 +2305,6 @@ static int omap_hsmmc_suspend(struct device *dev)
         int ret = 0;
         struct platform_device *pdev = to_platform_device(dev);
         struct omap_hsmmc_host *host = platform_get_drvdata(pdev);
-        pm_message_t state = PMSG_SUSPEND; /* unused by MMC core */
 
         if (host && host->suspended)
                 return 0;
@@ -2324,8 +2323,8 @@ static int omap_hsmmc_suspend(struct device *dev)
                         }
                 }
                 cancel_work_sync(&host->mmc_carddetect_work);
-                mmc_host_enable(host->mmc);
                 ret = mmc_suspend_host(host->mmc);
+                mmc_host_enable(host->mmc);
                 if (ret == 0) {
                         omap_hsmmc_disable_irq(host);
                         OMAP_HSMMC_WRITE(host->base, HCTL,
diff --git a/drivers/mmc/host/s3cmci.c b/drivers/mmc/host/s3cmci.c
index 2e16e0a90a5e..976330de379e 100644
--- a/drivers/mmc/host/s3cmci.c
+++ b/drivers/mmc/host/s3cmci.c
@@ -1600,7 +1600,7 @@ static int __devinit s3cmci_probe(struct platform_device *pdev)
         host->pio_active        = XFER_NONE;
 
 #ifdef CONFIG_MMC_S3C_PIODMA
-        host->dodma             = host->pdata->dma;
+        host->dodma             = host->pdata->use_dma;
 #endif
 
         host->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index 71ad4163b95e..aacb862ecc8a 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -241,8 +241,10 @@ static struct sdhci_ops sdhci_s3c_ops = {
 static void sdhci_s3c_notify_change(struct platform_device *dev, int state)
 {
         struct sdhci_host *host = platform_get_drvdata(dev);
+        unsigned long flags;
+
         if (host) {
-                spin_lock(&host->lock);
+                spin_lock_irqsave(&host->lock, flags);
                 if (state) {
                         dev_dbg(&dev->dev, "card inserted.\n");
                         host->flags &= ~SDHCI_DEVICE_DEAD;
@@ -253,7 +255,7 @@ static void sdhci_s3c_notify_change(struct platform_device *dev, int state)
                         host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
                 }
                 tasklet_schedule(&host->card_tasklet);
-                spin_unlock(&host->lock);
+                spin_unlock_irqrestore(&host->lock, flags);
         }
 }
 
@@ -481,8 +483,10 @@ static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
         sdhci_remove_host(host, 1);
 
         for (ptr = 0; ptr < 3; ptr++) {
-                clk_disable(sc->clk_bus[ptr]);
-                clk_put(sc->clk_bus[ptr]);
+                if (sc->clk_bus[ptr]) {
+                        clk_disable(sc->clk_bus[ptr]);
+                        clk_put(sc->clk_bus[ptr]);
+                }
         }
         clk_disable(sc->clk_io);
         clk_put(sc->clk_io);
diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c
index ee7d0a5a51c4..69d98e3bf6ab 100644
--- a/drivers/mmc/host/tmio_mmc.c
+++ b/drivers/mmc/host/tmio_mmc.c
@@ -164,6 +164,7 @@ tmio_mmc_start_command(struct tmio_mmc_host *host, struct mmc_command *cmd)
 static void tmio_mmc_pio_irq(struct tmio_mmc_host *host)
 {
         struct mmc_data *data = host->data;
+        void *sg_virt;
         unsigned short *buf;
         unsigned int count;
         unsigned long flags;
@@ -173,8 +174,8 @@ static void tmio_mmc_pio_irq(struct tmio_mmc_host *host)
                 return;
         }
 
-        buf = (unsigned short *)(tmio_mmc_kmap_atomic(host, &flags) +
-              host->sg_off);
+        sg_virt = tmio_mmc_kmap_atomic(host->sg_ptr, &flags);
+        buf = (unsigned short *)(sg_virt + host->sg_off);
 
         count = host->sg_ptr->length - host->sg_off;
         if (count > data->blksz)
@@ -191,7 +192,7 @@ static void tmio_mmc_pio_irq(struct tmio_mmc_host *host)
 
         host->sg_off += count;
 
-        tmio_mmc_kunmap_atomic(host, &flags);
+        tmio_mmc_kunmap_atomic(sg_virt, &flags);
 
         if (host->sg_off == host->sg_ptr->length)
                 tmio_mmc_next_sg(host);
diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h
index 64f7d5dfc106..0fedc78e3ea5 100644
--- a/drivers/mmc/host/tmio_mmc.h
+++ b/drivers/mmc/host/tmio_mmc.h
@@ -82,10 +82,7 @@
 
 #define ack_mmc_irqs(host, i) \
         do { \
-                u32 mask;\
-                mask  = sd_ctrl_read32((host), CTL_STATUS); \
-                mask &= ~((i) & TMIO_MASK_IRQ); \
-                sd_ctrl_write32((host), CTL_STATUS, mask); \
+                sd_ctrl_write32((host), CTL_STATUS, ~(i)); \
         } while (0)
 
 
@@ -177,19 +174,17 @@ static inline int tmio_mmc_next_sg(struct tmio_mmc_host *host)
         return --host->sg_len;
 }
 
-static inline char *tmio_mmc_kmap_atomic(struct tmio_mmc_host *host,
+static inline char *tmio_mmc_kmap_atomic(struct scatterlist *sg,
         unsigned long *flags)
 {
-        struct scatterlist *sg = host->sg_ptr;
-
         local_irq_save(*flags);
         return kmap_atomic(sg_page(sg), KM_BIO_SRC_IRQ) + sg->offset;
 }
 
-static inline void tmio_mmc_kunmap_atomic(struct tmio_mmc_host *host,
+static inline void tmio_mmc_kunmap_atomic(void *virt,
         unsigned long *flags)
 {
-        kunmap_atomic(sg_page(host->sg_ptr), KM_BIO_SRC_IRQ);
+        kunmap_atomic(virt, KM_BIO_SRC_IRQ);
         local_irq_restore(*flags);
 }
 
diff --git a/drivers/mtd/nand/bf5xx_nand.c b/drivers/mtd/nand/bf5xx_nand.c
index a382e3dd0a5d..6fbeefa3a766 100644
--- a/drivers/mtd/nand/bf5xx_nand.c
+++ b/drivers/mtd/nand/bf5xx_nand.c
@@ -682,7 +682,6 @@ static int __devinit bf5xx_nand_add_partition(struct bf5xx_nand_info *info)
 static int __devexit bf5xx_nand_remove(struct platform_device *pdev)
 {
         struct bf5xx_nand_info *info = to_nand_info(pdev);
-        struct mtd_info *mtd = NULL;
 
         platform_set_drvdata(pdev, NULL);
 
@@ -690,11 +689,7 @@ static int __devexit bf5xx_nand_remove(struct platform_device *pdev)
          * and their partitions, then go through freeing the
          * resources used
          */
-        mtd = &info->mtd;
-        if (mtd) {
-                nand_release(mtd);
-                kfree(mtd);
-        }
+        nand_release(&info->mtd);
 
         peripheral_free_list(bfin_nfc_pin_req);
         bf5xx_nand_dma_remove(info);
@@ -710,7 +705,7 @@ static int bf5xx_nand_scan(struct mtd_info *mtd)
         struct nand_chip *chip = mtd->priv;
         int ret;
 
-        ret = nand_scan_ident(mtd, 1);
+        ret = nand_scan_ident(mtd, 1, NULL);
         if (ret)
                 return ret;
 
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index fcf8ceb277d4..b2828e84d243 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -67,7 +67,9 @@
 #define NFC_V1_V2_CONFIG1_BIG           (1 << 5)
 #define NFC_V1_V2_CONFIG1_RST           (1 << 6)
 #define NFC_V1_V2_CONFIG1_CE            (1 << 7)
-#define NFC_V1_V2_CONFIG1_ONE_CYCLE     (1 << 8)
+#define NFC_V2_CONFIG1_ONE_CYCLE        (1 << 8)
+#define NFC_V2_CONFIG1_PPB(x)           (((x) & 0x3) << 9)
+#define NFC_V2_CONFIG1_FP_INT           (1 << 11)
 
 #define NFC_V1_V2_CONFIG2_INT           (1 << 15)
 
@@ -402,16 +404,16 @@ static void send_read_id_v1_v2(struct mxc_nand_host *host)
         /* Wait for operation to complete */
         wait_op_done(host, true);
 
+        memcpy(host->data_buf, host->main_area0, 16);
+
         if (this->options & NAND_BUSWIDTH_16) {
-                void __iomem *main_buf = host->main_area0;
                 /* compress the ID info */
-                writeb(readb(main_buf + 2), main_buf + 1);
-                writeb(readb(main_buf + 4), main_buf + 2);
-                writeb(readb(main_buf + 6), main_buf + 3);
-                writeb(readb(main_buf + 8), main_buf + 4);
-                writeb(readb(main_buf + 10), main_buf + 5);
+                host->data_buf[1] = host->data_buf[2];
+                host->data_buf[2] = host->data_buf[4];
+                host->data_buf[3] = host->data_buf[6];
+                host->data_buf[4] = host->data_buf[8];
+                host->data_buf[5] = host->data_buf[10];
         }
-        memcpy(host->data_buf, host->main_area0, 16);
 }
 
 static uint16_t get_dev_status_v3(struct mxc_nand_host *host)
@@ -729,27 +731,30 @@ static void preset_v1_v2(struct mtd_info *mtd)
 {
         struct nand_chip *nand_chip = mtd->priv;
         struct mxc_nand_host *host = nand_chip->priv;
-        uint16_t tmp;
-
-        /* enable interrupt, disable spare enable */
-        tmp = readw(NFC_V1_V2_CONFIG1);
-        tmp &= ~NFC_V1_V2_CONFIG1_INT_MSK;
-        tmp &= ~NFC_V1_V2_CONFIG1_SP_EN;
-        if (nand_chip->ecc.mode == NAND_ECC_HW) {
-                tmp |= NFC_V1_V2_CONFIG1_ECC_EN;
-        } else {
-                tmp &= ~NFC_V1_V2_CONFIG1_ECC_EN;
-        }
+        uint16_t config1 = 0;
+
+        if (nand_chip->ecc.mode == NAND_ECC_HW)
+                config1 |= NFC_V1_V2_CONFIG1_ECC_EN;
+
+        if (nfc_is_v21())
+                config1 |= NFC_V2_CONFIG1_FP_INT;
+
+        if (!cpu_is_mx21())
+                config1 |= NFC_V1_V2_CONFIG1_INT_MSK;
 
         if (nfc_is_v21() && mtd->writesize) {
+                uint16_t pages_per_block = mtd->erasesize / mtd->writesize;
+
                 host->eccsize = get_eccsize(mtd);
                 if (host->eccsize == 4)
-                        tmp |= NFC_V2_CONFIG1_ECC_MODE_4;
+                        config1 |= NFC_V2_CONFIG1_ECC_MODE_4;
+
+                config1 |= NFC_V2_CONFIG1_PPB(ffs(pages_per_block) - 6);
         } else {
                 host->eccsize = 1;
         }
 
-        writew(tmp, NFC_V1_V2_CONFIG1);
+        writew(config1, NFC_V1_V2_CONFIG1);
         /* preset operation */
 
         /* Unlock the internal RAM Buffer */
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index 133d51528f8d..513e0a76a4a7 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -413,7 +413,7 @@ static inline int omap_nand_dma_transfer(struct mtd_info *mtd, void *addr,
                 prefetch_status = gpmc_read_status(GPMC_PREFETCH_COUNT);
         } while (prefetch_status);
         /* disable and stop the PFPW engine */
-        gpmc_prefetch_reset();
+        gpmc_prefetch_reset(info->gpmc_cs);
 
         dma_unmap_single(&info->pdev->dev, dma_addr, len, dir);
         return 0;
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 4d89f3780207..4d01cda68844 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -1320,6 +1320,7 @@ static int pxa3xx_nand_probe(struct platform_device *pdev)
                 goto fail_free_irq;
         }
 
+#ifdef CONFIG_MTD_PARTITIONS
         if (mtd_has_cmdlinepart()) {
                 static const char *probes[] = { "cmdlinepart", NULL };
                 struct mtd_partition *parts;
@@ -1332,6 +1333,9 @@ static int pxa3xx_nand_probe(struct platform_device *pdev)
         }
 
         return add_mtd_partitions(mtd, pdata->parts, pdata->nr_parts);
+#else
+        return 0;
+#endif
 
 fail_free_irq:
         free_irq(irq, info);
@@ -1364,7 +1368,9 @@ static int pxa3xx_nand_remove(struct platform_device *pdev)
         platform_set_drvdata(pdev, NULL);
 
         del_mtd_device(mtd);
+#ifdef CONFIG_MTD_PARTITIONS
         del_mtd_partitions(mtd);
+#endif
         irq = platform_get_irq(pdev, 0);
         if (irq >= 0)
                 free_irq(irq, info);
diff --git a/drivers/mtd/onenand/samsung.c b/drivers/mtd/onenand/samsung.c
index cb443af3d45f..a460f1b748c2 100644
--- a/drivers/mtd/onenand/samsung.c
+++ b/drivers/mtd/onenand/samsung.c
@@ -554,14 +554,13 @@ static int s5pc110_dma_ops(void *dst, void *src, size_t count, int direction)
 
         do {
                 status = readl(base + S5PC110_DMA_TRANS_STATUS);
+                if (status & S5PC110_DMA_TRANS_STATUS_TE) {
+                        writel(S5PC110_DMA_TRANS_CMD_TEC,
+                                        base + S5PC110_DMA_TRANS_CMD);
+                        return -EIO;
+                }
         } while (!(status & S5PC110_DMA_TRANS_STATUS_TD));
 
-        if (status & S5PC110_DMA_TRANS_STATUS_TE) {
-                writel(S5PC110_DMA_TRANS_CMD_TEC, base + S5PC110_DMA_TRANS_CMD);
-                writel(S5PC110_DMA_TRANS_CMD_TDC, base + S5PC110_DMA_TRANS_CMD);
-                return -EIO;
-        }
-
         writel(S5PC110_DMA_TRANS_CMD_TDC, base + S5PC110_DMA_TRANS_CMD);
 
         return 0;
@@ -571,13 +570,12 @@ static int s5pc110_read_bufferram(struct mtd_info *mtd, int area,
                 unsigned char *buffer, int offset, size_t count)
 {
         struct onenand_chip *this = mtd->priv;
-        void __iomem *bufferram;
         void __iomem *p;
         void *buf = (void *) buffer;
         dma_addr_t dma_src, dma_dst;
         int err;
 
-        p = bufferram = this->base + area;
+        p = this->base + area;
         if (ONENAND_CURRENT_BUFFERRAM(this)) {
                 if (area == ONENAND_DATARAM)
                         p += this->writesize;
@@ -621,7 +619,7 @@ static int s5pc110_read_bufferram(struct mtd_info *mtd, int area,
 normal:
         if (count != mtd->writesize) {
                 /* Copy the bufferram to memory to prevent unaligned access */
-                memcpy(this->page_buf, bufferram, mtd->writesize);
+                memcpy(this->page_buf, p, mtd->writesize);
                 p = this->page_buf + offset;
         }
 
diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c
index 8a6eb0c44486..cdf7226a7c43 100644
--- a/drivers/net/3c515.c
+++ b/drivers/net/3c515.c
@@ -662,7 +662,9 @@ static int corkscrew_setup(struct net_device *dev, int ioaddr,
                 pr_warning(" *** Warning: this IRQ is unlikely to work! ***\n");
 
         {
-                char *ram_split[] = { "5:3", "3:1", "1:1", "3:5" };
+                static const char * const ram_split[] = {
+                        "5:3", "3:1", "1:1", "3:5"
+                };
                 __u32 config;
                 EL3WINDOW(3);
                 vp->available_media = inw(ioaddr + Wn3_Options);
diff --git a/drivers/net/3c523.c b/drivers/net/3c523.c
index a7b0e5e43a52..de579d043169 100644
--- a/drivers/net/3c523.c
+++ b/drivers/net/3c523.c
@@ -287,7 +287,7 @@ static int elmc_open(struct net_device *dev)
 
         elmc_id_attn586();      /* disable interrupts */
 
-        ret = request_irq(dev->irq, elmc_interrupt, IRQF_SHARED | IRQF_SAMPLE_RANDOM,
+        ret = request_irq(dev->irq, elmc_interrupt, IRQF_SHARED,
                           dev->name, dev);
         if (ret) {
                 pr_err("%s: couldn't get irq %d\n", dev->name, dev->irq);
@@ -463,7 +463,7 @@ static int __init do_elmc_probe(struct net_device *dev)
 
         /* we didn't find any 3c523 in the slots we checked for */
         if (slot == MCA_NOTFOUND)
-                return ((base_addr || irq) ? -ENXIO : -ENODEV);
+                return (base_addr || irq) ? -ENXIO : -ENODEV;
 
         mca_set_adapter_name(slot, "3Com 3c523 Etherlink/MC");
         mca_set_adapter_procfn(slot, (MCA_ProcFn) elmc_getinfo, dev);
diff --git a/drivers/net/3c527.c b/drivers/net/3c527.c
index 70705d1306b9..0d6ca1e407d0 100644
--- a/drivers/net/3c527.c
+++ b/drivers/net/3c527.c
@@ -443,7 +443,7 @@ static int __init mc32_probe1(struct net_device *dev, int slot)
          *      Grab the IRQ
          */
 
-        err = request_irq(dev->irq, mc32_interrupt, IRQF_SHARED | IRQF_SAMPLE_RANDOM, DRV_NAME, dev);
+        err = request_irq(dev->irq, mc32_interrupt, IRQF_SHARED, DRV_NAME, dev);
         if (err) {
                 release_region(dev->base_addr, MC32_IO_EXTENT);
                 pr_err("%s: unable to get IRQ %d.\n", DRV_NAME, dev->irq);
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index e31a6d1919c6..e1da258bbfb7 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -635,6 +635,9 @@ struct vortex_private {
                 must_free_region:1,                             /* Flag: if zero, Cardbus owns the I/O region */
                 large_frames:1,                 /* accept large frames */
                 handling_irq:1;                 /* private in_irq indicator */
+        /* {get|set}_wol operations are already serialized by rtnl.
+         * no additional locking is required for the enable_wol and acpi_set_WOL()
+         */
         int drv_flags;
         u16 status_enable;
         u16 intr_enable;
@@ -2939,28 +2942,31 @@ static void vortex_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
         struct vortex_private *vp = netdev_priv(dev);
 
-        spin_lock_irq(&vp->lock);
+        if (!VORTEX_PCI(vp))
+                return;
+
         wol->supported = WAKE_MAGIC;
 
         wol->wolopts = 0;
         if (vp->enable_wol)
                 wol->wolopts |= WAKE_MAGIC;
-        spin_unlock_irq(&vp->lock);
 }
 
 static int vortex_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
         struct vortex_private *vp = netdev_priv(dev);
+
+        if (!VORTEX_PCI(vp))
+                return -EOPNOTSUPP;
+
         if (wol->wolopts & ~WAKE_MAGIC)
                 return -EINVAL;
 
-        spin_lock_irq(&vp->lock);
         if (wol->wolopts & WAKE_MAGIC)
                 vp->enable_wol = 1;
         else
                 vp->enable_wol = 0;
         acpi_set_WOL(dev);
-        spin_unlock_irq(&vp->lock);
 
         return 0;
 }
@@ -3202,6 +3208,9 @@ static void acpi_set_WOL(struct net_device *dev)
                         return;
                 }
 
+                if (VORTEX_PCI(vp)->current_state < PCI_D3hot)
+                        return;
+
                 /* Change the power state to D3; RxEnable doesn't take effect. */
                 pci_set_power_state(VORTEX_PCI(vp), PCI_D3hot);
         }
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 237d4ea5a416..ac422cd332ea 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -754,7 +754,7 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
         }
 
 #if CP_VLAN_TAG_USED
-        if (cp->vlgrp && vlan_tx_tag_present(skb))
+        if (vlan_tx_tag_present(skb))
                 vlan_tag = TxVlanTag | swab16(vlan_tx_tag_get(skb));
 #endif
 
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 53c4810b119e..d24f54b8c19a 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -177,6 +177,13 @@ config NET_SB1000
 
 source "drivers/net/arcnet/Kconfig"
 
+config MII
+        tristate "Generic Media Independent Interface device support"
+        help
+          Most ethernet controllers have MII transceiver either as an external
+          or internal device.  It is safe to say Y or M here even if your
+          ethernet card lacks MII.
+
 source "drivers/net/phy/Kconfig"
 
 #
@@ -212,13 +219,6 @@ menuconfig NET_ETHERNET
 
 if NET_ETHERNET
 
-config MII
-        tristate "Generic Media Independent Interface device support"
-        help
-          Most ethernet controllers have MII transceiver either as an external
-          or internal device.  It is safe to say Y or M here even if your
-          ethernet card lack MII.
-
 config MACB
         tristate "Atmel MACB support"
         depends on AVR32 || ARCH_AT91SAM9260 || ARCH_AT91SAM9263 || ARCH_AT91SAM9G20 || ARCH_AT91SAM9G45 || ARCH_AT91CAP9
@@ -2428,7 +2428,7 @@ config UGETH_TX_ON_DEMAND
 
 config MV643XX_ETH
         tristate "Marvell Discovery (643XX) and Orion ethernet support"
-        depends on MV64X60 || PPC32 || PLAT_ORION
+        depends on (MV64X60 || PPC32 || PLAT_ORION) && INET
         select INET_LRO
         select PHYLIB
         help
@@ -2515,6 +2515,18 @@ config S6GMAC
 
 source "drivers/net/stmmac/Kconfig"
 
+config PCH_GBE
+        tristate "PCH Gigabit Ethernet"
+        depends on PCI
+        ---help---
+          This is a gigabit ethernet driver for Topcliff PCH.
+          Topcliff PCH is the platform controller hub that is used in Intel's
+          general embedded platform.
+          Topcliff PCH has Gigabit Ethernet interface.
+          Using this interface, it is able to access system devices connected
+          to Gigabit Ethernet.
+          This driver enables Gigabit Ethernet function.
+
 endif # NETDEV_1000
 
 #
@@ -2803,7 +2815,7 @@ config NIU
 
 config PASEMI_MAC
         tristate "PA Semi 1/10Gbit MAC"
-        depends on PPC_PASEMI && PCI
+        depends on PPC_PASEMI && PCI && INET
         select PHYLIB
         select INET_LRO
         help
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 18a277709a2a..b8bf93d4a132 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -298,3 +298,4 @@ obj-$(CONFIG_WIMAX) += wimax/
 obj-$(CONFIG_CAIF) += caif/
 
 obj-$(CONFIG_OCTEON_MGMT_ETHERNET) += octeon/
+obj-$(CONFIG_PCH_GBE) += pch_gbe/
diff --git a/drivers/net/amd8111e.c b/drivers/net/amd8111e.c
index 58a0ab4923ee..2ca880b4c0db 100644
--- a/drivers/net/amd8111e.c
+++ b/drivers/net/amd8111e.c
@@ -1315,7 +1315,7 @@ static netdev_tx_t amd8111e_start_xmit(struct sk_buff *skb,
         lp->tx_ring[tx_index].tx_flags = 0;
 
 #if AMD8111E_VLAN_TAG_USED
-        if((lp->vlgrp != NULL) && vlan_tx_tag_present(skb)){
+        if (vlan_tx_tag_present(skb)) {
                 lp->tx_ring[tx_index].tag_ctrl_cmd |=
                                 cpu_to_le16(TCC_VLAN_INSERT);
                 lp->tx_ring[tx_index].tag_ctrl_info =
diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c
index 0362c8d31a08..10d0dba572c2 100644
--- a/drivers/net/appletalk/ipddp.c
+++ b/drivers/net/appletalk/ipddp.c
@@ -244,7 +244,7 @@ static int ipddp_delete(struct ipddp_route *rt)
         }
 
         spin_unlock_bh(&ipddp_route_lock);
-        return (-ENOENT);
+        return -ENOENT;
 }
 
 /*
@@ -259,10 +259,10 @@ static struct ipddp_route* __ipddp_find_route(struct ipddp_route *rt)
                 if(f->ip == rt->ip &&
                    f->at.s_net == rt->at.s_net &&
                    f->at.s_node == rt->at.s_node)
-                        return (f);
+                        return f;
         }
 
-        return (NULL);
+        return NULL;
 }
 
 static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -279,7 +279,7 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         switch(cmd)
         {
                 case SIOCADDIPDDPRT:
-                        return (ipddp_create(&rcp));
+                        return ipddp_create(&rcp);
 
                 case SIOCFINDIPDDPRT:
                         spin_lock_bh(&ipddp_route_lock);
@@ -297,7 +297,7 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                                 return -ENOENT;
 
                 case SIOCDELIPDDPRT:
-                        return (ipddp_delete(&rcp));
+                        return ipddp_delete(&rcp);
 
                 default:
                         return -EINVAL;
diff --git a/drivers/net/appletalk/ltpc.c b/drivers/net/appletalk/ltpc.c
index adc07551739e..e69eead12ec7 100644
--- a/drivers/net/appletalk/ltpc.c
+++ b/drivers/net/appletalk/ltpc.c
@@ -727,7 +727,7 @@ static int sendup_buffer (struct net_device *dev)
 
         if (ltc->command != LT_RCVLAP) {
                 printk("unknown command 0x%02x from ltpc card\n",ltc->command);
-                return(-1);
+                return -1;
         }
         dnode = ltc->dnode;
         snode = ltc->snode;
diff --git a/drivers/net/atarilance.c b/drivers/net/atarilance.c
index b57d7dee389a..3134e5326231 100644
--- a/drivers/net/atarilance.c
+++ b/drivers/net/atarilance.c
@@ -362,7 +362,7 @@ static void *slow_memcpy( void *dst, const void *src, size_t len )
                 *cto++ = *cfrom++;
                 MFPDELAY();
         }
-        return( dst );
+        return dst;
 }
 
 
@@ -449,7 +449,7 @@ static noinline int __init addr_accessible(volatile void *regp, int wordflag,
         vbr[2] = save_berr;
         local_irq_restore(flags);
 
-        return( ret );
+        return ret;
 }
 
 static const struct net_device_ops lance_netdev_ops = {
@@ -526,7 +526,7 @@ static unsigned long __init lance_probe1( struct net_device *dev,
         goto probe_ok;
 
   probe_fail:
-        return( 0 );
+        return 0;
 
   probe_ok:
         lp = netdev_priv(dev);
@@ -556,7 +556,7 @@ static unsigned long __init lance_probe1( struct net_device *dev,
                 if (request_irq(IRQ_AUTO_5, lance_interrupt, IRQ_TYPE_PRIO,
                             "PAM/Riebl-ST Ethernet", dev)) {
                         printk( "Lance: request for irq %d failed\n", IRQ_AUTO_5 );
-                        return( 0 );
+                        return 0;
                 }
                 dev->irq = (unsigned short)IRQ_AUTO_5;
         }
@@ -568,12 +568,12 @@ static unsigned long __init lance_probe1( struct net_device *dev,
                 unsigned long irq = atari_register_vme_int();
                 if (!irq) {
                         printk( "Lance: request for VME interrupt failed\n" );
-                        return( 0 );
+                        return 0;
                 }
                 if (request_irq(irq, lance_interrupt, IRQ_TYPE_PRIO,
                             "Riebl-VME Ethernet", dev)) {
                         printk( "Lance: request for irq %ld failed\n", irq );
-                        return( 0 );
+                        return 0;
                 }
                 dev->irq = irq;
         }
@@ -637,7 +637,7 @@ static unsigned long __init lance_probe1( struct net_device *dev,
         /* XXX MSch */
         dev->watchdog_timeo = TX_TIMEOUT;
 
-        return( 1 );
+        return 1;
 }
 
 
@@ -666,7 +666,7 @@ static int lance_open( struct net_device *dev )
                 DPRINTK( 2, ( "lance_open(): opening %s failed, i=%d, csr0=%04x\n",
                                           dev->name, i, DREG ));
                 DREG = CSR0_STOP;
-                return( -EIO );
+                return -EIO;
         }
         DREG = CSR0_IDON;
         DREG = CSR0_STRT;
@@ -676,7 +676,7 @@ static int lance_open( struct net_device *dev )
 
         DPRINTK( 2, ( "%s: LANCE is open, csr0 %04x\n", dev->name, DREG ));
 
-        return( 0 );
+        return 0;
 }
 
 
@@ -1126,13 +1126,13 @@ static int lance_set_mac_address( struct net_device *dev, void *addr )
         int i;
 
         if (lp->cardtype != OLD_RIEBL && lp->cardtype != NEW_RIEBL)
-                return( -EOPNOTSUPP );
+                return -EOPNOTSUPP;
 
         if (netif_running(dev)) {
                 /* Only possible while card isn't started */
                 DPRINTK( 1, ( "%s: hwaddr can be set only while card isn't open.\n",
                                           dev->name ));
-                return( -EIO );
+                return -EIO;
         }
 
         memcpy( dev->dev_addr, saddr->sa_data, dev->addr_len );
@@ -1142,7 +1142,7 @@ static int lance_set_mac_address( struct net_device *dev, void *addr )
         /* set also the magic for future sessions */
         *RIEBL_MAGIC_ADDR = RIEBL_MAGIC;
 
-        return( 0 );
+        return 0;
 }
 
 
diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
index 553230eb365c..99ffcf667d1f 100644
--- a/drivers/net/atl1c/atl1c_main.c
+++ b/drivers/net/atl1c/atl1c_main.c
@@ -2243,7 +2243,7 @@ static netdev_tx_t atl1c_xmit_frame(struct sk_buff *skb,
                 return NETDEV_TX_OK;
         }
 
-        if (unlikely(adapter->vlgrp && vlan_tx_tag_present(skb))) {
+        if (unlikely(vlan_tx_tag_present(skb))) {
                 u16 vlan = vlan_tx_tag_get(skb);
                 __le16 tag;
 
diff --git a/drivers/net/atl1e/atl1e_main.c b/drivers/net/atl1e/atl1e_main.c
index 56ace3fbe40d..ef6349bf3b33 100644
--- a/drivers/net/atl1e/atl1e_main.c
+++ b/drivers/net/atl1e/atl1e_main.c
@@ -1814,7 +1814,7 @@ static netdev_tx_t atl1e_xmit_frame(struct sk_buff *skb,
 
         tpd = atl1e_get_tpd(adapter);
 
-        if (unlikely(adapter->vlgrp && vlan_tx_tag_present(skb))) {
+        if (unlikely(vlan_tx_tag_present(skb))) {
                 u16 vlan_tag = vlan_tx_tag_get(skb);
                 u16 atl1e_vlan_tag;
 
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index e1e0171d6e62..dbd27b8e66bd 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -1251,6 +1251,12 @@ static void atl1_free_ring_resources(struct atl1_adapter *adapter)
 
         rrd_ring->desc = NULL;
         rrd_ring->dma = 0;
+
+        adapter->cmb.dma = 0;
+        adapter->cmb.cmb = NULL;
+
+        adapter->smb.dma = 0;
+        adapter->smb.smb = NULL;
 }
 
 static void atl1_setup_mac_ctrl(struct atl1_adapter *adapter)
@@ -2094,9 +2100,9 @@ static u16 atl1_tpd_avail(struct atl1_tpd_ring *tpd_ring)
 {
         u16 next_to_clean = atomic_read(&tpd_ring->next_to_clean);
         u16 next_to_use = atomic_read(&tpd_ring->next_to_use);
-        return ((next_to_clean > next_to_use) ?
+        return (next_to_clean > next_to_use) ?
                 next_to_clean - next_to_use - 1 :
-                tpd_ring->count + next_to_clean - next_to_use - 1);
+                tpd_ring->count + next_to_clean - next_to_use - 1;
 }
 
 static int atl1_tso(struct atl1_adapter *adapter, struct sk_buff *skb,
@@ -2402,7 +2408,7 @@ static netdev_tx_t atl1_xmit_frame(struct sk_buff *skb,
                 (u16) atomic_read(&tpd_ring->next_to_use));
         memset(ptpd, 0, sizeof(struct tx_packet_desc));
 
-        if (adapter->vlgrp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 vlan_tag = vlan_tx_tag_get(skb);
                 vlan_tag = (vlan_tag << 4) | (vlan_tag >> 13) |
                         ((vlan_tag >> 9) & 0x8);
@@ -2847,10 +2853,11 @@ static int atl1_resume(struct pci_dev *pdev)
         pci_enable_wake(pdev, PCI_D3cold, 0);
 
         atl1_reset_hw(&adapter->hw);
-        adapter->cmb.cmb->int_stats = 0;
 
-        if (netif_running(netdev))
+        if (netif_running(netdev)) {
+                adapter->cmb.cmb->int_stats = 0;
                 atl1_up(adapter);
+        }
         netif_device_attach(netdev);
 
         return 0;
diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
index 29c0265ccc5d..35b14bec1207 100644
--- a/drivers/net/atlx/atl2.c
+++ b/drivers/net/atlx/atl2.c
@@ -870,7 +870,7 @@ static netdev_tx_t atl2_xmit_frame(struct sk_buff *skb,
                 offset = ((u32)(skb->len-copy_len + 3) & ~3);
         }
 #ifdef NETIF_F_HW_VLAN_TX
-        if (adapter->vlgrp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 u16 vlan_tag = vlan_tx_tag_get(skb);
                 vlan_tag = (vlan_tag << 4) |
                         (vlan_tag >> 13) |
diff --git a/drivers/net/ax88796.c b/drivers/net/ax88796.c
index 20e946b1e744..b6da4cf3694b 100644
--- a/drivers/net/ax88796.c
+++ b/drivers/net/ax88796.c
@@ -864,6 +864,7 @@ static int ax_probe(struct platform_device *pdev)
         res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
         if (res == NULL) {
                 dev_err(&pdev->dev, "no IRQ specified\n");
+                ret = -ENXIO;
                 goto exit_mem;
         }
 
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 8e7c8a8e61c7..171da7f75108 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -2296,18 +2296,27 @@ static int b44_resume(struct ssb_device *sdev)
         if (!netif_running(dev))
                 return 0;
 
+        spin_lock_irq(&bp->lock);
+        b44_init_rings(bp);
+        b44_init_hw(bp, B44_FULL_RESET);
+        spin_unlock_irq(&bp->lock);
+
+        /*
+         * As a shared interrupt, the handler can be called immediately. To be
+         * able to check the interrupt status the hardware must already be
+         * powered back on (b44_init_hw).
+         */
         rc = request_irq(dev->irq, b44_interrupt, IRQF_SHARED, dev->name, dev);
         if (rc) {
                 netdev_err(dev, "request_irq failed\n");
+                spin_lock_irq(&bp->lock);
+                b44_halt(bp);
+                b44_free_rings(bp);
+                spin_unlock_irq(&bp->lock);
                 return rc;
         }
 
-        spin_lock_irq(&bp->lock);
-
-        b44_init_rings(bp);
-        b44_init_hw(bp, B44_FULL_RESET);
         netif_device_attach(bp->dev);
-        spin_unlock_irq(&bp->lock);
 
         b44_enable_ints(bp);
         netif_wake_queue(dev);
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index 4faf6961dcec..4594a28b1f66 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -78,6 +78,8 @@ static inline char *nic_name(struct pci_dev *pdev)
 #define MCC_Q_LEN               128     /* total size not to exceed 8 pages */
 #define MCC_CQ_LEN              256
 
+#define MAX_RSS_QS              4       /* BE limit is 4 queues/port */
+#define BE_MAX_MSIX_VECTORS     (MAX_RSS_QS + 1 + 1)/* RSS qs + 1 def Rx + Tx */
 #define BE_NAPI_WEIGHT          64
 #define MAX_RX_POST             BE_NAPI_WEIGHT /* Frags posted at a time */
 #define RX_FRAGS_REFILL_WM      (RX_Q_LEN - MAX_RX_POST)
@@ -157,10 +159,9 @@ struct be_mcc_obj {
         bool rearm_cq;
 };
 
-struct be_drvr_stats {
+struct be_tx_stats {
         u32 be_tx_reqs;         /* number of TX requests initiated */
         u32 be_tx_stops;        /* number of times TX Q was stopped */
-        u32 be_fwd_reqs;        /* number of send reqs through forwarding i/f */
         u32 be_tx_wrbs;         /* number of tx WRBs used */
         u32 be_tx_events;       /* number of tx completion events  */
         u32 be_tx_compl;        /* number of tx completion entries processed */
@@ -169,35 +170,6 @@ struct be_drvr_stats {
         u64 be_tx_bytes_prev;
         u64 be_tx_pkts;
         u32 be_tx_rate;
-
-        u32 cache_barrier[16];
-
-        u32 be_ethrx_post_fail;/* number of ethrx buffer alloc failures */
-        u32 be_rx_polls;        /* number of times NAPI called poll function */
-        u32 be_rx_events;       /* number of ucast rx completion events  */
-        u32 be_rx_compl;        /* number of rx completion entries processed */
-        ulong be_rx_jiffies;
-        u64 be_rx_bytes;
-        u64 be_rx_bytes_prev;
-        u64 be_rx_pkts;
-        u32 be_rx_rate;
-        u32 be_rx_mcast_pkt;
-        /* number of non ether type II frames dropped where
-         * frame len > length field of Mac Hdr */
-        u32 be_802_3_dropped_frames;
-        /* number of non ether type II frames malformed where
-         * in frame len < length field of Mac Hdr */
-        u32 be_802_3_malformed_frames;
-        u32 be_rxcp_err;        /* Num rx completion entries w/ err set. */
-        ulong rx_fps_jiffies;   /* jiffies at last FPS calc */
-        u32 be_rx_frags;
-        u32 be_prev_rx_frags;
-        u32 be_rx_fps;          /* Rx frags per second */
-};
-
-struct be_stats_obj {
-        struct be_drvr_stats drvr_stats;
-        struct be_dma_mem cmd;
 };
 
 struct be_tx_obj {
@@ -215,10 +187,34 @@ struct be_rx_page_info {
         bool last_page_user;
 };
 
+struct be_rx_stats {
+        u32 rx_post_fail;/* number of ethrx buffer alloc failures */
+        u32 rx_polls;   /* number of times NAPI called poll function */
+        u32 rx_events;  /* number of ucast rx completion events  */
+        u32 rx_compl;   /* number of rx completion entries processed */
+        ulong rx_jiffies;
+        u64 rx_bytes;
+        u64 rx_bytes_prev;
+        u64 rx_pkts;
+        u32 rx_rate;
+        u32 rx_mcast_pkts;
+        u32 rxcp_err;   /* Num rx completion entries w/ err set. */
+        ulong rx_fps_jiffies;   /* jiffies at last FPS calc */
+        u32 rx_frags;
+        u32 prev_rx_frags;
+        u32 rx_fps;             /* Rx frags per second */
+};
+
 struct be_rx_obj {
+        struct be_adapter *adapter;
         struct be_queue_info q;
         struct be_queue_info cq;
         struct be_rx_page_info page_info_tbl[RX_Q_LEN];
+        struct be_eq_obj rx_eq;
+        struct be_rx_stats stats;
+        u8 rss_id;
+        bool rx_post_starved;   /* Zero rx frags have been posted to BE */
+        u32 cache_line_barrier[16];
 };
 
 struct be_vf_cfg {
@@ -229,7 +225,6 @@ struct be_vf_cfg {
         u32 vf_tx_rate;
 };
 
-#define BE_NUM_MSIX_VECTORS             2       /* 1 each for Tx and Rx */
 #define BE_INVALID_PMAC_ID              0xffffffff
 struct be_adapter {
         struct pci_dev *pdev;
@@ -249,29 +244,31 @@ struct be_adapter {
         spinlock_t mcc_lock;    /* For serializing mcc cmds to BE card */
         spinlock_t mcc_cq_lock;
 
-        struct msix_entry msix_entries[BE_NUM_MSIX_VECTORS];
+        struct msix_entry msix_entries[BE_MAX_MSIX_VECTORS];
         bool msix_enabled;
         bool isr_registered;
 
         /* TX Rings */
         struct be_eq_obj tx_eq;
         struct be_tx_obj tx_obj;
+        struct be_tx_stats tx_stats;
 
         u32 cache_line_break[8];
 
         /* Rx rings */
-        struct be_eq_obj rx_eq;
-        struct be_rx_obj rx_obj;
+        struct be_rx_obj rx_obj[MAX_RSS_QS + 1]; /* one default non-rss Q */
+        u32 num_rx_qs;
         u32 big_page_size;      /* Compounded page size shared by rx wrbs */
-        bool rx_post_starved;   /* Zero rx frags have been posted to BE */
 
         struct vlan_group *vlan_grp;
         u16 vlans_added;
         u16 max_vlans;  /* Number of vlans supported */
-        u8 vlan_tag[VLAN_GROUP_ARRAY_LEN];
+        u8 vlan_tag[VLAN_N_VID];
+        u8 vlan_prio_bmap;      /* Available Priority BitMap */
+        u16 recommended_prio;   /* Recommended Priority */
         struct be_dma_mem mc_cmd_mem;
 
-        struct be_stats_obj stats;
+        struct be_dma_mem stats_cmd;
         /* Work queue used to perform periodic tasks like getting statistics */
         struct delayed_work work;
 
@@ -287,6 +284,7 @@ struct be_adapter {
         bool promiscuous;
         bool wol;
         u32 function_mode;
+        u32 function_caps;
         u32 rx_fc;              /* Rx flow control */
         u32 tx_fc;              /* Tx flow control */
         bool ue_detected;
@@ -313,10 +311,20 @@ struct be_adapter {
 
 extern const struct ethtool_ops be_ethtool_ops;
 
-#define drvr_stats(adapter)             (&adapter->stats.drvr_stats)
+#define tx_stats(adapter)               (&adapter->tx_stats)
+#define rx_stats(rxo)                   (&rxo->stats)
 
 #define BE_SET_NETDEV_OPS(netdev, ops)  (netdev->netdev_ops = ops)
 
+#define for_all_rx_queues(adapter, rxo, i)                              \
+        for (i = 0, rxo = &adapter->rx_obj[i]; i < adapter->num_rx_qs;  \
+                i++, rxo++)
+
+/* Just skip the first default non-rss queue */
+#define for_all_rss_queues(adapter, rxo, i)                             \
+        for (i = 0, rxo = &adapter->rx_obj[i+1]; i < (adapter->num_rx_qs - 1);\
+                i++, rxo++)
+
 #define PAGE_SHIFT_4K           12
 #define PAGE_SIZE_4K            (1 << PAGE_SHIFT_4K)
 
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 34abcc9403d6..1e7f305ed00b 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -71,7 +71,7 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
         if (compl_status == MCC_STATUS_SUCCESS) {
                 if (compl->tag0 == OPCODE_ETH_GET_STATISTICS) {
                         struct be_cmd_resp_get_stats *resp =
-                                                adapter->stats.cmd.va;
+                                                adapter->stats_cmd.va;
                         be_dws_le_to_cpu(&resp->hw_stats,
                                                 sizeof(resp->hw_stats));
                         netdev_stats_update(adapter);
@@ -96,11 +96,62 @@ static void be_async_link_state_process(struct be_adapter *adapter,
                 evt->port_link_status == ASYNC_EVENT_LINK_UP);
 }
 
+/* Grp5 CoS Priority evt */
+static void be_async_grp5_cos_priority_process(struct be_adapter *adapter,
+                struct be_async_event_grp5_cos_priority *evt)
+{
+        if (evt->valid) {
+                adapter->vlan_prio_bmap = evt->available_priority_bmap;
+                adapter->recommended_prio =
+                        evt->reco_default_priority << VLAN_PRIO_SHIFT;
+        }
+}
+
+/* Grp5 QOS Speed evt */
+static void be_async_grp5_qos_speed_process(struct be_adapter *adapter,
+                struct be_async_event_grp5_qos_link_speed *evt)
+{
+        if (evt->physical_port == adapter->port_num) {
+                /* qos_link_speed is in units of 10 Mbps */
+                adapter->link_speed = evt->qos_link_speed * 10;
+        }
+}
+
+static void be_async_grp5_evt_process(struct be_adapter *adapter,
+                u32 trailer, struct be_mcc_compl *evt)
+{
+        u8 event_type = 0;
+
+        event_type = (trailer >> ASYNC_TRAILER_EVENT_TYPE_SHIFT) &
+                ASYNC_TRAILER_EVENT_TYPE_MASK;
+
+        switch (event_type) {
+        case ASYNC_EVENT_COS_PRIORITY:
+                be_async_grp5_cos_priority_process(adapter,
+                (struct be_async_event_grp5_cos_priority *)evt);
+        break;
+        case ASYNC_EVENT_QOS_SPEED:
+                be_async_grp5_qos_speed_process(adapter,
+                (struct be_async_event_grp5_qos_link_speed *)evt);
+        break;
+        default:
+                dev_warn(&adapter->pdev->dev, "Unknown grp5 event!\n");
+                break;
+        }
+}
+
 static inline bool is_link_state_evt(u32 trailer)
 {
+        return ((trailer >> ASYNC_TRAILER_EVENT_CODE_SHIFT) &
+                ASYNC_TRAILER_EVENT_CODE_MASK) ==
+                                ASYNC_EVENT_CODE_LINK_STATE;
+}
+
+static inline bool is_grp5_evt(u32 trailer)
+{
         return (((trailer >> ASYNC_TRAILER_EVENT_CODE_SHIFT) &
                 ASYNC_TRAILER_EVENT_CODE_MASK) ==
-                                ASYNC_EVENT_CODE_LINK_STATE);
+                                ASYNC_EVENT_CODE_GRP_5);
 }
 
 static struct be_mcc_compl *be_mcc_compl_get(struct be_adapter *adapter)
@@ -143,6 +194,9 @@ int be_process_mcc(struct be_adapter *adapter, int *status)
                         if (is_link_state_evt(compl->flags))
                                 be_async_link_state_process(adapter,
                                 (struct be_async_event_link_state *) compl);
+                        else if (is_grp5_evt(compl->flags))
+                                be_async_grp5_evt_process(adapter,
+                                compl->flags, compl);
                 } else if (compl->flags & CQE_FLAGS_COMPLETED_MASK) {
                                 *status = be_mcc_compl_process(adapter, compl);
                                 atomic_dec(&mcc_obj->q.used);
@@ -677,10 +731,10 @@ int be_cmd_mccq_create(struct be_adapter *adapter,
         ctxt = &req->context;
 
         be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-                        OPCODE_COMMON_MCC_CREATE);
+                        OPCODE_COMMON_MCC_CREATE_EXT);
 
         be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-                        OPCODE_COMMON_MCC_CREATE, sizeof(*req));
+                        OPCODE_COMMON_MCC_CREATE_EXT, sizeof(*req));
 
         req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
 
@@ -688,7 +742,8 @@ int be_cmd_mccq_create(struct be_adapter *adapter,
         AMAP_SET_BITS(struct amap_mcc_context, ring_size, ctxt,
                 be_encoded_q_len(mccq->len));
         AMAP_SET_BITS(struct amap_mcc_context, cq_id, ctxt, cq->id);
-
+        /* Subscribe to Link State and Group 5 Events(bits 1 and 5 set) */
+        req->async_event_bitmap[0] |= 0x00000022;
         be_dws_cpu_to_le(ctxt, sizeof(req->context));
 
         be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
@@ -754,7 +809,7 @@ int be_cmd_txq_create(struct be_adapter *adapter,
 /* Uses mbox */
 int be_cmd_rxq_create(struct be_adapter *adapter,
                 struct be_queue_info *rxq, u16 cq_id, u16 frag_size,
-                u16 max_frame_size, u32 if_id, u32 rss)
+                u16 max_frame_size, u32 if_id, u32 rss, u8 *rss_id)
 {
         struct be_mcc_wrb *wrb;
         struct be_cmd_req_eth_rx_create *req;
@@ -785,6 +840,7 @@ int be_cmd_rxq_create(struct be_adapter *adapter,
                 struct be_cmd_resp_eth_rx_create *resp = embedded_payload(wrb);
                 rxq->id = le16_to_cpu(resp->id);
                 rxq->created = true;
+                *rss_id = resp->rss_id;
         }
 
         spin_unlock(&adapter->mbox_lock);
@@ -1259,7 +1315,8 @@ err:
 }
 
 /* Uses mbox */
-int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num, u32 *mode)
+int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num,
+                u32 *mode, u32 *caps)
 {
         struct be_mcc_wrb *wrb;
         struct be_cmd_req_query_fw_cfg *req;
@@ -1281,6 +1338,7 @@ int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num, u32 *mode)
                 struct be_cmd_resp_query_fw_cfg *resp = embedded_payload(wrb);
                 *port_num = le32_to_cpu(resp->phys_port);
                 *mode = le32_to_cpu(resp->function_mode);
+                *caps = le32_to_cpu(resp->function_caps);
         }
 
         spin_unlock(&adapter->mbox_lock);
@@ -1311,6 +1369,37 @@ int be_cmd_reset_function(struct be_adapter *adapter)
         return status;
 }
 
+int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable, u16 table_size)
+{
+        struct be_mcc_wrb *wrb;
+        struct be_cmd_req_rss_config *req;
+        u32 myhash[10];
+        int status;
+
+        spin_lock(&adapter->mbox_lock);
+
+        wrb = wrb_from_mbox(adapter);
+        req = embedded_payload(wrb);
+
+        be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
+                OPCODE_ETH_RSS_CONFIG);
+
+        be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
+                OPCODE_ETH_RSS_CONFIG, sizeof(*req));
+
+        req->if_id = cpu_to_le32(adapter->if_handle);
+        req->enable_rss = cpu_to_le16(RSS_ENABLE_TCP_IPV4 | RSS_ENABLE_IPV4);
+        req->cpu_table_size_log2 = cpu_to_le16(fls(table_size) - 1);
+        memcpy(req->cpu_table, rsstable, table_size);
+        memcpy(req->hash, myhash, sizeof(myhash));
+        be_dws_cpu_to_le(req->hash, sizeof(req->hash));
+
+        status = be_mbox_notify_wait(adapter);
+
+        spin_unlock(&adapter->mbox_lock);
+        return status;
+}
+
 /* Uses sync mcc */
 int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num,
                         u8 bcn, u8 sts, u8 state)
diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
index ad1e6fac60c5..c7f6cdfe1c73 100644
--- a/drivers/net/benet/be_cmds.h
+++ b/drivers/net/benet/be_cmds.h
@@ -82,7 +82,12 @@ struct be_mcc_compl {
  */
 #define ASYNC_TRAILER_EVENT_CODE_SHIFT  8       /* bits 8 - 15 */
 #define ASYNC_TRAILER_EVENT_CODE_MASK   0xFF
+#define ASYNC_TRAILER_EVENT_TYPE_SHIFT  16
+#define ASYNC_TRAILER_EVENT_TYPE_MASK   0xFF
 #define ASYNC_EVENT_CODE_LINK_STATE     0x1
+#define ASYNC_EVENT_CODE_GRP_5          0x5
+#define ASYNC_EVENT_QOS_SPEED           0x1
+#define ASYNC_EVENT_COS_PRIORITY        0x2
 struct be_async_event_trailer {
         u32 code;
 };
@@ -105,6 +110,30 @@ struct be_async_event_link_state {
         struct be_async_event_trailer trailer;
 } __packed;
 
+/* When the event code of an async trailer is GRP-5 and event_type is QOS_SPEED
+ * the mcc_compl must be interpreted as follows
+ */
+struct be_async_event_grp5_qos_link_speed {
+        u8 physical_port;
+        u8 rsvd[5];
+        u16 qos_link_speed;
+        u32 event_tag;
+        struct be_async_event_trailer trailer;
+} __packed;
+
+/* When the event code of an async trailer is GRP5 and event type is
+ * CoS-Priority, the mcc_compl must be interpreted as follows
+ */
+struct be_async_event_grp5_cos_priority {
+        u8 physical_port;
+        u8 available_priority_bmap;
+        u8 reco_default_priority;
+        u8 valid;
+        u8 rsvd0;
+        u8 event_tag;
+        struct be_async_event_trailer trailer;
+} __packed;
+
 struct be_mcc_mailbox {
         struct be_mcc_wrb wrb;
         struct be_mcc_compl compl;
@@ -123,8 +152,9 @@ struct be_mcc_mailbox {
 #define OPCODE_COMMON_WRITE_FLASHROM                    7
 #define OPCODE_COMMON_CQ_CREATE                         12
 #define OPCODE_COMMON_EQ_CREATE                         13
-#define OPCODE_COMMON_MCC_CREATE                        21
+#define OPCODE_COMMON_MCC_CREATE                        21
 #define OPCODE_COMMON_SET_QOS                           28
+#define OPCODE_COMMON_MCC_CREATE_EXT                    90
 #define OPCODE_COMMON_SEEPROM_READ                      30
 #define OPCODE_COMMON_NTWK_RX_FILTER                    34
 #define OPCODE_COMMON_GET_FW_VERSION                    35
@@ -147,6 +177,7 @@ struct be_mcc_mailbox {
 #define OPCODE_COMMON_READ_TRANSRECV_DATA               73
 #define OPCODE_COMMON_GET_PHY_DETAILS                   102
 
+#define OPCODE_ETH_RSS_CONFIG                           1
 #define OPCODE_ETH_ACPI_CONFIG                          2
 #define OPCODE_ETH_PROMISCUOUS                          3
 #define OPCODE_ETH_GET_STATISTICS                       4
@@ -337,6 +368,7 @@ struct be_cmd_req_mcc_create {
         struct be_cmd_req_hdr hdr;
         u16 num_pages;
         u16 rsvd0;
+        u32 async_event_bitmap[1];
         u8 context[sizeof(struct amap_mcc_context) / 8];
         struct phys_addr pages[8];
 } __packed;
@@ -409,7 +441,7 @@ struct be_cmd_req_eth_rx_create {
 struct be_cmd_resp_eth_rx_create {
         struct be_cmd_resp_hdr hdr;
         u16 id;
-        u8 cpu_id;
+        u8 rss_id;
         u8 rsvd0;
 } __packed;
 
@@ -739,9 +771,10 @@ struct be_cmd_resp_modify_eq_delay {
 } __packed;
 
 /******************** Get FW Config *******************/
+#define BE_FUNCTION_CAPS_RSS                    0x2
 struct be_cmd_req_query_fw_cfg {
         struct be_cmd_req_hdr hdr;
-        u32 rsvd[30];
+        u32 rsvd[31];
 };
 
 struct be_cmd_resp_query_fw_cfg {
@@ -751,6 +784,26 @@ struct be_cmd_resp_query_fw_cfg {
         u32 phys_port;
         u32 function_mode;
         u32 rsvd[26];
+        u32 function_caps;
+};
+
+/******************** RSS Config *******************/
+/* RSS types */
+#define RSS_ENABLE_NONE                         0x0
+#define RSS_ENABLE_IPV4                         0x1
+#define RSS_ENABLE_TCP_IPV4                     0x2
+#define RSS_ENABLE_IPV6                         0x4
+#define RSS_ENABLE_TCP_IPV6                     0x8
+
+struct be_cmd_req_rss_config {
+        struct be_cmd_req_hdr hdr;
+        u32 if_id;
+        u16 enable_rss;
+        u16 cpu_table_size_log2;
+        u32 hash[10];
+        u8 cpu_table[128];
+        u8 flush;
+        u8 rsvd0[3];
 };
 
 /******************** Port Beacon ***************************/
@@ -937,7 +990,7 @@ extern int be_cmd_txq_create(struct be_adapter *adapter,
 extern int be_cmd_rxq_create(struct be_adapter *adapter,
                         struct be_queue_info *rxq, u16 cq_id,
                         u16 frag_size, u16 max_frame_size, u32 if_id,
-                        u32 rss);
+                        u32 rss, u8 *rss_id);
 extern int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
                         int type);
 extern int be_cmd_link_status_query(struct be_adapter *adapter,
@@ -960,8 +1013,10 @@ extern int be_cmd_set_flow_control(struct be_adapter *adapter,
 extern int be_cmd_get_flow_control(struct be_adapter *adapter,
                         u32 *tx_fc, u32 *rx_fc);
 extern int be_cmd_query_fw_cfg(struct be_adapter *adapter,
-                        u32 *port_num, u32 *cap);
+                        u32 *port_num, u32 *function_mode, u32 *function_caps);
 extern int be_cmd_reset_function(struct be_adapter *adapter);
+extern int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable,
+                        u16 table_size);
 extern int be_process_mcc(struct be_adapter *adapter, int *status);
 extern int be_cmd_set_beacon_state(struct be_adapter *adapter,
                         u8 port_num, u8 beacon, u8 status, u8 state);
diff --git a/drivers/net/benet/be_ethtool.c b/drivers/net/benet/be_ethtool.c
index d92063420c25..0f46366ecc48 100644
--- a/drivers/net/benet/be_ethtool.c
+++ b/drivers/net/benet/be_ethtool.c
@@ -26,14 +26,16 @@ struct be_ethtool_stat {
         int offset;
 };
 
-enum {NETSTAT, PORTSTAT, MISCSTAT, DRVSTAT, ERXSTAT};
+enum {NETSTAT, PORTSTAT, MISCSTAT, DRVSTAT_TX, DRVSTAT_RX, ERXSTAT};
 #define FIELDINFO(_struct, field) FIELD_SIZEOF(_struct, field), \
                                         offsetof(_struct, field)
 #define NETSTAT_INFO(field)     #field, NETSTAT,\
                                         FIELDINFO(struct net_device_stats,\
                                                 field)
-#define DRVSTAT_INFO(field)     #field, DRVSTAT,\
-                                        FIELDINFO(struct be_drvr_stats, field)
+#define DRVSTAT_TX_INFO(field)  #field, DRVSTAT_TX,\
+                                        FIELDINFO(struct be_tx_stats, field)
+#define DRVSTAT_RX_INFO(field)  #field, DRVSTAT_RX,\
+                                        FIELDINFO(struct be_rx_stats, field)
 #define MISCSTAT_INFO(field)    #field, MISCSTAT,\
                                         FIELDINFO(struct be_rxf_stats, field)
 #define PORTSTAT_INFO(field)    #field, PORTSTAT,\
@@ -51,21 +53,12 @@ static const struct be_ethtool_stat et_stats[] = {
         {NETSTAT_INFO(tx_errors)},
         {NETSTAT_INFO(rx_dropped)},
         {NETSTAT_INFO(tx_dropped)},
-        {DRVSTAT_INFO(be_tx_reqs)},
-        {DRVSTAT_INFO(be_tx_stops)},
-        {DRVSTAT_INFO(be_fwd_reqs)},
-        {DRVSTAT_INFO(be_tx_wrbs)},
-        {DRVSTAT_INFO(be_rx_polls)},
-        {DRVSTAT_INFO(be_tx_events)},
-        {DRVSTAT_INFO(be_rx_events)},
-        {DRVSTAT_INFO(be_tx_compl)},
-        {DRVSTAT_INFO(be_rx_compl)},
-        {DRVSTAT_INFO(be_rx_mcast_pkt)},
-        {DRVSTAT_INFO(be_ethrx_post_fail)},
-        {DRVSTAT_INFO(be_802_3_dropped_frames)},
-        {DRVSTAT_INFO(be_802_3_malformed_frames)},
-        {DRVSTAT_INFO(be_tx_rate)},
-        {DRVSTAT_INFO(be_rx_rate)},
+        {DRVSTAT_TX_INFO(be_tx_rate)},
+        {DRVSTAT_TX_INFO(be_tx_reqs)},
+        {DRVSTAT_TX_INFO(be_tx_wrbs)},
+        {DRVSTAT_TX_INFO(be_tx_stops)},
+        {DRVSTAT_TX_INFO(be_tx_events)},
+        {DRVSTAT_TX_INFO(be_tx_compl)},
         {PORTSTAT_INFO(rx_unicast_frames)},
         {PORTSTAT_INFO(rx_multicast_frames)},
         {PORTSTAT_INFO(rx_broadcast_frames)},
@@ -106,11 +99,24 @@ static const struct be_ethtool_stat et_stats[] = {
         {MISCSTAT_INFO(rx_drops_too_many_frags)},
         {MISCSTAT_INFO(rx_drops_invalid_ring)},
         {MISCSTAT_INFO(forwarded_packets)},
-        {MISCSTAT_INFO(rx_drops_mtu)},
-        {ERXSTAT_INFO(rx_drops_no_fragments)},
+        {MISCSTAT_INFO(rx_drops_mtu)}
 };
 #define ETHTOOL_STATS_NUM ARRAY_SIZE(et_stats)
 
+/* Stats related to multi RX queues */
+static const struct be_ethtool_stat et_rx_stats[] = {
+        {DRVSTAT_RX_INFO(rx_bytes)},
+        {DRVSTAT_RX_INFO(rx_pkts)},
+        {DRVSTAT_RX_INFO(rx_rate)},
+        {DRVSTAT_RX_INFO(rx_polls)},
+        {DRVSTAT_RX_INFO(rx_events)},
+        {DRVSTAT_RX_INFO(rx_compl)},
+        {DRVSTAT_RX_INFO(rx_mcast_pkts)},
+        {DRVSTAT_RX_INFO(rx_post_fail)},
+        {ERXSTAT_INFO(rx_drops_no_fragments)}
+};
+#define ETHTOOL_RXSTATS_NUM (ARRAY_SIZE(et_rx_stats))
+
 static const char et_self_tests[][ETH_GSTRING_LEN] = {
         "MAC Loopback test",
         "PHY Loopback test",
@@ -143,7 +149,7 @@ static int
 be_get_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
-        struct be_eq_obj *rx_eq = &adapter->rx_eq;
+        struct be_eq_obj *rx_eq = &adapter->rx_obj[0].rx_eq;
         struct be_eq_obj *tx_eq = &adapter->tx_eq;
 
         coalesce->rx_coalesce_usecs = rx_eq->cur_eqd;
@@ -167,25 +173,49 @@ static int
 be_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
-        struct be_eq_obj *rx_eq = &adapter->rx_eq;
+        struct be_rx_obj *rxo;
+        struct be_eq_obj *rx_eq;
         struct be_eq_obj *tx_eq = &adapter->tx_eq;
         u32 tx_max, tx_min, tx_cur;
         u32 rx_max, rx_min, rx_cur;
-        int status = 0;
+        int status = 0, i;
 
         if (coalesce->use_adaptive_tx_coalesce == 1)
                 return -EINVAL;
 
-        /* if AIC is being turned on now, start with an EQD of 0 */
-        if (rx_eq->enable_aic == 0 &&
-                coalesce->use_adaptive_rx_coalesce == 1) {
-                rx_eq->cur_eqd = 0;
+        for_all_rx_queues(adapter, rxo, i) {
+                rx_eq = &rxo->rx_eq;
+
+                if (!rx_eq->enable_aic && coalesce->use_adaptive_rx_coalesce)
+                        rx_eq->cur_eqd = 0;
+                rx_eq->enable_aic = coalesce->use_adaptive_rx_coalesce;
+
+                rx_max = coalesce->rx_coalesce_usecs_high;
+                rx_min = coalesce->rx_coalesce_usecs_low;
+                rx_cur = coalesce->rx_coalesce_usecs;
+
+                if (rx_eq->enable_aic) {
+                        if (rx_max > BE_MAX_EQD)
+                                rx_max = BE_MAX_EQD;
+                        if (rx_min > rx_max)
+                                rx_min = rx_max;
+                        rx_eq->max_eqd = rx_max;
+                        rx_eq->min_eqd = rx_min;
+                        if (rx_eq->cur_eqd > rx_max)
+                                rx_eq->cur_eqd = rx_max;
+                        if (rx_eq->cur_eqd < rx_min)
+                                rx_eq->cur_eqd = rx_min;
+                } else {
+                        if (rx_cur > BE_MAX_EQD)
+                                rx_cur = BE_MAX_EQD;
+                        if (rx_eq->cur_eqd != rx_cur) {
+                                status = be_cmd_modify_eqd(adapter, rx_eq->q.id,
+                                                rx_cur);
+                                if (!status)
+                                        rx_eq->cur_eqd = rx_cur;
+                        }
+                }
         }
-        rx_eq->enable_aic = coalesce->use_adaptive_rx_coalesce;
-
-        rx_max = coalesce->rx_coalesce_usecs_high;
-        rx_min = coalesce->rx_coalesce_usecs_low;
-        rx_cur = coalesce->rx_coalesce_usecs;
 
         tx_max = coalesce->tx_coalesce_usecs_high;
         tx_min = coalesce->tx_coalesce_usecs_low;
@@ -199,27 +229,6 @@ be_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
                         tx_eq->cur_eqd = tx_cur;
         }
 
-        if (rx_eq->enable_aic) {
-                if (rx_max > BE_MAX_EQD)
-                        rx_max = BE_MAX_EQD;
-                if (rx_min > rx_max)
-                        rx_min = rx_max;
-                rx_eq->max_eqd = rx_max;
-                rx_eq->min_eqd = rx_min;
-                if (rx_eq->cur_eqd > rx_max)
-                        rx_eq->cur_eqd = rx_max;
-                if (rx_eq->cur_eqd < rx_min)
-                        rx_eq->cur_eqd = rx_min;
-        } else {
-                if (rx_cur > BE_MAX_EQD)
-                        rx_cur = BE_MAX_EQD;
-                if (rx_eq->cur_eqd != rx_cur) {
-                        status = be_cmd_modify_eqd(adapter, rx_eq->q.id,
-                                        rx_cur);
-                        if (!status)
-                                rx_eq->cur_eqd = rx_cur;
-                }
-        }
         return 0;
 }
 
@@ -247,32 +256,25 @@ be_get_ethtool_stats(struct net_device *netdev,
                 struct ethtool_stats *stats, uint64_t *data)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
-        struct be_drvr_stats *drvr_stats = &adapter->stats.drvr_stats;
-        struct be_hw_stats *hw_stats = hw_stats_from_cmd(adapter->stats.cmd.va);
-        struct be_rxf_stats *rxf_stats = &hw_stats->rxf;
-        struct be_port_rxf_stats *port_stats =
-                        &rxf_stats->port[adapter->port_num];
-        struct net_device_stats *net_stats = &netdev->stats;
+        struct be_hw_stats *hw_stats = hw_stats_from_cmd(adapter->stats_cmd.va);
         struct be_erx_stats *erx_stats = &hw_stats->erx;
+        struct be_rx_obj *rxo;
         void *p = NULL;
-        int i;
+        int i, j;
 
         for (i = 0; i < ETHTOOL_STATS_NUM; i++) {
                 switch (et_stats[i].type) {
                 case NETSTAT:
-                        p = net_stats;
+                        p = &netdev->stats;
                         break;
-                case DRVSTAT:
-                        p = drvr_stats;
+                case DRVSTAT_TX:
+                        p = &adapter->tx_stats;
                         break;
                 case PORTSTAT:
-                        p = port_stats;
+                        p = &hw_stats->rxf.port[adapter->port_num];
                         break;
                 case MISCSTAT:
-                        p = rxf_stats;
-                        break;
-                case ERXSTAT: /* Currently only one ERX stat is provided */
-                        p = (u32 *)erx_stats + adapter->rx_obj.q.id;
+                        p = &hw_stats->rxf;
                         break;
                 }
 
@@ -280,19 +282,44 @@ be_get_ethtool_stats(struct net_device *netdev,
                 data[i] = (et_stats[i].size == sizeof(u64)) ?
                                 *(u64 *)p: *(u32 *)p;
         }
+
+        for_all_rx_queues(adapter, rxo, j) {
+                for (i = 0; i < ETHTOOL_RXSTATS_NUM; i++) {
+                        switch (et_rx_stats[i].type) {
+                        case DRVSTAT_RX:
+                                p = (u8 *)&rxo->stats + et_rx_stats[i].offset;
+                                break;
+                        case ERXSTAT:
+                                p = (u32 *)erx_stats + rxo->q.id;
+                                break;
+                        }
+                        data[ETHTOOL_STATS_NUM + j * ETHTOOL_RXSTATS_NUM + i] =
+                                (et_rx_stats[i].size == sizeof(u64)) ?
+                                        *(u64 *)p: *(u32 *)p;
+                }
+        }
 }
 
 static void
 be_get_stat_strings(struct net_device *netdev, uint32_t stringset,
                 uint8_t *data)
 {
-        int i;
+        struct be_adapter *adapter = netdev_priv(netdev);
+        int i, j;
+
         switch (stringset) {
         case ETH_SS_STATS:
                 for (i = 0; i < ETHTOOL_STATS_NUM; i++) {
                         memcpy(data, et_stats[i].desc, ETH_GSTRING_LEN);
                         data += ETH_GSTRING_LEN;
                 }
+                for (i = 0; i < adapter->num_rx_qs; i++) {
+                        for (j = 0; j < ETHTOOL_RXSTATS_NUM; j++) {
+                                sprintf(data, "rxq%d: %s", i,
+                                        et_rx_stats[j].desc);
+                                data += ETH_GSTRING_LEN;
+                        }
+                }
                 break;
         case ETH_SS_TEST:
                 for (i = 0; i < ETHTOOL_TESTS_NUM; i++) {
@@ -305,11 +332,14 @@ be_get_stat_strings(struct net_device *netdev, uint32_t stringset,
 
 static int be_get_sset_count(struct net_device *netdev, int stringset)
 {
+        struct be_adapter *adapter = netdev_priv(netdev);
+
         switch (stringset) {
         case ETH_SS_TEST:
                 return ETHTOOL_TESTS_NUM;
         case ETH_SS_STATS:
-                return ETHTOOL_STATS_NUM;
+                return ETHTOOL_STATS_NUM +
+                        adapter->num_rx_qs * ETHTOOL_RXSTATS_NUM;
         default:
                 return -EINVAL;
         }
@@ -424,10 +454,10 @@ be_get_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
 
-        ring->rx_max_pending = adapter->rx_obj.q.len;
+        ring->rx_max_pending = adapter->rx_obj[0].q.len;
         ring->tx_max_pending = adapter->tx_obj.q.len;
 
-        ring->rx_pending = atomic_read(&adapter->rx_obj.q.used);
+        ring->rx_pending = atomic_read(&adapter->rx_obj[0].q.used);
         ring->tx_pending = atomic_read(&adapter->tx_obj.q.used);
 }
 
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 43a3a574e2e0..45b1f6635282 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -32,6 +32,10 @@ module_param(num_vfs, uint, S_IRUGO);
 MODULE_PARM_DESC(rx_frag_size, "Size of a fragment that holds rcvd data.");
 MODULE_PARM_DESC(num_vfs, "Number of PCI VFs to initialize");
 
+static bool multi_rxq = true;
+module_param(multi_rxq, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(multi_rxq, "Multi Rx Queue support. Enabled by default");
+
 static DEFINE_PCI_DEVICE_TABLE(be_dev_ids) = {
         { PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID1) },
         { PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID2) },
@@ -111,6 +115,11 @@ static char *ue_status_hi_desc[] = {
         "Unknown"
 };
 
+static inline bool be_multi_rxq(struct be_adapter *adapter)
+{
+        return (adapter->num_rx_qs > 1);
+}
+
 static void be_queue_free(struct be_adapter *adapter, struct be_queue_info *q)
 {
         struct be_dma_mem *mem = &q->dma_mem;
@@ -236,18 +245,27 @@ netdev_addr:
 
 void netdev_stats_update(struct be_adapter *adapter)
 {
-        struct be_hw_stats *hw_stats = hw_stats_from_cmd(adapter->stats.cmd.va);
+        struct be_hw_stats *hw_stats = hw_stats_from_cmd(adapter->stats_cmd.va);
         struct be_rxf_stats *rxf_stats = &hw_stats->rxf;
         struct be_port_rxf_stats *port_stats =
                         &rxf_stats->port[adapter->port_num];
         struct net_device_stats *dev_stats = &adapter->netdev->stats;
         struct be_erx_stats *erx_stats = &hw_stats->erx;
+        struct be_rx_obj *rxo;
+        int i;
 
-        dev_stats->rx_packets = drvr_stats(adapter)->be_rx_pkts;
-        dev_stats->tx_packets = drvr_stats(adapter)->be_tx_pkts;
-        dev_stats->rx_bytes = drvr_stats(adapter)->be_rx_bytes;
-        dev_stats->tx_bytes = drvr_stats(adapter)->be_tx_bytes;
-        dev_stats->multicast = drvr_stats(adapter)->be_rx_mcast_pkt;
+        memset(dev_stats, 0, sizeof(*dev_stats));
+        for_all_rx_queues(adapter, rxo, i) {
+                dev_stats->rx_packets += rx_stats(rxo)->rx_pkts;
+                dev_stats->rx_bytes += rx_stats(rxo)->rx_bytes;
+                dev_stats->multicast += rx_stats(rxo)->rx_mcast_pkts;
+                /*  no space in linux buffers: best possible approximation */
+                dev_stats->rx_dropped +=
+                        erx_stats->rx_drops_no_fragments[rxo->q.id];
+        }
+
+        dev_stats->tx_packets = tx_stats(adapter)->be_tx_pkts;
+        dev_stats->tx_bytes = tx_stats(adapter)->be_tx_bytes;
 
         /* bad pkts received */
         dev_stats->rx_errors = port_stats->rx_crc_errors +
@@ -264,18 +282,11 @@ void netdev_stats_update(struct be_adapter *adapter)
                 port_stats->rx_ip_checksum_errs +
                 port_stats->rx_udp_checksum_errs;
 
-        /*  no space in linux buffers: best possible approximation */
-        dev_stats->rx_dropped =
-                erx_stats->rx_drops_no_fragments[adapter->rx_obj.q.id];
-
         /* detailed rx errors */
         dev_stats->rx_length_errors = port_stats->rx_in_range_errors +
                 port_stats->rx_out_range_errors +
                 port_stats->rx_frame_too_long;
 
-        /* receive ring buffer overflow */
-        dev_stats->rx_over_errors = 0;
-
         dev_stats->rx_crc_errors = port_stats->rx_crc_errors;
 
         /* frame alignment errors */
@@ -286,23 +297,6 @@ void netdev_stats_update(struct be_adapter *adapter)
         dev_stats->rx_fifo_errors = port_stats->rx_fifo_overflow +
                                         port_stats->rx_input_fifo_overflow +
                                         rxf_stats->rx_drops_no_pbuf;
-        /* receiver missed packetd */
-        dev_stats->rx_missed_errors = 0;
-
-        /*  packet transmit problems */
-        dev_stats->tx_errors = 0;
-
-        /* no space available in linux */
-        dev_stats->tx_dropped = 0;
-
-        dev_stats->collisions = 0;
-
-        /* detailed tx_errors */
-        dev_stats->tx_aborted_errors = 0;
-        dev_stats->tx_carrier_errors = 0;
-        dev_stats->tx_fifo_errors = 0;
-        dev_stats->tx_heartbeat_errors = 0;
-        dev_stats->tx_window_errors = 0;
 }
 
 void be_link_status_update(struct be_adapter *adapter, bool link_up)
@@ -326,10 +320,10 @@ void be_link_status_update(struct be_adapter *adapter, bool link_up)
 }
 
 /* Update the EQ delay n BE based on the RX frags consumed / sec */
-static void be_rx_eqd_update(struct be_adapter *adapter)
+static void be_rx_eqd_update(struct be_adapter *adapter, struct be_rx_obj *rxo)
 {
-        struct be_eq_obj *rx_eq = &adapter->rx_eq;
-        struct be_drvr_stats *stats = &adapter->stats.drvr_stats;
+        struct be_eq_obj *rx_eq = &rxo->rx_eq;
+        struct be_rx_stats *stats = &rxo->stats;
         ulong now = jiffies;
         u32 eqd;
 
@@ -346,12 +340,12 @@ static void be_rx_eqd_update(struct be_adapter *adapter)
         if ((now - stats->rx_fps_jiffies) < HZ)
                 return;
 
-        stats->be_rx_fps = (stats->be_rx_frags - stats->be_prev_rx_frags) /
+        stats->rx_fps = (stats->rx_frags - stats->prev_rx_frags) /
                         ((now - stats->rx_fps_jiffies) / HZ);
 
         stats->rx_fps_jiffies = now;
-        stats->be_prev_rx_frags = stats->be_rx_frags;
-        eqd = stats->be_rx_fps / 110000;
+        stats->prev_rx_frags = stats->rx_frags;
+        eqd = stats->rx_fps / 110000;
         eqd = eqd << 3;
         if (eqd > rx_eq->max_eqd)
                 eqd = rx_eq->max_eqd;
@@ -378,7 +372,7 @@ static u32 be_calc_rate(u64 bytes, unsigned long ticks)
 
 static void be_tx_rate_update(struct be_adapter *adapter)
 {
-        struct be_drvr_stats *stats = drvr_stats(adapter);
+        struct be_tx_stats *stats = tx_stats(adapter);
         ulong now = jiffies;
 
         /* Wrapped around? */
@@ -400,7 +394,7 @@ static void be_tx_rate_update(struct be_adapter *adapter)
 static void be_tx_stats_update(struct be_adapter *adapter,
                         u32 wrb_cnt, u32 copied, u32 gso_segs, bool stopped)
 {
-        struct be_drvr_stats *stats = drvr_stats(adapter);
+        struct be_tx_stats *stats = tx_stats(adapter);
         stats->be_tx_reqs++;
         stats->be_tx_wrbs += wrb_cnt;
         stats->be_tx_bytes += copied;
@@ -435,9 +429,12 @@ static inline void wrb_fill(struct be_eth_wrb *wrb, u64 addr, int len)
         wrb->frag_len = len & ETH_WRB_FRAG_LEN_MASK;
 }
 
-static void wrb_fill_hdr(struct be_eth_hdr_wrb *hdr, struct sk_buff *skb,
-                bool vlan, u32 wrb_cnt, u32 len)
+static void wrb_fill_hdr(struct be_adapter *adapter, struct be_eth_hdr_wrb *hdr,
+                struct sk_buff *skb, u32 wrb_cnt, u32 len)
 {
+        u8 vlan_prio = 0;
+        u16 vlan_tag = 0;
+
         memset(hdr, 0, sizeof(*hdr));
 
         AMAP_SET_BITS(struct amap_eth_hdr_wrb, crc, hdr, 1);
@@ -455,10 +452,15 @@ static void wrb_fill_hdr(struct be_eth_hdr_wrb *hdr, struct sk_buff *skb,
                         AMAP_SET_BITS(struct amap_eth_hdr_wrb, udpcs, hdr, 1);
         }
 
-        if (vlan && vlan_tx_tag_present(skb)) {
+        if (adapter->vlan_grp && vlan_tx_tag_present(skb)) {
                 AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan, hdr, 1);
-                AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan_tag,
-                        hdr, vlan_tx_tag_get(skb));
+                vlan_tag = vlan_tx_tag_get(skb);
+                vlan_prio = (vlan_tag & VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
+                /* If vlan priority provided by OS is NOT in available bmap */
+                if (!(adapter->vlan_prio_bmap & (1 << vlan_prio)))
+                        vlan_tag = (vlan_tag & ~VLAN_PRIO_MASK) |
+                                        adapter->recommended_prio;
+                AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan_tag, hdr, vlan_tag);
         }
 
         AMAP_SET_BITS(struct amap_eth_hdr_wrb, event, hdr, 1);
@@ -538,8 +540,7 @@ static int make_tx_wrbs(struct be_adapter *adapter,
                 queue_head_inc(txq);
         }
 
-        wrb_fill_hdr(hdr, first_skb, adapter->vlan_grp ? true : false,
-                wrb_cnt, copied);
+        wrb_fill_hdr(adapter, hdr, first_skb, wrb_cnt, copied);
         be_dws_cpu_to_le(hdr, sizeof(*hdr));
 
         return copied;
@@ -632,7 +633,7 @@ static int be_vid_config(struct be_adapter *adapter, bool vf, u32 vf_num)
 
         if (adapter->vlans_added <= adapter->max_vlans)  {
                 /* Construct VLAN Table to give to HW */
-                for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
+                for (i = 0; i < VLAN_N_VID; i++) {
                         if (adapter->vlan_tag[i]) {
                                 vtag[ntags] = cpu_to_le16(i);
                                 ntags++;
@@ -651,14 +652,8 @@ static int be_vid_config(struct be_adapter *adapter, bool vf, u32 vf_num)
 static void be_vlan_register(struct net_device *netdev, struct vlan_group *grp)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
-        struct be_eq_obj *rx_eq = &adapter->rx_eq;
-        struct be_eq_obj *tx_eq = &adapter->tx_eq;
 
-        be_eq_notify(adapter, rx_eq->q.id, false, false, 0);
-        be_eq_notify(adapter, tx_eq->q.id, false, false, 0);
         adapter->vlan_grp = grp;
-        be_eq_notify(adapter, rx_eq->q.id, true, false, 0);
-        be_eq_notify(adapter, tx_eq->q.id, true, false, 0);
 }
 
 static void be_vlan_add_vid(struct net_device *netdev, u16 vid)
@@ -820,40 +815,38 @@ static int be_set_vf_tx_rate(struct net_device *netdev,
         return status;
 }
 
-static void be_rx_rate_update(struct be_adapter *adapter)
+static void be_rx_rate_update(struct be_rx_obj *rxo)
 {
-        struct be_drvr_stats *stats = drvr_stats(adapter);
+        struct be_rx_stats *stats = &rxo->stats;
         ulong now = jiffies;
 
         /* Wrapped around */
-        if (time_before(now, stats->be_rx_jiffies)) {
-                stats->be_rx_jiffies = now;
+        if (time_before(now, stats->rx_jiffies)) {
+                stats->rx_jiffies = now;
                 return;
         }
 
         /* Update the rate once in two seconds */
-        if ((now - stats->be_rx_jiffies) < 2 * HZ)
+        if ((now - stats->rx_jiffies) < 2 * HZ)
                 return;
 
-        stats->be_rx_rate = be_calc_rate(stats->be_rx_bytes
-                                          - stats->be_rx_bytes_prev,
-                                         now - stats->be_rx_jiffies);
-        stats->be_rx_jiffies = now;
-        stats->be_rx_bytes_prev = stats->be_rx_bytes;
+        stats->rx_rate = be_calc_rate(stats->rx_bytes - stats->rx_bytes_prev,
+                                now - stats->rx_jiffies);
+        stats->rx_jiffies = now;
+        stats->rx_bytes_prev = stats->rx_bytes;
 }
 
-static void be_rx_stats_update(struct be_adapter *adapter,
+static void be_rx_stats_update(struct be_rx_obj *rxo,
                 u32 pktsize, u16 numfrags, u8 pkt_type)
 {
-        struct be_drvr_stats *stats = drvr_stats(adapter);
-
-        stats->be_rx_compl++;
-        stats->be_rx_frags += numfrags;
-        stats->be_rx_bytes += pktsize;
-        stats->be_rx_pkts++;
+        struct be_rx_stats *stats = &rxo->stats;
 
+        stats->rx_compl++;
+        stats->rx_frags += numfrags;
+        stats->rx_bytes += pktsize;
+        stats->rx_pkts++;
         if (pkt_type == BE_MULTICAST_PACKET)
-                stats->be_rx_mcast_pkt++;
+                stats->rx_mcast_pkts++;
 }
 
 static inline bool do_pkt_csum(struct be_eth_rx_compl *rxcp, bool cso)
@@ -873,12 +866,14 @@ static inline bool do_pkt_csum(struct be_eth_rx_compl *rxcp, bool cso)
 }
 
 static struct be_rx_page_info *
-get_rx_page_info(struct be_adapter *adapter, u16 frag_idx)
+get_rx_page_info(struct be_adapter *adapter,
+                struct be_rx_obj *rxo,
+                u16 frag_idx)
 {
         struct be_rx_page_info *rx_page_info;
-        struct be_queue_info *rxq = &adapter->rx_obj.q;
+        struct be_queue_info *rxq = &rxo->q;
 
-        rx_page_info = &adapter->rx_obj.page_info_tbl[frag_idx];
+        rx_page_info = &rxo->page_info_tbl[frag_idx];
         BUG_ON(!rx_page_info->page);
 
         if (rx_page_info->last_page_user) {
@@ -893,9 +888,10 @@ get_rx_page_info(struct be_adapter *adapter, u16 frag_idx)
 
 /* Throwaway the data in the Rx completion */
 static void be_rx_compl_discard(struct be_adapter *adapter,
-                        struct be_eth_rx_compl *rxcp)
+                struct be_rx_obj *rxo,
+                struct be_eth_rx_compl *rxcp)
 {
-        struct be_queue_info *rxq = &adapter->rx_obj.q;
+        struct be_queue_info *rxq = &rxo->q;
         struct be_rx_page_info *page_info;
         u16 rxq_idx, i, num_rcvd;
 
@@ -903,7 +899,7 @@ static void be_rx_compl_discard(struct be_adapter *adapter,
         num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
 
         for (i = 0; i < num_rcvd; i++) {
-                page_info = get_rx_page_info(adapter, rxq_idx);
+                page_info = get_rx_page_info(adapter, rxo, rxq_idx);
                 put_page(page_info->page);
                 memset(page_info, 0, sizeof(*page_info));
                 index_inc(&rxq_idx, rxq->len);
@@ -914,11 +910,11 @@ static void be_rx_compl_discard(struct be_adapter *adapter,
  * skb_fill_rx_data forms a complete skb for an ether frame
  * indicated by rxcp.
  */
-static void skb_fill_rx_data(struct be_adapter *adapter,
+static void skb_fill_rx_data(struct be_adapter *adapter, struct be_rx_obj *rxo,
                         struct sk_buff *skb, struct be_eth_rx_compl *rxcp,
                         u16 num_rcvd)
 {
-        struct be_queue_info *rxq = &adapter->rx_obj.q;
+        struct be_queue_info *rxq = &rxo->q;
         struct be_rx_page_info *page_info;
         u16 rxq_idx, i, j;
         u32 pktsize, hdr_len, curr_frag_len, size;
@@ -929,7 +925,7 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
         pktsize = AMAP_GET_BITS(struct amap_eth_rx_compl, pktsize, rxcp);
         pkt_type = AMAP_GET_BITS(struct amap_eth_rx_compl, cast_enc, rxcp);
 
-        page_info = get_rx_page_info(adapter, rxq_idx);
+        page_info = get_rx_page_info(adapter, rxo, rxq_idx);
 
         start = page_address(page_info->page) + page_info->page_offset;
         prefetch(start);
@@ -967,7 +963,7 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
         for (i = 1, j = 0; i < num_rcvd; i++) {
                 size -= curr_frag_len;
                 index_inc(&rxq_idx, rxq->len);
-                page_info = get_rx_page_info(adapter, rxq_idx);
+                page_info = get_rx_page_info(adapter, rxo, rxq_idx);
 
                 curr_frag_len = min(size, rx_frag_size);
 
@@ -993,11 +989,12 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
         BUG_ON(j > MAX_SKB_FRAGS);
 
 done:
-        be_rx_stats_update(adapter, pktsize, num_rcvd, pkt_type);
+        be_rx_stats_update(rxo, pktsize, num_rcvd, pkt_type);
 }
 
 /* Process the RX completion indicated by rxcp when GRO is disabled */
 static void be_rx_compl_process(struct be_adapter *adapter,
+                        struct be_rx_obj *rxo,
                         struct be_eth_rx_compl *rxcp)
 {
         struct sk_buff *skb;
@@ -1014,11 +1011,11 @@ static void be_rx_compl_process(struct be_adapter *adapter,
         if (unlikely(!skb)) {
                 if (net_ratelimit())
                         dev_warn(&adapter->pdev->dev, "skb alloc failed\n");
-                be_rx_compl_discard(adapter, rxcp);
+                be_rx_compl_discard(adapter, rxo, rxcp);
                 return;
         }
 
-        skb_fill_rx_data(adapter, skb, rxcp, num_rcvd);
+        skb_fill_rx_data(adapter, rxo, skb, rxcp, num_rcvd);
 
         if (do_pkt_csum(rxcp, adapter->rx_csum))
                 skb_checksum_none_assert(skb);
@@ -1051,12 +1048,13 @@ static void be_rx_compl_process(struct be_adapter *adapter,
 
 /* Process the RX completion indicated by rxcp when GRO is enabled */
 static void be_rx_compl_process_gro(struct be_adapter *adapter,
-                        struct be_eth_rx_compl *rxcp)
+                struct be_rx_obj *rxo,
+                struct be_eth_rx_compl *rxcp)
 {
         struct be_rx_page_info *page_info;
         struct sk_buff *skb = NULL;
-        struct be_queue_info *rxq = &adapter->rx_obj.q;
-        struct be_eq_obj *eq_obj =  &adapter->rx_eq;
+        struct be_queue_info *rxq = &rxo->q;
+        struct be_eq_obj *eq_obj =  &rxo->rx_eq;
         u32 num_rcvd, pkt_size, remaining, vlanf, curr_frag_len;
         u16 i, rxq_idx = 0, vid, j;
         u8 vtm;
@@ -1080,13 +1078,13 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
 
         skb = napi_get_frags(&eq_obj->napi);
         if (!skb) {
-                be_rx_compl_discard(adapter, rxcp);
+                be_rx_compl_discard(adapter, rxo, rxcp);
                 return;
         }
 
         remaining = pkt_size;
         for (i = 0, j = -1; i < num_rcvd; i++) {
-                page_info = get_rx_page_info(adapter, rxq_idx);
+                page_info = get_rx_page_info(adapter, rxo, rxq_idx);
 
                 curr_frag_len = min(remaining, rx_frag_size);
 
@@ -1127,12 +1125,12 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
                 vlan_gro_frags(&eq_obj->napi, adapter->vlan_grp, vid);
         }
 
-        be_rx_stats_update(adapter, pkt_size, num_rcvd, pkt_type);
+        be_rx_stats_update(rxo, pkt_size, num_rcvd, pkt_type);
 }
 
-static struct be_eth_rx_compl *be_rx_compl_get(struct be_adapter *adapter)
+static struct be_eth_rx_compl *be_rx_compl_get(struct be_rx_obj *rxo)
 {
-        struct be_eth_rx_compl *rxcp = queue_tail_node(&adapter->rx_obj.cq);
+        struct be_eth_rx_compl *rxcp = queue_tail_node(&rxo->cq);
 
         if (rxcp->dw[offsetof(struct amap_eth_rx_compl, valid) / 32] == 0)
                 return NULL;
@@ -1140,7 +1138,7 @@ static struct be_eth_rx_compl *be_rx_compl_get(struct be_adapter *adapter)
         rmb();
         be_dws_le_to_cpu(rxcp, sizeof(*rxcp));
 
-        queue_tail_inc(&adapter->rx_obj.cq);
+        queue_tail_inc(&rxo->cq);
         return rxcp;
 }
 
@@ -1166,22 +1164,23 @@ static inline struct page *be_alloc_pages(u32 size)
  * Allocate a page, split it to fragments of size rx_frag_size and post as
  * receive buffers to BE
  */
-static void be_post_rx_frags(struct be_adapter *adapter)
+static void be_post_rx_frags(struct be_rx_obj *rxo)
 {
-        struct be_rx_page_info *page_info_tbl = adapter->rx_obj.page_info_tbl;
+        struct be_adapter *adapter = rxo->adapter;
+        struct be_rx_page_info *page_info_tbl = rxo->page_info_tbl;
         struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
-        struct be_queue_info *rxq = &adapter->rx_obj.q;
+        struct be_queue_info *rxq = &rxo->q;
         struct page *pagep = NULL;
         struct be_eth_rx_d *rxd;
         u64 page_dmaaddr = 0, frag_dmaaddr;
         u32 posted, page_offset = 0;
 
-        page_info = &page_info_tbl[rxq->head];
+        page_info = &rxo->page_info_tbl[rxq->head];
         for (posted = 0; posted < MAX_RX_POST && !page_info->page; posted++) {
                 if (!pagep) {
                         pagep = be_alloc_pages(adapter->big_page_size);
                         if (unlikely(!pagep)) {
-                                drvr_stats(adapter)->be_ethrx_post_fail++;
+                                rxo->stats.rx_post_fail++;
                                 break;
                         }
                         page_dmaaddr = pci_map_page(adapter->pdev, pagep, 0,
@@ -1220,7 +1219,7 @@ static void be_post_rx_frags(struct be_adapter *adapter)
                 be_rxq_notify(adapter, rxq->id, posted);
         } else if (atomic_read(&rxq->used) == 0) {
                 /* Let be_worker replenish when memory is available */
-                adapter->rx_post_starved = true;
+                rxo->rx_post_starved = true;
         }
 }
 
@@ -1323,17 +1322,17 @@ static void be_eq_clean(struct be_adapter *adapter,
                 be_eq_notify(adapter, eq_obj->q.id, false, true, num);
 }
 
-static void be_rx_q_clean(struct be_adapter *adapter)
+static void be_rx_q_clean(struct be_adapter *adapter, struct be_rx_obj *rxo)
 {
         struct be_rx_page_info *page_info;
-        struct be_queue_info *rxq = &adapter->rx_obj.q;
-        struct be_queue_info *rx_cq = &adapter->rx_obj.cq;
+        struct be_queue_info *rxq = &rxo->q;
+        struct be_queue_info *rx_cq = &rxo->cq;
         struct be_eth_rx_compl *rxcp;
         u16 tail;
 
         /* First cleanup pending rx completions */
-        while ((rxcp = be_rx_compl_get(adapter)) != NULL) {
-                be_rx_compl_discard(adapter, rxcp);
+        while ((rxcp = be_rx_compl_get(rxo)) != NULL) {
+                be_rx_compl_discard(adapter, rxo, rxcp);
                 be_rx_compl_reset(rxcp);
                 be_cq_notify(adapter, rx_cq->id, true, 1);
         }
@@ -1341,7 +1340,7 @@ static void be_rx_q_clean(struct be_adapter *adapter)
         /* Then free posted rx buffer that were not used */
         tail = (rxq->head + rxq->len - atomic_read(&rxq->used)) % rxq->len;
         for (; atomic_read(&rxq->used) > 0; index_inc(&tail, rxq->len)) {
-                page_info = get_rx_page_info(adapter, tail);
+                page_info = get_rx_page_info(adapter, rxo, tail);
                 put_page(page_info->page);
                 memset(page_info, 0, sizeof(*page_info));
         }
@@ -1519,92 +1518,101 @@ tx_eq_free:
 static void be_rx_queues_destroy(struct be_adapter *adapter)
 {
         struct be_queue_info *q;
-
-        q = &adapter->rx_obj.q;
-        if (q->created) {
-                be_cmd_q_destroy(adapter, q, QTYPE_RXQ);
-
-                /* After the rxq is invalidated, wait for a grace time
-                 * of 1ms for all dma to end and the flush compl to arrive
-                 */
-                mdelay(1);
-                be_rx_q_clean(adapter);
+        struct be_rx_obj *rxo;
+        int i;
+
+        for_all_rx_queues(adapter, rxo, i) {
+                q = &rxo->q;
+                if (q->created) {
+                        be_cmd_q_destroy(adapter, q, QTYPE_RXQ);
+                        /* After the rxq is invalidated, wait for a grace time
+                         * of 1ms for all dma to end and the flush compl to
+                         * arrive
+                         */
+                        mdelay(1);
+                        be_rx_q_clean(adapter, rxo);
+                }
+                be_queue_free(adapter, q);
+
+                q = &rxo->cq;
+                if (q->created)
+                        be_cmd_q_destroy(adapter, q, QTYPE_CQ);
+                be_queue_free(adapter, q);
+
+                /* Clear any residual events */
+                q = &rxo->rx_eq.q;
+                if (q->created) {
+                        be_eq_clean(adapter, &rxo->rx_eq);
+                        be_cmd_q_destroy(adapter, q, QTYPE_EQ);
+                }
+                be_queue_free(adapter, q);
         }
-        be_queue_free(adapter, q);
-
-        q = &adapter->rx_obj.cq;
-        if (q->created)
-                be_cmd_q_destroy(adapter, q, QTYPE_CQ);
-        be_queue_free(adapter, q);
-
-        /* Clear any residual events */
-        be_eq_clean(adapter, &adapter->rx_eq);
-
-        q = &adapter->rx_eq.q;
-        if (q->created)
-                be_cmd_q_destroy(adapter, q, QTYPE_EQ);
-        be_queue_free(adapter, q);
 }
 
 static int be_rx_queues_create(struct be_adapter *adapter)
 {
         struct be_queue_info *eq, *q, *cq;
-        int rc;
+        struct be_rx_obj *rxo;
+        int rc, i;
 
         adapter->big_page_size = (1 << get_order(rx_frag_size)) * PAGE_SIZE;
-        adapter->rx_eq.max_eqd = BE_MAX_EQD;
-        adapter->rx_eq.min_eqd = 0;
-        adapter->rx_eq.cur_eqd = 0;
-        adapter->rx_eq.enable_aic = true;
-
-        /* Alloc Rx Event queue */
-        eq = &adapter->rx_eq.q;
-        rc = be_queue_alloc(adapter, eq, EVNT_Q_LEN,
-                                sizeof(struct be_eq_entry));
-        if (rc)
-                return rc;
-
-        /* Ask BE to create Rx Event queue */
-        rc = be_cmd_eq_create(adapter, eq, adapter->rx_eq.cur_eqd);
-        if (rc)
-                goto rx_eq_free;
-
-        /* Alloc RX eth compl queue */
-        cq = &adapter->rx_obj.cq;
-        rc = be_queue_alloc(adapter, cq, RX_CQ_LEN,
-                        sizeof(struct be_eth_rx_compl));
-        if (rc)
-                goto rx_eq_destroy;
-
-        /* Ask BE to create Rx eth compl queue */
-        rc = be_cmd_cq_create(adapter, cq, eq, false, false, 3);
-        if (rc)
-                goto rx_cq_free;
-
-        /* Alloc RX eth queue */
-        q = &adapter->rx_obj.q;
-        rc = be_queue_alloc(adapter, q, RX_Q_LEN, sizeof(struct be_eth_rx_d));
-        if (rc)
-                goto rx_cq_destroy;
-
-        /* Ask BE to create Rx eth queue */
-        rc = be_cmd_rxq_create(adapter, q, cq->id, rx_frag_size,
-                BE_MAX_JUMBO_FRAME_SIZE, adapter->if_handle, false);
-        if (rc)
-                goto rx_q_free;
+        for_all_rx_queues(adapter, rxo, i) {
+                rxo->adapter = adapter;
+                rxo->rx_eq.max_eqd = BE_MAX_EQD;
+                rxo->rx_eq.enable_aic = true;
+
+                /* EQ */
+                eq = &rxo->rx_eq.q;
+                rc = be_queue_alloc(adapter, eq, EVNT_Q_LEN,
+                                        sizeof(struct be_eq_entry));
+                if (rc)
+                        goto err;
+
+                rc = be_cmd_eq_create(adapter, eq, rxo->rx_eq.cur_eqd);
+                if (rc)
+                        goto err;
+
+                /* CQ */
+                cq = &rxo->cq;
+                rc = be_queue_alloc(adapter, cq, RX_CQ_LEN,
+                                sizeof(struct be_eth_rx_compl));
+                if (rc)
+                        goto err;
+
+                rc = be_cmd_cq_create(adapter, cq, eq, false, false, 3);
+                if (rc)
+                        goto err;
+
+                /* Rx Q */
+                q = &rxo->q;
+                rc = be_queue_alloc(adapter, q, RX_Q_LEN,
+                                sizeof(struct be_eth_rx_d));
+                if (rc)
+                        goto err;
+
+                rc = be_cmd_rxq_create(adapter, q, cq->id, rx_frag_size,
+                        BE_MAX_JUMBO_FRAME_SIZE, adapter->if_handle,
+                        (i > 0) ? 1 : 0/* rss enable */, &rxo->rss_id);
+                if (rc)
+                        goto err;
+        }
+
+        if (be_multi_rxq(adapter)) {
+                u8 rsstable[MAX_RSS_QS];
+
+                for_all_rss_queues(adapter, rxo, i)
+                        rsstable[i] = rxo->rss_id;
+
+                rc = be_cmd_rss_config(adapter, rsstable,
+                        adapter->num_rx_qs - 1);
+                if (rc)
+                        goto err;
+        }
 
         return 0;
-rx_q_free:
-        be_queue_free(adapter, q);
-rx_cq_destroy:
-        be_cmd_q_destroy(adapter, cq, QTYPE_CQ);
-rx_cq_free:
-        be_queue_free(adapter, cq);
-rx_eq_destroy:
-        be_cmd_q_destroy(adapter, eq, QTYPE_EQ);
-rx_eq_free:
-        be_queue_free(adapter, eq);
-        return rc;
+err:
+        be_rx_queues_destroy(adapter);
+        return -1;
 }
 
 /* There are 8 evt ids per func. Retruns the evt id's bit number */
@@ -1616,24 +1624,31 @@ static inline int be_evt_bit_get(struct be_adapter *adapter, u32 eq_id)
 static irqreturn_t be_intx(int irq, void *dev)
 {
         struct be_adapter *adapter = dev;
-        int isr;
+        struct be_rx_obj *rxo;
+        int isr, i;
 
         isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
                 (adapter->tx_eq.q.id/ 8) * CEV_ISR_SIZE);
         if (!isr)
                 return IRQ_NONE;
 
-        event_handle(adapter, &adapter->tx_eq);
-        event_handle(adapter, &adapter->rx_eq);
+        if ((1 << be_evt_bit_get(adapter, adapter->tx_eq.q.id) & isr))
+                event_handle(adapter, &adapter->tx_eq);
+
+        for_all_rx_queues(adapter, rxo, i) {
+                if ((1 << be_evt_bit_get(adapter, rxo->rx_eq.q.id) & isr))
+                        event_handle(adapter, &rxo->rx_eq);
+        }
 
         return IRQ_HANDLED;
 }
 
 static irqreturn_t be_msix_rx(int irq, void *dev)
 {
-        struct be_adapter *adapter = dev;
+        struct be_rx_obj *rxo = dev;
+        struct be_adapter *adapter = rxo->adapter;
 
-        event_handle(adapter, &adapter->rx_eq);
+        event_handle(adapter, &rxo->rx_eq);
 
         return IRQ_HANDLED;
 }
@@ -1647,14 +1662,14 @@ static irqreturn_t be_msix_tx_mcc(int irq, void *dev)
         return IRQ_HANDLED;
 }
 
-static inline bool do_gro(struct be_adapter *adapter,
+static inline bool do_gro(struct be_adapter *adapter, struct be_rx_obj *rxo,
                         struct be_eth_rx_compl *rxcp)
 {
         int err = AMAP_GET_BITS(struct amap_eth_rx_compl, err, rxcp);
         int tcp_frame = AMAP_GET_BITS(struct amap_eth_rx_compl, tcpf, rxcp);
 
         if (err)
-                drvr_stats(adapter)->be_rxcp_err++;
+                rxo->stats.rxcp_err++;
 
         return (tcp_frame && !err) ? true : false;
 }
@@ -1662,29 +1677,29 @@ static inline bool do_gro(struct be_adapter *adapter,
 int be_poll_rx(struct napi_struct *napi, int budget)
 {
         struct be_eq_obj *rx_eq = container_of(napi, struct be_eq_obj, napi);
-        struct be_adapter *adapter =
-                container_of(rx_eq, struct be_adapter, rx_eq);
-        struct be_queue_info *rx_cq = &adapter->rx_obj.cq;
+        struct be_rx_obj *rxo = container_of(rx_eq, struct be_rx_obj, rx_eq);
+        struct be_adapter *adapter = rxo->adapter;
+        struct be_queue_info *rx_cq = &rxo->cq;
         struct be_eth_rx_compl *rxcp;
         u32 work_done;
 
-        adapter->stats.drvr_stats.be_rx_polls++;
+        rxo->stats.rx_polls++;
         for (work_done = 0; work_done < budget; work_done++) {
-                rxcp = be_rx_compl_get(adapter);
+                rxcp = be_rx_compl_get(rxo);
                 if (!rxcp)
                         break;
 
-                if (do_gro(adapter, rxcp))
-                        be_rx_compl_process_gro(adapter, rxcp);
+                if (do_gro(adapter, rxo, rxcp))
+                        be_rx_compl_process_gro(adapter, rxo, rxcp);
                 else
-                        be_rx_compl_process(adapter, rxcp);
+                        be_rx_compl_process(adapter, rxo, rxcp);
 
                 be_rx_compl_reset(rxcp);
         }
 
         /* Refill the queue */
-        if (atomic_read(&adapter->rx_obj.q.used) < RX_FRAGS_REFILL_WM)
-                be_post_rx_frags(adapter);
+        if (atomic_read(&rxo->q.used) < RX_FRAGS_REFILL_WM)
+                be_post_rx_frags(rxo);
 
         /* All consumed */
         if (work_done < budget) {
@@ -1738,8 +1753,8 @@ static int be_poll_tx_mcc(struct napi_struct *napi, int budget)
                         netif_wake_queue(adapter->netdev);
                 }
 
-                drvr_stats(adapter)->be_tx_events++;
-                drvr_stats(adapter)->be_tx_compl += tx_compl;
+                tx_stats(adapter)->be_tx_events++;
+                tx_stats(adapter)->be_tx_compl += tx_compl;
         }
 
         return 1;
@@ -1788,20 +1803,24 @@ static void be_worker(struct work_struct *work)
 {
         struct be_adapter *adapter =
                 container_of(work, struct be_adapter, work.work);
+        struct be_rx_obj *rxo;
+        int i;
 
         if (!adapter->stats_ioctl_sent)
-                be_cmd_get_stats(adapter, &adapter->stats.cmd);
-
-        /* Set EQ delay */
-        be_rx_eqd_update(adapter);
+                be_cmd_get_stats(adapter, &adapter->stats_cmd);
 
         be_tx_rate_update(adapter);
-        be_rx_rate_update(adapter);
 
-        if (adapter->rx_post_starved) {
-                adapter->rx_post_starved = false;
-                be_post_rx_frags(adapter);
+        for_all_rx_queues(adapter, rxo, i) {
+                be_rx_rate_update(rxo);
+                be_rx_eqd_update(adapter, rxo);
+
+                if (rxo->rx_post_starved) {
+                        rxo->rx_post_starved = false;
+                        be_post_rx_frags(rxo);
+                }
         }
+
         if (!adapter->ue_detected)
                 be_detect_dump_ue(adapter);
 
@@ -1816,17 +1835,45 @@ static void be_msix_disable(struct be_adapter *adapter)
         }
 }
 
+static int be_num_rxqs_get(struct be_adapter *adapter)
+{
+        if (multi_rxq && (adapter->function_caps & BE_FUNCTION_CAPS_RSS) &&
+                !adapter->sriov_enabled && !(adapter->function_mode & 0x400)) {
+                return 1 + MAX_RSS_QS; /* one default non-RSS queue */
+        } else {
+                dev_warn(&adapter->pdev->dev,
+                        "No support for multiple RX queues\n");
+                return 1;
+        }
+}
+
 static void be_msix_enable(struct be_adapter *adapter)
 {
+#define BE_MIN_MSIX_VECTORS     (1 + 1) /* Rx + Tx */
         int i, status;
 
-        for (i = 0; i < BE_NUM_MSIX_VECTORS; i++)
+        adapter->num_rx_qs = be_num_rxqs_get(adapter);
+
+        for (i = 0; i < (adapter->num_rx_qs + 1); i++)
                 adapter->msix_entries[i].entry = i;
 
         status = pci_enable_msix(adapter->pdev, adapter->msix_entries,
-                BE_NUM_MSIX_VECTORS);
-        if (status == 0)
-                adapter->msix_enabled = true;
+                        adapter->num_rx_qs + 1);
+        if (status == 0) {
+                goto done;
+        } else if (status >= BE_MIN_MSIX_VECTORS) {
+                if (pci_enable_msix(adapter->pdev, adapter->msix_entries,
+                                status) == 0) {
+                        adapter->num_rx_qs = status - 1;
+                        dev_warn(&adapter->pdev->dev,
+                                "Could alloc only %d MSIx vectors. "
+                                "Using %d RX Qs\n", status, adapter->num_rx_qs);
+                        goto done;
+                }
+        }
+        return;
+done:
+        adapter->msix_enabled = true;
 }
 
 static void be_sriov_enable(struct be_adapter *adapter)
@@ -1860,38 +1907,50 @@ static inline int be_msix_vec_get(struct be_adapter *adapter, u32 eq_id)
 
 static int be_request_irq(struct be_adapter *adapter,
                 struct be_eq_obj *eq_obj,
-                void *handler, char *desc)
+                void *handler, char *desc, void *context)
 {
         struct net_device *netdev = adapter->netdev;
         int vec;
 
         sprintf(eq_obj->desc, "%s-%s", netdev->name, desc);
         vec = be_msix_vec_get(adapter, eq_obj->q.id);
-        return request_irq(vec, handler, 0, eq_obj->desc, adapter);
+        return request_irq(vec, handler, 0, eq_obj->desc, context);
 }
 
-static void be_free_irq(struct be_adapter *adapter, struct be_eq_obj *eq_obj)
+static void be_free_irq(struct be_adapter *adapter, struct be_eq_obj *eq_obj,
+                        void *context)
 {
         int vec = be_msix_vec_get(adapter, eq_obj->q.id);
-        free_irq(vec, adapter);
+        free_irq(vec, context);
 }
 
 static int be_msix_register(struct be_adapter *adapter)
 {
-        int status;
+        struct be_rx_obj *rxo;
+        int status, i;
+        char qname[10];
 
-        status = be_request_irq(adapter, &adapter->tx_eq, be_msix_tx_mcc, "tx");
+        status = be_request_irq(adapter, &adapter->tx_eq, be_msix_tx_mcc, "tx",
+                                adapter);
         if (status)
                 goto err;
 
-        status = be_request_irq(adapter, &adapter->rx_eq, be_msix_rx, "rx");
-        if (status)
-                goto free_tx_irq;
+        for_all_rx_queues(adapter, rxo, i) {
+                sprintf(qname, "rxq%d", i);
+                status = be_request_irq(adapter, &rxo->rx_eq, be_msix_rx,
+                                qname, rxo);
+                if (status)
+                        goto err_msix;
+        }
 
         return 0;
 
-free_tx_irq:
-        be_free_irq(adapter, &adapter->tx_eq);
+err_msix:
+        be_free_irq(adapter, &adapter->tx_eq, adapter);
+
+        for (i--, rxo = &adapter->rx_obj[i]; i >= 0; i--, rxo--)
+                be_free_irq(adapter, &rxo->rx_eq, rxo);
+
 err:
         dev_warn(&adapter->pdev->dev,
                 "MSIX Request IRQ failed - err %d\n", status);
@@ -1931,6 +1990,8 @@ done:
 static void be_irq_unregister(struct be_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
+        struct be_rx_obj *rxo;
+        int i;
 
         if (!adapter->isr_registered)
                 return;
@@ -1942,8 +2003,11 @@ static void be_irq_unregister(struct be_adapter *adapter)
         }
 
         /* MSIx */
-        be_free_irq(adapter, &adapter->tx_eq);
-        be_free_irq(adapter, &adapter->rx_eq);
+        be_free_irq(adapter, &adapter->tx_eq, adapter);
+
+        for_all_rx_queues(adapter, rxo, i)
+                be_free_irq(adapter, &rxo->rx_eq, rxo);
+
 done:
         adapter->isr_registered = false;
 }
@@ -1951,9 +2015,9 @@ done:
 static int be_close(struct net_device *netdev)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
-        struct be_eq_obj *rx_eq = &adapter->rx_eq;
+        struct be_rx_obj *rxo;
         struct be_eq_obj *tx_eq = &adapter->tx_eq;
-        int vec;
+        int vec, i;
 
         cancel_delayed_work_sync(&adapter->work);
 
@@ -1968,14 +2032,19 @@ static int be_close(struct net_device *netdev)
         if (adapter->msix_enabled) {
                 vec = be_msix_vec_get(adapter, tx_eq->q.id);
                 synchronize_irq(vec);
-                vec = be_msix_vec_get(adapter, rx_eq->q.id);
-                synchronize_irq(vec);
+
+                for_all_rx_queues(adapter, rxo, i) {
+                        vec = be_msix_vec_get(adapter, rxo->rx_eq.q.id);
+                        synchronize_irq(vec);
+                }
         } else {
                 synchronize_irq(netdev->irq);
         }
         be_irq_unregister(adapter);
 
-        napi_disable(&rx_eq->napi);
+        for_all_rx_queues(adapter, rxo, i)
+                napi_disable(&rxo->rx_eq.napi);
+
         napi_disable(&tx_eq->napi);
 
         /* Wait for all pending tx completions to arrive so that
@@ -1989,17 +2058,17 @@ static int be_close(struct net_device *netdev)
 static int be_open(struct net_device *netdev)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
-        struct be_eq_obj *rx_eq = &adapter->rx_eq;
         struct be_eq_obj *tx_eq = &adapter->tx_eq;
+        struct be_rx_obj *rxo;
         bool link_up;
-        int status;
+        int status, i;
         u8 mac_speed;
         u16 link_speed;
 
-        /* First time posting */
-        be_post_rx_frags(adapter);
-
-        napi_enable(&rx_eq->napi);
+        for_all_rx_queues(adapter, rxo, i) {
+                be_post_rx_frags(rxo);
+                napi_enable(&rxo->rx_eq.napi);
+        }
         napi_enable(&tx_eq->napi);
 
         be_irq_register(adapter);
@@ -2007,12 +2076,12 @@ static int be_open(struct net_device *netdev)
         be_intr_set(adapter, true);
 
         /* The evt queues are created in unarmed state; arm them */
-        be_eq_notify(adapter, rx_eq->q.id, true, false, 0);
+        for_all_rx_queues(adapter, rxo, i) {
+                be_eq_notify(adapter, rxo->rx_eq.q.id, true, false, 0);
+                be_cq_notify(adapter, rxo->cq.id, true, 0);
+        }
         be_eq_notify(adapter, tx_eq->q.id, true, false, 0);
 
-        /* Rx compl queue may be in unarmed state; rearm it */
-        be_cq_notify(adapter, adapter->rx_obj.cq.id, true, 0);
-
         /* Now that interrupts are on we can process async mcc */
         be_async_mcc_enable(adapter);
 
@@ -2088,7 +2157,7 @@ static int be_setup_wol(struct be_adapter *adapter, bool enable)
 static inline int be_vf_eth_addr_config(struct be_adapter *adapter)
 {
         u32 vf = 0;
-        int status;
+        int status = 0;
         u8 mac[ETH_ALEN];
 
         be_vf_eth_addr_generate(adapter, mac);
@@ -2134,6 +2203,11 @@ static int be_setup(struct be_adapter *adapter)
                                 BE_IF_FLAGS_PROMISCUOUS |
                                 BE_IF_FLAGS_PASS_L3L4_ERRORS;
                 en_flags |= BE_IF_FLAGS_PASS_L3L4_ERRORS;
+
+                if (be_multi_rxq(adapter)) {
+                        cap_flags |= BE_IF_FLAGS_RSS;
+                        en_flags |= BE_IF_FLAGS_RSS;
+                }
         }
 
         status = be_cmd_if_create(adapter, cap_flags, en_flags,
@@ -2455,6 +2529,8 @@ static struct net_device_ops be_netdev_ops = {
 static void be_netdev_init(struct net_device *netdev)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
+        struct be_rx_obj *rxo;
+        int i;
 
         netdev->features |= NETIF_F_SG | NETIF_F_HW_VLAN_RX | NETIF_F_TSO |
                 NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER | NETIF_F_HW_CSUM |
@@ -2476,8 +2552,10 @@ static void be_netdev_init(struct net_device *netdev)
 
         SET_ETHTOOL_OPS(netdev, &be_ethtool_ops);
 
-        netif_napi_add(netdev, &adapter->rx_eq.napi, be_poll_rx,
-                BE_NAPI_WEIGHT);
+        for_all_rx_queues(adapter, rxo, i)
+                netif_napi_add(netdev, &rxo->rx_eq.napi, be_poll_rx,
+                                BE_NAPI_WEIGHT);
+
         netif_napi_add(netdev, &adapter->tx_eq.napi, be_poll_tx_mcc,
                 BE_NAPI_WEIGHT);
 
@@ -2611,8 +2689,7 @@ done:
 
 static void be_stats_cleanup(struct be_adapter *adapter)
 {
-        struct be_stats_obj *stats = &adapter->stats;
-        struct be_dma_mem *cmd = &stats->cmd;
+        struct be_dma_mem *cmd = &adapter->stats_cmd;
 
         if (cmd->va)
                 pci_free_consistent(adapter->pdev, cmd->size,
@@ -2621,8 +2698,7 @@ static void be_stats_cleanup(struct be_adapter *adapter)
 
 static int be_stats_init(struct be_adapter *adapter)
 {
-        struct be_stats_obj *stats = &adapter->stats;
-        struct be_dma_mem *cmd = &stats->cmd;
+        struct be_dma_mem *cmd = &adapter->stats_cmd;
 
         cmd->size = sizeof(struct be_cmd_req_get_stats);
         cmd->va = pci_alloc_consistent(adapter->pdev, cmd->size, &cmd->dma);
@@ -2667,8 +2743,8 @@ static int be_get_config(struct be_adapter *adapter)
         if (status)
                 return status;
 
-        status = be_cmd_query_fw_cfg(adapter,
-                                &adapter->port_num, &adapter->function_mode);
+        status = be_cmd_query_fw_cfg(adapter, &adapter->port_num,
+                        &adapter->function_mode, &adapter->function_caps);
         if (status)
                 return status;
 
@@ -2703,7 +2779,6 @@ static int __devinit be_probe(struct pci_dev *pdev,
         struct be_adapter *adapter;
         struct net_device *netdev;
 
-
         status = pci_enable_device(pdev);
         if (status)
                 goto do_none;
@@ -2736,11 +2811,8 @@ static int __devinit be_probe(struct pci_dev *pdev,
         adapter->pdev = pdev;
         pci_set_drvdata(pdev, adapter);
         adapter->netdev = netdev;
-        be_netdev_init(netdev);
         SET_NETDEV_DEV(netdev, &pdev->dev);
 
-        be_msix_enable(adapter);
-
         status = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
         if (!status) {
                 netdev->features |= NETIF_F_HIGHDMA;
@@ -2784,12 +2856,15 @@ static int __devinit be_probe(struct pci_dev *pdev,
         if (status)
                 goto stats_clean;
 
+        be_msix_enable(adapter);
+
         INIT_DELAYED_WORK(&adapter->work, be_worker);
 
         status = be_setup(adapter);
         if (status)
-                goto stats_clean;
+                goto msix_disable;
 
+        be_netdev_init(netdev);
         status = register_netdev(netdev);
         if (status != 0)
                 goto unsetup;
@@ -2799,12 +2874,13 @@ static int __devinit be_probe(struct pci_dev *pdev,
 
 unsetup:
         be_clear(adapter);
+msix_disable:
+        be_msix_disable(adapter);
 stats_clean:
         be_stats_cleanup(adapter);
 ctrl_clean:
         be_ctrl_cleanup(adapter);
 free_netdev:
-        be_msix_disable(adapter);
         be_sriov_disable(adapter);
         free_netdev(adapter->netdev);
         pci_set_drvdata(pdev, NULL);
diff --git a/drivers/net/bmac.c b/drivers/net/bmac.c
index 9322699bb31c..a1b8c8b8010b 100644
--- a/drivers/net/bmac.c
+++ b/drivers/net/bmac.c
@@ -1581,7 +1581,7 @@ bmac_proc_info(char *buffer, char **start, off_t offset, int length)
         int i;
 
         if (bmac_devs == NULL)
-                return (-ENOSYS);
+                return -ENOSYS;
 
         len += sprintf(buffer, "BMAC counters & registers\n");
 
diff --git a/drivers/net/bna/bfa_ioc.c b/drivers/net/bna/bfa_ioc.c
index caa45c2185e9..e94e5aa97515 100644
--- a/drivers/net/bna/bfa_ioc.c
+++ b/drivers/net/bna/bfa_ioc.c
@@ -65,7 +65,7 @@
                         (!list_empty(&((__ioc)->mbox_mod.cmd_q)) || \
                         readl((__ioc)->ioc_regs.hfn_mbox_cmd))
 
-bool bfa_nw_auto_recover = true;
+static bool bfa_nw_auto_recover = true;
 
 /*
  * forward declarations
@@ -1276,12 +1276,6 @@ bfa_nw_ioc_auto_recover(bool auto_recover)
         bfa_nw_auto_recover = auto_recover;
 }
 
-bool
-bfa_nw_ioc_is_operational(struct bfa_ioc *ioc)
-{
-        return bfa_fsm_cmp_state(ioc, bfa_ioc_sm_op);
-}
-
 static void
 bfa_ioc_msgget(struct bfa_ioc *ioc, void *mbmsg)
 {
@@ -1514,7 +1508,7 @@ bfa_nw_ioc_mbox_isr(struct bfa_ioc *ioc)
                 return;
         }
 
-        if ((mc > BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
+        if ((mc >= BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
                 return;
 
         mod->mbhdlr[mc].cbfn(mod->mbhdlr[mc].cbarg, &m);
diff --git a/drivers/net/bna/bfa_ioc.h b/drivers/net/bna/bfa_ioc.h
index 7f0719e17efc..a73d84ec808c 100644
--- a/drivers/net/bna/bfa_ioc.h
+++ b/drivers/net/bna/bfa_ioc.h
@@ -271,7 +271,6 @@ void bfa_nw_ioc_enable(struct bfa_ioc *ioc);
 void bfa_nw_ioc_disable(struct bfa_ioc *ioc);
 
 void bfa_nw_ioc_error_isr(struct bfa_ioc *ioc);
-bool bfa_nw_ioc_is_operational(struct bfa_ioc *ioc);
 
 void bfa_nw_ioc_get_attr(struct bfa_ioc *ioc, struct bfa_ioc_attr *ioc_attr);
 void bfa_nw_ioc_hbfail_register(struct bfa_ioc *ioc,
diff --git a/drivers/net/bna/bfa_ioc_ct.c b/drivers/net/bna/bfa_ioc_ct.c
index 462857cbab9b..121cfd6d48b1 100644
--- a/drivers/net/bna/bfa_ioc_ct.c
+++ b/drivers/net/bna/bfa_ioc_ct.c
@@ -34,7 +34,7 @@ static void bfa_ioc_ct_notify_hbfail(struct bfa_ioc *ioc);
 static void bfa_ioc_ct_ownership_reset(struct bfa_ioc *ioc);
 static enum bfa_status bfa_ioc_ct_pll_init(void __iomem *rb, bool fcmode);
 
-struct bfa_ioc_hwif nw_hwif_ct;
+static struct bfa_ioc_hwif nw_hwif_ct;
 
 /**
  * Called from bfa_ioc_attach() to map asic specific calls.
diff --git a/drivers/net/bna/bfa_sm.h b/drivers/net/bna/bfa_sm.h
index 1d3d975d6f68..46462c49b6f9 100644
--- a/drivers/net/bna/bfa_sm.h
+++ b/drivers/net/bna/bfa_sm.h
@@ -77,7 +77,7 @@ typedef void (*bfa_fsm_t)(void *fsm, int event);
         ((_fsm)->fsm == (bfa_fsm_t)(_state))
 
 static inline int
-bfa_sm_to_state(struct bfa_sm_table *smt, bfa_sm_t sm)
+bfa_sm_to_state(const struct bfa_sm_table *smt, bfa_sm_t sm)
 {
         int     i = 0;
 
diff --git a/drivers/net/bna/bna.h b/drivers/net/bna/bna.h
index 6a2b3291c190..df6676bbc84e 100644
--- a/drivers/net/bna/bna.h
+++ b/drivers/net/bna/bna.h
@@ -19,8 +19,7 @@
 #include "bfi_ll.h"
 #include "bna_types.h"
 
-extern u32 bna_dim_vector[][BNA_BIAS_T_MAX];
-extern u32 bna_napi_dim_vector[][BNA_BIAS_T_MAX];
+extern const u32 bna_napi_dim_vector[][BNA_BIAS_T_MAX];
 
 /**
  *
@@ -344,9 +343,6 @@ do {									\
  * BNA
  */
 
-/* Internal APIs */
-void bna_adv_res_req(struct bna_res_info *res_info);
-
 /* APIs for BNAD */
 void bna_res_req(struct bna_res_info *res_info);
 void bna_init(struct bna *bna, struct bnad *bnad,
@@ -354,7 +350,6 @@ void bna_init(struct bna *bna, struct bnad *bnad,
                         struct bna_res_info *res_info);
 void bna_uninit(struct bna *bna);
 void bna_stats_get(struct bna *bna);
-void bna_stats_clr(struct bna *bna);
 void bna_get_perm_mac(struct bna *bna, u8 *mac);
 
 /* APIs for Rx */
@@ -376,18 +371,6 @@ void bna_rit_mod_seg_put(struct bna_rit_mod *rit_mod,
  * DEVICE
  */
 
-/* Interanl APIs */
-void bna_adv_device_init(struct bna_device *device, struct bna *bna,
-                        struct bna_res_info *res_info);
-
-/* APIs for BNA */
-void bna_device_init(struct bna_device *device, struct bna *bna,
-                     struct bna_res_info *res_info);
-void bna_device_uninit(struct bna_device *device);
-void bna_device_cb_port_stopped(void *arg, enum bna_cb_status status);
-int bna_device_status_get(struct bna_device *device);
-int bna_device_state_get(struct bna_device *device);
-
 /* APIs for BNAD */
 void bna_device_enable(struct bna_device *device);
 void bna_device_disable(struct bna_device *device,
@@ -397,12 +380,6 @@ void bna_device_disable(struct bna_device *device,
  * MBOX
  */
 
-/* APIs for DEVICE */
-void bna_mbox_mod_init(struct bna_mbox_mod *mbox_mod, struct bna *bna);
-void bna_mbox_mod_uninit(struct bna_mbox_mod *mbox_mod);
-void bna_mbox_mod_start(struct bna_mbox_mod *mbox_mod);
-void bna_mbox_mod_stop(struct bna_mbox_mod *mbox_mod);
-
 /* APIs for PORT, TX, RX */
 void bna_mbox_handler(struct bna *bna, u32 intr_status);
 void bna_mbox_send(struct bna *bna, struct bna_mbox_qe *mbox_qe);
@@ -411,17 +388,6 @@ void bna_mbox_send(struct bna *bna, struct bna_mbox_qe *mbox_qe);
  * PORT
  */
 
-/* APIs for BNA */
-void bna_port_init(struct bna_port *port, struct bna *bna);
-void bna_port_uninit(struct bna_port *port);
-int bna_port_state_get(struct bna_port *port);
-int bna_llport_state_get(struct bna_llport *llport);
-
-/* APIs for DEVICE */
-void bna_port_start(struct bna_port *port);
-void bna_port_stop(struct bna_port *port);
-void bna_port_fail(struct bna_port *port);
-
 /* API for RX */
 int bna_port_mtu_get(struct bna_port *port);
 void bna_llport_admin_up(struct bna_llport *llport);
@@ -437,12 +403,6 @@ void bna_port_pause_config(struct bna_port *port,
 void bna_port_mtu_set(struct bna_port *port, int mtu,
                       void (*cbfn)(struct bnad *, enum bna_cb_status));
 void bna_port_mac_get(struct bna_port *port, mac_t *mac);
-void bna_port_type_set(struct bna_port *port, enum bna_port_type type);
-void bna_port_linkcbfn_set(struct bna_port *port,
-                           void (*linkcbfn)(struct bnad *,
-                                            enum bna_link_status));
-void bna_port_admin_up(struct bna_port *port);
-void bna_port_admin_down(struct bna_port *port);
 
 /* Callbacks for TX, RX */
 void bna_port_cb_tx_stopped(struct bna_port *port,
@@ -450,11 +410,6 @@ void bna_port_cb_tx_stopped(struct bna_port *port,
 void bna_port_cb_rx_stopped(struct bna_port *port,
                             enum bna_cb_status status);
 
-/* Callbacks for MBOX */
-void bna_port_cb_link_up(struct bna_port *port, struct bfi_ll_aen *aen,
-                         int status);
-void bna_port_cb_link_down(struct bna_port *port, int status);
-
 /**
  * IB
  */
@@ -464,25 +419,10 @@ void bna_ib_mod_init(struct bna_ib_mod *ib_mod, struct bna *bna,
                      struct bna_res_info *res_info);
 void bna_ib_mod_uninit(struct bna_ib_mod *ib_mod);
 
-/* APIs for TX, RX */
-struct bna_ib *bna_ib_get(struct bna_ib_mod *ib_mod,
-                            enum bna_intr_type intr_type, int vector);
-void bna_ib_put(struct bna_ib_mod *ib_mod, struct bna_ib *ib);
-int bna_ib_reserve_idx(struct bna_ib *ib);
-void bna_ib_release_idx(struct bna_ib *ib, int idx);
-int bna_ib_config(struct bna_ib *ib, struct bna_ib_config *ib_config);
-void bna_ib_start(struct bna_ib *ib);
-void bna_ib_stop(struct bna_ib *ib);
-void bna_ib_fail(struct bna_ib *ib);
-void bna_ib_coalescing_timeo_set(struct bna_ib *ib, u8 coalescing_timeo);
-
 /**
  * TX MODULE AND TX
  */
 
-/* Internal APIs */
-void bna_tx_prio_changed(struct bna_tx *tx, int prio);
-
 /* APIs for BNA */
 void bna_tx_mod_init(struct bna_tx_mod *tx_mod, struct bna *bna,
                      struct bna_res_info *res_info);
@@ -508,10 +448,6 @@ void bna_tx_enable(struct bna_tx *tx);
 void bna_tx_disable(struct bna_tx *tx, enum bna_cleanup_type type,
                     void (*cbfn)(void *, struct bna_tx *,
                                  enum bna_cb_status));
-enum bna_cb_status
-bna_tx_prio_set(struct bna_tx *tx, int prio,
-                void (*cbfn)(struct bnad *, struct bna_tx *,
-                             enum bna_cb_status));
 void bna_tx_coalescing_timeo_set(struct bna_tx *tx, int coalescing_timeo);
 
 /**
@@ -564,35 +500,20 @@ void bna_rx_disable(struct bna_rx *rx, enum bna_cleanup_type type,
                     void (*cbfn)(void *, struct bna_rx *,
                                  enum bna_cb_status));
 void bna_rx_coalescing_timeo_set(struct bna_rx *rx, int coalescing_timeo);
-void bna_rx_dim_reconfig(struct bna *bna, u32 vector[][BNA_BIAS_T_MAX]);
+void bna_rx_dim_reconfig(struct bna *bna, const u32 vector[][BNA_BIAS_T_MAX]);
 void bna_rx_dim_update(struct bna_ccb *ccb);
 enum bna_cb_status
 bna_rx_ucast_set(struct bna_rx *rx, u8 *ucmac,
                  void (*cbfn)(struct bnad *, struct bna_rx *,
                               enum bna_cb_status));
 enum bna_cb_status
-bna_rx_ucast_add(struct bna_rx *rx, u8* ucmac,
-                 void (*cbfn)(struct bnad *, struct bna_rx *,
-                              enum bna_cb_status));
-enum bna_cb_status
-bna_rx_ucast_del(struct bna_rx *rx, u8 *ucmac,
-                 void (*cbfn)(struct bnad *, struct bna_rx *,
-                              enum bna_cb_status));
-enum bna_cb_status
 bna_rx_mcast_add(struct bna_rx *rx, u8 *mcmac,
                  void (*cbfn)(struct bnad *, struct bna_rx *,
                               enum bna_cb_status));
 enum bna_cb_status
-bna_rx_mcast_del(struct bna_rx *rx, u8 *mcmac,
-                 void (*cbfn)(struct bnad *, struct bna_rx *,
-                              enum bna_cb_status));
-enum bna_cb_status
 bna_rx_mcast_listset(struct bna_rx *rx, int count, u8 *mcmac,
                      void (*cbfn)(struct bnad *, struct bna_rx *,
                                   enum bna_cb_status));
-void bna_rx_mcast_delall(struct bna_rx *rx,
-                         void (*cbfn)(struct bnad *, struct bna_rx *,
-                                      enum bna_cb_status));
 enum bna_cb_status
 bna_rx_mode_set(struct bna_rx *rx, enum bna_rxmode rxmode,
                 enum bna_rxmode bitmask,
@@ -601,36 +522,12 @@ bna_rx_mode_set(struct bna_rx *rx, enum bna_rxmode rxmode,
 void bna_rx_vlan_add(struct bna_rx *rx, int vlan_id);
 void bna_rx_vlan_del(struct bna_rx *rx, int vlan_id);
 void bna_rx_vlanfilter_enable(struct bna_rx *rx);
-void bna_rx_vlanfilter_disable(struct bna_rx *rx);
-void bna_rx_rss_enable(struct bna_rx *rx);
-void bna_rx_rss_disable(struct bna_rx *rx);
-void bna_rx_rss_reconfig(struct bna_rx *rx, struct bna_rxf_rss *rss_config);
-void bna_rx_rss_rit_set(struct bna_rx *rx, unsigned int *vectors,
-                        int nvectors);
 void bna_rx_hds_enable(struct bna_rx *rx, struct bna_rxf_hds *hds_config,
                        void (*cbfn)(struct bnad *, struct bna_rx *,
                                     enum bna_cb_status));
 void bna_rx_hds_disable(struct bna_rx *rx,
                         void (*cbfn)(struct bnad *, struct bna_rx *,
                                      enum bna_cb_status));
-void bna_rx_receive_pause(struct bna_rx *rx,
-                          void (*cbfn)(struct bnad *, struct bna_rx *,
-                                       enum bna_cb_status));
-void bna_rx_receive_resume(struct bna_rx *rx,
-                           void (*cbfn)(struct bnad *, struct bna_rx *,
-                                        enum bna_cb_status));
-
-/* RxF APIs for RX */
-void bna_rxf_start(struct bna_rxf *rxf);
-void bna_rxf_stop(struct bna_rxf *rxf);
-void bna_rxf_fail(struct bna_rxf *rxf);
-void bna_rxf_init(struct bna_rxf *rxf, struct bna_rx *rx,
-                  struct bna_rx_config *q_config);
-void bna_rxf_uninit(struct bna_rxf *rxf);
-
-/* Callback from RXF to RX */
-void bna_rx_cb_rxf_stopped(struct bna_rx *rx, enum bna_cb_status);
-void bna_rx_cb_rxf_started(struct bna_rx *rx, enum bna_cb_status);
 
 /**
  * BNAD
@@ -639,7 +536,6 @@ void bna_rx_cb_rxf_started(struct bna_rx *rx, enum bna_cb_status);
 /* Callbacks for BNA */
 void bnad_cb_stats_get(struct bnad *bnad, enum bna_cb_status status,
                        struct bna_stats *stats);
-void bnad_cb_stats_clr(struct bnad *bnad);
 
 /* Callbacks for DEVICE */
 void bnad_cb_device_enabled(struct bnad *bnad, enum bna_cb_status status);
diff --git a/drivers/net/bna/bna_ctrl.c b/drivers/net/bna/bna_ctrl.c
index f3034d6bda58..07b26598546e 100644
--- a/drivers/net/bna/bna_ctrl.c
+++ b/drivers/net/bna/bna_ctrl.c
@@ -19,14 +19,54 @@
 #include "bfa_sm.h"
 #include "bfa_wc.h"
 
+static void bna_device_cb_port_stopped(void *arg, enum bna_cb_status status);
+
+static void
+bna_port_cb_link_up(struct bna_port *port, struct bfi_ll_aen *aen,
+                        int status)
+{
+        int i;
+        u8 prio_map;
+
+        port->llport.link_status = BNA_LINK_UP;
+        if (aen->cee_linkup)
+                port->llport.link_status = BNA_CEE_UP;
+
+        /* Compute the priority */
+        prio_map = aen->prio_map;
+        if (prio_map) {
+                for (i = 0; i < 8; i++) {
+                        if ((prio_map >> i) & 0x1)
+                                break;
+                }
+                port->priority = i;
+        } else
+                port->priority = 0;
+
+        /* Dispatch events */
+        bna_tx_mod_cee_link_status(&port->bna->tx_mod, aen->cee_linkup);
+        bna_tx_mod_prio_changed(&port->bna->tx_mod, port->priority);
+        port->link_cbfn(port->bna->bnad, port->llport.link_status);
+}
+
+static void
+bna_port_cb_link_down(struct bna_port *port, int status)
+{
+        port->llport.link_status = BNA_LINK_DOWN;
+
+        /* Dispatch events */
+        bna_tx_mod_cee_link_status(&port->bna->tx_mod, BNA_LINK_DOWN);
+        port->link_cbfn(port->bna->bnad, BNA_LINK_DOWN);
+}
+
 /**
  * MBOX
  */
 static int
 bna_is_aen(u8 msg_id)
 {
-        return (msg_id == BFI_LL_I2H_LINK_DOWN_AEN ||
-                msg_id == BFI_LL_I2H_LINK_UP_AEN);
+        return msg_id == BFI_LL_I2H_LINK_DOWN_AEN ||
+               msg_id == BFI_LL_I2H_LINK_UP_AEN;
 }
 
 static void
@@ -96,7 +136,7 @@ bna_ll_isr(void *llarg, struct bfi_mbmsg *msg)
                 bna_mbox_aen_callback(bna, msg);
 }
 
-void
+static void
 bna_err_handler(struct bna *bna, u32 intr_status)
 {
         u32 init_halt;
@@ -140,7 +180,7 @@ bna_mbox_send(struct bna *bna, struct bna_mbox_qe *mbox_qe)
         }
 }
 
-void
+static void
 bna_mbox_flush_q(struct bna *bna, struct list_head *q)
 {
         struct bna_mbox_qe *mb_qe = NULL;
@@ -166,18 +206,18 @@ bna_mbox_flush_q(struct bna *bna, struct list_head *q)
         bna->mbox_mod.state = BNA_MBOX_FREE;
 }
 
-void
+static void
 bna_mbox_mod_start(struct bna_mbox_mod *mbox_mod)
 {
 }
 
-void
+static void
 bna_mbox_mod_stop(struct bna_mbox_mod *mbox_mod)
 {
         bna_mbox_flush_q(mbox_mod->bna, &mbox_mod->posted_q);
 }
 
-void
+static void
 bna_mbox_mod_init(struct bna_mbox_mod *mbox_mod, struct bna *bna)
 {
         bfa_nw_ioc_mbox_regisr(&bna->device.ioc, BFI_MC_LL, bna_ll_isr, bna);
@@ -187,7 +227,7 @@ bna_mbox_mod_init(struct bna_mbox_mod *mbox_mod, struct bna *bna)
         mbox_mod->bna = bna;
 }
 
-void
+static void
 bna_mbox_mod_uninit(struct bna_mbox_mod *mbox_mod)
 {
         mbox_mod->bna = NULL;
@@ -538,7 +578,7 @@ bna_fw_cb_llport_down(void *arg, int status)
         bfa_fsm_send_event(llport, LLPORT_E_FWRESP_DOWN);
 }
 
-void
+static void
 bna_port_cb_llport_stopped(struct bna_port *port,
                                 enum bna_cb_status status)
 {
@@ -591,7 +631,7 @@ bna_llport_fail(struct bna_llport *llport)
         bfa_fsm_send_event(llport, LLPORT_E_FAIL);
 }
 
-int
+static int
 bna_llport_state_get(struct bna_llport *llport)
 {
         return bfa_sm_to_state(llport_sm_table, llport->fsm);
@@ -1109,7 +1149,7 @@ bna_port_cb_chld_stopped(void *arg)
         bfa_fsm_send_event(port, PORT_E_CHLD_STOPPED);
 }
 
-void
+static void
 bna_port_init(struct bna_port *port, struct bna *bna)
 {
         port->bna = bna;
@@ -1137,7 +1177,7 @@ bna_port_init(struct bna_port *port, struct bna *bna)
         bna_llport_init(&port->llport, bna);
 }
 
-void
+static void
 bna_port_uninit(struct bna_port *port)
 {
         bna_llport_uninit(&port->llport);
@@ -1147,13 +1187,13 @@ bna_port_uninit(struct bna_port *port)
         port->bna = NULL;
 }
 
-int
+static int
 bna_port_state_get(struct bna_port *port)
 {
         return bfa_sm_to_state(port_sm_table, port->fsm);
 }
 
-void
+static void
 bna_port_start(struct bna_port *port)
 {
         port->flags |= BNA_PORT_F_DEVICE_READY;
@@ -1161,7 +1201,7 @@ bna_port_start(struct bna_port *port)
                 bfa_fsm_send_event(port, PORT_E_START);
 }
 
-void
+static void
 bna_port_stop(struct bna_port *port)
 {
         port->stop_cbfn = bna_device_cb_port_stopped;
@@ -1171,7 +1211,7 @@ bna_port_stop(struct bna_port *port)
         bfa_fsm_send_event(port, PORT_E_STOP);
 }
 
-void
+static void
 bna_port_fail(struct bna_port *port)
 {
         port->flags &= ~BNA_PORT_F_DEVICE_READY;
@@ -1190,44 +1230,6 @@ bna_port_cb_rx_stopped(struct bna_port *port, enum bna_cb_status status)
         bfa_wc_down(&port->chld_stop_wc);
 }
 
-void
-bna_port_cb_link_up(struct bna_port *port, struct bfi_ll_aen *aen,
-                        int status)
-{
-        int i;
-        u8 prio_map;
-
-        port->llport.link_status = BNA_LINK_UP;
-        if (aen->cee_linkup)
-                port->llport.link_status = BNA_CEE_UP;
-
-        /* Compute the priority */
-        prio_map = aen->prio_map;
-        if (prio_map) {
-                for (i = 0; i < 8; i++) {
-                        if ((prio_map >> i) & 0x1)
-                                break;
-                }
-                port->priority = i;
-        } else
-                port->priority = 0;
-
-        /* Dispatch events */
-        bna_tx_mod_cee_link_status(&port->bna->tx_mod, aen->cee_linkup);
-        bna_tx_mod_prio_changed(&port->bna->tx_mod, port->priority);
-        port->link_cbfn(port->bna->bnad, port->llport.link_status);
-}
-
-void
-bna_port_cb_link_down(struct bna_port *port, int status)
-{
-        port->llport.link_status = BNA_LINK_DOWN;
-
-        /* Dispatch events */
-        bna_tx_mod_cee_link_status(&port->bna->tx_mod, BNA_LINK_DOWN);
-        port->link_cbfn(port->bna->bnad, BNA_LINK_DOWN);
-}
-
 int
 bna_port_mtu_get(struct bna_port *port)
 {
@@ -1293,54 +1295,6 @@ bna_port_mac_get(struct bna_port *port, mac_t *mac)
 }
 
 /**
- * Should be called only when port is disabled
- */
-void
-bna_port_type_set(struct bna_port *port, enum bna_port_type type)
-{
-        port->type = type;
-        port->llport.type = type;
-}
-
-/**
- * Should be called only when port is disabled
- */
-void
-bna_port_linkcbfn_set(struct bna_port *port,
-                      void (*linkcbfn)(struct bnad *, enum bna_link_status))
-{
-        port->link_cbfn = linkcbfn;
-}
-
-void
-bna_port_admin_up(struct bna_port *port)
-{
-        struct bna_llport *llport = &port->llport;
-
-        if (llport->flags & BNA_LLPORT_F_ENABLED)
-                return;
-
-        llport->flags |= BNA_LLPORT_F_ENABLED;
-
-        if (llport->flags & BNA_LLPORT_F_RX_ENABLED)
-                bfa_fsm_send_event(llport, LLPORT_E_UP);
-}
-
-void
-bna_port_admin_down(struct bna_port *port)
-{
-        struct bna_llport *llport = &port->llport;
-
-        if (!(llport->flags & BNA_LLPORT_F_ENABLED))
-                return;
-
-        llport->flags &= ~BNA_LLPORT_F_ENABLED;
-
-        if (llport->flags & BNA_LLPORT_F_RX_ENABLED)
-                bfa_fsm_send_event(llport, LLPORT_E_DOWN);
-}
-
-/**
  * DEVICE
  */
 #define enable_mbox_intr(_device)\
@@ -1357,7 +1311,7 @@ do {\
         bnad_cb_device_disable_mbox_intr((_device)->bna->bnad);\
 } while (0)
 
-const struct bna_chip_regs_offset reg_offset[] =
+static const struct bna_chip_regs_offset reg_offset[] =
 {{HOST_PAGE_NUM_FN0, HOSTFN0_INT_STATUS,
         HOSTFN0_INT_MASK, HOST_MSIX_ERR_INDEX_FN0},
 {HOST_PAGE_NUM_FN1, HOSTFN1_INT_STATUS,
@@ -1642,7 +1596,34 @@ static struct bfa_ioc_cbfn bfa_iocll_cbfn = {
         bna_device_cb_iocll_reset
 };
 
-void
+/* device */
+static void
+bna_adv_device_init(struct bna_device *device, struct bna *bna,
+                struct bna_res_info *res_info)
+{
+        u8 *kva;
+        u64 dma;
+
+        device->bna = bna;
+
+        kva = res_info[BNA_RES_MEM_T_FWTRC].res_u.mem_info.mdl[0].kva;
+
+        /**
+         * Attach common modules (Diag, SFP, CEE, Port) and claim respective
+         * DMA memory.
+         */
+        BNA_GET_DMA_ADDR(
+                &res_info[BNA_RES_MEM_T_COM].res_u.mem_info.mdl[0].dma, dma);
+        kva = res_info[BNA_RES_MEM_T_COM].res_u.mem_info.mdl[0].kva;
+
+        bfa_nw_cee_attach(&bna->cee, &device->ioc, bna);
+        bfa_nw_cee_mem_claim(&bna->cee, kva, dma);
+        kva += bfa_nw_cee_meminfo();
+        dma += bfa_nw_cee_meminfo();
+
+}
+
+static void
 bna_device_init(struct bna_device *device, struct bna *bna,
                 struct bna_res_info *res_info)
 {
@@ -1681,7 +1662,7 @@ bna_device_init(struct bna_device *device, struct bna *bna,
         bfa_fsm_set_state(device, bna_device_sm_stopped);
 }
 
-void
+static void
 bna_device_uninit(struct bna_device *device)
 {
         bna_mbox_mod_uninit(&device->bna->mbox_mod);
@@ -1691,7 +1672,7 @@ bna_device_uninit(struct bna_device *device)
         device->bna = NULL;
 }
 
-void
+static void
 bna_device_cb_port_stopped(void *arg, enum bna_cb_status status)
 {
         struct bna_device *device = (struct bna_device *)arg;
@@ -1699,10 +1680,10 @@ bna_device_cb_port_stopped(void *arg, enum bna_cb_status status)
         bfa_fsm_send_event(device, DEVICE_E_PORT_STOPPED);
 }
 
-int
+static int
 bna_device_status_get(struct bna_device *device)
 {
-        return (device->fsm == (bfa_fsm_t)bna_device_sm_ready);
+        return device->fsm == (bfa_fsm_t)bna_device_sm_ready;
 }
 
 void
@@ -1733,24 +1714,13 @@ bna_device_disable(struct bna_device *device, enum bna_cleanup_type type)
         bfa_fsm_send_event(device, DEVICE_E_DISABLE);
 }
 
-int
+static int
 bna_device_state_get(struct bna_device *device)
 {
         return bfa_sm_to_state(device_sm_table, device->fsm);
 }
 
-u32 bna_dim_vector[BNA_LOAD_T_MAX][BNA_BIAS_T_MAX] = {
-        {12, 20},
-        {10, 18},
-        {8, 16},
-        {6, 12},
-        {4, 8},
-        {3, 6},
-        {2, 4},
-        {1, 2},
-};
-
-u32 bna_napi_dim_vector[BNA_LOAD_T_MAX][BNA_BIAS_T_MAX] = {
+const u32 bna_napi_dim_vector[BNA_LOAD_T_MAX][BNA_BIAS_T_MAX] = {
         {12, 12},
         {6, 10},
         {5, 10},
@@ -1761,36 +1731,9 @@ u32 bna_napi_dim_vector[BNA_LOAD_T_MAX][BNA_BIAS_T_MAX] = {
         {1, 2},
 };
 
-/* device */
-void
-bna_adv_device_init(struct bna_device *device, struct bna *bna,
-                struct bna_res_info *res_info)
-{
-        u8 *kva;
-        u64 dma;
-
-        device->bna = bna;
-
-        kva = res_info[BNA_RES_MEM_T_FWTRC].res_u.mem_info.mdl[0].kva;
-
-        /**
-         * Attach common modules (Diag, SFP, CEE, Port) and claim respective
-         * DMA memory.
-         */
-        BNA_GET_DMA_ADDR(
-                &res_info[BNA_RES_MEM_T_COM].res_u.mem_info.mdl[0].dma, dma);
-        kva = res_info[BNA_RES_MEM_T_COM].res_u.mem_info.mdl[0].kva;
-
-        bfa_nw_cee_attach(&bna->cee, &device->ioc, bna);
-        bfa_nw_cee_mem_claim(&bna->cee, kva, dma);
-        kva += bfa_nw_cee_meminfo();
-        dma += bfa_nw_cee_meminfo();
-
-}
-
 /* utils */
 
-void
+static void
 bna_adv_res_req(struct bna_res_info *res_info)
 {
         /* DMA memory for COMMON_MODULE */
@@ -2044,36 +1987,6 @@ bna_fw_stats_get(struct bna *bna)
         bna->stats.txf_bmap[1] = bna->tx_mod.txf_bmap[1];
 }
 
-static void
-bna_fw_cb_stats_clr(void *arg, int status)
-{
-        struct bna *bna = (struct bna *)arg;
-
-        bfa_q_qe_init(&bna->mbox_qe.qe);
-
-        memset(bna->stats.sw_stats, 0, sizeof(struct bna_sw_stats));
-        memset(bna->stats.hw_stats, 0, sizeof(struct bfi_ll_stats));
-
-        bnad_cb_stats_clr(bna->bnad);
-}
-
-static void
-bna_fw_stats_clr(struct bna *bna)
-{
-        struct bfi_ll_stats_req ll_req;
-
-        bfi_h2i_set(ll_req.mh, BFI_MC_LL, BFI_LL_H2I_STATS_CLEAR_REQ, 0);
-        ll_req.stats_mask = htons(BFI_LL_STATS_ALL);
-        ll_req.rxf_id_mask[0] = htonl(0xffffffff);
-        ll_req.rxf_id_mask[1] = htonl(0xffffffff);
-        ll_req.txf_id_mask[0] = htonl(0xffffffff);
-        ll_req.txf_id_mask[1] = htonl(0xffffffff);
-
-        bna_mbox_qe_fill(&bna->mbox_qe, &ll_req, sizeof(ll_req),
-                                bna_fw_cb_stats_clr, bna);
-        bna_mbox_send(bna, &bna->mbox_qe);
-}
-
 void
 bna_stats_get(struct bna *bna)
 {
@@ -2083,22 +1996,8 @@ bna_stats_get(struct bna *bna)
                 bnad_cb_stats_get(bna->bnad, BNA_CB_FAIL, &bna->stats);
 }
 
-void
-bna_stats_clr(struct bna *bna)
-{
-        if (bna_device_status_get(&bna->device))
-                bna_fw_stats_clr(bna);
-        else {
-                memset(&bna->stats.sw_stats, 0,
-                                sizeof(struct bna_sw_stats));
-                memset(bna->stats.hw_stats, 0,
-                                sizeof(struct bfi_ll_stats));
-                bnad_cb_stats_clr(bna->bnad);
-        }
-}
-
 /* IB */
-void
+static void
 bna_ib_coalescing_timeo_set(struct bna_ib *ib, u8 coalescing_timeo)
 {
         ib->ib_config.coalescing_timeo = coalescing_timeo;
@@ -2157,7 +2056,7 @@ rxf_fltr_mbox_cmd(struct bna_rxf *rxf, u8 cmd, enum bna_status status)
         bna_mbox_send(rxf->rx->bna, &rxf->mbox_qe);
 }
 
-void
+static void
 __rxf_default_function_config(struct bna_rxf *rxf, enum bna_status status)
 {
         struct bna_rx_fndb_ram *rx_fndb_ram;
@@ -2553,7 +2452,7 @@ rxf_reset_packet_filter_allmulti(struct bna_rxf *rxf)
  *      0 = no h/w change
  *      1 = need h/w change
  */
-int
+static int
 rxf_promisc_enable(struct bna_rxf *rxf)
 {
         struct bna *bna = rxf->rx->bna;
@@ -2584,7 +2483,7 @@ rxf_promisc_enable(struct bna_rxf *rxf)
  *      0 = no h/w change
  *      1 = need h/w change
  */
-int
+static int
 rxf_promisc_disable(struct bna_rxf *rxf)
 {
         struct bna *bna = rxf->rx->bna;
@@ -2623,7 +2522,7 @@ rxf_promisc_disable(struct bna_rxf *rxf)
  *      0 = no h/w change
  *      1 = need h/w change
  */
-int
+static int
 rxf_default_enable(struct bna_rxf *rxf)
 {
         struct bna *bna = rxf->rx->bna;
@@ -2654,7 +2553,7 @@ rxf_default_enable(struct bna_rxf *rxf)
  *      0 = no h/w change
  *      1 = need h/w change
  */
-int
+static int
 rxf_default_disable(struct bna_rxf *rxf)
 {
         struct bna *bna = rxf->rx->bna;
@@ -2693,7 +2592,7 @@ rxf_default_disable(struct bna_rxf *rxf)
  *      0 = no h/w change
  *      1 = need h/w change
  */
-int
+static int
 rxf_allmulti_enable(struct bna_rxf *rxf)
 {
         int ret = 0;
@@ -2721,7 +2620,7 @@ rxf_allmulti_enable(struct bna_rxf *rxf)
  *      0 = no h/w change
  *      1 = need h/w change
  */
-int
+static int
 rxf_allmulti_disable(struct bna_rxf *rxf)
 {
         int ret = 0;
@@ -2746,159 +2645,6 @@ rxf_allmulti_disable(struct bna_rxf *rxf)
 }
 
 /* RxF <- bnad */
-void
-bna_rx_mcast_delall(struct bna_rx *rx,
-                    void (*cbfn)(struct bnad *, struct bna_rx *,
-                                 enum bna_cb_status))
-{
-        struct bna_rxf *rxf = &rx->rxf;
-        struct list_head *qe;
-        struct bna_mac *mac;
-        int need_hw_config = 0;
-
-        /* Purge all entries from pending_add_q */
-        while (!list_empty(&rxf->mcast_pending_add_q)) {
-                bfa_q_deq(&rxf->mcast_pending_add_q, &qe);
-                mac = (struct bna_mac *)qe;
-                bfa_q_qe_init(&mac->qe);
-                bna_mcam_mod_mac_put(&rxf->rx->bna->mcam_mod, mac);
-        }
-
-        /* Schedule all entries in active_q for deletion */
-        while (!list_empty(&rxf->mcast_active_q)) {
-                bfa_q_deq(&rxf->mcast_active_q, &qe);
-                mac = (struct bna_mac *)qe;
-                bfa_q_qe_init(&mac->qe);
-                list_add_tail(&mac->qe, &rxf->mcast_pending_del_q);
-                need_hw_config = 1;
-        }
-
-        if (need_hw_config) {
-                rxf->cam_fltr_cbfn = cbfn;
-                rxf->cam_fltr_cbarg = rx->bna->bnad;
-                bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
-                return;
-        }
-
-        if (cbfn)
-                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
-}
-
-/* RxF <- Rx */
-void
-bna_rx_receive_resume(struct bna_rx *rx,
-                      void (*cbfn)(struct bnad *, struct bna_rx *,
-                                   enum bna_cb_status))
-{
-        struct bna_rxf *rxf = &rx->rxf;
-
-        if (rxf->rxf_oper_state == BNA_RXF_OPER_STATE_PAUSED) {
-                rxf->oper_state_cbfn = cbfn;
-                rxf->oper_state_cbarg = rx->bna->bnad;
-                bfa_fsm_send_event(rxf, RXF_E_RESUME);
-        } else if (cbfn)
-                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
-}
-
-void
-bna_rx_receive_pause(struct bna_rx *rx,
-                     void (*cbfn)(struct bnad *, struct bna_rx *,
-                                  enum bna_cb_status))
-{
-        struct bna_rxf *rxf = &rx->rxf;
-
-        if (rxf->rxf_oper_state == BNA_RXF_OPER_STATE_RUNNING) {
-                rxf->oper_state_cbfn = cbfn;
-                rxf->oper_state_cbarg = rx->bna->bnad;
-                bfa_fsm_send_event(rxf, RXF_E_PAUSE);
-        } else if (cbfn)
-                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
-}
-
-/* RxF <- bnad */
-enum bna_cb_status
-bna_rx_ucast_add(struct bna_rx *rx, u8 *addr,
-                 void (*cbfn)(struct bnad *, struct bna_rx *,
-                              enum bna_cb_status))
-{
-        struct bna_rxf *rxf = &rx->rxf;
-        struct list_head *qe;
-        struct bna_mac *mac;
-
-        /* Check if already added */
-        list_for_each(qe, &rxf->ucast_active_q) {
-                mac = (struct bna_mac *)qe;
-                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
-                        if (cbfn)
-                                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
-                        return BNA_CB_SUCCESS;
-                }
-        }
-
-        /* Check if pending addition */
-        list_for_each(qe, &rxf->ucast_pending_add_q) {
-                mac = (struct bna_mac *)qe;
-                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
-                        if (cbfn)
-                                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
-                        return BNA_CB_SUCCESS;
-                }
-        }
-
-        mac = bna_ucam_mod_mac_get(&rxf->rx->bna->ucam_mod);
-        if (mac == NULL)
-                return BNA_CB_UCAST_CAM_FULL;
-        bfa_q_qe_init(&mac->qe);
-        memcpy(mac->addr, addr, ETH_ALEN);
-        list_add_tail(&mac->qe, &rxf->ucast_pending_add_q);
-
-        rxf->cam_fltr_cbfn = cbfn;
-        rxf->cam_fltr_cbarg = rx->bna->bnad;
-
-        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
-
-        return BNA_CB_SUCCESS;
-}
-
-/* RxF <- bnad */
-enum bna_cb_status
-bna_rx_ucast_del(struct bna_rx *rx, u8 *addr,
-                 void (*cbfn)(struct bnad *, struct bna_rx *,
-                              enum bna_cb_status))
-{
-        struct bna_rxf *rxf = &rx->rxf;
-        struct list_head *qe;
-        struct bna_mac *mac;
-
-        list_for_each(qe, &rxf->ucast_pending_add_q) {
-                mac = (struct bna_mac *)qe;
-                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
-                        list_del(qe);
-                        bfa_q_qe_init(qe);
-                        bna_ucam_mod_mac_put(&rxf->rx->bna->ucam_mod, mac);
-                        if (cbfn)
-                                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
-                        return BNA_CB_SUCCESS;
-                }
-        }
-
-        list_for_each(qe, &rxf->ucast_active_q) {
-                mac = (struct bna_mac *)qe;
-                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
-                        list_del(qe);
-                        bfa_q_qe_init(qe);
-                        list_add_tail(qe, &rxf->ucast_pending_del_q);
-                        rxf->cam_fltr_cbfn = cbfn;
-                        rxf->cam_fltr_cbarg = rx->bna->bnad;
-                        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
-                        return BNA_CB_SUCCESS;
-                }
-        }
-
-        return BNA_CB_INVALID_MAC;
-}
-
-/* RxF <- bnad */
 enum bna_cb_status
 bna_rx_mode_set(struct bna_rx *rx, enum bna_rxmode new_mode,
                 enum bna_rxmode bitmask,
@@ -2978,39 +2724,6 @@ err_return:
         return BNA_CB_FAIL;
 }
 
-/* RxF <- bnad */
-void
-bna_rx_rss_enable(struct bna_rx *rx)
-{
-        struct bna_rxf *rxf = &rx->rxf;
-
-        rxf->rxf_flags |= BNA_RXF_FL_RSS_CONFIG_PENDING;
-        rxf->rss_status = BNA_STATUS_T_ENABLED;
-        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
-}
-
-/* RxF <- bnad */
-void
-bna_rx_rss_disable(struct bna_rx *rx)
-{
-        struct bna_rxf *rxf = &rx->rxf;
-
-        rxf->rxf_flags |= BNA_RXF_FL_RSS_CONFIG_PENDING;
-        rxf->rss_status = BNA_STATUS_T_DISABLED;
-        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
-}
-
-/* RxF <- bnad */
-void
-bna_rx_rss_reconfig(struct bna_rx *rx, struct bna_rxf_rss *rss_config)
-{
-        struct bna_rxf *rxf = &rx->rxf;
-        rxf->rxf_flags |= BNA_RXF_FL_RSS_CONFIG_PENDING;
-        rxf->rss_status = BNA_STATUS_T_ENABLED;
-        rxf->rss_cfg = *rss_config;
-        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
-}
-
 void
 /* RxF <- bnad */
 bna_rx_vlanfilter_enable(struct bna_rx *rx)
@@ -3024,68 +2737,8 @@ bna_rx_vlanfilter_enable(struct bna_rx *rx)
         }
 }
 
-/* RxF <- bnad */
-void
-bna_rx_vlanfilter_disable(struct bna_rx *rx)
-{
-        struct bna_rxf *rxf = &rx->rxf;
-
-        if (rxf->vlan_filter_status == BNA_STATUS_T_ENABLED) {
-                rxf->rxf_flags |= BNA_RXF_FL_VLAN_CONFIG_PENDING;
-                rxf->vlan_filter_status = BNA_STATUS_T_DISABLED;
-                bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
-        }
-}
-
 /* Rx */
 
-struct bna_rxp *
-bna_rx_get_rxp(struct bna_rx *rx, int vector)
-{
-        struct bna_rxp *rxp;
-        struct list_head *qe;
-
-        list_for_each(qe, &rx->rxp_q) {
-                rxp = (struct bna_rxp *)qe;
-                if (rxp->vector == vector)
-                        return rxp;
-        }
-        return NULL;
-}
-
-/*
- * bna_rx_rss_rit_set()
- * Sets the Q ids for the specified msi-x vectors in the RIT.
- * Maximum rit size supported is 64, which should be the max size of the
- * vectors array.
- */
-
-void
-bna_rx_rss_rit_set(struct bna_rx *rx, unsigned int *vectors, int nvectors)
-{
-        int i;
-        struct bna_rxp *rxp;
-        struct bna_rxq *q0 = NULL, *q1 = NULL;
-        struct bna *bna;
-        struct bna_rxf *rxf;
-
-        /* Build the RIT contents for this RX */
-        bna = rx->bna;
-
-        rxf = &rx->rxf;
-        for (i = 0; i < nvectors; i++) {
-                rxp = bna_rx_get_rxp(rx, vectors[i]);
-
-                GET_RXQS(rxp, q0, q1);
-                rxf->rit_segment->rit[i].large_rxq_id = q0->rxq_id;
-                rxf->rit_segment->rit[i].small_rxq_id = (q1 ? q1->rxq_id : 0);
-        }
-
-        rxf->rit_segment->rit_size = nvectors;
-
-        /* Subsequent call to enable/reconfig RSS will update the RIT in h/w */
-}
-
 /* Rx <- bnad */
 void
 bna_rx_coalescing_timeo_set(struct bna_rx *rx, int coalescing_timeo)
@@ -3102,7 +2755,7 @@ bna_rx_coalescing_timeo_set(struct bna_rx *rx, int coalescing_timeo)
 
 /* Rx <- bnad */
 void
-bna_rx_dim_reconfig(struct bna *bna, u32 vector[][BNA_BIAS_T_MAX])
+bna_rx_dim_reconfig(struct bna *bna, const u32 vector[][BNA_BIAS_T_MAX])
 {
         int i, j;
 
@@ -3165,22 +2818,6 @@ bna_rx_dim_update(struct bna_ccb *ccb)
 
 /* Tx */
 /* TX <- bnad */
-enum bna_cb_status
-bna_tx_prio_set(struct bna_tx *tx, int prio,
-                void (*cbfn)(struct bnad *, struct bna_tx *,
-                             enum bna_cb_status))
-{
-        if (tx->flags & BNA_TX_F_PRIO_LOCK)
-                return BNA_CB_FAIL;
-        else {
-                tx->prio_change_cbfn = cbfn;
-                bna_tx_prio_changed(tx, prio);
-        }
-
-        return BNA_CB_SUCCESS;
-}
-
-/* TX <- bnad */
 void
 bna_tx_coalescing_timeo_set(struct bna_tx *tx, int coalescing_timeo)
 {
diff --git a/drivers/net/bna/bna_hw.h b/drivers/net/bna/bna_hw.h
index 67eb376c5c7e..806b224a4c63 100644
--- a/drivers/net/bna/bna_hw.h
+++ b/drivers/net/bna/bna_hw.h
@@ -1282,7 +1282,6 @@ struct bna_chip_regs_offset {
         u32 fn_int_mask;
         u32 msix_idx;
 };
-extern const struct bna_chip_regs_offset reg_offset[];
 
 struct bna_chip_regs {
         void __iomem *page_addr;
diff --git a/drivers/net/bna/bna_txrx.c b/drivers/net/bna/bna_txrx.c
index 890846d55502..ad93fdb0f427 100644
--- a/drivers/net/bna/bna_txrx.c
+++ b/drivers/net/bna/bna_txrx.c
@@ -195,7 +195,7 @@ bna_ib_mod_uninit(struct bna_ib_mod *ib_mod)
         ib_mod->bna = NULL;
 }
 
-struct bna_ib *
+static struct bna_ib *
 bna_ib_get(struct bna_ib_mod *ib_mod,
                 enum bna_intr_type intr_type,
                 int vector)
@@ -240,7 +240,7 @@ bna_ib_get(struct bna_ib_mod *ib_mod,
         return ib;
 }
 
-void
+static void
 bna_ib_put(struct bna_ib_mod *ib_mod, struct bna_ib *ib)
 {
         bna_intr_put(ib_mod, ib->intr);
@@ -255,7 +255,7 @@ bna_ib_put(struct bna_ib_mod *ib_mod, struct bna_ib *ib)
 }
 
 /* Returns index offset - starting from 0 */
-int
+static int
 bna_ib_reserve_idx(struct bna_ib *ib)
 {
         struct bna_ib_mod *ib_mod = &ib->bna->ib_mod;
@@ -309,7 +309,7 @@ bna_ib_reserve_idx(struct bna_ib *ib)
         return idx;
 }
 
-void
+static void
 bna_ib_release_idx(struct bna_ib *ib, int idx)
 {
         struct bna_ib_mod *ib_mod = &ib->bna->ib_mod;
@@ -356,7 +356,7 @@ bna_ib_release_idx(struct bna_ib *ib, int idx)
         }
 }
 
-int
+static int
 bna_ib_config(struct bna_ib *ib, struct bna_ib_config *ib_config)
 {
         if (ib->start_count)
@@ -374,7 +374,7 @@ bna_ib_config(struct bna_ib *ib, struct bna_ib_config *ib_config)
         return 0;
 }
 
-void
+static void
 bna_ib_start(struct bna_ib *ib)
 {
         struct bna_ib_blk_mem ib_cfg;
@@ -450,7 +450,7 @@ bna_ib_start(struct bna_ib *ib)
         }
 }
 
-void
+static void
 bna_ib_stop(struct bna_ib *ib)
 {
         u32 intx_mask;
@@ -468,7 +468,7 @@ bna_ib_stop(struct bna_ib *ib)
         }
 }
 
-void
+static void
 bna_ib_fail(struct bna_ib *ib)
 {
         ib->start_count = 0;
@@ -1394,7 +1394,7 @@ rxf_reset_packet_filter(struct bna_rxf *rxf)
         rxf_reset_packet_filter_allmulti(rxf);
 }
 
-void
+static void
 bna_rxf_init(struct bna_rxf *rxf,
                 struct bna_rx *rx,
                 struct bna_rx_config *q_config)
@@ -1444,7 +1444,7 @@ bna_rxf_init(struct bna_rxf *rxf,
         bfa_fsm_set_state(rxf, bna_rxf_sm_stopped);
 }
 
-void
+static void
 bna_rxf_uninit(struct bna_rxf *rxf)
 {
         struct bna_mac *mac;
@@ -1476,7 +1476,18 @@ bna_rxf_uninit(struct bna_rxf *rxf)
         rxf->rx = NULL;
 }
 
-void
+static void
+bna_rx_cb_rxf_started(struct bna_rx *rx, enum bna_cb_status status)
+{
+        bfa_fsm_send_event(rx, RX_E_RXF_STARTED);
+        if (rx->rxf.rxf_id < 32)
+                rx->bna->rx_mod.rxf_bmap[0] |= ((u32)1 << rx->rxf.rxf_id);
+        else
+                rx->bna->rx_mod.rxf_bmap[1] |= ((u32)
+                                1 << (rx->rxf.rxf_id - 32));
+}
+
+static void
 bna_rxf_start(struct bna_rxf *rxf)
 {
         rxf->start_cbfn = bna_rx_cb_rxf_started;
@@ -1485,7 +1496,18 @@ bna_rxf_start(struct bna_rxf *rxf)
         bfa_fsm_send_event(rxf, RXF_E_START);
 }
 
-void
+static void
+bna_rx_cb_rxf_stopped(struct bna_rx *rx, enum bna_cb_status status)
+{
+        bfa_fsm_send_event(rx, RX_E_RXF_STOPPED);
+        if (rx->rxf.rxf_id < 32)
+                rx->bna->rx_mod.rxf_bmap[0] &= ~(u32)1 << rx->rxf.rxf_id;
+        else
+                rx->bna->rx_mod.rxf_bmap[1] &= ~(u32)
+                                1 << (rx->rxf.rxf_id - 32);
+}
+
+static void
 bna_rxf_stop(struct bna_rxf *rxf)
 {
         rxf->stop_cbfn = bna_rx_cb_rxf_stopped;
@@ -1493,7 +1515,7 @@ bna_rxf_stop(struct bna_rxf *rxf)
         bfa_fsm_send_event(rxf, RXF_E_STOP);
 }
 
-void
+static void
 bna_rxf_fail(struct bna_rxf *rxf)
 {
         rxf->rxf_flags |= BNA_RXF_FL_FAILED;
@@ -1576,43 +1598,6 @@ bna_rx_mcast_add(struct bna_rx *rx, u8 *addr,
 }
 
 enum bna_cb_status
-bna_rx_mcast_del(struct bna_rx *rx, u8 *addr,
-                 void (*cbfn)(struct bnad *, struct bna_rx *,
-                              enum bna_cb_status))
-{
-        struct bna_rxf *rxf = &rx->rxf;
-        struct list_head *qe;
-        struct bna_mac *mac;
-
-        list_for_each(qe, &rxf->mcast_pending_add_q) {
-                mac = (struct bna_mac *)qe;
-                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
-                        list_del(qe);
-                        bfa_q_qe_init(qe);
-                        bna_mcam_mod_mac_put(&rxf->rx->bna->mcam_mod, mac);
-                        if (cbfn)
-                                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
-                        return BNA_CB_SUCCESS;
-                }
-        }
-
-        list_for_each(qe, &rxf->mcast_active_q) {
-                mac = (struct bna_mac *)qe;
-                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
-                        list_del(qe);
-                        bfa_q_qe_init(qe);
-                        list_add_tail(qe, &rxf->mcast_pending_del_q);
-                        rxf->cam_fltr_cbfn = cbfn;
-                        rxf->cam_fltr_cbarg = rx->bna->bnad;
-                        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
-                        return BNA_CB_SUCCESS;
-                }
-        }
-
-        return BNA_CB_INVALID_MAC;
-}
-
-enum bna_cb_status
 bna_rx_mcast_listset(struct bna_rx *rx, int count, u8 *mclist,
                      void (*cbfn)(struct bnad *, struct bna_rx *,
                                   enum bna_cb_status))
@@ -1862,7 +1847,7 @@ bfa_fsm_state_decl(bna_rx, rxf_stop_wait,
 bfa_fsm_state_decl(bna_rx, rxq_stop_wait,
         struct bna_rx, enum bna_rx_event);
 
-static struct bfa_sm_table rx_sm_table[] = {
+static const struct bfa_sm_table rx_sm_table[] = {
         {BFA_SM(bna_rx_sm_stopped), BNA_RX_STOPPED},
         {BFA_SM(bna_rx_sm_rxf_start_wait), BNA_RX_RXF_START_WAIT},
         {BFA_SM(bna_rx_sm_started), BNA_RX_STARTED},
@@ -2247,7 +2232,7 @@ bna_rit_create(struct bna_rx *rx)
         }
 }
 
-int
+static int
 _rx_can_satisfy(struct bna_rx_mod *rx_mod,
                 struct bna_rx_config *rx_cfg)
 {
@@ -2272,7 +2257,7 @@ _rx_can_satisfy(struct bna_rx_mod *rx_mod,
         return 1;
 }
 
-struct bna_rxq *
+static struct bna_rxq *
 _get_free_rxq(struct bna_rx_mod *rx_mod)
 {
         struct bna_rxq *rxq = NULL;
@@ -2286,7 +2271,7 @@ _get_free_rxq(struct bna_rx_mod *rx_mod)
         return rxq;
 }
 
-void
+static void
 _put_free_rxq(struct bna_rx_mod *rx_mod, struct bna_rxq *rxq)
 {
         bfa_q_qe_init(&rxq->qe);
@@ -2294,7 +2279,7 @@ _put_free_rxq(struct bna_rx_mod *rx_mod, struct bna_rxq *rxq)
         rx_mod->rxq_free_count++;
 }
 
-struct bna_rxp *
+static struct bna_rxp *
 _get_free_rxp(struct bna_rx_mod *rx_mod)
 {
         struct list_head        *qe = NULL;
@@ -2310,7 +2295,7 @@ _get_free_rxp(struct bna_rx_mod *rx_mod)
         return rxp;
 }
 
-void
+static void
 _put_free_rxp(struct bna_rx_mod *rx_mod, struct bna_rxp *rxp)
 {
         bfa_q_qe_init(&rxp->qe);
@@ -2318,7 +2303,7 @@ _put_free_rxp(struct bna_rx_mod *rx_mod, struct bna_rxp *rxp)
         rx_mod->rxp_free_count++;
 }
 
-struct bna_rx *
+static struct bna_rx *
 _get_free_rx(struct bna_rx_mod *rx_mod)
 {
         struct list_head        *qe = NULL;
@@ -2336,7 +2321,7 @@ _get_free_rx(struct bna_rx_mod *rx_mod)
         return rx;
 }
 
-void
+static void
 _put_free_rx(struct bna_rx_mod *rx_mod, struct bna_rx *rx)
 {
         bfa_q_qe_init(&rx->qe);
@@ -2344,7 +2329,7 @@ _put_free_rx(struct bna_rx_mod *rx_mod, struct bna_rx *rx)
         rx_mod->rx_free_count++;
 }
 
-void
+static void
 _rx_init(struct bna_rx *rx, struct bna *bna)
 {
         rx->bna = bna;
@@ -2360,7 +2345,7 @@ _rx_init(struct bna_rx *rx, struct bna *bna)
         rx->stop_cbarg = NULL;
 }
 
-void
+static void
 _rxp_add_rxqs(struct bna_rxp *rxp,
                 struct bna_rxq *q0,
                 struct bna_rxq *q1)
@@ -2383,7 +2368,7 @@ _rxp_add_rxqs(struct bna_rxp *rxp,
         }
 }
 
-void
+static void
 _rxq_qpt_init(struct bna_rxq *rxq,
                 struct bna_rxp *rxp,
                 u32 page_count,
@@ -2412,7 +2397,7 @@ _rxq_qpt_init(struct bna_rxq *rxq,
         }
 }
 
-void
+static void
 _rxp_cqpt_setup(struct bna_rxp *rxp,
                 u32 page_count,
                 u32 page_size,
@@ -2441,13 +2426,13 @@ _rxp_cqpt_setup(struct bna_rxp *rxp,
         }
 }
 
-void
+static void
 _rx_add_rxp(struct bna_rx *rx, struct bna_rxp *rxp)
 {
         list_add_tail(&rxp->qe, &rx->rxp_q);
 }
 
-void
+static void
 _init_rxmod_queues(struct bna_rx_mod *rx_mod)
 {
         INIT_LIST_HEAD(&rx_mod->rx_free_q);
@@ -2460,7 +2445,7 @@ _init_rxmod_queues(struct bna_rx_mod *rx_mod)
         rx_mod->rxp_free_count = 0;
 }
 
-void
+static void
 _rx_ctor(struct bna_rx *rx, int id)
 {
         bfa_q_qe_init(&rx->qe);
@@ -2492,7 +2477,7 @@ bna_rx_cb_rxq_stopped_all(void *arg)
         bfa_fsm_send_event(rx, RX_E_RXQ_STOPPED);
 }
 
-void
+static void
 bna_rx_mod_cb_rx_stopped(void *arg, struct bna_rx *rx,
                          enum bna_cb_status status)
 {
@@ -2501,7 +2486,7 @@ bna_rx_mod_cb_rx_stopped(void *arg, struct bna_rx *rx,
         bfa_wc_down(&rx_mod->rx_stop_wc);
 }
 
-void
+static void
 bna_rx_mod_cb_rx_stopped_all(void *arg)
 {
         struct bna_rx_mod *rx_mod = (struct bna_rx_mod *)arg;
@@ -2511,7 +2496,7 @@ bna_rx_mod_cb_rx_stopped_all(void *arg)
         rx_mod->stop_cbfn = NULL;
 }
 
-void
+static void
 bna_rx_start(struct bna_rx *rx)
 {
         rx->rx_flags |= BNA_RX_F_PORT_ENABLED;
@@ -2519,7 +2504,7 @@ bna_rx_start(struct bna_rx *rx)
                 bfa_fsm_send_event(rx, RX_E_START);
 }
 
-void
+static void
 bna_rx_stop(struct bna_rx *rx)
 {
         rx->rx_flags &= ~BNA_RX_F_PORT_ENABLED;
@@ -2532,7 +2517,7 @@ bna_rx_stop(struct bna_rx *rx)
         }
 }
 
-void
+static void
 bna_rx_fail(struct bna_rx *rx)
 {
         /* Indicate port is not enabled, and failed */
@@ -2542,28 +2527,6 @@ bna_rx_fail(struct bna_rx *rx)
 }
 
 void
-bna_rx_cb_rxf_started(struct bna_rx *rx, enum bna_cb_status status)
-{
-        bfa_fsm_send_event(rx, RX_E_RXF_STARTED);
-        if (rx->rxf.rxf_id < 32)
-                rx->bna->rx_mod.rxf_bmap[0] |= ((u32)1 << rx->rxf.rxf_id);
-        else
-                rx->bna->rx_mod.rxf_bmap[1] |= ((u32)
-                                1 << (rx->rxf.rxf_id - 32));
-}
-
-void
-bna_rx_cb_rxf_stopped(struct bna_rx *rx, enum bna_cb_status status)
-{
-        bfa_fsm_send_event(rx, RX_E_RXF_STOPPED);
-        if (rx->rxf.rxf_id < 32)
-                rx->bna->rx_mod.rxf_bmap[0] &= ~(u32)1 << rx->rxf.rxf_id;
-        else
-                rx->bna->rx_mod.rxf_bmap[1] &= ~(u32)
-                                1 << (rx->rxf.rxf_id - 32);
-}
-
-void
 bna_rx_mod_start(struct bna_rx_mod *rx_mod, enum bna_rx_type type)
 {
         struct bna_rx *rx;
@@ -3731,7 +3694,7 @@ bna_tx_fail(struct bna_tx *tx)
         bfa_fsm_send_event(tx, TX_E_FAIL);
 }
 
-void
+static void
 bna_tx_prio_changed(struct bna_tx *tx, int prio)
 {
         struct bna_txq *txq;
diff --git a/drivers/net/bna/bnad.c b/drivers/net/bna/bnad.c
index e380c0e88f4f..7e839b9cec22 100644
--- a/drivers/net/bna/bnad.c
+++ b/drivers/net/bna/bnad.c
@@ -28,7 +28,7 @@
 #include "bna.h"
 #include "cna.h"
 
-DEFINE_MUTEX(bnad_fwimg_mutex);
+static DEFINE_MUTEX(bnad_fwimg_mutex);
 
 /*
  * Module params
@@ -46,7 +46,7 @@ MODULE_PARM_DESC(bnad_ioc_auto_recover, "Enable / Disable auto recovery");
  */
 u32 bnad_rxqs_per_cq = 2;
 
-const u8 bnad_bcast_addr[] =  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+static const u8 bnad_bcast_addr[] =  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 
 /*
  * Local MACROS
@@ -564,9 +564,11 @@ bnad_disable_rx_irq(struct bnad *bnad, struct bna_ccb *ccb)
 static void
 bnad_enable_rx_irq(struct bnad *bnad, struct bna_ccb *ccb)
 {
-        spin_lock_irq(&bnad->bna_lock); /* Because of polling context */
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags); /* Because of polling context */
         bnad_enable_rx_irq_unsafe(ccb);
-        spin_unlock_irq(&bnad->bna_lock);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
 }
 
 static void
@@ -599,7 +601,7 @@ static irqreturn_t
 bnad_msix_mbox_handler(int irq, void *data)
 {
         u32 intr_status;
-        unsigned long  flags;
+        unsigned long flags;
         struct net_device *netdev = data;
         struct bnad *bnad;
 
@@ -630,13 +632,15 @@ bnad_isr(int irq, void *data)
         struct bnad_rx_info *rx_info;
         struct bnad_rx_ctrl *rx_ctrl;
 
-        spin_lock_irqsave(&bnad->bna_lock, flags);
+        if (unlikely(test_bit(BNAD_RF_MBOX_IRQ_DISABLED, &bnad->run_flags)))
+                return IRQ_NONE;
 
         bna_intr_status_get(&bnad->bna, intr_status);
-        if (!intr_status) {
-                spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        if (unlikely(!intr_status))
                 return IRQ_NONE;
-        }
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
 
         if (BNA_IS_MBOX_ERR_INTR(intr_status)) {
                 bna_mbox_handler(&bnad->bna, intr_status);
@@ -672,11 +676,10 @@ bnad_enable_mbox_irq(struct bnad *bnad)
 {
         int irq = BNAD_GET_MBOX_IRQ(bnad);
 
-        if (!(bnad->cfg_flags & BNAD_CF_MSIX))
-                return;
-
         if (test_and_clear_bit(BNAD_RF_MBOX_IRQ_DISABLED, &bnad->run_flags))
-                enable_irq(irq);
+                if (bnad->cfg_flags & BNAD_CF_MSIX)
+                        enable_irq(irq);
+
         BNAD_UPDATE_CTR(bnad, mbox_intr_enabled);
 }
 
@@ -684,16 +687,16 @@ bnad_enable_mbox_irq(struct bnad *bnad)
  * Called with bnad->bna_lock held b'cos of
  * bnad->cfg_flags access.
  */
-void
+static void
 bnad_disable_mbox_irq(struct bnad *bnad)
 {
         int irq = BNAD_GET_MBOX_IRQ(bnad);
 
-        if (!(bnad->cfg_flags & BNAD_CF_MSIX))
-                return;
 
         if (!test_and_set_bit(BNAD_RF_MBOX_IRQ_DISABLED, &bnad->run_flags))
-                disable_irq_nosync(irq);
+                if (bnad->cfg_flags & BNAD_CF_MSIX)
+                        disable_irq_nosync(irq);
+
         BNAD_UPDATE_CTR(bnad, mbox_intr_disabled);
 }
 
@@ -953,11 +956,6 @@ bnad_cb_stats_get(struct bnad *bnad, enum bna_cb_status status,
                   jiffies + msecs_to_jiffies(BNAD_STATS_TIMER_FREQ));
 }
 
-void
-bnad_cb_stats_clr(struct bnad *bnad)
-{
-}
-
 /* Resource allocation, free functions */
 
 static void
@@ -1045,14 +1043,12 @@ bnad_mbox_irq_free(struct bnad *bnad,
                 return;
 
         spin_lock_irqsave(&bnad->bna_lock, flags);
-
         bnad_disable_mbox_irq(bnad);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
 
         irq = BNAD_GET_MBOX_IRQ(bnad);
         free_irq(irq, bnad->netdev);
 
-        spin_unlock_irqrestore(&bnad->bna_lock, flags);
-
         kfree(intr_info->idl);
 }
 
@@ -1094,8 +1090,15 @@ bnad_mbox_irq_alloc(struct bnad *bnad,
 
         sprintf(bnad->mbox_irq_name, "%s", BNAD_NAME);
 
+        /*
+         * Set the Mbox IRQ disable flag, so that the IRQ handler
+         * called from request_irq() for SHARED IRQs do not execute
+         */
+        set_bit(BNAD_RF_MBOX_IRQ_DISABLED, &bnad->run_flags);
+
         err = request_irq(irq, irq_handler, flags,
                           bnad->mbox_irq_name, bnad->netdev);
+
         if (err) {
                 kfree(intr_info->idl);
                 intr_info->idl = NULL;
@@ -1103,7 +1106,10 @@ bnad_mbox_irq_alloc(struct bnad *bnad,
         }
 
         spin_lock_irqsave(&bnad->bna_lock, flags);
-        bnad_disable_mbox_irq(bnad);
+
+        if (bnad->cfg_flags & BNAD_CF_MSIX)
+                disable_irq_nosync(irq);
+
         spin_unlock_irqrestore(&bnad->bna_lock, flags);
         return 0;
 }
@@ -1485,7 +1491,6 @@ bnad_stats_timer_start(struct bnad *bnad)
                           jiffies + msecs_to_jiffies(BNAD_STATS_TIMER_FREQ));
         }
         spin_unlock_irqrestore(&bnad->bna_lock, flags);
-
 }
 
 /*
@@ -2170,7 +2175,6 @@ bnad_device_disable(struct bnad *bnad)
         spin_unlock_irqrestore(&bnad->bna_lock, flags);
 
         wait_for_completion(&bnad->bnad_completions.ioc_comp);
-
 }
 
 static int
@@ -2236,7 +2240,6 @@ static void
 bnad_enable_msix(struct bnad *bnad)
 {
         int i, ret;
-        u32 tot_msix_num;
         unsigned long flags;
 
         spin_lock_irqsave(&bnad->bna_lock, flags);
@@ -2249,18 +2252,16 @@ bnad_enable_msix(struct bnad *bnad)
         if (bnad->msix_table)
                 return;
 
-        tot_msix_num = bnad->msix_num + bnad->msix_diag_num;
-
         bnad->msix_table =
-                kcalloc(tot_msix_num, sizeof(struct msix_entry), GFP_KERNEL);
+                kcalloc(bnad->msix_num, sizeof(struct msix_entry), GFP_KERNEL);
 
         if (!bnad->msix_table)
                 goto intx_mode;
 
-        for (i = 0; i < tot_msix_num; i++)
+        for (i = 0; i < bnad->msix_num; i++)
                 bnad->msix_table[i].entry = i;
 
-        ret = pci_enable_msix(bnad->pcidev, bnad->msix_table, tot_msix_num);
+        ret = pci_enable_msix(bnad->pcidev, bnad->msix_table, bnad->msix_num);
         if (ret > 0) {
                 /* Not enough MSI-X vectors. */
 
@@ -2273,12 +2274,11 @@ bnad_enable_msix(struct bnad *bnad)
                         + (bnad->num_rx
                         * bnad->num_rxp_per_rx) +
                          BNAD_MAILBOX_MSIX_VECTORS;
-                tot_msix_num = bnad->msix_num + bnad->msix_diag_num;
 
                 /* Try once more with adjusted numbers */
                 /* If this fails, fall back to INTx */
                 ret = pci_enable_msix(bnad->pcidev, bnad->msix_table,
-                                      tot_msix_num);
+                                      bnad->msix_num);
                 if (ret)
                         goto intx_mode;
 
@@ -2291,7 +2291,6 @@ intx_mode:
         kfree(bnad->msix_table);
         bnad->msix_table = NULL;
         bnad->msix_num = 0;
-        bnad->msix_diag_num = 0;
         spin_lock_irqsave(&bnad->bna_lock, flags);
         bnad->cfg_flags &= ~BNAD_CF_MSIX;
         bnad_q_num_init(bnad);
@@ -2502,7 +2501,7 @@ bnad_start_xmit(struct sk_buff *skb, struct net_device *netdev)
                 htons((skb_is_gso(skb) ? BNA_TXQ_WI_SEND_LSO :
                        BNA_TXQ_WI_SEND));
 
-        if (bnad->vlan_grp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 vlan_tag = (u16) vlan_tx_tag_get(skb);
                 flags |= (BNA_TXQ_WI_CF_INS_PRIO | BNA_TXQ_WI_CF_INS_VLAN);
         }
@@ -2939,7 +2938,6 @@ bnad_init(struct bnad *bnad,
         bnad->msix_num = (bnad->num_tx * bnad->num_txq_per_tx) +
                 (bnad->num_rx * bnad->num_rxp_per_rx) +
                          BNAD_MAILBOX_MSIX_VECTORS;
-        bnad->msix_diag_num = 2;        /* 1 for Tx, 1 for Rx */
 
         bnad->txq_depth = BNAD_TXQ_DEPTH;
         bnad->rxq_depth = BNAD_RXQ_DEPTH;
@@ -3108,7 +3106,6 @@ bnad_pci_probe(struct pci_dev *pdev,
 
         spin_lock_irqsave(&bnad->bna_lock, flags);
         bna_init(bna, bnad, &pcidev_info, &bnad->res_info[0]);
-
         spin_unlock_irqrestore(&bnad->bna_lock, flags);
 
         bnad->stats.bna_stats = &bna->stats;
@@ -3211,7 +3208,7 @@ bnad_pci_remove(struct pci_dev *pdev)
         free_netdev(netdev);
 }
 
-const struct pci_device_id bnad_pci_id_table[] = {
+static const struct pci_device_id bnad_pci_id_table[] = {
         {
                 PCI_DEVICE(PCI_VENDOR_ID_BROCADE,
                         PCI_DEVICE_ID_BROCADE_CT),
diff --git a/drivers/net/bna/bnad.h b/drivers/net/bna/bnad.h
index ee377888b905..ebc3a9078642 100644
--- a/drivers/net/bna/bnad.h
+++ b/drivers/net/bna/bnad.h
@@ -248,7 +248,6 @@ struct bnad {
         u64             mmio_len;
 
         u32             msix_num;
-        u32             msix_diag_num;
         struct msix_entry       *msix_table;
 
         struct mutex            conf_mutex;
diff --git a/drivers/net/bna/cna_fwimg.c b/drivers/net/bna/cna_fwimg.c
index 0bd1d3790a27..e8f4ecd9ebb5 100644
--- a/drivers/net/bna/cna_fwimg.c
+++ b/drivers/net/bna/cna_fwimg.c
@@ -22,7 +22,7 @@ const struct firmware *bfi_fw;
 static u32 *bfi_image_ct_cna;
 static u32 bfi_image_ct_cna_size;
 
-u32 *
+static u32 *
 cna_read_firmware(struct pci_dev *pdev, u32 **bfi_image,
                         u32 *bfi_image_size, char *fw_name)
 {
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 4ff76e38e788..bf3c830e7dda 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -37,9 +37,6 @@
 #include <linux/ethtool.h>
 #include <linux/mii.h>
 #include <linux/if_vlan.h>
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
-#define BCM_VLAN 1
-#endif
 #include <net/ip.h>
 #include <net/tcp.h>
 #include <net/checksum.h>
@@ -59,13 +56,13 @@
 #include "bnx2_fw.h"
 
 #define DRV_MODULE_NAME         "bnx2"
-#define DRV_MODULE_VERSION      "2.0.17"
-#define DRV_MODULE_RELDATE      "July 18, 2010"
-#define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-5.0.0.j6.fw"
-#define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-5.0.0.j3.fw"
-#define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-5.0.0.j15.fw"
-#define FW_RV2P_FILE_09_Ax      "bnx2/bnx2-rv2p-09ax-5.0.0.j10.fw"
-#define FW_RV2P_FILE_09         "bnx2/bnx2-rv2p-09-5.0.0.j10.fw"
+#define DRV_MODULE_VERSION      "2.0.18"
+#define DRV_MODULE_RELDATE      "Oct 7, 2010"
+#define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-6.0.15.fw"
+#define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-6.0.15.fw"
+#define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-6.0.17.fw"
+#define FW_RV2P_FILE_09_Ax      "bnx2/bnx2-rv2p-09ax-6.0.17.fw"
+#define FW_RV2P_FILE_09         "bnx2/bnx2-rv2p-09-6.0.17.fw"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -266,7 +263,7 @@ static inline u32 bnx2_tx_avail(struct bnx2 *bp, struct bnx2_tx_ring_info *txr)
                 if (diff == TX_DESC_CNT)
                         diff = MAX_TX_DESC_CNT;
         }
-        return (bp->tx_ring_size - diff);
+        return bp->tx_ring_size - diff;
 }
 
 static u32
@@ -299,7 +296,7 @@ bnx2_shmem_wr(struct bnx2 *bp, u32 offset, u32 val)
 static u32
 bnx2_shmem_rd(struct bnx2 *bp, u32 offset)
 {
-        return (bnx2_reg_rd_ind(bp, bp->shmem_base + offset));
+        return bnx2_reg_rd_ind(bp, bp->shmem_base + offset);
 }
 
 static void
@@ -977,9 +974,9 @@ bnx2_report_fw_link(struct bnx2 *bp)
 static char *
 bnx2_xceiver_str(struct bnx2 *bp)
 {
-        return ((bp->phy_port == PORT_FIBRE) ? "SerDes" :
+        return (bp->phy_port == PORT_FIBRE) ? "SerDes" :
                 ((bp->phy_flags & BNX2_PHY_FLAG_SERDES) ? "Remote Copper" :
-                 "Copper"));
+                 "Copper");
 }
 
 static void
@@ -1269,30 +1266,9 @@ bnx2_init_rx_context(struct bnx2 *bp, u32 cid)
         val |= BNX2_L2CTX_CTX_TYPE_SIZE_L2;
         val |= 0x02 << 8;
 
-        if (CHIP_NUM(bp) == CHIP_NUM_5709) {
-                u32 lo_water, hi_water;
-
-                if (bp->flow_ctrl & FLOW_CTRL_TX)
-                        lo_water = BNX2_L2CTX_LO_WATER_MARK_DEFAULT;
-                else
-                        lo_water = BNX2_L2CTX_LO_WATER_MARK_DIS;
-                if (lo_water >= bp->rx_ring_size)
-                        lo_water = 0;
-
-                hi_water = min_t(int, bp->rx_ring_size / 4, lo_water + 16);
-
-                if (hi_water <= lo_water)
-                        lo_water = 0;
-
-                hi_water /= BNX2_L2CTX_HI_WATER_MARK_SCALE;
-                lo_water /= BNX2_L2CTX_LO_WATER_MARK_SCALE;
+        if (bp->flow_ctrl & FLOW_CTRL_TX)
+                val |= BNX2_L2CTX_FLOW_CTRL_ENABLE;
 
-                if (hi_water > 0xf)
-                        hi_water = 0xf;
-                else if (hi_water == 0)
-                        lo_water = 0;
-                val |= lo_water | (hi_water << BNX2_L2CTX_HI_WATER_MARK_SHIFT);
-        }
         bnx2_ctx_wr(bp, rx_cid_addr, BNX2_L2CTX_CTX_TYPE, val);
 }
 
@@ -1373,8 +1349,7 @@ bnx2_set_mac_link(struct bnx2 *bp)
         /* Acknowledge the interrupt. */
         REG_WR(bp, BNX2_EMAC_STATUS, BNX2_EMAC_STATUS_LINK_CHANGE);
 
-        if (CHIP_NUM(bp) == CHIP_NUM_5709)
-                bnx2_init_all_rx_contexts(bp);
+        bnx2_init_all_rx_contexts(bp);
 }
 
 static void
@@ -1758,7 +1733,7 @@ __acquires(&bp->phy_lock)
         u32 new_adv = 0;
 
         if (bp->phy_flags & BNX2_PHY_FLAG_REMOTE_PHY_CAP)
-                return (bnx2_setup_remote_phy(bp, port));
+                return bnx2_setup_remote_phy(bp, port);
 
         if (!(bp->autoneg & AUTONEG_SPEED)) {
                 u32 new_bmcr;
@@ -2171,10 +2146,10 @@ __acquires(&bp->phy_lock)
                 return 0;
 
         if (bp->phy_flags & BNX2_PHY_FLAG_SERDES) {
-                return (bnx2_setup_serdes_phy(bp, port));
+                return bnx2_setup_serdes_phy(bp, port);
         }
         else {
-                return (bnx2_setup_copper_phy(bp));
+                return bnx2_setup_copper_phy(bp);
         }
 }
 
@@ -3109,8 +3084,6 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
                 struct sw_bd *rx_buf, *next_rx_buf;
                 struct sk_buff *skb;
                 dma_addr_t dma_addr;
-                u16 vtag = 0;
-                int hw_vlan __maybe_unused = 0;
 
                 sw_ring_cons = RX_RING_IDX(sw_cons);
                 sw_ring_prod = RX_RING_IDX(sw_prod);
@@ -3190,23 +3163,8 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
                         goto next_rx;
 
                 if ((status & L2_FHDR_STATUS_L2_VLAN_TAG) &&
-                    !(bp->rx_mode & BNX2_EMAC_RX_MODE_KEEP_VLAN_TAG)) {
-                        vtag = rx_hdr->l2_fhdr_vlan_tag;
-#ifdef BCM_VLAN
-                        if (bp->vlgrp)
-                                hw_vlan = 1;
-                        else
-#endif
-                        {
-                                struct vlan_ethhdr *ve = (struct vlan_ethhdr *)
-                                        __skb_push(skb, 4);
-
-                                memmove(ve, skb->data + 4, ETH_ALEN * 2);
-                                ve->h_vlan_proto = htons(ETH_P_8021Q);
-                                ve->h_vlan_TCI = htons(vtag);
-                                len += 4;
-                        }
-                }
+                    !(bp->rx_mode & BNX2_EMAC_RX_MODE_KEEP_VLAN_TAG))
+                        __vlan_hwaccel_put_tag(skb, rx_hdr->l2_fhdr_vlan_tag);
 
                 skb->protocol = eth_type_trans(skb, bp->dev);
 
@@ -3233,14 +3191,7 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
                         skb->rxhash = rx_hdr->l2_fhdr_hash;
 
                 skb_record_rx_queue(skb, bnapi - &bp->bnx2_napi[0]);
-
-#ifdef BCM_VLAN
-                if (hw_vlan)
-                        vlan_gro_receive(&bnapi->napi, bp->vlgrp, vtag, skb);
-                else
-#endif
-                        napi_gro_receive(&bnapi->napi, skb);
-
+                napi_gro_receive(&bnapi->napi, skb);
                 rx_pkt++;
 
 next_rx:
@@ -3555,13 +3506,9 @@ bnx2_set_rx_mode(struct net_device *dev)
         rx_mode = bp->rx_mode & ~(BNX2_EMAC_RX_MODE_PROMISCUOUS |
                                   BNX2_EMAC_RX_MODE_KEEP_VLAN_TAG);
         sort_mode = 1 | BNX2_RPM_SORT_USER0_BC_EN;
-#ifdef BCM_VLAN
-        if (!bp->vlgrp && (bp->flags & BNX2_FLAG_CAN_KEEP_VLAN))
-                rx_mode |= BNX2_EMAC_RX_MODE_KEEP_VLAN_TAG;
-#else
-        if (bp->flags & BNX2_FLAG_CAN_KEEP_VLAN)
+        if (!(dev->features & NETIF_F_HW_VLAN_RX) &&
+             (bp->flags & BNX2_FLAG_CAN_KEEP_VLAN))
                 rx_mode |= BNX2_EMAC_RX_MODE_KEEP_VLAN_TAG;
-#endif
         if (dev->flags & IFF_PROMISC) {
                 /* Promiscuous mode. */
                 rx_mode |= BNX2_EMAC_RX_MODE_PROMISCUOUS;
@@ -4974,6 +4921,11 @@ bnx2_init_chip(struct bnx2 *bp)
 
         REG_WR(bp, BNX2_HC_CONFIG, val);
 
+        if (bp->rx_ticks < 25)
+                bnx2_reg_wr_ind(bp, BNX2_FW_RX_LOW_LATENCY, 1);
+        else
+                bnx2_reg_wr_ind(bp, BNX2_FW_RX_LOW_LATENCY, 0);
+
         for (i = 1; i < bp->irq_nvecs; i++) {
                 u32 base = ((i - 1) * BNX2_HC_SB_CONFIG_SIZE) +
                            BNX2_HC_SB_CONFIG_1;
@@ -5242,18 +5194,20 @@ bnx2_init_all_rings(struct bnx2 *bp)
                 bnx2_init_rx_ring(bp, i);
 
         if (bp->num_rx_rings > 1) {
-                u32 tbl_32;
-                u8 *tbl = (u8 *) &tbl_32;
-
-                bnx2_reg_wr_ind(bp, BNX2_RXP_SCRATCH_RSS_TBL_SZ,
-                                BNX2_RXP_SCRATCH_RSS_TBL_MAX_ENTRIES);
+                u32 tbl_32 = 0;
 
                 for (i = 0; i < BNX2_RXP_SCRATCH_RSS_TBL_MAX_ENTRIES; i++) {
-                        tbl[i % 4] = i % (bp->num_rx_rings - 1);
-                        if ((i % 4) == 3)
-                                bnx2_reg_wr_ind(bp,
-                                                BNX2_RXP_SCRATCH_RSS_TBL + i,
-                                                cpu_to_be32(tbl_32));
+                        int shift = (i % 8) << 2;
+
+                        tbl_32 |= (i % (bp->num_rx_rings - 1)) << shift;
+                        if ((i % 8) == 7) {
+                                REG_WR(bp, BNX2_RLUP_RSS_DATA, tbl_32);
+                                REG_WR(bp, BNX2_RLUP_RSS_COMMAND, (i >> 3) |
+                                        BNX2_RLUP_RSS_COMMAND_RSS_WRITE_MASK |
+                                        BNX2_RLUP_RSS_COMMAND_WRITE |
+                                        BNX2_RLUP_RSS_COMMAND_HASH_MASK);
+                                tbl_32 = 0;
+                        }
                 }
 
                 val = BNX2_RLUP_RSS_CONFIG_IPV4_RSS_TYPE_ALL_XI |
@@ -6202,7 +6156,7 @@ bnx2_enable_msix(struct bnx2 *bp, int msix_vecs)
         }
 }
 
-static void
+static int
 bnx2_setup_int_mode(struct bnx2 *bp, int dis_msi)
 {
         int cpus = num_online_cpus();
@@ -6231,9 +6185,10 @@ bnx2_setup_int_mode(struct bnx2 *bp, int dis_msi)
         }
 
         bp->num_tx_rings = rounddown_pow_of_two(bp->irq_nvecs);
-        bp->dev->real_num_tx_queues = bp->num_tx_rings;
+        netif_set_real_num_tx_queues(bp->dev, bp->num_tx_rings);
 
         bp->num_rx_rings = bp->irq_nvecs;
+        return netif_set_real_num_rx_queues(bp->dev, bp->num_rx_rings);
 }
 
 /* Called with rtnl_lock */
@@ -6248,7 +6203,9 @@ bnx2_open(struct net_device *dev)
         bnx2_set_power_state(bp, PCI_D0);
         bnx2_disable_int(bp);
 
-        bnx2_setup_int_mode(bp, disable_msi);
+        rc = bnx2_setup_int_mode(bp, disable_msi);
+        if (rc)
+                goto open_err;
         bnx2_init_napi(bp);
         bnx2_napi_enable(bp);
         rc = bnx2_alloc_mem(bp);
@@ -6377,29 +6334,6 @@ bnx2_tx_timeout(struct net_device *dev)
         schedule_work(&bp->reset_task);
 }
 
-#ifdef BCM_VLAN
-/* Called with rtnl_lock */
-static void
-bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
-{
-        struct bnx2 *bp = netdev_priv(dev);
-
-        if (netif_running(dev))
-                bnx2_netif_stop(bp, false);
-
-        bp->vlgrp = vlgrp;
-
-        if (!netif_running(dev))
-                return;
-
-        bnx2_set_rx_mode(dev);
-        if (bp->flags & BNX2_FLAG_CAN_KEEP_VLAN)
-                bnx2_fw_sync(bp, BNX2_DRV_MSG_CODE_KEEP_VLAN_UPDATE, 0, 1);
-
-        bnx2_netif_start(bp, false);
-}
-#endif
-
 /* Called with netif_tx_lock.
  * bnx2_tx_int() runs without netif_tx_lock unless it needs to call
  * netif_wake_queue().
@@ -6440,12 +6374,11 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 vlan_tag_flags |= TX_BD_FLAGS_TCP_UDP_CKSUM;
         }
 
-#ifdef BCM_VLAN
-        if (bp->vlgrp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 vlan_tag_flags |=
                         (TX_BD_FLAGS_VLAN_TAG | (vlan_tx_tag_get(skb) << 16));
         }
-#endif
+
         if ((mss = skb_shinfo(skb)->gso_size)) {
                 u32 tcp_opt_len;
                 struct iphdr *iph;
@@ -7582,15 +7515,36 @@ bnx2_set_tx_csum(struct net_device *dev, u32 data)
         struct bnx2 *bp = netdev_priv(dev);
 
         if (CHIP_NUM(bp) == CHIP_NUM_5709)
-                return (ethtool_op_set_tx_ipv6_csum(dev, data));
+                return ethtool_op_set_tx_ipv6_csum(dev, data);
         else
-                return (ethtool_op_set_tx_csum(dev, data));
+                return ethtool_op_set_tx_csum(dev, data);
 }
 
 static int
 bnx2_set_flags(struct net_device *dev, u32 data)
 {
-        return ethtool_op_set_flags(dev, data, ETH_FLAG_RXHASH);
+        struct bnx2 *bp = netdev_priv(dev);
+        int rc;
+
+        if (!(bp->flags & BNX2_FLAG_CAN_KEEP_VLAN) &&
+            !(data & ETH_FLAG_RXVLAN))
+                return -EOPNOTSUPP;
+
+        rc = ethtool_op_set_flags(dev, data, ETH_FLAG_RXHASH | ETH_FLAG_RXVLAN |
+                                  ETH_FLAG_TXVLAN);
+        if (rc)
+                return rc;
+
+        if ((!!(data & ETH_FLAG_RXVLAN) !=
+            !!(bp->rx_mode & BNX2_EMAC_RX_MODE_KEEP_VLAN_TAG)) &&
+            netif_running(dev)) {
+                bnx2_netif_stop(bp, false);
+                bnx2_set_rx_mode(dev);
+                bnx2_fw_sync(bp, BNX2_DRV_MSG_CODE_KEEP_VLAN_UPDATE, 0, 1);
+                bnx2_netif_start(bp, false);
+        }
+
+        return 0;
 }
 
 static const struct ethtool_ops bnx2_ethtool_ops = {
@@ -7705,7 +7659,7 @@ bnx2_change_mtu(struct net_device *dev, int new_mtu)
                 return -EINVAL;
 
         dev->mtu = new_mtu;
-        return (bnx2_change_ring_size(bp, bp->rx_ring_size, bp->tx_ring_size));
+        return bnx2_change_ring_size(bp, bp->rx_ring_size, bp->tx_ring_size);
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -7927,16 +7881,7 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
                 goto err_out_disable;
         }
 
-        /* AER (Advanced Error Reporting) hooks */
-        err = pci_enable_pcie_error_reporting(pdev);
-        if (err) {
-                dev_err(&pdev->dev, "pci_enable_pcie_error_reporting failed "
-                                    "0x%x\n", err);
-                /* non-fatal, continue */
-        }
-
         pci_set_master(pdev);
-        pci_save_state(pdev);
 
         bp->pm_cap = pci_find_capability(pdev, PCI_CAP_ID_PM);
         if (bp->pm_cap == 0) {
@@ -7991,6 +7936,15 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
                 bp->flags |= BNX2_FLAG_PCIE;
                 if (CHIP_REV(bp) == CHIP_REV_Ax)
                         bp->flags |= BNX2_FLAG_JUMBO_BROKEN;
+
+                /* AER (Advanced Error Reporting) hooks */
+                err = pci_enable_pcie_error_reporting(pdev);
+                if (err) {
+                        dev_err(&pdev->dev, "pci_enable_pcie_error_reporting "
+                                            "failed 0x%x\n", err);
+                        /* non-fatal, continue */
+                }
+
         } else {
                 bp->pcix_cap = pci_find_capability(pdev, PCI_CAP_ID_PCIX);
                 if (bp->pcix_cap == 0) {
@@ -8247,16 +8201,20 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         bp->timer.data = (unsigned long) bp;
         bp->timer.function = bnx2_timer;
 
+        pci_save_state(pdev);
+
         return 0;
 
 err_out_unmap:
+        if (bp->flags & BNX2_FLAG_PCIE)
+                pci_disable_pcie_error_reporting(pdev);
+
         if (bp->regview) {
                 iounmap(bp->regview);
                 bp->regview = NULL;
         }
 
 err_out_release:
-        pci_disable_pcie_error_reporting(pdev);
         pci_release_regions(pdev);
 
 err_out_disable:
@@ -8326,9 +8284,6 @@ static const struct net_device_ops bnx2_netdev_ops = {
         .ndo_set_mac_address    = bnx2_change_mac_addr,
         .ndo_change_mtu         = bnx2_change_mtu,
         .ndo_tx_timeout         = bnx2_tx_timeout,
-#ifdef BCM_VLAN
-        .ndo_vlan_rx_register   = bnx2_vlan_rx_register,
-#endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = poll_bnx2,
 #endif
@@ -8336,9 +8291,7 @@ static const struct net_device_ops bnx2_netdev_ops = {
 
 static void inline vlan_features_add(struct net_device *dev, unsigned long flags)
 {
-#ifdef BCM_VLAN
         dev->vlan_features |= flags;
-#endif
 }
 
 static int __devinit
@@ -8387,9 +8340,7 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 dev->features |= NETIF_F_IPV6_CSUM;
                 vlan_features_add(dev, NETIF_F_IPV6_CSUM);
         }
-#ifdef BCM_VLAN
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
-#endif
         dev->features |= NETIF_F_TSO | NETIF_F_TSO_ECN;
         vlan_features_add(dev, NETIF_F_TSO | NETIF_F_TSO_ECN);
         if (CHIP_NUM(bp) == CHIP_NUM_5709) {
@@ -8446,9 +8397,10 @@ bnx2_remove_one(struct pci_dev *pdev)
 
         kfree(bp->temp_stats_blk);
 
-        free_netdev(dev);
+        if (bp->flags & BNX2_FLAG_PCIE)
+                pci_disable_pcie_error_reporting(pdev);
 
-        pci_disable_pcie_error_reporting(pdev);
+        free_netdev(dev);
 
         pci_release_regions(pdev);
         pci_disable_device(pdev);
@@ -8562,6 +8514,9 @@ static pci_ers_result_t bnx2_io_slot_reset(struct pci_dev *pdev)
         }
         rtnl_unlock();
 
+        if (!(bp->flags & BNX2_FLAG_PCIE))
+                return result;
+
         err = pci_cleanup_aer_uncorrect_error_status(pdev);
         if (err) {
                 dev_err(&pdev->dev,
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index 2104c1005d02..bf4c3421067d 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -352,12 +352,7 @@ struct l2_fhdr {
 #define BNX2_L2CTX_BD_PRE_READ                          0x00000000
 #define BNX2_L2CTX_CTX_SIZE                             0x00000000
 #define BNX2_L2CTX_CTX_TYPE                             0x00000000
-#define BNX2_L2CTX_LO_WATER_MARK_DEFAULT                 4
-#define BNX2_L2CTX_LO_WATER_MARK_SCALE                   4
-#define BNX2_L2CTX_LO_WATER_MARK_DIS                     0
-#define BNX2_L2CTX_HI_WATER_MARK_SHIFT                   4
-#define BNX2_L2CTX_HI_WATER_MARK_SCALE                   16
-#define BNX2_L2CTX_WATER_MARKS_MSK                       0x000000ff
+#define BNX2_L2CTX_FLOW_CTRL_ENABLE                      0x000000ff
 #define BNX2_L2CTX_CTX_TYPE_SIZE_L2                      ((0x20/20)<<16)
 #define BNX2_L2CTX_CTX_TYPE_CTX_BD_CHN_TYPE              (0xf<<28)
 #define BNX2_L2CTX_CTX_TYPE_CTX_BD_CHN_TYPE_UNDEFINED    (0<<28)
@@ -4185,6 +4180,15 @@ struct l2_fhdr {
 #define BNX2_RLUP_RSS_CONFIG_IPV6_RSS_TYPE_IP_ONLY_XI    (2L<<2)
 #define BNX2_RLUP_RSS_CONFIG_IPV6_RSS_TYPE_RES_XI        (3L<<2)
 
+#define BNX2_RLUP_RSS_COMMAND                           0x00002048
+#define BNX2_RLUP_RSS_COMMAND_RSS_IND_TABLE_ADDR         (0xfUL<<0)
+#define BNX2_RLUP_RSS_COMMAND_RSS_WRITE_MASK             (0xffUL<<4)
+#define BNX2_RLUP_RSS_COMMAND_WRITE                      (1UL<<12)
+#define BNX2_RLUP_RSS_COMMAND_READ                       (1UL<<13)
+#define BNX2_RLUP_RSS_COMMAND_HASH_MASK                  (0x7UL<<14)
+
+#define BNX2_RLUP_RSS_DATA                              0x0000204c
+
 
 /*
  *  rbuf_reg definition
@@ -6077,6 +6081,7 @@ struct l2_fhdr {
 
 #define BNX2_COM_SCRATCH                                0x00120000
 
+#define BNX2_FW_RX_LOW_LATENCY                           0x00120058
 #define BNX2_FW_RX_DROP_COUNT                            0x00120084
 
 
@@ -6497,8 +6502,8 @@ struct l2_fhdr {
 #define TX_DESC_CNT  (BCM_PAGE_SIZE / sizeof(struct tx_bd))
 #define MAX_TX_DESC_CNT (TX_DESC_CNT - 1)
 
-#define MAX_RX_RINGS    4
-#define MAX_RX_PG_RINGS 16
+#define MAX_RX_RINGS    8
+#define MAX_RX_PG_RINGS 32
 #define RX_DESC_CNT  (BCM_PAGE_SIZE / sizeof(struct rx_bd))
 #define MAX_RX_DESC_CNT (RX_DESC_CNT - 1)
 #define MAX_TOTAL_RX_DESC_CNT (MAX_RX_DESC_CNT * MAX_RX_RINGS)
@@ -6737,10 +6742,6 @@ struct bnx2 {
 
         struct bnx2_napi        bnx2_napi[BNX2_MAX_MSIX_VEC];
 
-#ifdef BCM_VLAN
-        struct                  vlan_group *vlgrp;
-#endif
-
         u32                     rx_buf_use_size;        /* useable size */
         u32                     rx_buf_size;            /* with alignment */
         u32                     rx_copy_thresh;
diff --git a/drivers/net/bnx2x/bnx2x.h b/drivers/net/bnx2x/bnx2x.h
index 64329c5fbdea..9571ecf48f35 100644
--- a/drivers/net/bnx2x/bnx2x.h
+++ b/drivers/net/bnx2x/bnx2x.h
@@ -20,26 +20,20 @@
  * (you will need to reboot afterwards) */
 /* #define BNX2X_STOP_ON_ERROR */
 
-#define DRV_MODULE_VERSION      "1.52.53-7"
-#define DRV_MODULE_RELDATE      "2010/09/12"
+#define DRV_MODULE_VERSION      "1.60.00-3"
+#define DRV_MODULE_RELDATE      "2010/10/19"
 #define BNX2X_BC_VER            0x040200
 
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
-#define BCM_VLAN                        1
-#endif
-
 #define BNX2X_MULTI_QUEUE
 
 #define BNX2X_NEW_NAPI
 
 
-
 #if defined(CONFIG_CNIC) || defined(CONFIG_CNIC_MODULE)
 #define BCM_CNIC 1
 #include "../cnic_if.h"
 #endif
 
-
 #ifdef BCM_CNIC
 #define BNX2X_MIN_MSIX_VEC_CNT 3
 #define BNX2X_MSIX_VEC_FP_START 2
@@ -129,16 +123,18 @@ void bnx2x_panic_dump(struct bnx2x *bp);
         } while (0)
 #endif
 
+#define bnx2x_mc_addr(ha)      ((ha)->addr)
 
 #define U64_LO(x)                       (u32)(((u64)(x)) & 0xffffffff)
 #define U64_HI(x)                       (u32)(((u64)(x)) >> 32)
 #define HILO_U64(hi, lo)                ((((u64)(hi)) << 32) + (lo))
 
 
-#define REG_ADDR(bp, offset)            (bp->regview + offset)
+#define REG_ADDR(bp, offset)            ((bp->regview) + (offset))
 
 #define REG_RD(bp, offset)              readl(REG_ADDR(bp, offset))
 #define REG_RD8(bp, offset)             readb(REG_ADDR(bp, offset))
+#define REG_RD16(bp, offset)            readw(REG_ADDR(bp, offset))
 
 #define REG_WR(bp, offset, val)         writel((u32)val, REG_ADDR(bp, offset))
 #define REG_WR8(bp, offset, val)        writeb((u8)val, REG_ADDR(bp, offset))
@@ -160,6 +156,9 @@ void bnx2x_panic_dump(struct bnx2x *bp);
                                  offset, len32); \
         } while (0)
 
+#define REG_WR_DMAE_LEN(bp, offset, valp, len32) \
+        REG_WR_DMAE(bp, offset, valp, len32)
+
 #define VIRT_WR_DMAE_LEN(bp, data, addr, len32, le32_swap) \
         do { \
                 memcpy(GUNZIP_BUF(bp), data, (len32) * 4); \
@@ -175,16 +174,59 @@ void bnx2x_panic_dump(struct bnx2x *bp);
                                          offsetof(struct shmem2_region, field))
 #define SHMEM2_RD(bp, field)            REG_RD(bp, SHMEM2_ADDR(bp, field))
 #define SHMEM2_WR(bp, field, val)       REG_WR(bp, SHMEM2_ADDR(bp, field), val)
+#define MF_CFG_ADDR(bp, field)          (bp->common.mf_cfg_base + \
+                                         offsetof(struct mf_cfg, field))
+#define MF2_CFG_ADDR(bp, field)         (bp->common.mf2_cfg_base + \
+                                         offsetof(struct mf2_cfg, field))
 
-#define MF_CFG_RD(bp, field)            SHMEM_RD(bp, mf_cfg.field)
-#define MF_CFG_WR(bp, field, val)       SHMEM_WR(bp, mf_cfg.field, val)
+#define MF_CFG_RD(bp, field)            REG_RD(bp, MF_CFG_ADDR(bp, field))
+#define MF_CFG_WR(bp, field, val)       REG_WR(bp,\
+                                               MF_CFG_ADDR(bp, field), (val))
+#define MF2_CFG_RD(bp, field)           REG_RD(bp, MF2_CFG_ADDR(bp, field))
+
+#define SHMEM2_HAS(bp, field)           ((bp)->common.shmem2_base &&    \
+                                         (SHMEM2_RD((bp), size) >       \
+                                         offsetof(struct shmem2_region, field)))
 
 #define EMAC_RD(bp, reg)                REG_RD(bp, emac_base + reg)
 #define EMAC_WR(bp, reg, val)           REG_WR(bp, emac_base + reg, val)
 
+/* SP SB indices */
+
+/* General SP events - stats query, cfc delete, etc  */
+#define HC_SP_INDEX_ETH_DEF_CONS                3
+
+/* EQ completions */
+#define HC_SP_INDEX_EQ_CONS                     7
+
+/* iSCSI L2 */
+#define HC_SP_INDEX_ETH_ISCSI_CQ_CONS           5
+#define HC_SP_INDEX_ETH_ISCSI_RX_CQ_CONS        1
+
+/**
+ *  CIDs and CLIDs:
+ *  CLIDs below is a CLID for func 0, then the CLID for other
+ *  functions will be calculated by the formula:
+ *
+ *  FUNC_N_CLID_X = N * NUM_SPECIAL_CLIENTS + FUNC_0_CLID_X
+ *
+ */
+/* iSCSI L2 */
+#define BNX2X_ISCSI_ETH_CL_ID           17
+#define BNX2X_ISCSI_ETH_CID             17
+
+/** Additional rings budgeting */
+#ifdef BCM_CNIC
+#define CNIC_CONTEXT_USE                1
+#else
+#define CNIC_CONTEXT_USE                0
+#endif /* BCM_CNIC */
+
 #define AEU_IN_ATTN_BITS_PXPPCICLOCKCLIENT_PARITY_ERROR \
         AEU_INPUTS_ATTN_BITS_PXPPCICLOCKCLIENT_PARITY_ERROR
 
+#define SM_RX_ID                        0
+#define SM_TX_ID                        1
 
 /* fast path */
 
@@ -254,11 +296,24 @@ union db_prod {
 #define RX_SGE_MASK_LEN_MASK            (RX_SGE_MASK_LEN - 1)
 #define NEXT_SGE_MASK_ELEM(el)          (((el) + 1) & RX_SGE_MASK_LEN_MASK)
 
+union host_hc_status_block {
+        /* pointer to fp status block e1x */
+        struct host_hc_status_block_e1x *e1x_sb;
+        /* pointer to fp status block e2 */
+        struct host_hc_status_block_e2  *e2_sb;
+};
 
 struct bnx2x_fastpath {
 
+#define BNX2X_NAPI_WEIGHT       128
         struct napi_struct      napi;
-        struct host_status_block *status_blk;
+        union host_hc_status_block      status_blk;
+        /* chip independed shortcuts into sb structure */
+        __le16                  *sb_index_values;
+        __le16                  *sb_running_index;
+        /* chip independed shortcut into rx_prods_offset memory */
+        u32                     ustorm_rx_prods_offset;
+
         dma_addr_t              status_blk_mapping;
 
         struct sw_tx_bd         *tx_buf_ring;
@@ -288,10 +343,15 @@ struct bnx2x_fastpath {
 #define BNX2X_FP_STATE_OPEN             0xa0000
 #define BNX2X_FP_STATE_HALTING          0xb0000
 #define BNX2X_FP_STATE_HALTED           0xc0000
+#define BNX2X_FP_STATE_TERMINATING      0xd0000
+#define BNX2X_FP_STATE_TERMINATED       0xe0000
 
-        u8                      index;  /* number in fp array */
-        u8                      cl_id;  /* eth client id */
-        u8                      sb_id;  /* status block number in HW */
+        u8                      index;          /* number in fp array */
+        u8                      cl_id;          /* eth client id */
+        u8                      cl_qzone_id;
+        u8                      fw_sb_id;       /* status block number in FW */
+        u8                      igu_sb_id;      /* status block number in HW */
+        u32                     cid;
 
         union db_prod           tx_db;
 
@@ -301,8 +361,7 @@ struct bnx2x_fastpath {
         u16                     tx_bd_cons;
         __le16                  *tx_cons_sb;
 
-        __le16                  fp_c_idx;
-        __le16                  fp_u_idx;
+        __le16                  fp_hc_idx;
 
         u16                     rx_bd_prod;
         u16                     rx_bd_cons;
@@ -312,8 +371,6 @@ struct bnx2x_fastpath {
         /* The last maximal completed SGE */
         u16                     last_max_sge;
         __le16                  *rx_cons_sb;
-        __le16                  *rx_bd_cons_sb;
-
 
         unsigned long           tx_pkt,
                                 rx_pkt,
@@ -356,6 +413,8 @@ struct bnx2x_fastpath {
 #define NUM_TX_BD                       (TX_DESC_CNT * NUM_TX_RINGS)
 #define MAX_TX_BD                       (NUM_TX_BD - 1)
 #define MAX_TX_AVAIL                    (MAX_TX_DESC_CNT * NUM_TX_RINGS - 2)
+#define INIT_JUMBO_TX_RING_SIZE         MAX_TX_AVAIL
+#define INIT_TX_RING_SIZE               MAX_TX_AVAIL
 #define NEXT_TX_IDX(x)          ((((x) & MAX_TX_DESC_CNT) == \
                                   (MAX_TX_DESC_CNT - 1)) ? (x) + 2 : (x) + 1)
 #define TX_BD(x)                        ((x) & MAX_TX_BD)
@@ -370,6 +429,8 @@ struct bnx2x_fastpath {
 #define MAX_RX_BD                       (NUM_RX_BD - 1)
 #define MAX_RX_AVAIL                    (MAX_RX_DESC_CNT * NUM_RX_RINGS - 2)
 #define MIN_RX_AVAIL                    128
+#define INIT_JUMBO_RX_RING_SIZE         MAX_RX_AVAIL
+#define INIT_RX_RING_SIZE               MAX_RX_AVAIL
 #define NEXT_RX_IDX(x)          ((((x) & RX_DESC_MASK) == \
                                   (MAX_RX_DESC_CNT - 1)) ? (x) + 3 : (x) + 1)
 #define RX_BD(x)                        ((x) & MAX_RX_BD)
@@ -420,11 +481,12 @@ struct bnx2x_fastpath {
                                                  le32_to_cpu((bd)->addr_lo))
 #define BD_UNMAP_LEN(bd)                (le16_to_cpu((bd)->nbytes))
 
-
+#define BNX2X_DB_MIN_SHIFT              3       /* 8 bytes */
+#define BNX2X_DB_SHIFT                  7       /* 128 bytes*/
 #define DPM_TRIGER_TYPE                 0x40
 #define DOORBELL(bp, cid, val) \
         do { \
-                writel((u32)(val), bp->doorbells + (BCM_PAGE_SIZE * (cid)) + \
+                writel((u32)(val), bp->doorbells + (bp->db_size * (cid)) + \
                        DPM_TRIGER_TYPE); \
         } while (0)
 
@@ -482,31 +544,15 @@ struct bnx2x_fastpath {
 #define BNX2X_RX_SUM_FIX(cqe) \
         BNX2X_PRS_FLAG_OVERETH_IPV4(cqe->fast_path_cqe.pars_flags.flags)
 
-
-#define FP_USB_FUNC_OFF                 (2 + 2*HC_USTORM_SB_NUM_INDICES)
-#define FP_CSB_FUNC_OFF                 (2 + 2*HC_CSTORM_SB_NUM_INDICES)
-
-#define U_SB_ETH_RX_CQ_INDEX            HC_INDEX_U_ETH_RX_CQ_CONS
-#define U_SB_ETH_RX_BD_INDEX            HC_INDEX_U_ETH_RX_BD_CONS
-#define C_SB_ETH_TX_CQ_INDEX            HC_INDEX_C_ETH_TX_CQ_CONS
+#define U_SB_ETH_RX_CQ_INDEX            1
+#define U_SB_ETH_RX_BD_INDEX            2
+#define C_SB_ETH_TX_CQ_INDEX            5
 
 #define BNX2X_RX_SB_INDEX \
-        (&fp->status_blk->u_status_block.index_values[U_SB_ETH_RX_CQ_INDEX])
-
-#define BNX2X_RX_SB_BD_INDEX \
-        (&fp->status_blk->u_status_block.index_values[U_SB_ETH_RX_BD_INDEX])
-
-#define BNX2X_RX_SB_INDEX_NUM \
-                (((U_SB_ETH_RX_CQ_INDEX << \
-                   USTORM_ETH_ST_CONTEXT_CONFIG_CQE_SB_INDEX_NUMBER_SHIFT) & \
-                  USTORM_ETH_ST_CONTEXT_CONFIG_CQE_SB_INDEX_NUMBER) | \
-                 ((U_SB_ETH_RX_BD_INDEX << \
-                   USTORM_ETH_ST_CONTEXT_CONFIG_BD_SB_INDEX_NUMBER_SHIFT) & \
-                  USTORM_ETH_ST_CONTEXT_CONFIG_BD_SB_INDEX_NUMBER))
+        (&fp->sb_index_values[U_SB_ETH_RX_CQ_INDEX])
 
 #define BNX2X_TX_SB_INDEX \
-        (&fp->status_blk->c_status_block.index_values[C_SB_ETH_TX_CQ_INDEX])
-
+        (&fp->sb_index_values[C_SB_ETH_TX_CQ_INDEX])
 
 /* end of fast path */
 
@@ -522,12 +568,19 @@ struct bnx2x_common {
 #define CHIP_NUM_57710                  0x164e
 #define CHIP_NUM_57711                  0x164f
 #define CHIP_NUM_57711E                 0x1650
+#define CHIP_NUM_57712                  0x1662
+#define CHIP_NUM_57712E                 0x1663
 #define CHIP_IS_E1(bp)                  (CHIP_NUM(bp) == CHIP_NUM_57710)
 #define CHIP_IS_57711(bp)               (CHIP_NUM(bp) == CHIP_NUM_57711)
 #define CHIP_IS_57711E(bp)              (CHIP_NUM(bp) == CHIP_NUM_57711E)
+#define CHIP_IS_57712(bp)               (CHIP_NUM(bp) == CHIP_NUM_57712)
+#define CHIP_IS_57712E(bp)              (CHIP_NUM(bp) == CHIP_NUM_57712E)
 #define CHIP_IS_E1H(bp)                 (CHIP_IS_57711(bp) || \
                                          CHIP_IS_57711E(bp))
-#define IS_E1H_OFFSET                   CHIP_IS_E1H(bp)
+#define CHIP_IS_E2(bp)                  (CHIP_IS_57712(bp) || \
+                                         CHIP_IS_57712E(bp))
+#define CHIP_IS_E1x(bp)                 (CHIP_IS_E1((bp)) || CHIP_IS_E1H((bp)))
+#define IS_E1H_OFFSET                   (CHIP_IS_E1H(bp) || CHIP_IS_E2(bp))
 
 #define CHIP_REV(bp)                    (bp->common.chip_id & 0x0000f000)
 #define CHIP_REV_Ax                     0x00000000
@@ -553,12 +606,34 @@ struct bnx2x_common {
 
         u32                     shmem_base;
         u32                     shmem2_base;
+        u32                     mf_cfg_base;
+        u32                     mf2_cfg_base;
 
         u32                     hw_config;
 
         u32                     bc_ver;
+
+        u8                      int_block;
+#define INT_BLOCK_HC                    0
+#define INT_BLOCK_IGU                   1
+#define INT_BLOCK_MODE_NORMAL           0
+#define INT_BLOCK_MODE_BW_COMP          2
+#define CHIP_INT_MODE_IS_NBC(bp)                \
+                        (CHIP_IS_E2(bp) &&      \
+                        !((bp)->common.int_block & INT_BLOCK_MODE_BW_COMP))
+#define CHIP_INT_MODE_IS_BC(bp) (!CHIP_INT_MODE_IS_NBC(bp))
+
+        u8                      chip_port_mode;
+#define CHIP_4_PORT_MODE                        0x0
+#define CHIP_2_PORT_MODE                        0x1
+#define CHIP_PORT_MODE_NONE                     0x2
+#define CHIP_MODE(bp)                   (bp->common.chip_port_mode)
+#define CHIP_MODE_IS_4_PORT(bp) (CHIP_MODE(bp) == CHIP_4_PORT_MODE)
 };
 
+/* IGU MSIX STATISTICS on 57712: 64 for VFs; 4 for PFs; 4 for Attentions */
+#define BNX2X_IGU_STAS_MSG_VF_CNT 64
+#define BNX2X_IGU_STAS_MSG_PF_CNT 4
 
 /* end of common */
 
@@ -590,27 +665,98 @@ struct bnx2x_port {
 
 /* end of port */
 
+/* e1h Classification CAM line allocations */
+enum {
+        CAM_ETH_LINE = 0,
+        CAM_ISCSI_ETH_LINE,
+        CAM_MAX_PF_LINE = CAM_ISCSI_ETH_LINE
+};
 
+#define BNX2X_VF_ID_INVALID     0xFF
 
-#ifdef BCM_CNIC
-#define MAX_CONTEXT                     15
-#else
-#define MAX_CONTEXT                     16
-#endif
+/*
+ * The total number of L2 queues, MSIX vectors and HW contexts (CIDs) is
+ * control by the number of fast-path status blocks supported by the
+ * device (HW/FW). Each fast-path status block (FP-SB) aka non-default
+ * status block represents an independent interrupts context that can
+ * serve a regular L2 networking queue. However special L2 queues such
+ * as the FCoE queue do not require a FP-SB and other components like
+ * the CNIC may consume FP-SB reducing the number of possible L2 queues
+ *
+ * If the maximum number of FP-SB available is X then:
+ * a. If CNIC is supported it consumes 1 FP-SB thus the max number of
+ *    regular L2 queues is Y=X-1
+ * b. in MF mode the actual number of L2 queues is Y= (X-1/MF_factor)
+ * c. If the FCoE L2 queue is supported the actual number of L2 queues
+ *    is Y+1
+ * d. The number of irqs (MSIX vectors) is either Y+1 (one extra for
+ *    slow-path interrupts) or Y+2 if CNIC is supported (one additional
+ *    FP interrupt context for the CNIC).
+ * e. The number of HW context (CID count) is always X or X+1 if FCoE
+ *    L2 queue is supported. the cid for the FCoE L2 queue is always X.
+ */
+
+#define FP_SB_MAX_E1x           16      /* fast-path interrupt contexts E1x */
+#define FP_SB_MAX_E2            16      /* fast-path interrupt contexts E2 */
+
+/*
+ * cid_cnt paramter below refers to the value returned by
+ * 'bnx2x_get_l2_cid_count()' routine
+ */
+
+/*
+ * The number of FP context allocated by the driver == max number of regular
+ * L2 queues + 1 for the FCoE L2 queue
+ */
+#define L2_FP_COUNT(cid_cnt)    ((cid_cnt) - CNIC_CONTEXT_USE)
 
 union cdu_context {
         struct eth_context eth;
         char pad[1024];
 };
 
+/* CDU host DB constants */
+#define CDU_ILT_PAGE_SZ_HW      3
+#define CDU_ILT_PAGE_SZ         (4096 << CDU_ILT_PAGE_SZ_HW) /* 32K */
+#define ILT_PAGE_CIDS           (CDU_ILT_PAGE_SZ / sizeof(union cdu_context))
+
+#ifdef BCM_CNIC
+#define CNIC_ISCSI_CID_MAX      256
+#define CNIC_CID_MAX            (CNIC_ISCSI_CID_MAX)
+#define CNIC_ILT_LINES          DIV_ROUND_UP(CNIC_CID_MAX, ILT_PAGE_CIDS)
+#endif
+
+#define QM_ILT_PAGE_SZ_HW       3
+#define QM_ILT_PAGE_SZ          (4096 << QM_ILT_PAGE_SZ_HW) /* 32K */
+#define QM_CID_ROUND            1024
+
+#ifdef BCM_CNIC
+/* TM (timers) host DB constants */
+#define TM_ILT_PAGE_SZ_HW       2
+#define TM_ILT_PAGE_SZ          (4096 << TM_ILT_PAGE_SZ_HW) /* 16K */
+/* #define TM_CONN_NUM          (CNIC_STARTING_CID+CNIC_ISCSI_CXT_MAX) */
+#define TM_CONN_NUM             1024
+#define TM_ILT_SZ               (8 * TM_CONN_NUM)
+#define TM_ILT_LINES            DIV_ROUND_UP(TM_ILT_SZ, TM_ILT_PAGE_SZ)
+
+/* SRC (Searcher) host DB constants */
+#define SRC_ILT_PAGE_SZ_HW      3
+#define SRC_ILT_PAGE_SZ         (4096 << SRC_ILT_PAGE_SZ_HW) /* 32K */
+#define SRC_HASH_BITS           10
+#define SRC_CONN_NUM            (1 << SRC_HASH_BITS) /* 1024 */
+#define SRC_ILT_SZ              (sizeof(struct src_ent) * SRC_CONN_NUM)
+#define SRC_T2_SZ               SRC_ILT_SZ
+#define SRC_ILT_LINES           DIV_ROUND_UP(SRC_ILT_SZ, SRC_ILT_PAGE_SZ)
+#endif
+
 #define MAX_DMAE_C                      8
 
 /* DMA memory not used in fastpath */
 struct bnx2x_slowpath {
-        union cdu_context               context[MAX_CONTEXT];
         struct eth_stats_query          fw_stats;
         struct mac_configuration_cmd    mac_config;
         struct mac_configuration_cmd    mcast_config;
+        struct client_init_ramrod_data  client_init_data;
 
         /* used by dmae command executer */
         struct dmae_command             dmae[MAX_DMAE_C];
@@ -635,52 +781,83 @@ struct bnx2x_slowpath {
 #define MAX_DYNAMIC_ATTN_GRPS           8
 
 struct attn_route {
-        u32     sig[4];
+        u32     sig[5];
 };
 
+struct iro {
+        u32 base;
+        u16 m1;
+        u16 m2;
+        u16 m3;
+        u16 size;
+};
+
+struct hw_context {
+        union cdu_context *vcxt;
+        dma_addr_t cxt_mapping;
+        size_t size;
+};
+
+/* forward */
+struct bnx2x_ilt;
+
 typedef enum {
         BNX2X_RECOVERY_DONE,
         BNX2X_RECOVERY_INIT,
         BNX2X_RECOVERY_WAIT,
 } bnx2x_recovery_state_t;
 
+/**
+ * Event queue (EQ or event ring) MC hsi
+ * NUM_EQ_PAGES and EQ_DESC_CNT_PAGE must be power of 2
+ */
+#define NUM_EQ_PAGES            1
+#define EQ_DESC_CNT_PAGE        (BCM_PAGE_SIZE / sizeof(union event_ring_elem))
+#define EQ_DESC_MAX_PAGE        (EQ_DESC_CNT_PAGE - 1)
+#define NUM_EQ_DESC             (EQ_DESC_CNT_PAGE * NUM_EQ_PAGES)
+#define EQ_DESC_MASK            (NUM_EQ_DESC - 1)
+#define MAX_EQ_AVAIL            (EQ_DESC_MAX_PAGE * NUM_EQ_PAGES - 2)
+
+/* depends on EQ_DESC_CNT_PAGE being a power of 2 */
+#define NEXT_EQ_IDX(x)          ((((x) & EQ_DESC_MAX_PAGE) == \
+                                  (EQ_DESC_MAX_PAGE - 1)) ? (x) + 2 : (x) + 1)
+
+/* depends on the above and on NUM_EQ_PAGES being a power of 2 */
+#define EQ_DESC(x)              ((x) & EQ_DESC_MASK)
+
+#define BNX2X_EQ_INDEX \
+        (&bp->def_status_blk->sp_sb.\
+        index_values[HC_SP_INDEX_EQ_CONS])
+
 struct bnx2x {
         /* Fields used in the tx and intr/napi performance paths
          * are grouped together in the beginning of the structure
          */
-        struct bnx2x_fastpath   fp[MAX_CONTEXT];
+        struct bnx2x_fastpath   *fp;
         void __iomem            *regview;
         void __iomem            *doorbells;
-#ifdef BCM_CNIC
-#define BNX2X_DB_SIZE           (18*BCM_PAGE_SIZE)
-#else
-#define BNX2X_DB_SIZE           (16*BCM_PAGE_SIZE)
-#endif
+        u16                     db_size;
 
         struct net_device       *dev;
         struct pci_dev          *pdev;
 
+        struct iro              *iro_arr;
+#define IRO (bp->iro_arr)
+
         atomic_t                intr_sem;
 
         bnx2x_recovery_state_t  recovery_state;
         int                     is_leader;
-#ifdef BCM_CNIC
-        struct msix_entry       msix_table[MAX_CONTEXT+2];
-#else
-        struct msix_entry       msix_table[MAX_CONTEXT+1];
-#endif
+        struct msix_entry       *msix_table;
 #define INT_MODE_INTx                   1
 #define INT_MODE_MSI                    2
 
         int                     tx_ring_size;
 
-#ifdef BCM_VLAN
-        struct vlan_group       *vlgrp;
-#endif
-
         u32                     rx_csum;
         u32                     rx_buf_size;
-#define ETH_OVREHEAD                    (ETH_HLEN + 8)  /* 8 for CRC + VLAN */
+/* L2 header size + 2*VLANs (8 bytes) + LLC SNAP (8 bytes) */
+#define ETH_OVREHEAD            (ETH_HLEN + 8 + 8)
 #define ETH_MIN_PACKET_SIZE             60
 #define ETH_MAX_PACKET_SIZE             1500
 #define ETH_MAX_JUMBO_PACKET_SIZE       9600
@@ -689,13 +866,12 @@ struct bnx2x {
 #define BNX2X_RX_ALIGN_SHIFT            ((L1_CACHE_SHIFT < 8) ? \
                                          L1_CACHE_SHIFT : 8)
 #define BNX2X_RX_ALIGN                  (1 << BNX2X_RX_ALIGN_SHIFT)
+#define BNX2X_PXP_DRAM_ALIGN            (BNX2X_RX_ALIGN_SHIFT - 5)
 
-        struct host_def_status_block *def_status_blk;
-#define DEF_SB_ID                       16
-        __le16                  def_c_idx;
-        __le16                  def_u_idx;
-        __le16                  def_x_idx;
-        __le16                  def_t_idx;
+        struct host_sp_status_block *def_status_blk;
+#define DEF_SB_IGU_ID                   16
+#define DEF_SB_ID                       HC_SP_SB_ID
+        __le16                  def_idx;
         __le16                  def_att_idx;
         u32                     attn_state;
         struct attn_route       attn_group[MAX_DYNAMIC_ATTN_GRPS];
@@ -707,10 +883,17 @@ struct bnx2x {
         struct eth_spe          *spq_prod_bd;
         struct eth_spe          *spq_last_bd;
         __le16                  *dsb_sp_prod;
-        u16                     spq_left; /* serialize spq */
+        atomic_t                spq_left; /* serialize spq */
         /* used to synchronize spq accesses */
         spinlock_t              spq_lock;
 
+        /* event queue */
+        union event_ring_elem   *eq_ring;
+        dma_addr_t              eq_mapping;
+        u16                     eq_prod;
+        u16                     eq_cons;
+        __le16                  *eq_cons_sb;
+
         /* Flags for marking that there is a STAT_QUERY or
            SET_MAC ramrod pending */
         int                     stats_pending;
@@ -729,18 +912,27 @@ struct bnx2x {
 #define USING_DAC_FLAG                  0x10
 #define USING_MSIX_FLAG                 0x20
 #define USING_MSI_FLAG                  0x40
+
 #define TPA_ENABLE_FLAG                 0x80
 #define NO_MCP_FLAG                     0x100
+#define DISABLE_MSI_FLAG                0x200
 #define BP_NOMCP(bp)                    (bp->flags & NO_MCP_FLAG)
-#define HW_VLAN_TX_FLAG                 0x400
-#define HW_VLAN_RX_FLAG                 0x800
 #define MF_FUNC_DIS                     0x1000
 
-        int                     func;
-#define BP_PORT(bp)                     (bp->func % PORT_MAX)
-#define BP_FUNC(bp)                     (bp->func)
-#define BP_E1HVN(bp)                    (bp->func >> 1)
+        int                     pf_num; /* absolute PF number */
+        int                     pfid;   /* per-path PF number */
+        int                     base_fw_ndsb;
+#define BP_PATH(bp)                     (!CHIP_IS_E2(bp) ? \
+                                                0 : (bp->pf_num & 1))
+#define BP_PORT(bp)                     (bp->pfid & 1)
+#define BP_FUNC(bp)                     (bp->pfid)
+#define BP_ABS_FUNC(bp)                 (bp->pf_num)
+#define BP_E1HVN(bp)                    (bp->pfid >> 1)
+#define BP_VN(bp)                       (CHIP_MODE_IS_4_PORT(bp) ? \
+                                                0 : BP_E1HVN(bp))
 #define BP_L_ID(bp)                     (BP_E1HVN(bp) << 2)
+#define BP_FW_MB_IDX(bp)                (BP_PORT(bp) +\
+                                         BP_VN(bp) * (CHIP_IS_E1x(bp) ? 2  : 1))
 
 #ifdef BCM_CNIC
 #define BCM_CNIC_CID_START              16
@@ -770,10 +962,11 @@ struct bnx2x {
         struct cmng_struct_per_port cmng;
         u32                     vn_weight_sum;
 
-        u32                     mf_config;
-        u16                     e1hov;
-        u8                      e1hmf;
-#define IS_E1HMF(bp)                    (bp->e1hmf != 0)
+        u32                     mf_config[E1HVN_MAX];
+        u32                     mf2_config[E2_FUNC_MAX];
+        u16                     mf_ov;
+        u8                      mf_mode;
+#define IS_MF(bp)               (bp->mf_mode != 0)
 
         u8                      wol;
 
@@ -801,6 +994,7 @@ struct bnx2x {
 #define BNX2X_STATE_CLOSING_WAIT4_HALT  0x4000
 #define BNX2X_STATE_CLOSING_WAIT4_DELETE 0x5000
 #define BNX2X_STATE_CLOSING_WAIT4_UNLOAD 0x6000
+#define BNX2X_STATE_FUNC_STARTED        0x7000
 #define BNX2X_STATE_DIAG                0xe000
 #define BNX2X_STATE_ERROR               0xf000
 
@@ -809,6 +1003,15 @@ struct bnx2x {
         int                     disable_tpa;
         int                     int_mode;
 
+        struct tstorm_eth_mac_filter_config     mac_filters;
+#define BNX2X_ACCEPT_NONE               0x0000
+#define BNX2X_ACCEPT_UNICAST            0x0001
+#define BNX2X_ACCEPT_MULTICAST          0x0002
+#define BNX2X_ACCEPT_ALL_UNICAST        0x0004
+#define BNX2X_ACCEPT_ALL_MULTICAST      0x0008
+#define BNX2X_ACCEPT_BROADCAST          0x0010
+#define BNX2X_PROMISCUOUS_MODE          0x10000
+
         u32                     rx_mode;
 #define BNX2X_RX_MODE_NONE              0
 #define BNX2X_RX_MODE_NORMAL            1
@@ -817,34 +1020,41 @@ struct bnx2x {
 #define BNX2X_MAX_MULTICAST             64
 #define BNX2X_MAX_EMUL_MULTI            16
 
-        u32                     rx_mode_cl_mask;
-
+        u8                      igu_dsb_id;
+        u8                      igu_base_sb;
+        u8                      igu_sb_cnt;
         dma_addr_t              def_status_blk_mapping;
 
         struct bnx2x_slowpath   *slowpath;
         dma_addr_t              slowpath_mapping;
+        struct hw_context       context;
+
+        struct bnx2x_ilt        *ilt;
+#define BP_ILT(bp)              ((bp)->ilt)
+#define ILT_MAX_LINES           128
+
+        int                     l2_cid_count;
+#define L2_ILT_LINES(bp)        (DIV_ROUND_UP((bp)->l2_cid_count, \
+                                 ILT_PAGE_CIDS))
+#define BNX2X_DB_SIZE(bp)       ((bp)->l2_cid_count * (1 << BNX2X_DB_SHIFT))
+
+        int                     qm_cid_count;
 
         int                     dropless_fc;
 
 #ifdef BCM_CNIC
         u32                     cnic_flags;
 #define BNX2X_CNIC_FLAG_MAC_SET         1
-
-        void                    *t1;
-        dma_addr_t              t1_mapping;
         void                    *t2;
         dma_addr_t              t2_mapping;
-        void                    *timers;
-        dma_addr_t              timers_mapping;
-        void                    *qm;
-        dma_addr_t              qm_mapping;
         struct cnic_ops         *cnic_ops;
         void                    *cnic_data;
         u32                     cnic_tag;
         struct cnic_eth_dev     cnic_eth_dev;
-        struct host_status_block *cnic_sb;
+        union host_hc_status_block cnic_sb;
         dma_addr_t              cnic_sb_mapping;
-#define CNIC_SB_ID(bp)                  BP_L_ID(bp)
+#define CNIC_SB_ID(bp)          ((bp)->base_fw_ndsb + BP_L_ID(bp))
+#define CNIC_IGU_SB_ID(bp)      ((bp)->igu_base_sb)
         struct eth_spe          *cnic_kwq;
         struct eth_spe          *cnic_kwq_prod;
         struct eth_spe          *cnic_kwq_cons;
@@ -914,33 +1124,197 @@ struct bnx2x {
         const struct firmware   *firmware;
 };
 
+/**
+ *      Init queue/func interface
+ */
+/* queue init flags */
+#define QUEUE_FLG_TPA           0x0001
+#define QUEUE_FLG_CACHE_ALIGN   0x0002
+#define QUEUE_FLG_STATS         0x0004
+#define QUEUE_FLG_OV            0x0008
+#define QUEUE_FLG_VLAN          0x0010
+#define QUEUE_FLG_COS           0x0020
+#define QUEUE_FLG_HC            0x0040
+#define QUEUE_FLG_DHC           0x0080
+#define QUEUE_FLG_OOO           0x0100
+
+#define QUEUE_DROP_IP_CS_ERR    TSTORM_ETH_CLIENT_CONFIG_DROP_IP_CS_ERR
+#define QUEUE_DROP_TCP_CS_ERR   TSTORM_ETH_CLIENT_CONFIG_DROP_TCP_CS_ERR
+#define QUEUE_DROP_TTL0         TSTORM_ETH_CLIENT_CONFIG_DROP_TTL0
+#define QUEUE_DROP_UDP_CS_ERR   TSTORM_ETH_CLIENT_CONFIG_DROP_UDP_CS_ERR
+
+
+
+/* rss capabilities */
+#define RSS_IPV4_CAP            0x0001
+#define RSS_IPV4_TCP_CAP        0x0002
+#define RSS_IPV6_CAP            0x0004
+#define RSS_IPV6_TCP_CAP        0x0008
 
-#define BNX2X_MAX_QUEUES(bp)    (IS_E1HMF(bp) ? (MAX_CONTEXT/E1HVN_MAX) \
-                                              : MAX_CONTEXT)
 #define BNX2X_NUM_QUEUES(bp)    (bp->num_queues)
 #define is_multi(bp)            (BNX2X_NUM_QUEUES(bp) > 1)
 
+#define BNX2X_MAX_QUEUES(bp)    (bp->igu_sb_cnt - CNIC_CONTEXT_USE)
+#define is_eth_multi(bp)        (BNX2X_NUM_ETH_QUEUES(bp) > 1)
+
+#define RSS_IPV4_CAP_MASK                                               \
+        TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_IPV4_CAPABILITY
+
+#define RSS_IPV4_TCP_CAP_MASK                                           \
+        TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_IPV4_TCP_CAPABILITY
+
+#define RSS_IPV6_CAP_MASK                                               \
+        TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_IPV6_CAPABILITY
+
+#define RSS_IPV6_TCP_CAP_MASK                                           \
+        TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_IPV6_TCP_CAPABILITY
+
+/* func init flags */
+#define FUNC_FLG_STATS          0x0001
+#define FUNC_FLG_TPA            0x0002
+#define FUNC_FLG_SPQ            0x0004
+#define FUNC_FLG_LEADING        0x0008  /* PF only */
+
+struct rxq_pause_params {
+        u16             bd_th_lo;
+        u16             bd_th_hi;
+        u16             rcq_th_lo;
+        u16             rcq_th_hi;
+        u16             sge_th_lo; /* valid iff QUEUE_FLG_TPA */
+        u16             sge_th_hi; /* valid iff QUEUE_FLG_TPA */
+        u16             pri_map;
+};
+
+struct bnx2x_rxq_init_params {
+        /* cxt*/
+        struct eth_context *cxt;
+
+        /* dma */
+        dma_addr_t      dscr_map;
+        dma_addr_t      sge_map;
+        dma_addr_t      rcq_map;
+        dma_addr_t      rcq_np_map;
+
+        u16             flags;
+        u16             drop_flags;
+        u16             mtu;
+        u16             buf_sz;
+        u16             fw_sb_id;
+        u16             cl_id;
+        u16             spcl_id;
+        u16             cl_qzone_id;
+
+        /* valid iff QUEUE_FLG_STATS */
+        u16             stat_id;
+
+        /* valid iff QUEUE_FLG_TPA */
+        u16             tpa_agg_sz;
+        u16             sge_buf_sz;
+        u16             max_sges_pkt;
+
+        /* valid iff QUEUE_FLG_CACHE_ALIGN */
+        u8              cache_line_log;
+
+        u8              sb_cq_index;
+        u32             cid;
+
+        /* desired interrupts per sec. valid iff QUEUE_FLG_HC */
+        u32             hc_rate;
+};
+
+struct bnx2x_txq_init_params {
+        /* cxt*/
+        struct eth_context *cxt;
+
+        /* dma */
+        dma_addr_t      dscr_map;
+
+        u16             flags;
+        u16             fw_sb_id;
+        u8              sb_cq_index;
+        u8              cos;            /* valid iff QUEUE_FLG_COS */
+        u16             stat_id;        /* valid iff QUEUE_FLG_STATS */
+        u16             traffic_type;
+        u32             cid;
+        u16             hc_rate;        /* desired interrupts per sec.*/
+                                        /* valid iff QUEUE_FLG_HC */
+
+};
+
+struct bnx2x_client_ramrod_params {
+        int *pstate;
+        int state;
+        u16 index;
+        u16 cl_id;
+        u32 cid;
+        u8 poll;
+#define CLIENT_IS_LEADING_RSS           0x02
+        u8 flags;
+};
+
+struct bnx2x_client_init_params {
+        struct rxq_pause_params pause;
+        struct bnx2x_rxq_init_params rxq_params;
+        struct bnx2x_txq_init_params txq_params;
+        struct bnx2x_client_ramrod_params ramrod_params;
+};
+
+struct bnx2x_rss_params {
+        int     mode;
+        u16     cap;
+        u16     result_mask;
+};
+
+struct bnx2x_func_init_params {
+
+        /* rss */
+        struct bnx2x_rss_params *rss;   /* valid iff FUNC_FLG_RSS */
+
+        /* dma */
+        dma_addr_t      fw_stat_map;    /* valid iff FUNC_FLG_STATS */
+        dma_addr_t      spq_map;        /* valid iff FUNC_FLG_SPQ */
+
+        u16             func_flgs;
+        u16             func_id;        /* abs fid */
+        u16             pf_id;
+        u16             spq_prod;       /* valid iff FUNC_FLG_SPQ */
+};
+
 #define for_each_queue(bp, var) \
                         for (var = 0; var < BNX2X_NUM_QUEUES(bp); var++)
 #define for_each_nondefault_queue(bp, var) \
                         for (var = 1; var < BNX2X_NUM_QUEUES(bp); var++)
 
 
+#define WAIT_RAMROD_POLL        0x01
+#define WAIT_RAMROD_COMMON      0x02
+int bnx2x_wait_ramrod(struct bnx2x *bp, int state, int idx,
+                             int *state_p, int flags);
+
+/* dmae */
 void bnx2x_read_dmae(struct bnx2x *bp, u32 src_addr, u32 len32);
 void bnx2x_write_dmae(struct bnx2x *bp, dma_addr_t dma_addr, u32 dst_addr,
                       u32 len32);
+void bnx2x_write_dmae_phys_len(struct bnx2x *bp, dma_addr_t phys_addr,
+                               u32 addr, u32 len);
+void bnx2x_post_dmae(struct bnx2x *bp, struct dmae_command *dmae, int idx);
+u32 bnx2x_dmae_opcode_add_comp(u32 opcode, u8 comp_type);
+u32 bnx2x_dmae_opcode_clr_src_reset(u32 opcode);
+u32 bnx2x_dmae_opcode(struct bnx2x *bp, u8 src_type, u8 dst_type,
+                      bool with_comp, u8 comp_type);
+
 int bnx2x_get_gpio(struct bnx2x *bp, int gpio_num, u8 port);
 int bnx2x_set_gpio(struct bnx2x *bp, int gpio_num, u32 mode, u8 port);
 int bnx2x_set_gpio_int(struct bnx2x *bp, int gpio_num, u32 mode, u8 port);
 u32 bnx2x_fw_command(struct bnx2x *bp, u32 command, u32 param);
 void bnx2x_reg_wr_ind(struct bnx2x *bp, u32 addr, u32 val);
-void bnx2x_write_dmae_phys_len(struct bnx2x *bp, dma_addr_t phys_addr,
-                               u32 addr, u32 len);
+
 void bnx2x_calc_fc_adv(struct bnx2x *bp);
 int bnx2x_sp_post(struct bnx2x *bp, int command, int cid,
                   u32 data_hi, u32 data_lo, int common);
 void bnx2x_update_coalesce(struct bnx2x *bp);
 int bnx2x_get_link_cfg_idx(struct bnx2x *bp);
+
 static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
                            int wait)
 {
@@ -958,6 +1332,40 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
         return val;
 }
 
+#define BNX2X_ILT_ZALLOC(x, y, size) \
+        do { \
+                x = pci_alloc_consistent(bp->pdev, size, y); \
+                if (x) \
+                        memset(x, 0, size); \
+        } while (0)
+
+#define BNX2X_ILT_FREE(x, y, size) \
+        do { \
+                if (x) { \
+                        pci_free_consistent(bp->pdev, size, x, y); \
+                        x = NULL; \
+                        y = 0; \
+                } \
+        } while (0)
+
+#define ILOG2(x)        (ilog2((x)))
+
+#define ILT_NUM_PAGE_ENTRIES    (3072)
+/* In 57710/11 we use whole table since we have 8 func
+ * In 57712 we have only 4 func, but use same size per func, then only half of
+ * the table in use
+ */
+#define ILT_PER_FUNC            (ILT_NUM_PAGE_ENTRIES/8)
+
+#define FUNC_ILT_BASE(func)     (func * ILT_PER_FUNC)
+/*
+ * the phys address is shifted right 12 bits and has an added
+ * 1=valid bit added to the 53rd bit
+ * then since this is a wide register(TM)
+ * we split it into two 32 bit writes
+ */
+#define ONCHIP_ADDR1(x)         ((u32)(((u64)x >> 12) & 0xFFFFFFFF))
+#define ONCHIP_ADDR2(x)         ((u32)((1 << 20) | ((u64)x >> 44)))
 
 /* load/unload mode */
 #define LOAD_NORMAL                     0
@@ -965,18 +1373,44 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 #define LOAD_DIAG                       2
 #define UNLOAD_NORMAL                   0
 #define UNLOAD_CLOSE                    1
-#define UNLOAD_RECOVERY                 2
+#define UNLOAD_RECOVERY                 2
 
 
 /* DMAE command defines */
-#define DMAE_CMD_SRC_PCI                0
-#define DMAE_CMD_SRC_GRC                DMAE_COMMAND_SRC
+#define DMAE_TIMEOUT                    -1
+#define DMAE_PCI_ERROR                  -2      /* E2 and onward */
+#define DMAE_NOT_RDY                    -3
+#define DMAE_PCI_ERR_FLAG               0x80000000
+
+#define DMAE_SRC_PCI                    0
+#define DMAE_SRC_GRC                    1
+
+#define DMAE_DST_NONE                   0
+#define DMAE_DST_PCI                    1
+#define DMAE_DST_GRC                    2
+
+#define DMAE_COMP_PCI                   0
+#define DMAE_COMP_GRC                   1
+
+/* E2 and onward - PCI error handling in the completion */
 
-#define DMAE_CMD_DST_PCI                (1 << DMAE_COMMAND_DST_SHIFT)
-#define DMAE_CMD_DST_GRC                (2 << DMAE_COMMAND_DST_SHIFT)
+#define DMAE_COMP_REGULAR               0
+#define DMAE_COM_SET_ERR                1
 
-#define DMAE_CMD_C_DST_PCI              0
-#define DMAE_CMD_C_DST_GRC              (1 << DMAE_COMMAND_C_DST_SHIFT)
+#define DMAE_CMD_SRC_PCI                (DMAE_SRC_PCI << \
+                                                DMAE_COMMAND_SRC_SHIFT)
+#define DMAE_CMD_SRC_GRC                (DMAE_SRC_GRC << \
+                                                DMAE_COMMAND_SRC_SHIFT)
+
+#define DMAE_CMD_DST_PCI                (DMAE_DST_PCI << \
+                                                DMAE_COMMAND_DST_SHIFT)
+#define DMAE_CMD_DST_GRC                (DMAE_DST_GRC << \
+                                                DMAE_COMMAND_DST_SHIFT)
+
+#define DMAE_CMD_C_DST_PCI              (DMAE_COMP_PCI << \
+                                                DMAE_COMMAND_C_DST_SHIFT)
+#define DMAE_CMD_C_DST_GRC              (DMAE_COMP_GRC << \
+                                                DMAE_COMMAND_C_DST_SHIFT)
 
 #define DMAE_CMD_C_ENABLE               DMAE_COMMAND_C_TYPE_ENABLE
 
@@ -992,10 +1426,20 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 #define DMAE_CMD_DST_RESET              DMAE_COMMAND_DST_RESET
 #define DMAE_CMD_E1HVN_SHIFT            DMAE_COMMAND_E1HVN_SHIFT
 
+#define DMAE_SRC_PF                     0
+#define DMAE_SRC_VF                     1
+
+#define DMAE_DST_PF                     0
+#define DMAE_DST_VF                     1
+
+#define DMAE_C_SRC                      0
+#define DMAE_C_DST                      1
+
 #define DMAE_LEN32_RD_MAX               0x80
 #define DMAE_LEN32_WR_MAX(bp)           (CHIP_IS_E1(bp) ? 0x400 : 0x2000)
 
-#define DMAE_COMP_VAL                   0xe0d0d0ae
+#define DMAE_COMP_VAL                   0x60d0d0ae /* E2 and on - upper bit
+                                                        indicates eror */
 
 #define MAX_DMAE_C_PER_PORT             8
 #define INIT_DMAE_C(bp)                 (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
@@ -1003,7 +1447,6 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 #define PMF_DMAE_C(bp)                  (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
                                          E1HVN_MAX)
 
-
 /* PCIE link and speed */
 #define PCICFG_LINK_WIDTH               0x1f00000
 #define PCICFG_LINK_WIDTH_SHIFT         20
@@ -1032,7 +1475,7 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 #define MAX_SP_DESC_CNT                 (SP_DESC_CNT - 1)
 
 
-#define BNX2X_BTR                       1
+#define BNX2X_BTR                       4
 #define MAX_SPQ_PENDING                 8
 
 
@@ -1149,20 +1592,26 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
                   TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_MODE_SHIFT))
 #define MULTI_MASK                      0x7f
 
+#define BNX2X_SP_DSB_INDEX \
+                (&bp->def_status_blk->sp_sb.\
+                                        index_values[HC_SP_INDEX_ETH_DEF_CONS])
 
-#define DEF_USB_FUNC_OFF                (2 + 2*HC_USTORM_DEF_SB_NUM_INDICES)
-#define DEF_CSB_FUNC_OFF                (2 + 2*HC_CSTORM_DEF_SB_NUM_INDICES)
-#define DEF_XSB_FUNC_OFF                (2 + 2*HC_XSTORM_DEF_SB_NUM_INDICES)
-#define DEF_TSB_FUNC_OFF                (2 + 2*HC_TSTORM_DEF_SB_NUM_INDICES)
+#define SET_FLAG(value, mask, flag) \
+        do {\
+                (value) &= ~(mask);\
+                (value) |= ((flag) << (mask##_SHIFT));\
+        } while (0)
 
-#define C_DEF_SB_SP_INDEX               HC_INDEX_DEF_C_ETH_SLOW_PATH
-
-#define BNX2X_SP_DSB_INDEX \
-(&bp->def_status_blk->c_def_status_block.index_values[C_DEF_SB_SP_INDEX])
+#define GET_FLAG(value, mask) \
+        (((value) &= (mask)) >> (mask##_SHIFT))
 
+#define GET_FIELD(value, fname) \
+        (((value) & (fname##_MASK)) >> (fname##_SHIFT))
 
 #define CAM_IS_INVALID(x) \
-(x.target_table_entry.flags == TSTORM_CAM_TARGET_TABLE_ENTRY_ACTION_TYPE)
+        (GET_FLAG(x.flags, \
+        MAC_CONFIGURATION_ENTRY_ACTION_TYPE) == \
+        (T_ETH_MAC_COMMAND_INVALIDATE))
 
 #define CAM_INVALIDATE(x) \
         (x.target_table_entry.flags = TSTORM_CAM_TARGET_TABLE_ENTRY_ACTION_TYPE)
@@ -1178,21 +1627,29 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 #define PXP2_REG_PXP2_INT_STS           PXP2_REG_PXP2_INT_STS_0
 #endif
 
+#ifndef ETH_MAX_RX_CLIENTS_E2
+#define ETH_MAX_RX_CLIENTS_E2           ETH_MAX_RX_CLIENTS_E1H
+#endif
+
 #define BNX2X_VPD_LEN                   128
 #define VENDOR_ID_LEN                   4
 
+/* Congestion management fairness mode */
+#define CMNG_FNS_NONE           0
+#define CMNG_FNS_MINMAX         1
+
+#define HC_SEG_ACCESS_DEF               0   /*Driver decision 0-3*/
+#define HC_SEG_ACCESS_ATTN              4
+#define HC_SEG_ACCESS_NORM              0   /*Driver decision 0-1*/
+
 #ifdef BNX2X_MAIN
 #define BNX2X_EXTERN
 #else
 #define BNX2X_EXTERN extern
 #endif
 
-BNX2X_EXTERN int load_count[3]; /* 0-common, 1-port0, 2-port1 */
-
-/* MISC_REG_RESET_REG - this is here for the hsi to work don't touch */
+BNX2X_EXTERN int load_count[2][3]; /* per path: 0-common, 1-port0, 2-port1 */
 
 extern void bnx2x_set_ethtool_ops(struct net_device *netdev);
 
-void bnx2x_post_dmae(struct bnx2x *bp, struct dmae_command *dmae, int idx);
-
 #endif /* bnx2x.h */
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index efc7be4aefb5..bc5837514074 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -15,19 +15,16 @@
  *
  */
 
-
 #include <linux/etherdevice.h>
+#include <linux/if_vlan.h>
 #include <linux/ip.h>
-#include <linux/ipv6.h>
+#include <net/ipv6.h>
 #include <net/ip6_checksum.h>
 #include <linux/firmware.h>
 #include "bnx2x_cmn.h"
 
-#ifdef BCM_VLAN
-#include <linux/if_vlan.h>
-#endif
+#include "bnx2x_init.h"
 
-static int bnx2x_poll(struct napi_struct *napi, int budget);
 
 /* free skb in the packet ring at pos idx
  * return idx of last bd freed
@@ -52,7 +49,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fastpath *fp,
         DP(BNX2X_MSG_OFF, "free bd_idx %d\n", bd_idx);
         tx_start_bd = &fp->tx_desc_ring[bd_idx].start_bd;
         dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
-                         BD_UNMAP_LEN(tx_start_bd), PCI_DMA_TODEVICE);
+                         BD_UNMAP_LEN(tx_start_bd), DMA_TO_DEVICE);
 
         nbd = le16_to_cpu(tx_start_bd->nbd) - 1;
 #ifdef BNX2X_STOP_ON_ERROR
@@ -116,16 +113,10 @@ int bnx2x_tx_int(struct bnx2x_fastpath *fp)
 
                 pkt_cons = TX_BD(sw_cons);
 
-                /* prefetch(bp->tx_buf_ring[pkt_cons].skb); */
-
-                DP(NETIF_MSG_TX_DONE, "hw_cons %u  sw_cons %u  pkt_cons %u\n",
-                   hw_cons, sw_cons, pkt_cons);
+                DP(NETIF_MSG_TX_DONE, "queue[%d]: hw_cons %u  sw_cons %u "
+                                      " pkt_cons %u\n",
+                   fp->index, hw_cons, sw_cons, pkt_cons);
 
-/*              if (NEXT_TX_IDX(sw_cons) != hw_cons) {
-                        rmb();
-                        prefetch(fp->tx_buf_ring[NEXT_TX_IDX(sw_cons)].skb);
-                }
-*/
                 bd_cons = bnx2x_free_tx_pkt(bp, fp, pkt_cons);
                 sw_cons++;
         }
@@ -141,7 +132,6 @@ int bnx2x_tx_int(struct bnx2x_fastpath *fp)
          */
         smp_mb();
 
-        /* TBD need a thresh? */
         if (unlikely(netif_tx_queue_stopped(txq))) {
                 /* Taking tx_lock() is needed to prevent reenabling the queue
                  * while it's empty. This could have happen if rx_action() gets
@@ -190,14 +180,16 @@ static void bnx2x_update_sge_prod(struct bnx2x_fastpath *fp,
 
         /* First mark all used pages */
         for (i = 0; i < sge_len; i++)
-                SGE_MASK_CLEAR_BIT(fp, RX_SGE(le16_to_cpu(fp_cqe->sgl[i])));
+                SGE_MASK_CLEAR_BIT(fp,
+                        RX_SGE(le16_to_cpu(fp_cqe->sgl_or_raw_data.sgl[i])));
 
         DP(NETIF_MSG_RX_STATUS, "fp_cqe->sgl[%d] = %d\n",
-           sge_len - 1, le16_to_cpu(fp_cqe->sgl[sge_len - 1]));
+           sge_len - 1, le16_to_cpu(fp_cqe->sgl_or_raw_data.sgl[sge_len - 1]));
 
         /* Here we assume that the last SGE index is the biggest */
         prefetch((void *)(fp->sge_mask));
-        bnx2x_update_last_max_sge(fp, le16_to_cpu(fp_cqe->sgl[sge_len - 1]));
+        bnx2x_update_last_max_sge(fp,
+                le16_to_cpu(fp_cqe->sgl_or_raw_data.sgl[sge_len - 1]));
 
         last_max = RX_SGE(fp->last_max_sge);
         last_elem = last_max >> RX_SGE_MASK_ELEM_SHIFT;
@@ -298,7 +290,8 @@ static int bnx2x_fill_frag_skb(struct bnx2x *bp, struct bnx2x_fastpath *fp,
 
         /* Run through the SGL and compose the fragmented skb */
         for (i = 0, j = 0; i < pages; i += PAGES_PER_SGE, j++) {
-                u16 sge_idx = RX_SGE(le16_to_cpu(fp_cqe->sgl[j]));
+                u16 sge_idx =
+                        RX_SGE(le16_to_cpu(fp_cqe->sgl_or_raw_data.sgl[j]));
 
                 /* FW gives the indices of the SGE as if the ring is an array
                    (meaning that "next" element will consume 2 indices) */
@@ -350,16 +343,9 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
         if (likely(new_skb)) {
                 /* fix ip xsum and give it to the stack */
                 /* (no need to map the new skb) */
-#ifdef BCM_VLAN
-                int is_vlan_cqe =
-                        (le16_to_cpu(cqe->fast_path_cqe.pars_flags.flags) &
-                         PARSING_FLAGS_VLAN);
-                int is_not_hwaccel_vlan_cqe =
-                        (is_vlan_cqe && (!(bp->flags & HW_VLAN_RX_FLAG)));
-#endif
 
                 prefetch(skb);
-                prefetch(((char *)(skb)) + 128);
+                prefetch(((char *)(skb)) + L1_CACHE_BYTES);
 
 #ifdef BNX2X_STOP_ON_ERROR
                 if (pad + len > bp->rx_buf_size) {
@@ -381,27 +367,18 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                         struct iphdr *iph;
 
                         iph = (struct iphdr *)skb->data;
-#ifdef BCM_VLAN
-                        /* If there is no Rx VLAN offloading -
-                           take VLAN tag into an account */
-                        if (unlikely(is_not_hwaccel_vlan_cqe))
-                                iph = (struct iphdr *)((u8 *)iph + VLAN_HLEN);
-#endif
                         iph->check = 0;
                         iph->check = ip_fast_csum((u8 *)iph, iph->ihl);
                 }
 
                 if (!bnx2x_fill_frag_skb(bp, fp, skb,
                                          &cqe->fast_path_cqe, cqe_idx)) {
-#ifdef BCM_VLAN
-                        if ((bp->vlgrp != NULL) && is_vlan_cqe &&
-                            (!is_not_hwaccel_vlan_cqe))
-                                vlan_gro_receive(&fp->napi, bp->vlgrp,
+                        if ((le16_to_cpu(cqe->fast_path_cqe.
+                            pars_flags.flags) & PARSING_FLAGS_VLAN))
+                                __vlan_hwaccel_put_tag(skb,
                                                  le16_to_cpu(cqe->fast_path_cqe.
-                                                             vlan_tag), skb);
-                        else
-#endif
-                                napi_gro_receive(&fp->napi, skb);
+                                                             vlan_tag));
+                        napi_gro_receive(&fp->napi, skb);
                 } else {
                         DP(NETIF_MSG_RX_STATUS, "Failed to allocate new pages"
                            " - dropping packet!\n");
@@ -510,8 +487,11 @@ int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                         len = le16_to_cpu(cqe->fast_path_cqe.pkt_len);
                         pad = cqe->fast_path_cqe.placement_offset;
 
-                        /* If CQE is marked both TPA_START and TPA_END
-                           it is a non-TPA CQE */
+                        /* - If CQE is marked both TPA_START and TPA_END it is
+                         *   a non-TPA CQE.
+                         * - FP CQE will always have either TPA_START or/and
+                         *   TPA_STOP flags set.
+                         */
                         if ((!fp->disable_tpa) &&
                             (TPA_TYPE(cqe_fp_flags) !=
                                         (TPA_TYPE_START | TPA_TYPE_END))) {
@@ -529,9 +509,7 @@ int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                                         bnx2x_set_skb_rxhash(bp, cqe, skb);
 
                                         goto next_rx;
-                                }
-
-                                if (TPA_TYPE(cqe_fp_flags) == TPA_TYPE_END) {
+                                } else { /* TPA_STOP */
                                         DP(NETIF_MSG_RX_STATUS,
                                            "calling tpa_stop on queue %d\n",
                                            queue);
@@ -561,7 +539,7 @@ int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                                         dma_unmap_addr(rx_buf, mapping),
                                                    pad + RX_COPY_THRESH,
                                                    DMA_FROM_DEVICE);
-                        prefetch(((char *)(skb)) + 128);
+                        prefetch(((char *)(skb)) + L1_CACHE_BYTES);
 
                         /* is this an error packet? */
                         if (unlikely(cqe_fp_flags & ETH_RX_ERROR_FALGS)) {
@@ -595,7 +573,7 @@ int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                                 skb_reserve(new_skb, pad);
                                 skb_put(new_skb, len);
 
-                                bnx2x_reuse_rx_skb(fp, skb, bd_cons, bd_prod);
+                                bnx2x_reuse_rx_skb(fp, bd_cons, bd_prod);
 
                                 skb = new_skb;
 
@@ -614,7 +592,7 @@ int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                                    "of alloc failure\n");
                                 fp->eth_q_stats.rx_skb_alloc_failed++;
 reuse_rx:
-                                bnx2x_reuse_rx_skb(fp, skb, bd_cons, bd_prod);
+                                bnx2x_reuse_rx_skb(fp, bd_cons, bd_prod);
                                 goto next_rx;
                         }
 
@@ -624,6 +602,7 @@ reuse_rx:
                         bnx2x_set_skb_rxhash(bp, cqe, skb);
 
                         skb_checksum_none_assert(skb);
+
                         if (bp->rx_csum) {
                                 if (likely(BNX2X_RX_CSUM_OK(cqe)))
                                         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -634,15 +613,11 @@ reuse_rx:
 
                 skb_record_rx_queue(skb, fp->index);
 
-#ifdef BCM_VLAN
-                if ((bp->vlgrp != NULL) && (bp->flags & HW_VLAN_RX_FLAG) &&
-                    (le16_to_cpu(cqe->fast_path_cqe.pars_flags.flags) &
-                     PARSING_FLAGS_VLAN))
-                        vlan_gro_receive(&fp->napi, bp->vlgrp,
-                                le16_to_cpu(cqe->fast_path_cqe.vlan_tag), skb);
-                else
-#endif
-                        napi_gro_receive(&fp->napi, skb);
+                if (le16_to_cpu(cqe->fast_path_cqe.pars_flags.flags) &
+                     PARSING_FLAGS_VLAN)
+                        __vlan_hwaccel_put_tag(skb,
+                                le16_to_cpu(cqe->fast_path_cqe.vlan_tag));
+                napi_gro_receive(&fp->napi, skb);
 
 
 next_rx:
@@ -686,9 +661,10 @@ static irqreturn_t bnx2x_msix_fp_int(int irq, void *fp_cookie)
                 return IRQ_HANDLED;
         }
 
-        DP(BNX2X_MSG_FP, "got an MSI-X interrupt on IDX:SB [%d:%d]\n",
-           fp->index, fp->sb_id);
-        bnx2x_ack_sb(bp, fp->sb_id, USTORM_ID, 0, IGU_INT_DISABLE, 0);
+        DP(BNX2X_MSG_FP, "got an MSI-X interrupt on IDX:SB "
+                         "[fp %d fw_sd %d igusb %d]\n",
+           fp->index, fp->fw_sb_id, fp->igu_sb_id);
+        bnx2x_ack_sb(bp, fp->igu_sb_id, USTORM_ID, 0, IGU_INT_DISABLE, 0);
 
 #ifdef BNX2X_STOP_ON_ERROR
         if (unlikely(bp->panic))
@@ -698,14 +674,12 @@ static irqreturn_t bnx2x_msix_fp_int(int irq, void *fp_cookie)
         /* Handle Rx and Tx according to MSI-X vector */
         prefetch(fp->rx_cons_sb);
         prefetch(fp->tx_cons_sb);
-        prefetch(&fp->status_blk->u_status_block.status_block_index);
-        prefetch(&fp->status_blk->c_status_block.status_block_index);
+        prefetch(&fp->sb_running_index[SM_RX_ID]);
         napi_schedule(&bnx2x_fp(bp, fp->index, napi));
 
         return IRQ_HANDLED;
 }
 
-
 /* HW Lock for shared dual port PHYs */
 void bnx2x_acquire_phy_lock(struct bnx2x *bp)
 {
@@ -739,12 +713,13 @@ void bnx2x_link_report(struct bnx2x *bp)
                 netdev_info(bp->dev, "NIC Link is Up, ");
 
                 line_speed = bp->link_vars.line_speed;
-                if (IS_E1HMF(bp)) {
+                if (IS_MF(bp)) {
                         u16 vn_max_rate;
 
                         vn_max_rate =
-                                ((bp->mf_config & FUNC_MF_CFG_MAX_BW_MASK) >>
-                                 FUNC_MF_CFG_MAX_BW_SHIFT) * 100;
+                                ((bp->mf_config[BP_VN(bp)] &
+                                  FUNC_MF_CFG_MAX_BW_MASK) >>
+                                                FUNC_MF_CFG_MAX_BW_SHIFT) * 100;
                         if (vn_max_rate < line_speed)
                                 line_speed = vn_max_rate;
                 }
@@ -774,27 +749,73 @@ void bnx2x_link_report(struct bnx2x *bp)
         }
 }
 
+/* Returns the number of actually allocated BDs */
+static inline int bnx2x_alloc_rx_bds(struct bnx2x_fastpath *fp,
+                                      int rx_ring_size)
+{
+        struct bnx2x *bp = fp->bp;
+        u16 ring_prod, cqe_ring_prod;
+        int i;
+
+        fp->rx_comp_cons = 0;
+        cqe_ring_prod = ring_prod = 0;
+        for (i = 0; i < rx_ring_size; i++) {
+                if (bnx2x_alloc_rx_skb(bp, fp, ring_prod) < 0) {
+                        BNX2X_ERR("was only able to allocate "
+                                  "%d rx skbs on queue[%d]\n", i, fp->index);
+                        fp->eth_q_stats.rx_skb_alloc_failed++;
+                        break;
+                }
+                ring_prod = NEXT_RX_IDX(ring_prod);
+                cqe_ring_prod = NEXT_RCQ_IDX(cqe_ring_prod);
+                WARN_ON(ring_prod <= i);
+        }
+
+        fp->rx_bd_prod = ring_prod;
+        /* Limit the CQE producer by the CQE ring size */
+        fp->rx_comp_prod = min_t(u16, NUM_RCQ_RINGS*RCQ_DESC_CNT,
+                               cqe_ring_prod);
+        fp->rx_pkt = fp->rx_calls = 0;
+
+        return i;
+}
+
+static inline void bnx2x_alloc_rx_bd_ring(struct bnx2x_fastpath *fp)
+{
+        struct bnx2x *bp = fp->bp;
+        int rx_ring_size = bp->rx_ring_size ? bp->rx_ring_size :
+                                              MAX_RX_AVAIL/bp->num_queues;
+
+        rx_ring_size = max_t(int, MIN_RX_AVAIL, rx_ring_size);
+
+        bnx2x_alloc_rx_bds(fp, rx_ring_size);
+
+        /* Warning!
+         * this will generate an interrupt (to the TSTORM)
+         * must only be done after chip is initialized
+         */
+        bnx2x_update_rx_prod(bp, fp, fp->rx_bd_prod, fp->rx_comp_prod,
+                             fp->rx_sge_prod);
+}
+
 void bnx2x_init_rx_rings(struct bnx2x *bp)
 {
         int func = BP_FUNC(bp);
         int max_agg_queues = CHIP_IS_E1(bp) ? ETH_MAX_AGGREGATION_QUEUES_E1 :
                                               ETH_MAX_AGGREGATION_QUEUES_E1H;
-        u16 ring_prod, cqe_ring_prod;
+        u16 ring_prod;
         int i, j;
-        int rx_ring_size = bp->rx_ring_size ? bp->rx_ring_size :
-                                              MAX_RX_AVAIL/bp->num_queues;
 
-        rx_ring_size = max_t(int, MIN_RX_AVAIL, rx_ring_size);
+        bp->rx_buf_size = bp->dev->mtu + ETH_OVREHEAD + BNX2X_RX_ALIGN +
+                IP_HEADER_ALIGNMENT_PADDING;
 
-        bp->rx_buf_size = bp->dev->mtu + ETH_OVREHEAD + BNX2X_RX_ALIGN;
         DP(NETIF_MSG_IFUP,
            "mtu %d  rx_buf_size %d\n", bp->dev->mtu, bp->rx_buf_size);
 
-        if (bp->flags & TPA_ENABLE_FLAG) {
-
-                for_each_queue(bp, j) {
-                        struct bnx2x_fastpath *fp = &bp->fp[j];
+        for_each_queue(bp, j) {
+                struct bnx2x_fastpath *fp = &bp->fp[j];
 
+                if (!fp->disable_tpa) {
                         for (i = 0; i < max_agg_queues; i++) {
                                 fp->tpa_pool[i].skb =
                                    netdev_alloc_skb(bp->dev, bp->rx_buf_size);
@@ -812,6 +833,35 @@ void bnx2x_init_rx_rings(struct bnx2x *bp)
                                                    mapping, 0);
                                 fp->tpa_state[i] = BNX2X_TPA_STOP;
                         }
+
+                        /* "next page" elements initialization */
+                        bnx2x_set_next_page_sgl(fp);
+
+                        /* set SGEs bit mask */
+                        bnx2x_init_sge_ring_bit_mask(fp);
+
+                        /* Allocate SGEs and initialize the ring elements */
+                        for (i = 0, ring_prod = 0;
+                             i < MAX_RX_SGE_CNT*NUM_RX_SGE_PAGES; i++) {
+
+                                if (bnx2x_alloc_rx_sge(bp, fp, ring_prod) < 0) {
+                                        BNX2X_ERR("was only able to allocate "
+                                                  "%d rx sges\n", i);
+                                        BNX2X_ERR("disabling TPA for"
+                                                  " queue[%d]\n", j);
+                                        /* Cleanup already allocated elements */
+                                        bnx2x_free_rx_sge_range(bp,
+                                                                fp, ring_prod);
+                                        bnx2x_free_tpa_pool(bp,
+                                                            fp, max_agg_queues);
+                                        fp->disable_tpa = 1;
+                                        ring_prod = 0;
+                                        break;
+                                }
+                                ring_prod = NEXT_SGE_IDX(ring_prod);
+                        }
+
+                        fp->rx_sge_prod = ring_prod;
                 }
         }
 
@@ -819,109 +869,29 @@ void bnx2x_init_rx_rings(struct bnx2x *bp)
                 struct bnx2x_fastpath *fp = &bp->fp[j];
 
                 fp->rx_bd_cons = 0;
-                fp->rx_cons_sb = BNX2X_RX_SB_INDEX;
-                fp->rx_bd_cons_sb = BNX2X_RX_SB_BD_INDEX;
-
-                /* "next page" elements initialization */
-                /* SGE ring */
-                for (i = 1; i <= NUM_RX_SGE_PAGES; i++) {
-                        struct eth_rx_sge *sge;
-
-                        sge = &fp->rx_sge_ring[RX_SGE_CNT * i - 2];
-                        sge->addr_hi =
-                                cpu_to_le32(U64_HI(fp->rx_sge_mapping +
-                                        BCM_PAGE_SIZE*(i % NUM_RX_SGE_PAGES)));
-                        sge->addr_lo =
-                                cpu_to_le32(U64_LO(fp->rx_sge_mapping +
-                                        BCM_PAGE_SIZE*(i % NUM_RX_SGE_PAGES)));
-                }
-
-                bnx2x_init_sge_ring_bit_mask(fp);
 
-                /* RX BD ring */
-                for (i = 1; i <= NUM_RX_RINGS; i++) {
-                        struct eth_rx_bd *rx_bd;
-
-                        rx_bd = &fp->rx_desc_ring[RX_DESC_CNT * i - 2];
-                        rx_bd->addr_hi =
-                                cpu_to_le32(U64_HI(fp->rx_desc_mapping +
-                                            BCM_PAGE_SIZE*(i % NUM_RX_RINGS)));
-                        rx_bd->addr_lo =
-                                cpu_to_le32(U64_LO(fp->rx_desc_mapping +
-                                            BCM_PAGE_SIZE*(i % NUM_RX_RINGS)));
-                }
+                bnx2x_set_next_page_rx_bd(fp);
 
                 /* CQ ring */
-                for (i = 1; i <= NUM_RCQ_RINGS; i++) {
-                        struct eth_rx_cqe_next_page *nextpg;
-
-                        nextpg = (struct eth_rx_cqe_next_page *)
-                                &fp->rx_comp_ring[RCQ_DESC_CNT * i - 1];
-                        nextpg->addr_hi =
-                                cpu_to_le32(U64_HI(fp->rx_comp_mapping +
-                                           BCM_PAGE_SIZE*(i % NUM_RCQ_RINGS)));
-                        nextpg->addr_lo =
-                                cpu_to_le32(U64_LO(fp->rx_comp_mapping +
-                                           BCM_PAGE_SIZE*(i % NUM_RCQ_RINGS)));
-                }
-
-                /* Allocate SGEs and initialize the ring elements */
-                for (i = 0, ring_prod = 0;
-                     i < MAX_RX_SGE_CNT*NUM_RX_SGE_PAGES; i++) {
-
-                        if (bnx2x_alloc_rx_sge(bp, fp, ring_prod) < 0) {
-                                BNX2X_ERR("was only able to allocate "
-                                          "%d rx sges\n", i);
-                                BNX2X_ERR("disabling TPA for queue[%d]\n", j);
-                                /* Cleanup already allocated elements */
-                                bnx2x_free_rx_sge_range(bp, fp, ring_prod);
-                                bnx2x_free_tpa_pool(bp, fp, max_agg_queues);
-                                fp->disable_tpa = 1;
-                                ring_prod = 0;
-                                break;
-                        }
-                        ring_prod = NEXT_SGE_IDX(ring_prod);
-                }
-                fp->rx_sge_prod = ring_prod;
+                bnx2x_set_next_page_rx_cq(fp);
 
                 /* Allocate BDs and initialize BD ring */
-                fp->rx_comp_cons = 0;
-                cqe_ring_prod = ring_prod = 0;
-                for (i = 0; i < rx_ring_size; i++) {
-                        if (bnx2x_alloc_rx_skb(bp, fp, ring_prod) < 0) {
-                                BNX2X_ERR("was only able to allocate "
-                                          "%d rx skbs on queue[%d]\n", i, j);
-                                fp->eth_q_stats.rx_skb_alloc_failed++;
-                                break;
-                        }
-                        ring_prod = NEXT_RX_IDX(ring_prod);
-                        cqe_ring_prod = NEXT_RCQ_IDX(cqe_ring_prod);
-                        WARN_ON(ring_prod <= i);
-                }
+                bnx2x_alloc_rx_bd_ring(fp);
 
-                fp->rx_bd_prod = ring_prod;
-                /* must not have more available CQEs than BDs */
-                fp->rx_comp_prod = min_t(u16, NUM_RCQ_RINGS*RCQ_DESC_CNT,
-                                         cqe_ring_prod);
-                fp->rx_pkt = fp->rx_calls = 0;
-
-                /* Warning!
-                 * this will generate an interrupt (to the TSTORM)
-                 * must only be done after chip is initialized
-                 */
-                bnx2x_update_rx_prod(bp, fp, ring_prod, fp->rx_comp_prod,
-                                     fp->rx_sge_prod);
                 if (j != 0)
                         continue;
 
-                REG_WR(bp, BAR_USTRORM_INTMEM +
-                       USTORM_MEM_WORKAROUND_ADDRESS_OFFSET(func),
-                       U64_LO(fp->rx_comp_mapping));
-                REG_WR(bp, BAR_USTRORM_INTMEM +
-                       USTORM_MEM_WORKAROUND_ADDRESS_OFFSET(func) + 4,
-                       U64_HI(fp->rx_comp_mapping));
+                if (!CHIP_IS_E2(bp)) {
+                        REG_WR(bp, BAR_USTRORM_INTMEM +
+                               USTORM_MEM_WORKAROUND_ADDRESS_OFFSET(func),
+                               U64_LO(fp->rx_comp_mapping));
+                        REG_WR(bp, BAR_USTRORM_INTMEM +
+                               USTORM_MEM_WORKAROUND_ADDRESS_OFFSET(func) + 4,
+                               U64_HI(fp->rx_comp_mapping));
+                }
         }
 }
+
 static void bnx2x_free_tx_skbs(struct bnx2x *bp)
 {
         int i;
@@ -994,55 +964,49 @@ static void bnx2x_free_msix_irqs(struct bnx2x *bp)
         }
 }
 
-void bnx2x_free_irq(struct bnx2x *bp, bool disable_only)
+void bnx2x_free_irq(struct bnx2x *bp)
 {
-        if (bp->flags & USING_MSIX_FLAG) {
-                if (!disable_only)
-                        bnx2x_free_msix_irqs(bp);
-                pci_disable_msix(bp->pdev);
-                bp->flags &= ~USING_MSIX_FLAG;
-
-        } else if (bp->flags & USING_MSI_FLAG) {
-                if (!disable_only)
-                        free_irq(bp->pdev->irq, bp->dev);
-                pci_disable_msi(bp->pdev);
-                bp->flags &= ~USING_MSI_FLAG;
-
-        } else if (!disable_only)
+        if (bp->flags & USING_MSIX_FLAG)
+                bnx2x_free_msix_irqs(bp);
+        else if (bp->flags & USING_MSI_FLAG)
+                free_irq(bp->pdev->irq, bp->dev);
+        else
                 free_irq(bp->pdev->irq, bp->dev);
 }
 
-static int bnx2x_enable_msix(struct bnx2x *bp)
+int bnx2x_enable_msix(struct bnx2x *bp)
 {
-        int i, rc, offset = 1;
-        int igu_vec = 0;
+        int msix_vec = 0, i, rc, req_cnt;
 
-        bp->msix_table[0].entry = igu_vec;
-        DP(NETIF_MSG_IFUP, "msix_table[0].entry = %d (slowpath)\n", igu_vec);
+        bp->msix_table[msix_vec].entry = msix_vec;
+        DP(NETIF_MSG_IFUP, "msix_table[0].entry = %d (slowpath)\n",
+           bp->msix_table[0].entry);
+        msix_vec++;
 
 #ifdef BCM_CNIC
-        igu_vec = BP_L_ID(bp) + offset;
-        bp->msix_table[1].entry = igu_vec;
-        DP(NETIF_MSG_IFUP, "msix_table[1].entry = %d (CNIC)\n", igu_vec);
-        offset++;
+        bp->msix_table[msix_vec].entry = msix_vec;
+        DP(NETIF_MSG_IFUP, "msix_table[%d].entry = %d (CNIC)\n",
+           bp->msix_table[msix_vec].entry, bp->msix_table[msix_vec].entry);
+        msix_vec++;
 #endif
         for_each_queue(bp, i) {
-                igu_vec = BP_L_ID(bp) + offset + i;
-                bp->msix_table[i + offset].entry = igu_vec;
+                bp->msix_table[msix_vec].entry = msix_vec;
                 DP(NETIF_MSG_IFUP, "msix_table[%d].entry = %d "
-                   "(fastpath #%u)\n", i + offset, igu_vec, i);
+                   "(fastpath #%u)\n", msix_vec, msix_vec, i);
+                msix_vec++;
         }
 
-        rc = pci_enable_msix(bp->pdev, &bp->msix_table[0],
-                             BNX2X_NUM_QUEUES(bp) + offset);
+        req_cnt = BNX2X_NUM_QUEUES(bp) + CNIC_CONTEXT_USE + 1;
+
+        rc = pci_enable_msix(bp->pdev, &bp->msix_table[0], req_cnt);
 
         /*
          * reconfigure number of tx/rx queues according to available
          * MSI-X vectors
          */
         if (rc >= BNX2X_MIN_MSIX_VEC_CNT) {
-                /* vectors available for FP */
-                int fp_vec = rc - BNX2X_MSIX_VEC_FP_START;
+                /* how less vectors we will have? */
+                int diff = req_cnt - rc;
 
                 DP(NETIF_MSG_IFUP,
                    "Trying to use less MSI-X vectors: %d\n", rc);
@@ -1054,12 +1018,17 @@ static int bnx2x_enable_msix(struct bnx2x *bp)
                            "MSI-X is not attainable  rc %d\n", rc);
                         return rc;
                 }
-
-                bp->num_queues = min(bp->num_queues, fp_vec);
+                /*
+                 * decrease number of queues by number of unallocated entries
+                 */
+                bp->num_queues -= diff;
 
                 DP(NETIF_MSG_IFUP, "New queue configuration set: %d\n",
                                   bp->num_queues);
         } else if (rc) {
+                /* fall to INTx if not enough memory */
+                if (rc == -ENOMEM)
+                        bp->flags |= DISABLE_MSI_FLAG;
                 DP(NETIF_MSG_IFUP, "MSI-X is not attainable  rc %d\n", rc);
                 return rc;
         }
@@ -1088,7 +1057,7 @@ static int bnx2x_req_msix_irqs(struct bnx2x *bp)
                 snprintf(fp->name, sizeof(fp->name), "%s-fp-%d",
                          bp->dev->name, i);
 
-                rc = request_irq(bp->msix_table[i + offset].vector,
+                rc = request_irq(bp->msix_table[offset].vector,
                                  bnx2x_msix_fp_int, 0, fp->name, fp);
                 if (rc) {
                         BNX2X_ERR("request fp #%d irq failed  rc %d\n", i, rc);
@@ -1096,10 +1065,12 @@ static int bnx2x_req_msix_irqs(struct bnx2x *bp)
                         return -EBUSY;
                 }
 
+                offset++;
                 fp->state = BNX2X_FP_STATE_IRQ;
         }
 
         i = BNX2X_NUM_QUEUES(bp);
+        offset = 1 + CNIC_CONTEXT_USE;
         netdev_info(bp->dev, "using MSI-X  IRQs: sp %d  fp[%d] %d"
                " ... fp[%d] %d\n",
                bp->msix_table[0].vector,
@@ -1109,7 +1080,7 @@ static int bnx2x_req_msix_irqs(struct bnx2x *bp)
         return 0;
 }
 
-static int bnx2x_enable_msi(struct bnx2x *bp)
+int bnx2x_enable_msi(struct bnx2x *bp)
 {
         int rc;
 
@@ -1180,35 +1151,21 @@ void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
         bnx2x_napi_disable(bp);
         netif_tx_disable(bp->dev);
 }
-static int bnx2x_set_num_queues(struct bnx2x *bp)
-{
-        int rc = 0;
 
-        switch (bp->int_mode) {
-        case INT_MODE_INTx:
-        case INT_MODE_MSI:
+void bnx2x_set_num_queues(struct bnx2x *bp)
+{
+        switch (bp->multi_mode) {
+        case ETH_RSS_MODE_DISABLED:
                 bp->num_queues = 1;
-                DP(NETIF_MSG_IFUP, "set number of queues to 1\n");
                 break;
-        default:
-                /* Set number of queues according to bp->multi_mode value */
-                bnx2x_set_num_queues_msix(bp);
-
-                DP(NETIF_MSG_IFUP, "set number of queues to %d\n",
-                   bp->num_queues);
+        case ETH_RSS_MODE_REGULAR:
+                bp->num_queues = bnx2x_calc_num_queues(bp);
+                break;
 
-                /* if we can't use MSI-X we only need one fp,
-                 * so try to enable MSI-X with the requested number of fp's
-                 * and fallback to MSI or legacy INTx with one fp
-                 */
-                rc = bnx2x_enable_msix(bp);
-                if (rc)
-                        /* failed to enable MSI-X */
-                        bp->num_queues = 1;
+        default:
+                bp->num_queues = 1;
                 break;
         }
-        bp->dev->real_num_tx_queues = bp->num_queues;
-        return rc;
 }
 
 static void bnx2x_release_firmware(struct bnx2x *bp)
@@ -1239,48 +1196,25 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 
         bp->state = BNX2X_STATE_OPENING_WAIT4_LOAD;
 
-        rc = bnx2x_set_num_queues(bp);
+        /* must be called before memory allocation and HW init */
+        bnx2x_ilt_set_info(bp);
 
-        if (bnx2x_alloc_mem(bp)) {
-                bnx2x_free_irq(bp, true);
+        if (bnx2x_alloc_mem(bp))
                 return -ENOMEM;
+
+        netif_set_real_num_tx_queues(bp->dev, bp->num_queues);
+        rc = netif_set_real_num_rx_queues(bp->dev, bp->num_queues);
+        if (rc) {
+                BNX2X_ERR("Unable to update real_num_rx_queues\n");
+                goto load_error0;
         }
 
         for_each_queue(bp, i)
                 bnx2x_fp(bp, i, disable_tpa) =
                                         ((bp->flags & TPA_ENABLE_FLAG) == 0);
 
-        for_each_queue(bp, i)
-                netif_napi_add(bp->dev, &bnx2x_fp(bp, i, napi),
-                               bnx2x_poll, 128);
-
         bnx2x_napi_enable(bp);
 
-        if (bp->flags & USING_MSIX_FLAG) {
-                rc = bnx2x_req_msix_irqs(bp);
-                if (rc) {
-                        bnx2x_free_irq(bp, true);
-                        goto load_error1;
-                }
-        } else {
-                /* Fall to INTx if failed to enable MSI-X due to lack of
-                   memory (in bnx2x_set_num_queues()) */
-                if ((rc != -ENOMEM) && (bp->int_mode != INT_MODE_INTx))
-                        bnx2x_enable_msi(bp);
-                bnx2x_ack_int(bp);
-                rc = bnx2x_req_irq(bp);
-                if (rc) {
-                        BNX2X_ERR("IRQ request failed  rc %d, aborting\n", rc);
-                        bnx2x_free_irq(bp, true);
-                        goto load_error1;
-                }
-                if (bp->flags & USING_MSI_FLAG) {
-                        bp->dev->irq = bp->pdev->irq;
-                        netdev_info(bp->dev, "using MSI  IRQ %d\n",
-                                    bp->pdev->irq);
-                }
-        }
-
         /* Send LOAD_REQUEST command to MCP
            Returns the type of LOAD command:
            if it is the first port to be initialized
@@ -1291,31 +1225,35 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                 if (!load_code) {
                         BNX2X_ERR("MCP response failure, aborting\n");
                         rc = -EBUSY;
-                        goto load_error2;
+                        goto load_error1;
                 }
                 if (load_code == FW_MSG_CODE_DRV_LOAD_REFUSED) {
                         rc = -EBUSY; /* other port in diagnostic mode */
-                        goto load_error2;
+                        goto load_error1;
                 }
 
         } else {
+                int path = BP_PATH(bp);
                 int port = BP_PORT(bp);
 
-                DP(NETIF_MSG_IFUP, "NO MCP - load counts      %d, %d, %d\n",
-                   load_count[0], load_count[1], load_count[2]);
-                load_count[0]++;
-                load_count[1 + port]++;
-                DP(NETIF_MSG_IFUP, "NO MCP - new load counts  %d, %d, %d\n",
-                   load_count[0], load_count[1], load_count[2]);
-                if (load_count[0] == 1)
+                DP(NETIF_MSG_IFUP, "NO MCP - load counts[%d]      %d, %d, %d\n",
+                   path, load_count[path][0], load_count[path][1],
+                   load_count[path][2]);
+                load_count[path][0]++;
+                load_count[path][1 + port]++;
+                DP(NETIF_MSG_IFUP, "NO MCP - new load counts[%d]  %d, %d, %d\n",
+                   path, load_count[path][0], load_count[path][1],
+                   load_count[path][2]);
+                if (load_count[path][0] == 1)
                         load_code = FW_MSG_CODE_DRV_LOAD_COMMON;
-                else if (load_count[1 + port] == 1)
+                else if (load_count[path][1 + port] == 1)
                         load_code = FW_MSG_CODE_DRV_LOAD_PORT;
                 else
                         load_code = FW_MSG_CODE_DRV_LOAD_FUNCTION;
         }
 
         if ((load_code == FW_MSG_CODE_DRV_LOAD_COMMON) ||
+            (load_code == FW_MSG_CODE_DRV_LOAD_COMMON_CHIP) ||
             (load_code == FW_MSG_CODE_DRV_LOAD_PORT))
                 bp->port.pmf = 1;
         else
@@ -1327,15 +1265,21 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
         if (rc) {
                 BNX2X_ERR("HW init failed, aborting\n");
                 bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_DONE, 0);
-                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP, 0);
-                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE, 0);
+                goto load_error2;
+        }
+
+        /* Connect to IRQs */
+        rc = bnx2x_setup_irqs(bp);
+        if (rc) {
+                bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_DONE, 0);
                 goto load_error2;
         }
 
         /* Setup NIC internals and enable interrupts */
         bnx2x_nic_init(bp, load_code);
 
-        if ((load_code == FW_MSG_CODE_DRV_LOAD_COMMON) &&
+        if (((load_code == FW_MSG_CODE_DRV_LOAD_COMMON) ||
+            (load_code == FW_MSG_CODE_DRV_LOAD_COMMON_CHIP)) &&
             (bp->common.shmem2_base))
                 SHMEM2_WR(bp, dcc_support,
                           (SHMEM_DCC_SUPPORT_DISABLE_ENABLE_PF_TLV |
@@ -1353,7 +1297,18 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 
         bp->state = BNX2X_STATE_OPENING_WAIT4_PORT;
 
-        rc = bnx2x_setup_leading(bp);
+        rc = bnx2x_func_start(bp);
+        if (rc) {
+                BNX2X_ERR("Function start failed!\n");
+#ifndef BNX2X_STOP_ON_ERROR
+                goto load_error3;
+#else
+                bp->panic = 1;
+                return -EBUSY;
+#endif
+        }
+
+        rc = bnx2x_setup_client(bp, &bp->fp[0], 1 /* Leading */);
         if (rc) {
                 BNX2X_ERR("Setup leading failed!\n");
 #ifndef BNX2X_STOP_ON_ERROR
@@ -1364,62 +1319,47 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 #endif
         }
 
-        if (CHIP_IS_E1H(bp))
-                if (bp->mf_config & FUNC_MF_CFG_FUNC_DISABLED) {
-                        DP(NETIF_MSG_IFUP, "mf_cfg function disabled\n");
-                        bp->flags |= MF_FUNC_DIS;
-                }
+        if (!CHIP_IS_E1(bp) &&
+            (bp->mf_config[BP_VN(bp)] & FUNC_MF_CFG_FUNC_DISABLED)) {
+                DP(NETIF_MSG_IFUP, "mf_cfg function disabled\n");
+                bp->flags |= MF_FUNC_DIS;
+        }
 
-        if (bp->state == BNX2X_STATE_OPEN) {
-#ifdef BCM_CNIC
-                /* Enable Timer scan */
-                REG_WR(bp, TM_REG_EN_LINEAR0_TIMER + BP_PORT(bp)*4, 1);
-#endif
-                for_each_nondefault_queue(bp, i) {
-                        rc = bnx2x_setup_multi(bp, i);
-                        if (rc)
 #ifdef BCM_CNIC
-                                goto load_error4;
-#else
-                                goto load_error3;
+        /* Enable Timer scan */
+        REG_WR(bp, TM_REG_EN_LINEAR0_TIMER + BP_PORT(bp)*4, 1);
 #endif
-                }
 
-                if (CHIP_IS_E1(bp))
-                        bnx2x_set_eth_mac_addr_e1(bp, 1);
-                else
-                        bnx2x_set_eth_mac_addr_e1h(bp, 1);
+        for_each_nondefault_queue(bp, i) {
+                rc = bnx2x_setup_client(bp, &bp->fp[i], 0);
+                if (rc)
 #ifdef BCM_CNIC
-                /* Set iSCSI L2 MAC */
-                mutex_lock(&bp->cnic_mutex);
-                if (bp->cnic_eth_dev.drv_state & CNIC_DRV_STATE_REGD) {
-                        bnx2x_set_iscsi_eth_mac_addr(bp, 1);
-                        bp->cnic_flags |= BNX2X_CNIC_FLAG_MAC_SET;
-                        bnx2x_init_sb(bp, bp->cnic_sb, bp->cnic_sb_mapping,
-                                      CNIC_SB_ID(bp));
-                }
-                mutex_unlock(&bp->cnic_mutex);
+                        goto load_error4;
+#else
+                        goto load_error3;
 #endif
         }
 
+        /* Now when Clients are configured we are ready to work */
+        bp->state = BNX2X_STATE_OPEN;
+
+        bnx2x_set_eth_mac(bp, 1);
+
         if (bp->port.pmf)
                 bnx2x_initial_phy_init(bp, load_mode);
 
         /* Start fast path */
         switch (load_mode) {
         case LOAD_NORMAL:
-                if (bp->state == BNX2X_STATE_OPEN) {
-                        /* Tx queue should be only reenabled */
-                        netif_tx_wake_all_queues(bp->dev);
-                }
+                /* Tx queue should be only reenabled */
+                netif_tx_wake_all_queues(bp->dev);
                 /* Initialize the receive filter. */
                 bnx2x_set_rx_mode(bp->dev);
                 break;
 
         case LOAD_OPEN:
                 netif_tx_start_all_queues(bp->dev);
-                if (bp->state != BNX2X_STATE_OPEN)
-                        netif_tx_disable(bp->dev);
+                smp_mb__after_clear_bit();
                 /* Initialize the receive filter. */
                 bnx2x_set_rx_mode(bp->dev);
                 break;
@@ -1458,22 +1398,24 @@ load_error4:
 #endif
 load_error3:
         bnx2x_int_disable_sync(bp, 1);
-        if (!BP_NOMCP(bp)) {
-                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP, 0);
-                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE, 0);
-        }
-        bp->port.pmf = 0;
+
         /* Free SKBs, SGEs, TPA pool and driver internals */
         bnx2x_free_skbs(bp);
         for_each_queue(bp, i)
                 bnx2x_free_rx_sge_range(bp, bp->fp + i, NUM_RX_SGE);
-load_error2:
+
         /* Release IRQs */
-        bnx2x_free_irq(bp, false);
+        bnx2x_free_irq(bp);
+load_error2:
+        if (!BP_NOMCP(bp)) {
+                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP, 0);
+                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE, 0);
+        }
+
+        bp->port.pmf = 0;
 load_error1:
         bnx2x_napi_disable(bp);
-        for_each_queue(bp, i)
-                netif_napi_del(&bnx2x_fp(bp, i, napi));
+load_error0:
         bnx2x_free_mem(bp);
 
         bnx2x_release_firmware(bp);
@@ -1505,21 +1447,26 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode)
         bp->rx_mode = BNX2X_RX_MODE_NONE;
         bnx2x_set_storm_rx_mode(bp);
 
-        /* Disable HW interrupts, NAPI and Tx */
-        bnx2x_netif_stop(bp, 1);
-        netif_carrier_off(bp->dev);
+        /* Stop Tx */
+        bnx2x_tx_disable(bp);
 
         del_timer_sync(&bp->timer);
-        SHMEM_WR(bp, func_mb[BP_FUNC(bp)].drv_pulse_mb,
+
+        SHMEM_WR(bp, func_mb[BP_FW_MB_IDX(bp)].drv_pulse_mb,
                  (DRV_PULSE_ALWAYS_ALIVE | bp->fw_drv_pulse_wr_seq));
-        bnx2x_stats_handle(bp, STATS_EVENT_STOP);
 
-        /* Release IRQs */
-        bnx2x_free_irq(bp, false);
+        bnx2x_stats_handle(bp, STATS_EVENT_STOP);
 
         /* Cleanup the chip if needed */
         if (unload_mode != UNLOAD_RECOVERY)
                 bnx2x_chip_cleanup(bp, unload_mode);
+        else {
+                /* Disable HW interrupts, NAPI and Tx */
+                bnx2x_netif_stop(bp, 1);
+
+                /* Release IRQs */
+                bnx2x_free_irq(bp);
+        }
 
         bp->port.pmf = 0;
 
@@ -1527,8 +1474,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode)
         bnx2x_free_skbs(bp);
         for_each_queue(bp, i)
                 bnx2x_free_rx_sge_range(bp, bp->fp + i, NUM_RX_SGE);
-        for_each_queue(bp, i)
-                netif_napi_del(&bnx2x_fp(bp, i, napi));
+
         bnx2x_free_mem(bp);
 
         bp->state = BNX2X_STATE_CLOSED;
@@ -1546,10 +1492,17 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode)
 
         return 0;
 }
+
 int bnx2x_set_power_state(struct bnx2x *bp, pci_power_t state)
 {
         u16 pmcsr;
 
+        /* If there is no power capability, silently succeed */
+        if (!bp->pm_cap) {
+                DP(NETIF_MSG_HW, "No power capability. Breaking.\n");
+                return 0;
+        }
+
         pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, &pmcsr);
 
         switch (state) {
@@ -1592,13 +1545,10 @@ int bnx2x_set_power_state(struct bnx2x *bp, pci_power_t state)
         return 0;
 }
 
-
-
 /*
  * net_device service functions
  */
-
-static int bnx2x_poll(struct napi_struct *napi, int budget)
+int bnx2x_poll(struct napi_struct *napi, int budget)
 {
         int work_done = 0;
         struct bnx2x_fastpath *fp = container_of(napi, struct bnx2x_fastpath,
@@ -1627,27 +1577,28 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
                 /* Fall out from the NAPI loop if needed */
                 if (!(bnx2x_has_rx_work(fp) || bnx2x_has_tx_work(fp))) {
                         bnx2x_update_fpsb_idx(fp);
-                /* bnx2x_has_rx_work() reads the status block, thus we need
-                 * to ensure that status block indices have been actually read
-                 * (bnx2x_update_fpsb_idx) prior to this check
-                 * (bnx2x_has_rx_work) so that we won't write the "newer"
-                 * value of the status block to IGU (if there was a DMA right
-                 * after bnx2x_has_rx_work and if there is no rmb, the memory
-                 * reading (bnx2x_update_fpsb_idx) may be postponed to right
-                 * before bnx2x_ack_sb). In this case there will never be
-                 * another interrupt until there is another update of the
-                 * status block, while there is still unhandled work.
-                 */
+                        /* bnx2x_has_rx_work() reads the status block,
+                         * thus we need to ensure that status block indices
+                         * have been actually read (bnx2x_update_fpsb_idx)
+                         * prior to this check (bnx2x_has_rx_work) so that
+                         * we won't write the "newer" value of the status block
+                         * to IGU (if there was a DMA right after
+                         * bnx2x_has_rx_work and if there is no rmb, the memory
+                         * reading (bnx2x_update_fpsb_idx) may be postponed
+                         * to right before bnx2x_ack_sb). In this case there
+                         * will never be another interrupt until there is
+                         * another update of the status block, while there
+                         * is still unhandled work.
+                         */
                         rmb();
 
                         if (!(bnx2x_has_rx_work(fp) || bnx2x_has_tx_work(fp))) {
                                 napi_complete(napi);
                                 /* Re-enable interrupts */
-                                bnx2x_ack_sb(bp, fp->sb_id, CSTORM_ID,
-                                             le16_to_cpu(fp->fp_c_idx),
-                                             IGU_INT_NOP, 1);
-                                bnx2x_ack_sb(bp, fp->sb_id, USTORM_ID,
-                                             le16_to_cpu(fp->fp_u_idx),
+                                DP(NETIF_MSG_HW,
+                                   "Update index to %d\n", fp->fp_hc_idx);
+                                bnx2x_ack_sb(bp, fp->igu_sb_id, USTORM_ID,
+                                             le16_to_cpu(fp->fp_hc_idx),
                                              IGU_INT_ENABLE, 1);
                                 break;
                         }
@@ -1657,7 +1608,6 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
         return work_done;
 }
 
-
 /* we split the first BD into headers and data BDs
  * to ease the pain of our fellow microcode engineers
  * we use one mapping for both BDs
@@ -1831,6 +1781,122 @@ exit_lbl:
 }
 #endif
 
+static inline void bnx2x_set_pbd_gso_e2(struct sk_buff *skb,
+                                     struct eth_tx_parse_bd_e2 *pbd,
+                                     u32 xmit_type)
+{
+        pbd->parsing_data |= cpu_to_le16(skb_shinfo(skb)->gso_size) <<
+                ETH_TX_PARSE_BD_E2_LSO_MSS_SHIFT;
+        if ((xmit_type & XMIT_GSO_V6) &&
+            (ipv6_hdr(skb)->nexthdr == NEXTHDR_IPV6))
+                pbd->parsing_data |= ETH_TX_PARSE_BD_E2_IPV6_WITH_EXT_HDR;
+}
+
+/**
+ * Update PBD in GSO case.
+ *
+ * @param skb
+ * @param tx_start_bd
+ * @param pbd
+ * @param xmit_type
+ */
+static inline void bnx2x_set_pbd_gso(struct sk_buff *skb,
+                                     struct eth_tx_parse_bd_e1x *pbd,
+                                     u32 xmit_type)
+{
+        pbd->lso_mss = cpu_to_le16(skb_shinfo(skb)->gso_size);
+        pbd->tcp_send_seq = swab32(tcp_hdr(skb)->seq);
+        pbd->tcp_flags = pbd_tcp_flags(skb);
+
+        if (xmit_type & XMIT_GSO_V4) {
+                pbd->ip_id = swab16(ip_hdr(skb)->id);
+                pbd->tcp_pseudo_csum =
+                        swab16(~csum_tcpudp_magic(ip_hdr(skb)->saddr,
+                                                  ip_hdr(skb)->daddr,
+                                                  0, IPPROTO_TCP, 0));
+
+        } else
+                pbd->tcp_pseudo_csum =
+                        swab16(~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                                &ipv6_hdr(skb)->daddr,
+                                                0, IPPROTO_TCP, 0));
+
+        pbd->global_data |= ETH_TX_PARSE_BD_E1X_PSEUDO_CS_WITHOUT_LEN;
+}
+
+/**
+ *
+ * @param skb
+ * @param tx_start_bd
+ * @param pbd_e2
+ * @param xmit_type
+ *
+ * @return header len
+ */
+static inline  u8 bnx2x_set_pbd_csum_e2(struct bnx2x *bp, struct sk_buff *skb,
+        struct eth_tx_parse_bd_e2 *pbd,
+        u32 xmit_type)
+{
+        pbd->parsing_data |= cpu_to_le16(tcp_hdrlen(skb)/4) <<
+                ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW_SHIFT;
+
+        pbd->parsing_data |= cpu_to_le16(((unsigned char *)tcp_hdr(skb) -
+                                          skb->data) / 2) <<
+                ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W_SHIFT;
+
+        return skb_transport_header(skb) + tcp_hdrlen(skb) - skb->data;
+}
+
+/**
+ *
+ * @param skb
+ * @param tx_start_bd
+ * @param pbd
+ * @param xmit_type
+ *
+ * @return Header length
+ */
+static inline u8 bnx2x_set_pbd_csum(struct bnx2x *bp, struct sk_buff *skb,
+        struct eth_tx_parse_bd_e1x *pbd,
+        u32 xmit_type)
+{
+        u8 hlen = (skb_network_header(skb) - skb->data) / 2;
+
+        /* for now NS flag is not used in Linux */
+        pbd->global_data =
+                (hlen | ((skb->protocol == cpu_to_be16(ETH_P_8021Q)) <<
+                         ETH_TX_PARSE_BD_E1X_LLC_SNAP_EN_SHIFT));
+
+        pbd->ip_hlen_w = (skb_transport_header(skb) -
+                        skb_network_header(skb)) / 2;
+
+        hlen += pbd->ip_hlen_w + tcp_hdrlen(skb) / 2;
+
+        pbd->total_hlen_w = cpu_to_le16(hlen);
+        hlen = hlen*2;
+
+        if (xmit_type & XMIT_CSUM_TCP) {
+                pbd->tcp_pseudo_csum = swab16(tcp_hdr(skb)->check);
+
+        } else {
+                s8 fix = SKB_CS_OFF(skb); /* signed! */
+
+                DP(NETIF_MSG_TX_QUEUED,
+                   "hlen %d  fix %d  csum before fix %x\n",
+                   le16_to_cpu(pbd->total_hlen_w), fix, SKB_CS(skb));
+
+                /* HW bug: fixup the CSUM */
+                pbd->tcp_pseudo_csum =
+                        bnx2x_csum_fix(skb_transport_header(skb),
+                                       SKB_CS(skb), fix);
+
+                DP(NETIF_MSG_TX_QUEUED, "csum after fix %x\n",
+                   pbd->tcp_pseudo_csum);
+        }
+
+        return hlen;
+}
+
 /* called with netif_tx_lock
  * bnx2x_tx_int() runs without netif_tx_lock unless it needs to call
  * netif_wake_queue()
@@ -1843,7 +1909,8 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct sw_tx_bd *tx_buf;
         struct eth_tx_start_bd *tx_start_bd;
         struct eth_tx_bd *tx_data_bd, *total_pkt_bd = NULL;
-        struct eth_tx_parse_bd *pbd = NULL;
+        struct eth_tx_parse_bd_e1x *pbd_e1x = NULL;
+        struct eth_tx_parse_bd_e2 *pbd_e2 = NULL;
         u16 pkt_prod, bd_prod;
         int nbd, fp_index;
         dma_addr_t mapping;
@@ -1871,9 +1938,9 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
-        DP(NETIF_MSG_TX_QUEUED, "SKB: summed %x  protocol %x  protocol(%x,%x)"
-           "  gso type %x  xmit_type %x\n",
-           skb->ip_summed, skb->protocol, ipv6_hdr(skb)->nexthdr,
+        DP(NETIF_MSG_TX_QUEUED, "queue[%d]: SKB: summed %x  protocol %x  "
+                                "protocol(%x,%x) gso type %x  xmit_type %x\n",
+           fp_index, skb->ip_summed, skb->protocol, ipv6_hdr(skb)->nexthdr,
            ip_hdr(skb)->protocol, skb_shinfo(skb)->gso_type, xmit_type);
 
         eth = (struct ethhdr *)skb->data;
@@ -1919,10 +1986,11 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
         tx_start_bd = &fp->tx_desc_ring[bd_prod].start_bd;
 
         tx_start_bd->bd_flags.as_bitfield = ETH_TX_BD_FLAGS_START_BD;
-        tx_start_bd->general_data =  (mac_type <<
-                                        ETH_TX_START_BD_ETH_ADDR_TYPE_SHIFT);
+        SET_FLAG(tx_start_bd->general_data, ETH_TX_START_BD_ETH_ADDR_TYPE,
+                 mac_type);
+
         /* header nbd */
-        tx_start_bd->general_data |= (1 << ETH_TX_START_BD_HDR_NBDS_SHIFT);
+        SET_FLAG(tx_start_bd->general_data, ETH_TX_START_BD_HDR_NBDS, 1);
 
         /* remember the first BD of the packet */
         tx_buf->first_bd = fp->tx_bd_prod;
@@ -1933,37 +2001,18 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
            "sending pkt %u @%p  next_idx %u  bd %u @%p\n",
            pkt_prod, tx_buf, fp->tx_pkt_prod, bd_prod, tx_start_bd);
 
-#ifdef BCM_VLAN
-        if ((bp->vlgrp != NULL) && vlan_tx_tag_present(skb) &&
-            (bp->flags & HW_VLAN_TX_FLAG)) {
-                tx_start_bd->vlan = cpu_to_le16(vlan_tx_tag_get(skb));
-                tx_start_bd->bd_flags.as_bitfield |= ETH_TX_BD_FLAGS_VLAN_TAG;
+        if (vlan_tx_tag_present(skb)) {
+                tx_start_bd->vlan_or_ethertype =
+                    cpu_to_le16(vlan_tx_tag_get(skb));
+                tx_start_bd->bd_flags.as_bitfield |=
+                    (X_ETH_OUTBAND_VLAN << ETH_TX_BD_FLAGS_VLAN_MODE_SHIFT);
         } else
-#endif
-                tx_start_bd->vlan = cpu_to_le16(pkt_prod);
+                tx_start_bd->vlan_or_ethertype = cpu_to_le16(pkt_prod);
 
         /* turn on parsing and get a BD */
         bd_prod = TX_BD(NEXT_TX_IDX(bd_prod));
-        pbd = &fp->tx_desc_ring[bd_prod].parse_bd;
-
-        memset(pbd, 0, sizeof(struct eth_tx_parse_bd));
 
         if (xmit_type & XMIT_CSUM) {
-                hlen = (skb_network_header(skb) - skb->data) / 2;
-
-                /* for now NS flag is not used in Linux */
-                pbd->global_data =
-                        (hlen | ((skb->protocol == cpu_to_be16(ETH_P_8021Q)) <<
-                                 ETH_TX_PARSE_BD_LLC_SNAP_EN_SHIFT));
-
-                pbd->ip_hlen = (skb_transport_header(skb) -
-                                skb_network_header(skb)) / 2;
-
-                hlen += pbd->ip_hlen + tcp_hdrlen(skb) / 2;
-
-                pbd->total_hlen = cpu_to_le16(hlen);
-                hlen = hlen*2;
-
                 tx_start_bd->bd_flags.as_bitfield |= ETH_TX_BD_FLAGS_L4_CSUM;
 
                 if (xmit_type & XMIT_CSUM_V4)
@@ -1973,31 +2022,32 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         tx_start_bd->bd_flags.as_bitfield |=
                                                 ETH_TX_BD_FLAGS_IPV6;
 
-                if (xmit_type & XMIT_CSUM_TCP) {
-                        pbd->tcp_pseudo_csum = swab16(tcp_hdr(skb)->check);
-
-                } else {
-                        s8 fix = SKB_CS_OFF(skb); /* signed! */
-
-                        pbd->global_data |= ETH_TX_PARSE_BD_UDP_CS_FLG;
-
-                        DP(NETIF_MSG_TX_QUEUED,
-                           "hlen %d  fix %d  csum before fix %x\n",
-                           le16_to_cpu(pbd->total_hlen), fix, SKB_CS(skb));
+                if (!(xmit_type & XMIT_CSUM_TCP))
+                        tx_start_bd->bd_flags.as_bitfield |=
+                                                ETH_TX_BD_FLAGS_IS_UDP;
+        }
 
-                        /* HW bug: fixup the CSUM */
-                        pbd->tcp_pseudo_csum =
-                                bnx2x_csum_fix(skb_transport_header(skb),
-                                               SKB_CS(skb), fix);
+        if (CHIP_IS_E2(bp)) {
+                pbd_e2 = &fp->tx_desc_ring[bd_prod].parse_bd_e2;
+                memset(pbd_e2, 0, sizeof(struct eth_tx_parse_bd_e2));
+                /* Set PBD in checksum offload case */
+                if (xmit_type & XMIT_CSUM)
+                        hlen = bnx2x_set_pbd_csum_e2(bp,
+                                                     skb, pbd_e2, xmit_type);
+        } else {
+                pbd_e1x = &fp->tx_desc_ring[bd_prod].parse_bd_e1x;
+                memset(pbd_e1x, 0, sizeof(struct eth_tx_parse_bd_e1x));
+                /* Set PBD in checksum offload case */
+                if (xmit_type & XMIT_CSUM)
+                        hlen = bnx2x_set_pbd_csum(bp, skb, pbd_e1x, xmit_type);
 
-                        DP(NETIF_MSG_TX_QUEUED, "csum after fix %x\n",
-                           pbd->tcp_pseudo_csum);
-                }
         }
 
+        /* Map skb linear data for DMA */
         mapping = dma_map_single(&bp->pdev->dev, skb->data,
                                  skb_headlen(skb), DMA_TO_DEVICE);
 
+        /* Setup the data pointer of the first BD of the packet */
         tx_start_bd->addr_hi = cpu_to_le32(U64_HI(mapping));
         tx_start_bd->addr_lo = cpu_to_le32(U64_LO(mapping));
         nbd = skb_shinfo(skb)->nr_frags + 2; /* start_bd + pbd + frags */
@@ -2009,7 +2059,8 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
            "  nbytes %d  flags %x  vlan %x\n",
            tx_start_bd, tx_start_bd->addr_hi, tx_start_bd->addr_lo,
            le16_to_cpu(tx_start_bd->nbd), le16_to_cpu(tx_start_bd->nbytes),
-           tx_start_bd->bd_flags.as_bitfield, le16_to_cpu(tx_start_bd->vlan));
+           tx_start_bd->bd_flags.as_bitfield,
+           le16_to_cpu(tx_start_bd->vlan_or_ethertype));
 
         if (xmit_type & XMIT_GSO) {
 
@@ -2023,28 +2074,14 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 if (unlikely(skb_headlen(skb) > hlen))
                         bd_prod = bnx2x_tx_split(bp, fp, tx_buf, &tx_start_bd,
                                                  hlen, bd_prod, ++nbd);
-
-                pbd->lso_mss = cpu_to_le16(skb_shinfo(skb)->gso_size);
-                pbd->tcp_send_seq = swab32(tcp_hdr(skb)->seq);
-                pbd->tcp_flags = pbd_tcp_flags(skb);
-
-                if (xmit_type & XMIT_GSO_V4) {
-                        pbd->ip_id = swab16(ip_hdr(skb)->id);
-                        pbd->tcp_pseudo_csum =
-                                swab16(~csum_tcpudp_magic(ip_hdr(skb)->saddr,
-                                                          ip_hdr(skb)->daddr,
-                                                          0, IPPROTO_TCP, 0));
-
-                } else
-                        pbd->tcp_pseudo_csum =
-                                swab16(~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
-                                                        &ipv6_hdr(skb)->daddr,
-                                                        0, IPPROTO_TCP, 0));
-
-                pbd->global_data |= ETH_TX_PARSE_BD_PSEUDO_CS_WITHOUT_LEN;
+                if (CHIP_IS_E2(bp))
+                        bnx2x_set_pbd_gso_e2(skb, pbd_e2, xmit_type);
+                else
+                        bnx2x_set_pbd_gso(skb, pbd_e1x, xmit_type);
         }
         tx_data_bd = (struct eth_tx_bd *)tx_start_bd;
 
+        /* Handle fragmented skb */
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 
@@ -2081,14 +2118,21 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (total_pkt_bd != NULL)
                 total_pkt_bd->total_pkt_bytes = pkt_size;
 
-        if (pbd)
+        if (pbd_e1x)
                 DP(NETIF_MSG_TX_QUEUED,
-                   "PBD @%p  ip_data %x  ip_hlen %u  ip_id %u  lso_mss %u"
+                   "PBD (E1X) @%p  ip_data %x  ip_hlen %u  ip_id %u  lso_mss %u"
                    "  tcp_flags %x  xsum %x  seq %u  hlen %u\n",
-                   pbd, pbd->global_data, pbd->ip_hlen, pbd->ip_id,
-                   pbd->lso_mss, pbd->tcp_flags, pbd->tcp_pseudo_csum,
-                   pbd->tcp_send_seq, le16_to_cpu(pbd->total_hlen));
-
+                   pbd_e1x, pbd_e1x->global_data, pbd_e1x->ip_hlen_w,
+                   pbd_e1x->ip_id, pbd_e1x->lso_mss, pbd_e1x->tcp_flags,
+                   pbd_e1x->tcp_pseudo_csum, pbd_e1x->tcp_send_seq,
+                    le16_to_cpu(pbd_e1x->total_hlen_w));
+        if (pbd_e2)
+                DP(NETIF_MSG_TX_QUEUED,
+                   "PBD (E2) @%p  dst %x %x %x src %x %x %x parsing_data %x\n",
+                   pbd_e2, pbd_e2->dst_mac_addr_hi, pbd_e2->dst_mac_addr_mid,
+                   pbd_e2->dst_mac_addr_lo, pbd_e2->src_mac_addr_hi,
+                   pbd_e2->src_mac_addr_mid, pbd_e2->src_mac_addr_lo,
+                   pbd_e2->parsing_data);
         DP(NETIF_MSG_TX_QUEUED, "doorbell: nbd %d  bd %u\n", nbd, bd_prod);
 
         /*
@@ -2102,7 +2146,8 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         fp->tx_db.data.prod += nbd;
         barrier();
-        DOORBELL(bp, fp->index, fp->tx_db.raw);
+
+        DOORBELL(bp, fp->cid, fp->tx_db.raw);
 
         mmiowb();
 
@@ -2124,6 +2169,7 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         return NETDEV_TX_OK;
 }
+
 /* called with rtnl_lock */
 int bnx2x_change_mac_addr(struct net_device *dev, void *p)
 {
@@ -2134,16 +2180,76 @@ int bnx2x_change_mac_addr(struct net_device *dev, void *p)
                 return -EINVAL;
 
         memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
-        if (netif_running(dev)) {
-                if (CHIP_IS_E1(bp))
-                        bnx2x_set_eth_mac_addr_e1(bp, 1);
-                else
-                        bnx2x_set_eth_mac_addr_e1h(bp, 1);
+        if (netif_running(dev))
+                bnx2x_set_eth_mac(bp, 1);
+
+        return 0;
+}
+
+
+int bnx2x_setup_irqs(struct bnx2x *bp)
+{
+        int rc = 0;
+        if (bp->flags & USING_MSIX_FLAG) {
+                rc = bnx2x_req_msix_irqs(bp);
+                if (rc)
+                        return rc;
+        } else {
+                bnx2x_ack_int(bp);
+                rc = bnx2x_req_irq(bp);
+                if (rc) {
+                        BNX2X_ERR("IRQ request failed  rc %d, aborting\n", rc);
+                        return rc;
+                }
+                if (bp->flags & USING_MSI_FLAG) {
+                        bp->dev->irq = bp->pdev->irq;
+                        netdev_info(bp->dev, "using MSI  IRQ %d\n",
+                               bp->pdev->irq);
+                }
         }
 
         return 0;
 }
 
+void bnx2x_free_mem_bp(struct bnx2x *bp)
+{
+        kfree(bp->fp);
+        kfree(bp->msix_table);
+        kfree(bp->ilt);
+}
+
+int __devinit bnx2x_alloc_mem_bp(struct bnx2x *bp)
+{
+        struct bnx2x_fastpath *fp;
+        struct msix_entry *tbl;
+        struct bnx2x_ilt *ilt;
+
+        /* fp array */
+        fp = kzalloc(L2_FP_COUNT(bp->l2_cid_count)*sizeof(*fp), GFP_KERNEL);
+        if (!fp)
+                goto alloc_err;
+        bp->fp = fp;
+
+        /* msix table */
+        tbl = kzalloc((bp->l2_cid_count + 1) * sizeof(*tbl),
+                                  GFP_KERNEL);
+        if (!tbl)
+                goto alloc_err;
+        bp->msix_table = tbl;
+
+        /* ilt */
+        ilt = kzalloc(sizeof(*ilt), GFP_KERNEL);
+        if (!ilt)
+                goto alloc_err;
+        bp->ilt = ilt;
+
+        return 0;
+alloc_err:
+        bnx2x_free_mem_bp(bp);
+        return -ENOMEM;
+
+}
+
 /* called with rtnl_lock */
 int bnx2x_change_mtu(struct net_device *dev, int new_mtu)
 {
@@ -2185,29 +2291,6 @@ void bnx2x_tx_timeout(struct net_device *dev)
         schedule_delayed_work(&bp->reset_task, 0);
 }
 
-#ifdef BCM_VLAN
-/* called with rtnl_lock */
-void bnx2x_vlan_rx_register(struct net_device *dev,
-                                   struct vlan_group *vlgrp)
-{
-        struct bnx2x *bp = netdev_priv(dev);
-
-        bp->vlgrp = vlgrp;
-
-        /* Set flags according to the required capabilities */
-        bp->flags &= ~(HW_VLAN_RX_FLAG | HW_VLAN_TX_FLAG);
-
-        if (dev->features & NETIF_F_HW_VLAN_TX)
-                bp->flags |= HW_VLAN_TX_FLAG;
-
-        if (dev->features & NETIF_F_HW_VLAN_RX)
-                bp->flags |= HW_VLAN_RX_FLAG;
-
-        if (netif_running(dev))
-                bnx2x_set_client_config(bp);
-}
-
-#endif
 int bnx2x_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
@@ -2268,6 +2351,8 @@ int bnx2x_resume(struct pci_dev *pdev)
         bnx2x_set_power_state(bp, PCI_D0);
         netif_device_attach(dev);
 
+        /* Since the chip was reset, clear the FW sequence number */
+        bp->fw_seq = 0;
         rc = bnx2x_nic_load(bp, LOAD_OPEN);
 
         rtnl_unlock();
diff --git a/drivers/net/bnx2x/bnx2x_cmn.h b/drivers/net/bnx2x/bnx2x_cmn.h
index d1e6a8c977d1..5bfe0ab1d2d4 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/bnx2x/bnx2x_cmn.h
@@ -23,6 +23,7 @@
 
 #include "bnx2x.h"
 
+extern int num_queues;
 
 /*********************** Interfaces ****************************
  *  Functions that need to be implemented by each driver version
@@ -63,6 +64,15 @@ u8 bnx2x_link_test(struct bnx2x *bp, u8 is_serdes);
 void bnx2x__link_status_update(struct bnx2x *bp);
 
 /**
+ * Report link status to upper layer
+ *
+ * @param bp
+ *
+ * @return int
+ */
+void bnx2x_link_report(struct bnx2x *bp);
+
+/**
  * MSI-X slowpath interrupt handler
  *
  * @param irq
@@ -107,6 +117,13 @@ void bnx2x_setup_cnic_irq_info(struct bnx2x *bp);
 void bnx2x_int_enable(struct bnx2x *bp);
 
 /**
+ * Disable HW interrupts.
+ *
+ * @param bp
+ */
+void bnx2x_int_disable(struct bnx2x *bp);
+
+/**
  * Disable interrupts. This function ensures that there are no
  * ISRs or SP DPCs (sp_task) are running after it returns.
  *
@@ -163,32 +180,35 @@ int bnx2x_alloc_mem(struct bnx2x *bp);
 void bnx2x_free_mem(struct bnx2x *bp);
 
 /**
- * Bring up a leading (the first) eth Client.
+ * Setup eth Client.
  *
  * @param bp
+ * @param fp
+ * @param is_leading
  *
  * @return int
  */
-int bnx2x_setup_leading(struct bnx2x *bp);
+int bnx2x_setup_client(struct bnx2x *bp, struct bnx2x_fastpath *fp,
+                       int is_leading);
 
 /**
- * Setup non-leading eth Client.
+ * Bring down an eth client.
  *
  * @param bp
- * @param fp
+ * @param p
  *
  * @return int
  */
-int bnx2x_setup_multi(struct bnx2x *bp, int index);
+int bnx2x_stop_fw_client(struct bnx2x *bp,
+                         struct bnx2x_client_ramrod_params *p);
 
 /**
- * Set number of quueus according to mode and number of available
- * msi-x vectors
+ * Set number of queues according to mode
  *
  * @param bp
  *
  */
-void bnx2x_set_num_queues_msix(struct bnx2x *bp);
+void bnx2x_set_num_queues(struct bnx2x *bp);
 
 /**
  * Cleanup chip internals:
@@ -223,21 +243,12 @@ int bnx2x_release_hw_lock(struct bnx2x *bp, u32 resource);
 
 /**
  * Configure eth MAC address in the HW according to the value in
- * netdev->dev_addr for 57711
- *
- * @param bp driver handle
- * @param set
- */
-void bnx2x_set_eth_mac_addr_e1h(struct bnx2x *bp, int set);
-
-/**
- * Configure eth MAC address in the HW according to the value in
- * netdev->dev_addr for 57710
+ * netdev->dev_addr.
  *
  * @param bp driver handle
  * @param set
  */
-void bnx2x_set_eth_mac_addr_e1(struct bnx2x *bp, int set);
+void bnx2x_set_eth_mac(struct bnx2x *bp, int set);
 
 #ifdef BCM_CNIC
 /**
@@ -257,18 +268,22 @@ int bnx2x_set_iscsi_eth_mac_addr(struct bnx2x *bp, int set);
  * Initialize status block in FW and HW
  *
  * @param bp driver handle
- * @param sb host_status_block
  * @param dma_addr_t mapping
  * @param int sb_id
+ * @param int vfid
+ * @param u8 vf_valid
+ * @param int fw_sb_id
+ * @param int igu_sb_id
  */
-void bnx2x_init_sb(struct bnx2x *bp, struct host_status_block *sb,
-                          dma_addr_t mapping, int sb_id);
+void bnx2x_init_sb(struct bnx2x *bp, dma_addr_t mapping, int vfid,
+                          u8 vf_valid, int fw_sb_id, int igu_sb_id);
 
 /**
- * Reconfigure FW/HW according to dev->flags rx mode
+ * Set MAC filtering configurations.
  *
- * @param dev net_device
+ * @remarks called with netif_tx_lock from dev_mcast.c
  *
+ * @param dev net_device
  */
 void bnx2x_set_rx_mode(struct net_device *dev);
 
@@ -290,34 +305,162 @@ void bnx2x_disable_close_the_gate(struct bnx2x *bp);
  * Perform statistics handling according to event
  *
  * @param bp driver handle
- * @param even tbnx2x_stats_event
+ * @param event bnx2x_stats_event
  */
 void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event);
 
 /**
- * Configures FW with client paramteres (like HW VLAN removal)
- * for each active client.
+ * Handle ramrods completion
+ *
+ * @param fp fastpath handle for the event
+ * @param rr_cqe eth_rx_cqe
+ */
+void bnx2x_sp_event(struct bnx2x_fastpath *fp, union eth_rx_cqe *rr_cqe);
+
+/**
+ * Init/halt function before/after sending
+ * CLIENT_SETUP/CFC_DEL for the first/last client.
  *
  * @param bp
+ *
+ * @return int
  */
-void bnx2x_set_client_config(struct bnx2x *bp);
+int bnx2x_func_start(struct bnx2x *bp);
+int bnx2x_func_stop(struct bnx2x *bp);
 
 /**
- * Handle sp events
+ * Prepare ILT configurations according to current driver
+ * parameters.
  *
- * @param fp fastpath handle for the event
- * @param rr_cqe eth_rx_cqe
+ * @param bp
  */
-void bnx2x_sp_event(struct bnx2x_fastpath *fp,  union eth_rx_cqe *rr_cqe);
+void bnx2x_ilt_set_info(struct bnx2x *bp);
 
+/**
+ * Set power state to the requested value. Currently only D0 and
+ * D3hot are supported.
+ *
+ * @param bp
+ * @param state D0 or D3hot
+ *
+ * @return int
+ */
+int bnx2x_set_power_state(struct bnx2x *bp, pci_power_t state);
+
+/* dev_close main block */
+int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode);
+
+/* dev_open main block */
+int bnx2x_nic_load(struct bnx2x *bp, int load_mode);
+
+/* hard_xmit callback */
+netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev);
+
+int bnx2x_change_mac_addr(struct net_device *dev, void *p);
+
+/* NAPI poll Rx part */
+int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget);
+
+/* NAPI poll Tx part */
+int bnx2x_tx_int(struct bnx2x_fastpath *fp);
+
+/* suspend/resume callbacks */
+int bnx2x_suspend(struct pci_dev *pdev, pm_message_t state);
+int bnx2x_resume(struct pci_dev *pdev);
+
+/* Release IRQ vectors */
+void bnx2x_free_irq(struct bnx2x *bp);
+
+void bnx2x_init_rx_rings(struct bnx2x *bp);
+void bnx2x_free_skbs(struct bnx2x *bp);
+void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw);
+void bnx2x_netif_start(struct bnx2x *bp);
+
+/**
+ * Fill msix_table, request vectors, update num_queues according
+ * to number of available vectors
+ *
+ * @param bp
+ *
+ * @return int
+ */
+int bnx2x_enable_msix(struct bnx2x *bp);
+
+/**
+ * Request msi mode from OS, updated internals accordingly
+ *
+ * @param bp
+ *
+ * @return int
+ */
+int bnx2x_enable_msi(struct bnx2x *bp);
+
+/**
+ * Request IRQ vectors from OS.
+ *
+ * @param bp
+ *
+ * @return int
+ */
+int bnx2x_setup_irqs(struct bnx2x *bp);
+/**
+ * NAPI callback
+ *
+ * @param napi
+ * @param budget
+ *
+ * @return int
+ */
+int bnx2x_poll(struct napi_struct *napi, int budget);
+
+/**
+ * Allocate/release memories outsize main driver structure
+ *
+ * @param bp
+ *
+ * @return int
+ */
+int __devinit bnx2x_alloc_mem_bp(struct bnx2x *bp);
+void bnx2x_free_mem_bp(struct bnx2x *bp);
+
+/**
+ * Change mtu netdev callback
+ *
+ * @param dev
+ * @param new_mtu
+ *
+ * @return int
+ */
+int bnx2x_change_mtu(struct net_device *dev, int new_mtu);
+
+/**
+ * tx timeout netdev callback
+ *
+ * @param dev
+ * @param new_mtu
+ *
+ * @return int
+ */
+void bnx2x_tx_timeout(struct net_device *dev);
+
+#ifdef BCM_VLAN
+/**
+ * vlan rx register netdev callback
+ *
+ * @param dev
+ * @param new_mtu
+ *
+ * @return int
+ */
+void bnx2x_vlan_rx_register(struct net_device *dev,
+                                   struct vlan_group *vlgrp);
+
+#endif
 
 static inline void bnx2x_update_fpsb_idx(struct bnx2x_fastpath *fp)
 {
-        struct host_status_block *fpsb = fp->status_blk;
-
         barrier(); /* status block is written to by the chip */
-        fp->fp_c_idx = fpsb->c_status_block.status_block_index;
-        fp->fp_u_idx = fpsb->u_status_block.status_block_index;
+        fp->fp_hc_idx = fp->sb_running_index[SM_RX_ID];
 }
 
 static inline void bnx2x_update_rx_prod(struct bnx2x *bp,
@@ -344,8 +487,8 @@ static inline void bnx2x_update_rx_prod(struct bnx2x *bp,
         wmb();
 
         for (i = 0; i < sizeof(struct ustorm_eth_rx_producers)/4; i++)
-                REG_WR(bp, BAR_USTRORM_INTMEM +
-                       USTORM_RX_PRODS_OFFSET(BP_PORT(bp), fp->cl_id) + i*4,
+                REG_WR(bp,
+                       BAR_USTRORM_INTMEM + fp->ustorm_rx_prods_offset + i*4,
                        ((u32 *)&rx_prods)[i]);
 
         mmiowb(); /* keep prod updates ordered */
@@ -355,10 +498,77 @@ static inline void bnx2x_update_rx_prod(struct bnx2x *bp,
            fp->index, bd_prod, rx_comp_prod, rx_sge_prod);
 }
 
+static inline void bnx2x_igu_ack_sb_gen(struct bnx2x *bp, u8 igu_sb_id,
+                                        u8 segment, u16 index, u8 op,
+                                        u8 update, u32 igu_addr)
+{
+        struct igu_regular cmd_data = {0};
+
+        cmd_data.sb_id_and_flags =
+                        ((index << IGU_REGULAR_SB_INDEX_SHIFT) |
+                         (segment << IGU_REGULAR_SEGMENT_ACCESS_SHIFT) |
+                         (update << IGU_REGULAR_BUPDATE_SHIFT) |
+                         (op << IGU_REGULAR_ENABLE_INT_SHIFT));
 
+        DP(NETIF_MSG_HW, "write 0x%08x to IGU addr 0x%x\n",
+           cmd_data.sb_id_and_flags, igu_addr);
+        REG_WR(bp, igu_addr, cmd_data.sb_id_and_flags);
+
+        /* Make sure that ACK is written */
+        mmiowb();
+        barrier();
+}
 
-static inline void bnx2x_ack_sb(struct bnx2x *bp, u8 sb_id,
-                                u8 storm, u16 index, u8 op, u8 update)
+static inline void bnx2x_igu_clear_sb_gen(struct bnx2x *bp,
+                                          u8 idu_sb_id, bool is_Pf)
+{
+        u32 data, ctl, cnt = 100;
+        u32 igu_addr_data = IGU_REG_COMMAND_REG_32LSB_DATA;
+        u32 igu_addr_ctl = IGU_REG_COMMAND_REG_CTRL;
+        u32 igu_addr_ack = IGU_REG_CSTORM_TYPE_0_SB_CLEANUP + (idu_sb_id/32)*4;
+        u32 sb_bit =  1 << (idu_sb_id%32);
+        u32 func_encode = BP_FUNC(bp) |
+                        ((is_Pf == true ? 1 : 0) << IGU_FID_ENCODE_IS_PF_SHIFT);
+        u32 addr_encode = IGU_CMD_E2_PROD_UPD_BASE + idu_sb_id;
+
+        /* Not supported in BC mode */
+        if (CHIP_INT_MODE_IS_BC(bp))
+                return;
+
+        data = (IGU_USE_REGISTER_cstorm_type_0_sb_cleanup
+                        << IGU_REGULAR_CLEANUP_TYPE_SHIFT)      |
+                IGU_REGULAR_CLEANUP_SET                         |
+                IGU_REGULAR_BCLEANUP;
+
+        ctl = addr_encode << IGU_CTRL_REG_ADDRESS_SHIFT         |
+              func_encode << IGU_CTRL_REG_FID_SHIFT             |
+              IGU_CTRL_CMD_TYPE_WR << IGU_CTRL_REG_TYPE_SHIFT;
+
+        DP(NETIF_MSG_HW, "write 0x%08x to IGU(via GRC) addr 0x%x\n",
+                         data, igu_addr_data);
+        REG_WR(bp, igu_addr_data, data);
+        mmiowb();
+        barrier();
+        DP(NETIF_MSG_HW, "write 0x%08x to IGU(via GRC) addr 0x%x\n",
+                          ctl, igu_addr_ctl);
+        REG_WR(bp, igu_addr_ctl, ctl);
+        mmiowb();
+        barrier();
+
+        /* wait for clean up to finish */
+        while (!(REG_RD(bp, igu_addr_ack) & sb_bit) && --cnt)
+                msleep(20);
+
+
+        if (!(REG_RD(bp, igu_addr_ack) & sb_bit)) {
+                DP(NETIF_MSG_HW, "Unable to finish IGU cleanup: "
+                          "idu_sb_id %d offset %d bit %d (cnt %d)\n",
+                          idu_sb_id, idu_sb_id/32, idu_sb_id%32, cnt);
+        }
+}
+
+static inline void bnx2x_hc_ack_sb(struct bnx2x *bp, u8 sb_id,
+                                   u8 storm, u16 index, u8 op, u8 update)
 {
         u32 hc_addr = (HC_REG_COMMAND_REG + BP_PORT(bp)*32 +
                        COMMAND_REG_INT_ACK);
@@ -379,7 +589,37 @@ static inline void bnx2x_ack_sb(struct bnx2x *bp, u8 sb_id,
         mmiowb();
         barrier();
 }
-static inline u16 bnx2x_ack_int(struct bnx2x *bp)
+
+static inline void bnx2x_igu_ack_sb(struct bnx2x *bp, u8 igu_sb_id, u8 segment,
+                      u16 index, u8 op, u8 update)
+{
+        u32 igu_addr = BAR_IGU_INTMEM + (IGU_CMD_INT_ACK_BASE + igu_sb_id)*8;
+
+        bnx2x_igu_ack_sb_gen(bp, igu_sb_id, segment, index, op, update,
+                             igu_addr);
+}
+
+static inline void bnx2x_ack_sb(struct bnx2x *bp, u8 igu_sb_id, u8 storm,
+                                u16 index, u8 op, u8 update)
+{
+        if (bp->common.int_block == INT_BLOCK_HC)
+                bnx2x_hc_ack_sb(bp, igu_sb_id, storm, index, op, update);
+        else {
+                u8 segment;
+
+                if (CHIP_INT_MODE_IS_BC(bp))
+                        segment = storm;
+                else if (igu_sb_id != bp->igu_dsb_id)
+                        segment = IGU_SEG_ACCESS_DEF;
+                else if (storm == ATTENTION_ID)
+                        segment = IGU_SEG_ACCESS_ATTN;
+                else
+                        segment = IGU_SEG_ACCESS_DEF;
+                bnx2x_igu_ack_sb(bp, igu_sb_id, segment, index, op, update);
+        }
+}
+
+static inline u16 bnx2x_hc_ack_int(struct bnx2x *bp)
 {
         u32 hc_addr = (HC_REG_COMMAND_REG + BP_PORT(bp)*32 +
                        COMMAND_REG_SIMD_MASK);
@@ -388,18 +628,36 @@ static inline u16 bnx2x_ack_int(struct bnx2x *bp)
         DP(BNX2X_MSG_OFF, "read 0x%08x from HC addr 0x%x\n",
            result, hc_addr);
 
+        barrier();
         return result;
 }
 
-/*
- * fast path service functions
- */
+static inline u16 bnx2x_igu_ack_int(struct bnx2x *bp)
+{
+        u32 igu_addr = (BAR_IGU_INTMEM + IGU_REG_SISR_MDPC_WMASK_LSB_UPPER*8);
+        u32 result = REG_RD(bp, igu_addr);
+
+        DP(NETIF_MSG_HW, "read 0x%08x from IGU addr 0x%x\n",
+           result, igu_addr);
+
+        barrier();
+        return result;
+}
+
+static inline u16 bnx2x_ack_int(struct bnx2x *bp)
+{
+        barrier();
+        if (bp->common.int_block == INT_BLOCK_HC)
+                return bnx2x_hc_ack_int(bp);
+        else
+                return bnx2x_igu_ack_int(bp);
+}
 
 static inline int bnx2x_has_tx_work_unload(struct bnx2x_fastpath *fp)
 {
         /* Tell compiler that consumer and producer can change */
         barrier();
-        return (fp->tx_pkt_prod != fp->tx_pkt_cons);
+        return fp->tx_pkt_prod != fp->tx_pkt_cons;
 }
 
 static inline u16 bnx2x_tx_avail(struct bnx2x_fastpath *fp)
@@ -434,6 +692,29 @@ static inline int bnx2x_has_tx_work(struct bnx2x_fastpath *fp)
         return hw_cons != fp->tx_pkt_cons;
 }
 
+static inline int bnx2x_has_rx_work(struct bnx2x_fastpath *fp)
+{
+        u16 rx_cons_sb;
+
+        /* Tell compiler that status block fields can change */
+        barrier();
+        rx_cons_sb = le16_to_cpu(*fp->rx_cons_sb);
+        if ((rx_cons_sb & MAX_RCQ_DESC_CNT) == MAX_RCQ_DESC_CNT)
+                rx_cons_sb++;
+        return (fp->rx_comp_cons != rx_cons_sb);
+}
+
+/**
+ * disables tx from stack point of view
+ *
+ * @param bp
+ */
+static inline void bnx2x_tx_disable(struct bnx2x *bp)
+{
+        netif_tx_disable(bp->dev);
+        netif_carrier_off(bp->dev);
+}
+
 static inline void bnx2x_free_rx_sge(struct bnx2x *bp,
                                      struct bnx2x_fastpath *fp, u16 index)
 {
@@ -446,7 +727,7 @@ static inline void bnx2x_free_rx_sge(struct bnx2x *bp,
                 return;
 
         dma_unmap_page(&bp->pdev->dev, dma_unmap_addr(sw_buf, mapping),
-                       SGE_PAGE_SIZE*PAGES_PER_SGE, PCI_DMA_FROMDEVICE);
+                       SGE_PAGE_SIZE*PAGES_PER_SGE, DMA_FROM_DEVICE);
         __free_pages(page, PAGES_PER_SGE_SHIFT);
 
         sw_buf->page = NULL;
@@ -454,13 +735,67 @@ static inline void bnx2x_free_rx_sge(struct bnx2x *bp,
         sge->addr_lo = 0;
 }
 
-static inline void bnx2x_free_rx_sge_range(struct bnx2x *bp,
-                                           struct bnx2x_fastpath *fp, int last)
+static inline void bnx2x_add_all_napi(struct bnx2x *bp)
 {
         int i;
 
-        for (i = 0; i < last; i++)
-                bnx2x_free_rx_sge(bp, fp, i);
+        /* Add NAPI objects */
+        for_each_queue(bp, i)
+                netif_napi_add(bp->dev, &bnx2x_fp(bp, i, napi),
+                               bnx2x_poll, BNX2X_NAPI_WEIGHT);
+}
+
+static inline void bnx2x_del_all_napi(struct bnx2x *bp)
+{
+        int i;
+
+        for_each_queue(bp, i)
+                netif_napi_del(&bnx2x_fp(bp, i, napi));
+}
+
+static inline void bnx2x_disable_msi(struct bnx2x *bp)
+{
+        if (bp->flags & USING_MSIX_FLAG) {
+                pci_disable_msix(bp->pdev);
+                bp->flags &= ~USING_MSIX_FLAG;
+        } else if (bp->flags & USING_MSI_FLAG) {
+                pci_disable_msi(bp->pdev);
+                bp->flags &= ~USING_MSI_FLAG;
+        }
+}
+
+static inline int bnx2x_calc_num_queues(struct bnx2x *bp)
+{
+        return  num_queues ?
+                 min_t(int, num_queues, BNX2X_MAX_QUEUES(bp)) :
+                 min_t(int, num_online_cpus(), BNX2X_MAX_QUEUES(bp));
+}
+
+static inline void bnx2x_clear_sge_mask_next_elems(struct bnx2x_fastpath *fp)
+{
+        int i, j;
+
+        for (i = 1; i <= NUM_RX_SGE_PAGES; i++) {
+                int idx = RX_SGE_CNT * i - 1;
+
+                for (j = 0; j < 2; j++) {
+                        SGE_MASK_CLEAR_BIT(fp, idx);
+                        idx--;
+                }
+        }
+}
+
+static inline void bnx2x_init_sge_ring_bit_mask(struct bnx2x_fastpath *fp)
+{
+        /* Set the mask to all 1-s: it's faster to compare to 0 than to 0xf-s */
+        memset(fp->sge_mask, 0xff,
+               (NUM_RX_SGE >> RX_SGE_MASK_ELEM_SHIFT)*sizeof(u64));
+
+        /* Clear the two last indices in the page to 1:
+           these are the indices that correspond to the "next" element,
+           hence will never be indicated and should be removed from
+           the calculations. */
+        bnx2x_clear_sge_mask_next_elems(fp);
 }
 
 static inline int bnx2x_alloc_rx_sge(struct bnx2x *bp,
@@ -489,6 +824,7 @@ static inline int bnx2x_alloc_rx_sge(struct bnx2x *bp,
 
         return 0;
 }
+
 static inline int bnx2x_alloc_rx_skb(struct bnx2x *bp,
                                      struct bnx2x_fastpath *fp, u16 index)
 {
@@ -523,7 +859,7 @@ static inline int bnx2x_alloc_rx_skb(struct bnx2x *bp,
  * so there is no need to check for dma_mapping_error().
  */
 static inline void bnx2x_reuse_rx_skb(struct bnx2x_fastpath *fp,
-                               struct sk_buff *skb, u16 cons, u16 prod)
+                                      u16 cons, u16 prod)
 {
         struct bnx2x *bp = fp->bp;
         struct sw_rx_bd *cons_rx_buf = &fp->rx_buf_ring[cons];
@@ -541,32 +877,15 @@ static inline void bnx2x_reuse_rx_skb(struct bnx2x_fastpath *fp,
         *prod_bd = *cons_bd;
 }
 
-static inline void bnx2x_clear_sge_mask_next_elems(struct bnx2x_fastpath *fp)
+static inline void bnx2x_free_rx_sge_range(struct bnx2x *bp,
+                                           struct bnx2x_fastpath *fp, int last)
 {
-        int i, j;
-
-        for (i = 1; i <= NUM_RX_SGE_PAGES; i++) {
-                int idx = RX_SGE_CNT * i - 1;
+        int i;
 
-                for (j = 0; j < 2; j++) {
-                        SGE_MASK_CLEAR_BIT(fp, idx);
-                        idx--;
-                }
-        }
+        for (i = 0; i < last; i++)
+                bnx2x_free_rx_sge(bp, fp, i);
 }
 
-static inline void bnx2x_init_sge_ring_bit_mask(struct bnx2x_fastpath *fp)
-{
-        /* Set the mask to all 1-s: it's faster to compare to 0 than to 0xf-s */
-        memset(fp->sge_mask, 0xff,
-               (NUM_RX_SGE >> RX_SGE_MASK_ELEM_SHIFT)*sizeof(u64));
-
-        /* Clear the two last indices in the page to 1:
-           these are the indices that correspond to the "next" element,
-           hence will never be indicated and should be removed from
-           the calculations. */
-        bnx2x_clear_sge_mask_next_elems(fp);
-}
 static inline void bnx2x_free_tpa_pool(struct bnx2x *bp,
                                        struct bnx2x_fastpath *fp, int last)
 {
@@ -592,7 +911,7 @@ static inline void bnx2x_free_tpa_pool(struct bnx2x *bp,
 }
 
 
-static inline void bnx2x_init_tx_ring(struct bnx2x *bp)
+static inline void bnx2x_init_tx_rings(struct bnx2x *bp)
 {
         int i, j;
 
@@ -611,7 +930,7 @@ static inline void bnx2x_init_tx_ring(struct bnx2x *bp)
                                             BCM_PAGE_SIZE*(i % NUM_TX_RINGS)));
                 }
 
-                fp->tx_db.data.header.header = DOORBELL_HDR_DB_TYPE;
+                SET_FLAG(fp->tx_db.data.header.header, DOORBELL_HDR_DB_TYPE, 1);
                 fp->tx_db.data.zero_fill1 = 0;
                 fp->tx_db.data.prod = 0;
 
@@ -619,44 +938,98 @@ static inline void bnx2x_init_tx_ring(struct bnx2x *bp)
                 fp->tx_pkt_cons = 0;
                 fp->tx_bd_prod = 0;
                 fp->tx_bd_cons = 0;
-                fp->tx_cons_sb = BNX2X_TX_SB_INDEX;
                 fp->tx_pkt = 0;
         }
 }
-static inline int bnx2x_has_rx_work(struct bnx2x_fastpath *fp)
+
+static inline void bnx2x_set_next_page_rx_bd(struct bnx2x_fastpath *fp)
 {
-        u16 rx_cons_sb;
+        int i;
 
-        /* Tell compiler that status block fields can change */
-        barrier();
-        rx_cons_sb = le16_to_cpu(*fp->rx_cons_sb);
-        if ((rx_cons_sb & MAX_RCQ_DESC_CNT) == MAX_RCQ_DESC_CNT)
-                rx_cons_sb++;
-        return (fp->rx_comp_cons != rx_cons_sb);
+        for (i = 1; i <= NUM_RX_RINGS; i++) {
+                struct eth_rx_bd *rx_bd;
+
+                rx_bd = &fp->rx_desc_ring[RX_DESC_CNT * i - 2];
+                rx_bd->addr_hi =
+                        cpu_to_le32(U64_HI(fp->rx_desc_mapping +
+                                    BCM_PAGE_SIZE*(i % NUM_RX_RINGS)));
+                rx_bd->addr_lo =
+                        cpu_to_le32(U64_LO(fp->rx_desc_mapping +
+                                    BCM_PAGE_SIZE*(i % NUM_RX_RINGS)));
+        }
+}
+
+static inline void bnx2x_set_next_page_sgl(struct bnx2x_fastpath *fp)
+{
+        int i;
+
+        for (i = 1; i <= NUM_RX_SGE_PAGES; i++) {
+                struct eth_rx_sge *sge;
+
+                sge = &fp->rx_sge_ring[RX_SGE_CNT * i - 2];
+                sge->addr_hi =
+                        cpu_to_le32(U64_HI(fp->rx_sge_mapping +
+                        BCM_PAGE_SIZE*(i % NUM_RX_SGE_PAGES)));
+
+                sge->addr_lo =
+                        cpu_to_le32(U64_LO(fp->rx_sge_mapping +
+                        BCM_PAGE_SIZE*(i % NUM_RX_SGE_PAGES)));
+        }
+}
+
+static inline void bnx2x_set_next_page_rx_cq(struct bnx2x_fastpath *fp)
+{
+        int i;
+        for (i = 1; i <= NUM_RCQ_RINGS; i++) {
+                struct eth_rx_cqe_next_page *nextpg;
+
+                nextpg = (struct eth_rx_cqe_next_page *)
+                        &fp->rx_comp_ring[RCQ_DESC_CNT * i - 1];
+                nextpg->addr_hi =
+                        cpu_to_le32(U64_HI(fp->rx_comp_mapping +
+                                   BCM_PAGE_SIZE*(i % NUM_RCQ_RINGS)));
+                nextpg->addr_lo =
+                        cpu_to_le32(U64_LO(fp->rx_comp_mapping +
+                                   BCM_PAGE_SIZE*(i % NUM_RCQ_RINGS)));
+        }
+}
+
+
+
+static inline void __storm_memset_struct(struct bnx2x *bp,
+                                         u32 addr, size_t size, u32 *data)
+{
+        int i;
+        for (i = 0; i < size/4; i++)
+                REG_WR(bp, addr + (i * 4), data[i]);
+}
+
+static inline void storm_memset_mac_filters(struct bnx2x *bp,
+                        struct tstorm_eth_mac_filter_config *mac_filters,
+                        u16 abs_fid)
+{
+        size_t size = sizeof(struct tstorm_eth_mac_filter_config);
+
+        u32 addr = BAR_TSTRORM_INTMEM +
+                        TSTORM_MAC_FILTER_CONFIG_OFFSET(abs_fid);
+
+        __storm_memset_struct(bp, addr, size, (u32 *)mac_filters);
+}
+
+static inline void storm_memset_cmng(struct bnx2x *bp,
+                                struct cmng_struct_per_port *cmng,
+                                u8 port)
+{
+        size_t size = sizeof(struct cmng_struct_per_port);
+
+        u32 addr = BAR_XSTRORM_INTMEM +
+                        XSTORM_CMNG_PER_PORT_VARS_OFFSET(port);
+
+        __storm_memset_struct(bp, addr, size, (u32 *)cmng);
 }
 
 /* HW Lock for shared dual port PHYs */
 void bnx2x_acquire_phy_lock(struct bnx2x *bp);
 void bnx2x_release_phy_lock(struct bnx2x *bp);
 
-void bnx2x_link_report(struct bnx2x *bp);
-int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget);
-int bnx2x_tx_int(struct bnx2x_fastpath *fp);
-void bnx2x_init_rx_rings(struct bnx2x *bp);
-netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev);
-
-int bnx2x_change_mac_addr(struct net_device *dev, void *p);
-void bnx2x_tx_timeout(struct net_device *dev);
-void bnx2x_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp);
-void bnx2x_netif_start(struct bnx2x *bp);
-void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw);
-void bnx2x_free_irq(struct bnx2x *bp, bool disable_only);
-int bnx2x_suspend(struct pci_dev *pdev, pm_message_t state);
-int bnx2x_resume(struct pci_dev *pdev);
-void bnx2x_free_skbs(struct bnx2x *bp);
-int bnx2x_change_mtu(struct net_device *dev, int new_mtu);
-int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode);
-int bnx2x_nic_load(struct bnx2x *bp, int load_mode);
-int bnx2x_set_power_state(struct bnx2x *bp, pci_power_t state);
-
 #endif /* BNX2X_CMN_H */
diff --git a/drivers/net/bnx2x/bnx2x_dump.h b/drivers/net/bnx2x/bnx2x_dump.h
index 3bb9a91bb3f7..dc18c25ca9e5 100644
--- a/drivers/net/bnx2x/bnx2x_dump.h
+++ b/drivers/net/bnx2x/bnx2x_dump.h
@@ -31,14 +31,24 @@ struct dump_sign {
 
 #define RI_E1                           0x1
 #define RI_E1H                          0x2
+#define RI_E2                   0x4
 #define RI_ONLINE                       0x100
-
+#define RI_PATH0_DUMP           0x200
+#define RI_PATH1_DUMP           0x400
 #define RI_E1_OFFLINE                   (RI_E1)
 #define RI_E1_ONLINE                    (RI_E1 | RI_ONLINE)
 #define RI_E1H_OFFLINE                  (RI_E1H)
 #define RI_E1H_ONLINE                   (RI_E1H | RI_ONLINE)
-#define RI_ALL_OFFLINE                  (RI_E1 | RI_E1H)
-#define RI_ALL_ONLINE                   (RI_E1 | RI_E1H | RI_ONLINE)
+#define RI_E2_OFFLINE                   (RI_E2)
+#define RI_E2_ONLINE                    (RI_E2 | RI_ONLINE)
+#define RI_E1E1H_OFFLINE                (RI_E1 | RI_E1H)
+#define RI_E1E1H_ONLINE                 (RI_E1 | RI_E1H | RI_ONLINE)
+#define RI_E1HE2_OFFLINE                (RI_E2 | RI_E1H)
+#define RI_E1HE2_ONLINE                 (RI_E2 | RI_E1H | RI_ONLINE)
+#define RI_E1E2_OFFLINE                 (RI_E2 | RI_E1)
+#define RI_E1E2_ONLINE                  (RI_E2 | RI_E1 | RI_ONLINE)
+#define RI_ALL_OFFLINE                  (RI_E1 | RI_E1H | RI_E2)
+#define RI_ALL_ONLINE                   (RI_E1 | RI_E1H | RI_E2 | RI_ONLINE)
 
 #define MAX_TIMER_PENDING               200
 #define TIMER_SCAN_DONT_CARE            0xFF
@@ -513,6 +523,12 @@ static const struct wreg_addr wreg_addrs_e1h[WREGS_COUNT_E1H] = {
         { 0x1b0c00, 256, 2, read_reg_e1h_0, RI_E1H_OFFLINE }
 };
 
+#define WREGS_COUNT_E2                  1
+static const u32 read_reg_e2_0[] = { 0x1b1040, 0x1b1000 };
+
+static const struct wreg_addr wreg_addrs_e2[WREGS_COUNT_E2] = {
+        { 0x1b0c00, 128, 2, read_reg_e2_0, RI_E2_OFFLINE }
+};
 
 static const struct dump_sign dump_sign_all = { 0x49aa93ee, 0x40835, 0x22 };
 
@@ -531,4 +547,17 @@ static const u32 timer_scan_regs_e1h[TIMER_REGS_COUNT_E1H] =
         { 0x1640d0, 0x1640d4 };
 
 
+#define PAGE_MODE_VALUES_E2 2
+
+#define PAGE_READ_REGS_E2 1
+
+#define PAGE_WRITE_REGS_E2 1
+
+static const u32 page_vals_e2[PAGE_MODE_VALUES_E2] = { 0, 128 };
+
+static const u32 page_write_regs_e2[PAGE_WRITE_REGS_E2] = { 328476 };
+
+static const struct reg_addr page_read_regs_e2[PAGE_READ_REGS_E2] = {
+        { 0x58000, 4608, RI_E2_ONLINE } };
+
 #endif /* BNX2X_DUMP_H */
diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
index d9748e97fad3..daefef618ef7 100644
--- a/drivers/net/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/bnx2x/bnx2x_ethtool.c
@@ -25,7 +25,6 @@
 #include "bnx2x_cmn.h"
 #include "bnx2x_dump.h"
 
-
 static int bnx2x_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
         struct bnx2x *bp = netdev_priv(dev);
@@ -41,19 +40,19 @@ static int bnx2x_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
             (bp->link_vars.link_up)) {
                 cmd->speed = bp->link_vars.line_speed;
                 cmd->duplex = bp->link_vars.duplex;
-                if (IS_E1HMF(bp)) {
-                        u16 vn_max_rate;
-
-                        vn_max_rate =
-                                ((bp->mf_config & FUNC_MF_CFG_MAX_BW_MASK) >>
-                                FUNC_MF_CFG_MAX_BW_SHIFT) * 100;
-                        if (vn_max_rate < cmd->speed)
-                                cmd->speed = vn_max_rate;
-                }
         } else {
+
                 cmd->speed = bp->link_params.req_line_speed[cfg_idx];
                 cmd->duplex = bp->link_params.req_duplex[cfg_idx];
         }
+        if (IS_MF(bp)) {
+                u16 vn_max_rate = ((bp->mf_config[BP_VN(bp)] &
+                        FUNC_MF_CFG_MAX_BW_MASK) >> FUNC_MF_CFG_MAX_BW_SHIFT) *
+                        100;
+
+                if (vn_max_rate < cmd->speed)
+                        cmd->speed = vn_max_rate;
+        }
 
         if (bp->port.supported[cfg_idx] & SUPPORTED_TP)
                 cmd->port = PORT_TP;
@@ -89,7 +88,7 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
         struct bnx2x *bp = netdev_priv(dev);
         u32 advertising, cfg_idx, old_multi_phy_config, new_multi_phy_config;
 
-        if (IS_E1HMF(bp))
+        if (IS_MF(bp))
                 return 0;
 
         DP(NETIF_MSG_LINK, "ethtool_cmd: cmd %d\n"
@@ -298,6 +297,7 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 
 #define IS_E1_ONLINE(info)      (((info) & RI_E1_ONLINE) == RI_E1_ONLINE)
 #define IS_E1H_ONLINE(info)     (((info) & RI_E1H_ONLINE) == RI_E1H_ONLINE)
+#define IS_E2_ONLINE(info)      (((info) & RI_E2_ONLINE) == RI_E2_ONLINE)
 
 static int bnx2x_get_regs_len(struct net_device *dev)
 {
@@ -315,7 +315,7 @@ static int bnx2x_get_regs_len(struct net_device *dev)
                                 regdump_len += wreg_addrs_e1[i].size *
                                         (1 + wreg_addrs_e1[i].read_regs_count);
 
-        } else { /* E1H */
+        } else if (CHIP_IS_E1H(bp)) {
                 for (i = 0; i < REGS_COUNT; i++)
                         if (IS_E1H_ONLINE(reg_addrs[i].info))
                                 regdump_len += reg_addrs[i].size;
@@ -324,6 +324,15 @@ static int bnx2x_get_regs_len(struct net_device *dev)
                         if (IS_E1H_ONLINE(wreg_addrs_e1h[i].info))
                                 regdump_len += wreg_addrs_e1h[i].size *
                                         (1 + wreg_addrs_e1h[i].read_regs_count);
+        } else if (CHIP_IS_E2(bp)) {
+                for (i = 0; i < REGS_COUNT; i++)
+                        if (IS_E2_ONLINE(reg_addrs[i].info))
+                                regdump_len += reg_addrs[i].size;
+
+                for (i = 0; i < WREGS_COUNT_E2; i++)
+                        if (IS_E2_ONLINE(wreg_addrs_e2[i].info))
+                                regdump_len += wreg_addrs_e2[i].size *
+                                        (1 + wreg_addrs_e2[i].read_regs_count);
         }
         regdump_len *= 4;
         regdump_len += sizeof(struct dump_hdr);
@@ -331,6 +340,23 @@ static int bnx2x_get_regs_len(struct net_device *dev)
         return regdump_len;
 }
 
+static inline void bnx2x_read_pages_regs_e2(struct bnx2x *bp, u32 *p)
+{
+        u32 i, j, k, n;
+
+        for (i = 0; i < PAGE_MODE_VALUES_E2; i++) {
+                for (j = 0; j < PAGE_WRITE_REGS_E2; j++) {
+                        REG_WR(bp, page_write_regs_e2[j], page_vals_e2[i]);
+                        for (k = 0; k < PAGE_READ_REGS_E2; k++)
+                                if (IS_E2_ONLINE(page_read_regs_e2[k].info))
+                                        for (n = 0; n <
+                                              page_read_regs_e2[k].size; n++)
+                                                *p++ = REG_RD(bp,
+                                        page_read_regs_e2[k].addr + n*4);
+                }
+        }
+}
+
 static void bnx2x_get_regs(struct net_device *dev,
                            struct ethtool_regs *regs, void *_p)
 {
@@ -350,7 +376,14 @@ static void bnx2x_get_regs(struct net_device *dev,
         dump_hdr.tstorm_waitp = REG_RD(bp, TSTORM_WAITP_ADDR);
         dump_hdr.ustorm_waitp = REG_RD(bp, USTORM_WAITP_ADDR);
         dump_hdr.cstorm_waitp = REG_RD(bp, CSTORM_WAITP_ADDR);
-        dump_hdr.info = CHIP_IS_E1(bp) ? RI_E1_ONLINE : RI_E1H_ONLINE;
+
+        if (CHIP_IS_E1(bp))
+                dump_hdr.info = RI_E1_ONLINE;
+        else if (CHIP_IS_E1H(bp))
+                dump_hdr.info = RI_E1H_ONLINE;
+        else if (CHIP_IS_E2(bp))
+                dump_hdr.info = RI_E2_ONLINE |
+                (BP_PATH(bp) ? RI_PATH1_DUMP : RI_PATH0_DUMP);
 
         memcpy(p, &dump_hdr, sizeof(struct dump_hdr));
         p += dump_hdr.hdr_size + 1;
@@ -362,16 +395,25 @@ static void bnx2x_get_regs(struct net_device *dev,
                                         *p++ = REG_RD(bp,
                                                       reg_addrs[i].addr + j*4);
 
-        } else { /* E1H */
+        } else if (CHIP_IS_E1H(bp)) {
                 for (i = 0; i < REGS_COUNT; i++)
                         if (IS_E1H_ONLINE(reg_addrs[i].info))
                                 for (j = 0; j < reg_addrs[i].size; j++)
                                         *p++ = REG_RD(bp,
                                                       reg_addrs[i].addr + j*4);
+
+        } else if (CHIP_IS_E2(bp)) {
+                for (i = 0; i < REGS_COUNT; i++)
+                        if (IS_E2_ONLINE(reg_addrs[i].info))
+                                for (j = 0; j < reg_addrs[i].size; j++)
+                                        *p++ = REG_RD(bp,
+                                              reg_addrs[i].addr + j*4);
+
+                bnx2x_read_pages_regs_e2(bp, p);
         }
 }
 
-#define PHY_FW_VER_LEN                  10
+#define PHY_FW_VER_LEN                  20
 
 static void bnx2x_get_drvinfo(struct net_device *dev,
                               struct ethtool_drvinfo *info)
@@ -474,7 +516,7 @@ static u32 bnx2x_get_link(struct net_device *dev)
 {
         struct bnx2x *bp = netdev_priv(dev);
 
-        if (bp->flags & MF_FUNC_DIS)
+        if (bp->flags & MF_FUNC_DIS || (bp->state != BNX2X_STATE_OPEN))
                 return 0;
 
         return bp->link_vars.link_up;
@@ -920,6 +962,7 @@ static int bnx2x_set_eeprom(struct net_device *dev,
 
         return rc;
 }
+
 static int bnx2x_get_coalesce(struct net_device *dev,
                               struct ethtool_coalesce *coal)
 {
@@ -1027,7 +1070,7 @@ static int bnx2x_set_pauseparam(struct net_device *dev,
 {
         struct bnx2x *bp = netdev_priv(dev);
         u32 cfg_idx = bnx2x_get_link_cfg_idx(bp);
-        if (IS_E1HMF(bp))
+        if (IS_MF(bp))
                 return 0;
 
         DP(NETIF_MSG_LINK, "ethtool_pauseparam: cmd %d\n"
@@ -1074,35 +1117,34 @@ static int bnx2x_set_flags(struct net_device *dev, u32 data)
         int changed = 0;
         int rc = 0;
 
-        if (data & ~(ETH_FLAG_LRO | ETH_FLAG_RXHASH))
-                return -EINVAL;
-
         if (bp->recovery_state != BNX2X_RECOVERY_DONE) {
                 printk(KERN_ERR "Handling parity error recovery. Try again later\n");
                 return -EAGAIN;
         }
 
+        if (!(data & ETH_FLAG_RXVLAN))
+                return -EOPNOTSUPP;
+
+        if ((data & ETH_FLAG_LRO) && bp->rx_csum && bp->disable_tpa)
+                return -EINVAL;
+
+        rc = ethtool_op_set_flags(dev, data, ETH_FLAG_LRO | ETH_FLAG_RXVLAN |
+                                        ETH_FLAG_TXVLAN | ETH_FLAG_RXHASH);
+        if (rc)
+                return rc;
+
         /* TPA requires Rx CSUM offloading */
         if ((data & ETH_FLAG_LRO) && bp->rx_csum) {
-                if (!bp->disable_tpa) {
-                        if (!(dev->features & NETIF_F_LRO)) {
-                                dev->features |= NETIF_F_LRO;
-                                bp->flags |= TPA_ENABLE_FLAG;
-                                changed = 1;
-                        }
-                } else
-                        rc = -EINVAL;
-        } else if (dev->features & NETIF_F_LRO) {
+                if (!(bp->flags & TPA_ENABLE_FLAG)) {
+                        bp->flags |= TPA_ENABLE_FLAG;
+                        changed = 1;
+                }
+        } else if (bp->flags & TPA_ENABLE_FLAG) {
                 dev->features &= ~NETIF_F_LRO;
                 bp->flags &= ~TPA_ENABLE_FLAG;
                 changed = 1;
         }
 
-        if (data & ETH_FLAG_RXHASH)
-                dev->features |= NETIF_F_RXHASH;
-        else
-                dev->features &= ~NETIF_F_RXHASH;
-
         if (changed && netif_running(dev)) {
                 bnx2x_nic_unload(bp, UNLOAD_NORMAL);
                 rc = bnx2x_nic_load(bp, LOAD_NORMAL);
@@ -1235,6 +1277,9 @@ static int bnx2x_test_registers(struct bnx2x *bp)
 
                 for (i = 0; reg_tbl[i].offset0 != 0xffffffff; i++) {
                         u32 offset, mask, save_val, val;
+                        if (CHIP_IS_E2(bp) &&
+                            reg_tbl[i].offset0 == HC_REG_AGG_INT_0)
+                                continue;
 
                         offset = reg_tbl[i].offset0 + port*reg_tbl[i].offset1;
                         mask = reg_tbl[i].mask;
@@ -1242,6 +1287,7 @@ static int bnx2x_test_registers(struct bnx2x *bp)
                         save_val = REG_RD(bp, offset);
 
                         REG_WR(bp, offset, (wr_val & mask));
+
                         val = REG_RD(bp, offset);
 
                         /* Restore the original register's value */
@@ -1286,20 +1332,33 @@ static int bnx2x_test_memory(struct bnx2x *bp)
                 u32 offset;
                 u32 e1_mask;
                 u32 e1h_mask;
+                u32 e2_mask;
         } prty_tbl[] = {
-                { "CCM_PRTY_STS",  CCM_REG_CCM_PRTY_STS,   0x3ffc0, 0 },
-                { "CFC_PRTY_STS",  CFC_REG_CFC_PRTY_STS,   0x2,     0x2 },
-                { "DMAE_PRTY_STS", DMAE_REG_DMAE_PRTY_STS, 0,       0 },
-                { "TCM_PRTY_STS",  TCM_REG_TCM_PRTY_STS,   0x3ffc0, 0 },
-                { "UCM_PRTY_STS",  UCM_REG_UCM_PRTY_STS,   0x3ffc0, 0 },
-                { "XCM_PRTY_STS",  XCM_REG_XCM_PRTY_STS,   0x3ffc1, 0 },
-
-                { NULL, 0xffffffff, 0, 0 }
+                { "CCM_PRTY_STS",  CCM_REG_CCM_PRTY_STS,   0x3ffc0, 0,   0 },
+                { "CFC_PRTY_STS",  CFC_REG_CFC_PRTY_STS,   0x2,     0x2, 0 },
+                { "DMAE_PRTY_STS", DMAE_REG_DMAE_PRTY_STS, 0,       0,   0 },
+                { "TCM_PRTY_STS",  TCM_REG_TCM_PRTY_STS,   0x3ffc0, 0,   0 },
+                { "UCM_PRTY_STS",  UCM_REG_UCM_PRTY_STS,   0x3ffc0, 0,   0 },
+                { "XCM_PRTY_STS",  XCM_REG_XCM_PRTY_STS,   0x3ffc1, 0,   0 },
+
+                { NULL, 0xffffffff, 0, 0, 0 }
         };
 
         if (!netif_running(bp->dev))
                 return rc;
 
+        /* pre-Check the parity status */
+        for (i = 0; prty_tbl[i].offset != 0xffffffff; i++) {
+                val = REG_RD(bp, prty_tbl[i].offset);
+                if ((CHIP_IS_E1(bp) && (val & ~(prty_tbl[i].e1_mask))) ||
+                    (CHIP_IS_E1H(bp) && (val & ~(prty_tbl[i].e1h_mask))) ||
+                    (CHIP_IS_E2(bp) && (val & ~(prty_tbl[i].e2_mask)))) {
+                        DP(NETIF_MSG_HW,
+                           "%s is 0x%x\n", prty_tbl[i].name, val);
+                        goto test_mem_exit;
+                }
+        }
+
         /* Go through all the memories */
         for (i = 0; mem_tbl[i].offset != 0xffffffff; i++)
                 for (j = 0; j < mem_tbl[i].size; j++)
@@ -1309,7 +1368,8 @@ static int bnx2x_test_memory(struct bnx2x *bp)
         for (i = 0; prty_tbl[i].offset != 0xffffffff; i++) {
                 val = REG_RD(bp, prty_tbl[i].offset);
                 if ((CHIP_IS_E1(bp) && (val & ~(prty_tbl[i].e1_mask))) ||
-                    (CHIP_IS_E1H(bp) && (val & ~(prty_tbl[i].e1h_mask)))) {
+                    (CHIP_IS_E1H(bp) && (val & ~(prty_tbl[i].e1h_mask))) ||
+                    (CHIP_IS_E2(bp) && (val & ~(prty_tbl[i].e2_mask)))) {
                         DP(NETIF_MSG_HW,
                            "%s is 0x%x\n", prty_tbl[i].name, val);
                         goto test_mem_exit;
@@ -1324,7 +1384,7 @@ test_mem_exit:
 
 static void bnx2x_wait_for_link(struct bnx2x *bp, u8 link_up, u8 is_serdes)
 {
-        int cnt = 1000;
+        int cnt = 1400;
 
         if (link_up)
                 while (bnx2x_link_test(bp, is_serdes) && cnt--)
@@ -1343,7 +1403,8 @@ static int bnx2x_run_loopback(struct bnx2x *bp, int loopback_mode, u8 link_up)
         u16 pkt_prod, bd_prod;
         struct sw_tx_bd *tx_buf;
         struct eth_tx_start_bd *tx_start_bd;
-        struct eth_tx_parse_bd *pbd = NULL;
+        struct eth_tx_parse_bd_e1x  *pbd_e1x = NULL;
+        struct eth_tx_parse_bd_e2  *pbd_e2 = NULL;
         dma_addr_t mapping;
         union eth_rx_cqe *cqe;
         u8 cqe_fp_flags;
@@ -1399,16 +1460,23 @@ static int bnx2x_run_loopback(struct bnx2x *bp, int loopback_mode, u8 link_up)
         tx_start_bd->addr_lo = cpu_to_le32(U64_LO(mapping));
         tx_start_bd->nbd = cpu_to_le16(2); /* start + pbd */
         tx_start_bd->nbytes = cpu_to_le16(skb_headlen(skb));
-        tx_start_bd->vlan = cpu_to_le16(pkt_prod);
+        tx_start_bd->vlan_or_ethertype = cpu_to_le16(pkt_prod);
         tx_start_bd->bd_flags.as_bitfield = ETH_TX_BD_FLAGS_START_BD;
-        tx_start_bd->general_data = ((UNICAST_ADDRESS <<
-                                ETH_TX_START_BD_ETH_ADDR_TYPE_SHIFT) | 1);
+        SET_FLAG(tx_start_bd->general_data,
+                 ETH_TX_START_BD_ETH_ADDR_TYPE,
+                 UNICAST_ADDRESS);
+        SET_FLAG(tx_start_bd->general_data,
+                 ETH_TX_START_BD_HDR_NBDS,
+                 1);
 
         /* turn on parsing and get a BD */
         bd_prod = TX_BD(NEXT_TX_IDX(bd_prod));
-        pbd = &fp_tx->tx_desc_ring[bd_prod].parse_bd;
 
-        memset(pbd, 0, sizeof(struct eth_tx_parse_bd));
+        pbd_e1x = &fp_tx->tx_desc_ring[bd_prod].parse_bd_e1x;
+        pbd_e2 = &fp_tx->tx_desc_ring[bd_prod].parse_bd_e2;
+
+        memset(pbd_e2, 0, sizeof(struct eth_tx_parse_bd_e2));
+        memset(pbd_e1x, 0, sizeof(struct eth_tx_parse_bd_e1x));
 
         wmb();
 
@@ -1427,6 +1495,13 @@ static int bnx2x_run_loopback(struct bnx2x *bp, int loopback_mode, u8 link_up)
         if (tx_idx != tx_start_idx + num_pkts)
                 goto test_loopback_exit;
 
+        /* Unlike HC IGU won't generate an interrupt for status block
+         * updates that have been performed while interrupts were
+         * disabled.
+         */
+        if (bp->common.int_block == INT_BLOCK_IGU)
+                bnx2x_tx_int(fp_tx);
+
         rx_idx = le16_to_cpu(*fp_rx->rx_cons_sb);
         if (rx_idx != rx_start_idx + num_pkts)
                 goto test_loopback_exit;
@@ -1569,8 +1644,7 @@ static int bnx2x_test_intr(struct bnx2x *bp)
 
         config->hdr.length = 0;
         if (CHIP_IS_E1(bp))
-                /* use last unicast entries */
-                config->hdr.offset = (BP_PORT(bp) ? 63 : 31);
+                config->hdr.offset = (BP_PORT(bp) ? 32 : 0);
         else
                 config->hdr.offset = BP_FUNC(bp);
         config->hdr.client_id = bp->fp->cl_id;
@@ -1578,9 +1652,9 @@ static int bnx2x_test_intr(struct bnx2x *bp)
 
         bp->set_mac_pending++;
         smp_wmb();
-        rc = bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_SET_MAC, 0,
+        rc = bnx2x_sp_post(bp, RAMROD_CMD_ID_COMMON_SET_MAC, 0,
                            U64_HI(bnx2x_sp_mapping(bp, mac_config)),
-                           U64_LO(bnx2x_sp_mapping(bp, mac_config)), 0);
+                           U64_LO(bnx2x_sp_mapping(bp, mac_config)), 1);
         if (rc == 0) {
                 for (i = 0; i < 10; i++) {
                         if (!bp->set_mac_pending)
@@ -1612,7 +1686,7 @@ static void bnx2x_self_test(struct net_device *dev,
                 return;
 
         /* offline tests are not supported in MF mode */
-        if (IS_E1HMF(bp))
+        if (IS_MF(bp))
                 etest->flags &= ~ETH_TEST_FL_OFFLINE;
         is_serdes = (bp->link_vars.link_status & LINK_STATUS_SERDES_LINK) > 0;
 
@@ -1641,6 +1715,7 @@ static void bnx2x_self_test(struct net_device *dev,
                         buf[1] = 1;
                         etest->flags |= ETH_TEST_FL_FAILED;
                 }
+
                 buf[2] = bnx2x_test_loopback(bp, link_up);
                 if (buf[2] != 0)
                         etest->flags |= ETH_TEST_FL_FAILED;
@@ -1804,8 +1879,8 @@ static const struct {
 #define IS_PORT_STAT(i) \
         ((bnx2x_stats_arr[i].flags & STATS_FLAGS_BOTH) == STATS_FLAGS_PORT)
 #define IS_FUNC_STAT(i)         (bnx2x_stats_arr[i].flags & STATS_FLAGS_FUNC)
-#define IS_E1HMF_MODE_STAT(bp) \
-                        (IS_E1HMF(bp) && !(bp->msg_enable & BNX2X_MSG_STATS))
+#define IS_MF_MODE_STAT(bp) \
+                        (IS_MF(bp) && !(bp->msg_enable & BNX2X_MSG_STATS))
 
 static int bnx2x_get_sset_count(struct net_device *dev, int stringset)
 {
@@ -1816,10 +1891,10 @@ static int bnx2x_get_sset_count(struct net_device *dev, int stringset)
         case ETH_SS_STATS:
                 if (is_multi(bp)) {
                         num_stats = BNX2X_NUM_Q_STATS * bp->num_queues;
-                        if (!IS_E1HMF_MODE_STAT(bp))
+                        if (!IS_MF_MODE_STAT(bp))
                                 num_stats += BNX2X_NUM_STATS;
                 } else {
-                        if (IS_E1HMF_MODE_STAT(bp)) {
+                        if (IS_MF_MODE_STAT(bp)) {
                                 num_stats = 0;
                                 for (i = 0; i < BNX2X_NUM_STATS; i++)
                                         if (IS_FUNC_STAT(i))
@@ -1852,14 +1927,14 @@ static void bnx2x_get_strings(struct net_device *dev, u32 stringset, u8 *buf)
                                                 bnx2x_q_stats_arr[j].string, i);
                                 k += BNX2X_NUM_Q_STATS;
                         }
-                        if (IS_E1HMF_MODE_STAT(bp))
+                        if (IS_MF_MODE_STAT(bp))
                                 break;
                         for (j = 0; j < BNX2X_NUM_STATS; j++)
                                 strcpy(buf + (k + j)*ETH_GSTRING_LEN,
                                        bnx2x_stats_arr[j].string);
                 } else {
                         for (i = 0, j = 0; i < BNX2X_NUM_STATS; i++) {
-                                if (IS_E1HMF_MODE_STAT(bp) && IS_PORT_STAT(i))
+                                if (IS_MF_MODE_STAT(bp) && IS_PORT_STAT(i))
                                         continue;
                                 strcpy(buf + j*ETH_GSTRING_LEN,
                                        bnx2x_stats_arr[i].string);
@@ -1903,7 +1978,7 @@ static void bnx2x_get_ethtool_stats(struct net_device *dev,
                         }
                         k += BNX2X_NUM_Q_STATS;
                 }
-                if (IS_E1HMF_MODE_STAT(bp))
+                if (IS_MF_MODE_STAT(bp))
                         return;
                 hw_stats = (u32 *)&bp->eth_stats;
                 for (j = 0; j < BNX2X_NUM_STATS; j++) {
@@ -1924,7 +1999,7 @@ static void bnx2x_get_ethtool_stats(struct net_device *dev,
         } else {
                 hw_stats = (u32 *)&bp->eth_stats;
                 for (i = 0, j = 0; i < BNX2X_NUM_STATS; i++) {
-                        if (IS_E1HMF_MODE_STAT(bp) && IS_PORT_STAT(i))
+                        if (IS_MF_MODE_STAT(bp) && IS_PORT_STAT(i))
                                 continue;
                         if (bnx2x_stats_arr[i].size == 0) {
                                 /* skip this counter */
diff --git a/drivers/net/bnx2x/bnx2x_fw_defs.h b/drivers/net/bnx2x/bnx2x_fw_defs.h
index 08d71bf438d6..f4e5b1ce8149 100644
--- a/drivers/net/bnx2x/bnx2x_fw_defs.h
+++ b/drivers/net/bnx2x/bnx2x_fw_defs.h
@@ -7,369 +7,272 @@
  * the Free Software Foundation.
  */
 
-
-#define CSTORM_ASSERT_LIST_INDEX_OFFSET \
-        (IS_E1H_OFFSET ? 0x7000 : 0x1000)
-#define CSTORM_ASSERT_LIST_OFFSET(idx) \
-        (IS_E1H_OFFSET ? (0x7020 + (idx * 0x10)) : (0x1020 + (idx * 0x10)))
-#define CSTORM_DEF_SB_HC_DISABLE_C_OFFSET(function, index) \
-        (IS_E1H_OFFSET ? (0x8622 + ((function>>1) * 0x40) + \
-        ((function&1) * 0x100) + (index * 0x4)) : (0x3562 + (function * \
-        0x40) + (index * 0x4)))
-#define CSTORM_DEF_SB_HC_DISABLE_U_OFFSET(function, index) \
-        (IS_E1H_OFFSET ? (0x8822 + ((function>>1) * 0x80) + \
-        ((function&1) * 0x200) + (index * 0x4)) : (0x35e2 + (function * \
-        0x80) + (index * 0x4)))
-#define CSTORM_DEF_SB_HOST_SB_ADDR_C_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8600 + ((function>>1) * 0x40) + \
-        ((function&1) * 0x100)) : (0x3540 + (function * 0x40)))
-#define CSTORM_DEF_SB_HOST_SB_ADDR_U_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8800 + ((function>>1) * 0x80) + \
-        ((function&1) * 0x200)) : (0x35c0 + (function * 0x80)))
-#define CSTORM_DEF_SB_HOST_STATUS_BLOCK_C_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8608 + ((function>>1) * 0x40) + \
-        ((function&1) * 0x100)) : (0x3548 + (function * 0x40)))
-#define CSTORM_DEF_SB_HOST_STATUS_BLOCK_U_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8808 + ((function>>1) * 0x80) + \
-        ((function&1) * 0x200)) : (0x35c8 + (function * 0x80)))
-#define CSTORM_FUNCTION_MODE_OFFSET \
-        (IS_E1H_OFFSET ? 0x11e8 : 0xffffffff)
-#define CSTORM_HC_BTR_C_OFFSET(port) \
-        (IS_E1H_OFFSET ? (0x8c04 + (port * 0xf0)) : (0x36c4 + (port * 0xc0)))
-#define CSTORM_HC_BTR_U_OFFSET(port) \
-        (IS_E1H_OFFSET ? (0x8de4 + (port * 0xf0)) : (0x3844 + (port * 0xc0)))
-#define CSTORM_ISCSI_CQ_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6680 + (function * 0x8)) : (0x25a0 + \
-        (function * 0x8)))
-#define CSTORM_ISCSI_CQ_SQN_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x66c0 + (function * 0x8)) : (0x25b0 + \
-        (function * 0x8)))
-#define CSTORM_ISCSI_EQ_CONS_OFFSET(function, eqIdx) \
-        (IS_E1H_OFFSET ? (0x6040 + (function * 0xc0) + (eqIdx * 0x18)) : \
-        (0x2410 + (function * 0xc0) + (eqIdx * 0x18)))
-#define CSTORM_ISCSI_EQ_NEXT_EQE_ADDR_OFFSET(function, eqIdx) \
-        (IS_E1H_OFFSET ? (0x6044 + (function * 0xc0) + (eqIdx * 0x18)) : \
-        (0x2414 + (function * 0xc0) + (eqIdx * 0x18)))
-#define CSTORM_ISCSI_EQ_NEXT_PAGE_ADDR_OFFSET(function, eqIdx) \
-        (IS_E1H_OFFSET ? (0x604c + (function * 0xc0) + (eqIdx * 0x18)) : \
-        (0x241c + (function * 0xc0) + (eqIdx * 0x18)))
-#define CSTORM_ISCSI_EQ_NEXT_PAGE_ADDR_VALID_OFFSET(function, eqIdx) \
-        (IS_E1H_OFFSET ? (0x6057 + (function * 0xc0) + (eqIdx * 0x18)) : \
-        (0x2427 + (function * 0xc0) + (eqIdx * 0x18)))
-#define CSTORM_ISCSI_EQ_PROD_OFFSET(function, eqIdx) \
-        (IS_E1H_OFFSET ? (0x6042 + (function * 0xc0) + (eqIdx * 0x18)) : \
-        (0x2412 + (function * 0xc0) + (eqIdx * 0x18)))
-#define CSTORM_ISCSI_EQ_SB_INDEX_OFFSET(function, eqIdx) \
-        (IS_E1H_OFFSET ? (0x6056 + (function * 0xc0) + (eqIdx * 0x18)) : \
-        (0x2426 + (function * 0xc0) + (eqIdx * 0x18)))
-#define CSTORM_ISCSI_EQ_SB_NUM_OFFSET(function, eqIdx) \
-        (IS_E1H_OFFSET ? (0x6054 + (function * 0xc0) + (eqIdx * 0x18)) : \
-        (0x2424 + (function * 0xc0) + (eqIdx * 0x18)))
-#define CSTORM_ISCSI_HQ_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6640 + (function * 0x8)) : (0x2590 + \
-        (function * 0x8)))
-#define CSTORM_ISCSI_NUM_OF_TASKS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6004 + (function * 0x8)) : (0x2404 + \
-        (function * 0x8)))
-#define CSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6002 + (function * 0x8)) : (0x2402 + \
-        (function * 0x8)))
-#define CSTORM_ISCSI_PAGE_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6000 + (function * 0x8)) : (0x2400 + \
-        (function * 0x8)))
-#define CSTORM_SB_HC_DISABLE_C_OFFSET(port, cpu_id, index) \
-        (IS_E1H_OFFSET ? (0x811a + (port * 0x280) + (cpu_id * 0x28) + \
-        (index * 0x4)) : (0x305a + (port * 0x280) + (cpu_id * 0x28) + \
-        (index * 0x4)))
-#define CSTORM_SB_HC_DISABLE_U_OFFSET(port, cpu_id, index) \
-        (IS_E1H_OFFSET ? (0xb01a + (port * 0x800) + (cpu_id * 0x80) + \
-        (index * 0x4)) : (0x401a + (port * 0x800) + (cpu_id * 0x80) + \
-        (index * 0x4)))
-#define CSTORM_SB_HC_TIMEOUT_C_OFFSET(port, cpu_id, index) \
-        (IS_E1H_OFFSET ? (0x8118 + (port * 0x280) + (cpu_id * 0x28) + \
-        (index * 0x4)) : (0x3058 + (port * 0x280) + (cpu_id * 0x28) + \
-        (index * 0x4)))
-#define CSTORM_SB_HC_TIMEOUT_U_OFFSET(port, cpu_id, index) \
-        (IS_E1H_OFFSET ? (0xb018 + (port * 0x800) + (cpu_id * 0x80) + \
-        (index * 0x4)) : (0x4018 + (port * 0x800) + (cpu_id * 0x80) + \
-        (index * 0x4)))
-#define CSTORM_SB_HOST_SB_ADDR_C_OFFSET(port, cpu_id) \
-        (IS_E1H_OFFSET ? (0x8100 + (port * 0x280) + (cpu_id * 0x28)) : \
-        (0x3040 + (port * 0x280) + (cpu_id * 0x28)))
-#define CSTORM_SB_HOST_SB_ADDR_U_OFFSET(port, cpu_id) \
-        (IS_E1H_OFFSET ? (0xb000 + (port * 0x800) + (cpu_id * 0x80)) : \
-        (0x4000 + (port * 0x800) + (cpu_id * 0x80)))
-#define CSTORM_SB_HOST_STATUS_BLOCK_C_OFFSET(port, cpu_id) \
-        (IS_E1H_OFFSET ? (0x8108 + (port * 0x280) + (cpu_id * 0x28)) : \
-        (0x3048 + (port * 0x280) + (cpu_id * 0x28)))
-#define CSTORM_SB_HOST_STATUS_BLOCK_U_OFFSET(port, cpu_id) \
-        (IS_E1H_OFFSET ? (0xb008 + (port * 0x800) + (cpu_id * 0x80)) : \
-        (0x4008 + (port * 0x800) + (cpu_id * 0x80)))
-#define CSTORM_SB_STATUS_BLOCK_C_SIZE 0x10
-#define CSTORM_SB_STATUS_BLOCK_U_SIZE 0x60
-#define CSTORM_STATS_FLAGS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x1108 + (function * 0x8)) : (0x5108 + \
-        (function * 0x8)))
-#define TSTORM_APPROXIMATE_MATCH_MULTICAST_FILTERING_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x3200 + (function * 0x20)) : 0xffffffff)
-#define TSTORM_ASSERT_LIST_INDEX_OFFSET \
-        (IS_E1H_OFFSET ? 0xa000 : 0x1000)
-#define TSTORM_ASSERT_LIST_OFFSET(idx) \
-        (IS_E1H_OFFSET ? (0xa020 + (idx * 0x10)) : (0x1020 + (idx * 0x10)))
-#define TSTORM_CLIENT_CONFIG_OFFSET(port, client_id) \
-        (IS_E1H_OFFSET ? (0x33a0 + (port * 0x1a0) + (client_id * 0x10)) \
-        : (0x9c0 + (port * 0x120) + (client_id * 0x10)))
-#define TSTORM_COMMON_SAFC_WORKAROUND_ENABLE_OFFSET \
-        (IS_E1H_OFFSET ? 0x1ed8 : 0xffffffff)
+#ifndef BNX2X_FW_DEFS_H
+#define BNX2X_FW_DEFS_H
+
+#define CSTORM_ASSERT_LIST_INDEX_OFFSET (IRO[142].base)
+#define CSTORM_ASSERT_LIST_OFFSET(assertListEntry) \
+        (IRO[141].base + ((assertListEntry) * IRO[141].m1))
+#define CSTORM_ETH_STATS_QUERY_ADDR_OFFSET(pfId) \
+        (IRO[144].base + ((pfId) * IRO[144].m1))
+#define CSTORM_EVENT_RING_DATA_OFFSET(pfId) \
+        (IRO[149].base + (((pfId)>>1) * IRO[149].m1) + (((pfId)&1) * \
+        IRO[149].m2))
+#define CSTORM_EVENT_RING_PROD_OFFSET(pfId) \
+        (IRO[150].base + (((pfId)>>1) * IRO[150].m1) + (((pfId)&1) * \
+        IRO[150].m2))
+#define CSTORM_FINAL_CLEANUP_COMPLETE_OFFSET(funcId) \
+        (IRO[156].base + ((funcId) * IRO[156].m1))
+#define CSTORM_FUNC_EN_OFFSET(funcId) \
+        (IRO[146].base + ((funcId) * IRO[146].m1))
+#define CSTORM_FUNCTION_MODE_OFFSET (IRO[153].base)
+#define CSTORM_IGU_MODE_OFFSET (IRO[154].base)
+#define CSTORM_ISCSI_CQ_SIZE_OFFSET(pfId) \
+        (IRO[311].base + ((pfId) * IRO[311].m1))
+#define CSTORM_ISCSI_CQ_SQN_SIZE_OFFSET(pfId) \
+        (IRO[312].base + ((pfId) * IRO[312].m1))
+        #define CSTORM_ISCSI_EQ_CONS_OFFSET(pfId, iscsiEqId) \
+        (IRO[304].base + ((pfId) * IRO[304].m1) + ((iscsiEqId) * \
+        IRO[304].m2))
+        #define CSTORM_ISCSI_EQ_NEXT_EQE_ADDR_OFFSET(pfId, iscsiEqId) \
+        (IRO[306].base + ((pfId) * IRO[306].m1) + ((iscsiEqId) * \
+        IRO[306].m2))
+        #define CSTORM_ISCSI_EQ_NEXT_PAGE_ADDR_OFFSET(pfId, iscsiEqId) \
+        (IRO[305].base + ((pfId) * IRO[305].m1) + ((iscsiEqId) * \
+        IRO[305].m2))
+        #define \
+        CSTORM_ISCSI_EQ_NEXT_PAGE_ADDR_VALID_OFFSET(pfId, iscsiEqId) \
+        (IRO[307].base + ((pfId) * IRO[307].m1) + ((iscsiEqId) * \
+        IRO[307].m2))
+        #define CSTORM_ISCSI_EQ_PROD_OFFSET(pfId, iscsiEqId) \
+        (IRO[303].base + ((pfId) * IRO[303].m1) + ((iscsiEqId) * \
+        IRO[303].m2))
+        #define CSTORM_ISCSI_EQ_SB_INDEX_OFFSET(pfId, iscsiEqId) \
+        (IRO[309].base + ((pfId) * IRO[309].m1) + ((iscsiEqId) * \
+        IRO[309].m2))
+        #define CSTORM_ISCSI_EQ_SB_NUM_OFFSET(pfId, iscsiEqId) \
+        (IRO[308].base + ((pfId) * IRO[308].m1) + ((iscsiEqId) * \
+        IRO[308].m2))
+#define CSTORM_ISCSI_HQ_SIZE_OFFSET(pfId) \
+        (IRO[310].base + ((pfId) * IRO[310].m1))
+#define CSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfId) \
+        (IRO[302].base + ((pfId) * IRO[302].m1))
+#define CSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfId) \
+        (IRO[301].base + ((pfId) * IRO[301].m1))
+#define CSTORM_ISCSI_PAGE_SIZE_OFFSET(pfId) \
+        (IRO[300].base + ((pfId) * IRO[300].m1))
+#define CSTORM_PATH_ID_OFFSET (IRO[159].base)
+#define CSTORM_SP_STATUS_BLOCK_DATA_OFFSET(pfId) \
+        (IRO[137].base + ((pfId) * IRO[137].m1))
+#define CSTORM_SP_STATUS_BLOCK_OFFSET(pfId) \
+        (IRO[136].base + ((pfId) * IRO[136].m1))
+#define CSTORM_SP_STATUS_BLOCK_SIZE (IRO[136].size)
+#define CSTORM_SP_SYNC_BLOCK_OFFSET(pfId) \
+        (IRO[138].base + ((pfId) * IRO[138].m1))
+#define CSTORM_SP_SYNC_BLOCK_SIZE (IRO[138].size)
+#define CSTORM_STATS_FLAGS_OFFSET(pfId) \
+        (IRO[143].base + ((pfId) * IRO[143].m1))
+#define CSTORM_STATUS_BLOCK_DATA_OFFSET(sbId) \
+        (IRO[129].base + ((sbId) * IRO[129].m1))
+#define CSTORM_STATUS_BLOCK_OFFSET(sbId) \
+        (IRO[128].base + ((sbId) * IRO[128].m1))
+#define CSTORM_STATUS_BLOCK_SIZE (IRO[128].size)
+#define CSTORM_SYNC_BLOCK_OFFSET(sbId) \
+        (IRO[132].base + ((sbId) * IRO[132].m1))
+#define CSTORM_SYNC_BLOCK_SIZE (IRO[132].size)
+#define CSTORM_VF_PF_CHANNEL_STATE_OFFSET(vfId) \
+        (IRO[151].base + ((vfId) * IRO[151].m1))
+#define CSTORM_VF_PF_CHANNEL_VALID_OFFSET(vfId) \
+        (IRO[152].base + ((vfId) * IRO[152].m1))
+#define CSTORM_VF_TO_PF_OFFSET(funcId) \
+        (IRO[147].base + ((funcId) * IRO[147].m1))
+#define TSTORM_ACCEPT_CLASSIFY_FAILED_OFFSET (IRO[199].base)
+#define TSTORM_APPROXIMATE_MATCH_MULTICAST_FILTERING_OFFSET(pfId) \
+        (IRO[198].base + ((pfId) * IRO[198].m1))
+#define TSTORM_ASSERT_LIST_INDEX_OFFSET (IRO[99].base)
+#define TSTORM_ASSERT_LIST_OFFSET(assertListEntry) \
+        (IRO[98].base + ((assertListEntry) * IRO[98].m1))
+        #define TSTORM_CLIENT_CONFIG_OFFSET(portId, clientId) \
+        (IRO[197].base + ((portId) * IRO[197].m1) + ((clientId) * \
+        IRO[197].m2))
+#define TSTORM_COMMON_SAFC_WORKAROUND_ENABLE_OFFSET (IRO[104].base)
 #define TSTORM_COMMON_SAFC_WORKAROUND_TIMEOUT_10USEC_OFFSET \
-        (IS_E1H_OFFSET ? 0x1eda : 0xffffffff)
-#define TSTORM_DEF_SB_HC_DISABLE_OFFSET(function, index) \
-        (IS_E1H_OFFSET ? (0xb01a + ((function>>1) * 0x28) + \
-        ((function&1) * 0xa0) + (index * 0x4)) : (0x141a + (function * \
-        0x28) + (index * 0x4)))
-#define TSTORM_DEF_SB_HOST_SB_ADDR_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0xb000 + ((function>>1) * 0x28) + \
-        ((function&1) * 0xa0)) : (0x1400 + (function * 0x28)))
-#define TSTORM_DEF_SB_HOST_STATUS_BLOCK_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0xb008 + ((function>>1) * 0x28) + \
-        ((function&1) * 0xa0)) : (0x1408 + (function * 0x28)))
-#define TSTORM_ETH_STATS_QUERY_ADDR_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x2940 + (function * 0x8)) : (0x4928 + \
-        (function * 0x8)))
-#define TSTORM_FUNCTION_COMMON_CONFIG_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x3000 + (function * 0x40)) : (0x1500 + \
-        (function * 0x40)))
-#define TSTORM_FUNCTION_MODE_OFFSET \
-        (IS_E1H_OFFSET ? 0x1ed0 : 0xffffffff)
-#define TSTORM_HC_BTR_OFFSET(port) \
-        (IS_E1H_OFFSET ? (0xb144 + (port * 0x30)) : (0x1454 + (port * 0x18)))
-#define TSTORM_INDIRECTION_TABLE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x12c8 + (function * 0x80)) : (0x22c8 + \
-        (function * 0x80)))
-#define TSTORM_INDIRECTION_TABLE_SIZE 0x80
-#define TSTORM_ISCSI_CONN_BUF_PBL_OFFSET(function, pblEntry) \
-        (IS_E1H_OFFSET ? (0x60c0 + (function * 0x40) + (pblEntry * 0x8)) \
-        : (0x4c30 + (function * 0x40) + (pblEntry * 0x8)))
-#define TSTORM_ISCSI_ERROR_BITMAP_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6340 + (function * 0x8)) : (0x4cd0 + \
-        (function * 0x8)))
-#define TSTORM_ISCSI_NUM_OF_TASKS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6004 + (function * 0x8)) : (0x4c04 + \
-        (function * 0x8)))
-#define TSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6002 + (function * 0x8)) : (0x4c02 + \
-        (function * 0x8)))
-#define TSTORM_ISCSI_PAGE_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6000 + (function * 0x8)) : (0x4c00 + \
-        (function * 0x8)))
-#define TSTORM_ISCSI_RQ_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6080 + (function * 0x8)) : (0x4c20 + \
-        (function * 0x8)))
-#define TSTORM_ISCSI_TCP_VARS_FLAGS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6040 + (function * 0x8)) : (0x4c10 + \
-        (function * 0x8)))
-#define TSTORM_ISCSI_TCP_VARS_LSB_LOCAL_MAC_ADDR_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6042 + (function * 0x8)) : (0x4c12 + \
-        (function * 0x8)))
-#define TSTORM_ISCSI_TCP_VARS_MSB_LOCAL_MAC_ADDR_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x6044 + (function * 0x8)) : (0x4c14 + \
-        (function * 0x8)))
-#define TSTORM_MAC_FILTER_CONFIG_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x3008 + (function * 0x40)) : (0x1508 + \
-        (function * 0x40)))
-#define TSTORM_PER_COUNTER_ID_STATS_OFFSET(port, stats_counter_id) \
-        (IS_E1H_OFFSET ? (0x2010 + (port * 0x490) + (stats_counter_id * \
-        0x40)) : (0x4010 + (port * 0x490) + (stats_counter_id * 0x40)))
-#define TSTORM_STATS_FLAGS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x29c0 + (function * 0x8)) : (0x4948 + \
-        (function * 0x8)))
-#define TSTORM_TCP_MAX_CWND_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x4004 + (function * 0x8)) : (0x1fb4 + \
-        (function * 0x8)))
-#define USTORM_AGG_DATA_OFFSET (IS_E1H_OFFSET ? 0xa000 : 0x3000)
-#define USTORM_AGG_DATA_SIZE (IS_E1H_OFFSET ? 0x2000 : 0x1000)
-#define USTORM_ASSERT_LIST_INDEX_OFFSET \
-        (IS_E1H_OFFSET ? 0x8000 : 0x1000)
-#define USTORM_ASSERT_LIST_OFFSET(idx) \
-        (IS_E1H_OFFSET ? (0x8020 + (idx * 0x10)) : (0x1020 + (idx * 0x10)))
-#define USTORM_CQE_PAGE_BASE_OFFSET(port, clientId) \
-        (IS_E1H_OFFSET ? (0x1010 + (port * 0x680) + (clientId * 0x40)) : \
-        (0x4010 + (port * 0x360) + (clientId * 0x30)))
-#define USTORM_CQE_PAGE_NEXT_OFFSET(port, clientId) \
-        (IS_E1H_OFFSET ? (0x1028 + (port * 0x680) + (clientId * 0x40)) : \
-        (0x4028 + (port * 0x360) + (clientId * 0x30)))
-#define USTORM_ETH_PAUSE_ENABLED_OFFSET(port) \
-        (IS_E1H_OFFSET ? (0x2ad4 + (port * 0x8)) : 0xffffffff)
-#define USTORM_ETH_RING_PAUSE_DATA_OFFSET(port, clientId) \
-        (IS_E1H_OFFSET ? (0x1030 + (port * 0x680) + (clientId * 0x40)) : \
-        0xffffffff)
-#define USTORM_ETH_STATS_QUERY_ADDR_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x2a50 + (function * 0x8)) : (0x1dd0 + \
-        (function * 0x8)))
-#define USTORM_FUNCTION_MODE_OFFSET \
-        (IS_E1H_OFFSET ? 0x2448 : 0xffffffff)
-#define USTORM_ISCSI_CQ_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x7044 + (function * 0x8)) : (0x2414 + \
-        (function * 0x8)))
-#define USTORM_ISCSI_CQ_SQN_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x7046 + (function * 0x8)) : (0x2416 + \
-        (function * 0x8)))
-#define USTORM_ISCSI_ERROR_BITMAP_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x7688 + (function * 0x8)) : (0x29c8 + \
-        (function * 0x8)))
-#define USTORM_ISCSI_GLOBAL_BUF_PHYS_ADDR_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x7648 + (function * 0x8)) : (0x29b8 + \
-        (function * 0x8)))
-#define USTORM_ISCSI_NUM_OF_TASKS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x7004 + (function * 0x8)) : (0x2404 + \
-        (function * 0x8)))
-#define USTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x7002 + (function * 0x8)) : (0x2402 + \
-        (function * 0x8)))
-#define USTORM_ISCSI_PAGE_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x7000 + (function * 0x8)) : (0x2400 + \
-        (function * 0x8)))
-#define USTORM_ISCSI_R2TQ_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x7040 + (function * 0x8)) : (0x2410 + \
-        (function * 0x8)))
-#define USTORM_ISCSI_RQ_BUFFER_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x7080 + (function * 0x8)) : (0x2420 + \
-        (function * 0x8)))
-#define USTORM_ISCSI_RQ_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x7084 + (function * 0x8)) : (0x2424 + \
-        (function * 0x8)))
-#define USTORM_MAX_AGG_SIZE_OFFSET(port, clientId) \
-        (IS_E1H_OFFSET ? (0x1018 + (port * 0x680) + (clientId * 0x40)) : \
-        (0x4018 + (port * 0x360) + (clientId * 0x30)))
-#define USTORM_MEM_WORKAROUND_ADDRESS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x2408 + (function * 0x8)) : (0x1da8 + \
-        (function * 0x8)))
-#define USTORM_PER_COUNTER_ID_STATS_OFFSET(port, stats_counter_id) \
-        (IS_E1H_OFFSET ? (0x2450 + (port * 0x2d0) + (stats_counter_id * \
-        0x28)) : (0x1500 + (port * 0x2d0) + (stats_counter_id * 0x28)))
-#define USTORM_RX_PRODS_OFFSET(port, client_id) \
-        (IS_E1H_OFFSET ? (0x1000 + (port * 0x680) + (client_id * 0x40)) \
-        : (0x4000 + (port * 0x360) + (client_id * 0x30)))
-#define USTORM_STATS_FLAGS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x29f0 + (function * 0x8)) : (0x1db8 + \
-        (function * 0x8)))
-#define USTORM_TPA_BTR_OFFSET (IS_E1H_OFFSET ? 0x3da5 : 0x5095)
-#define USTORM_TPA_BTR_SIZE 0x1
-#define XSTORM_ASSERT_LIST_INDEX_OFFSET \
-        (IS_E1H_OFFSET ? 0x9000 : 0x1000)
-#define XSTORM_ASSERT_LIST_OFFSET(idx) \
-        (IS_E1H_OFFSET ? (0x9020 + (idx * 0x10)) : (0x1020 + (idx * 0x10)))
-#define XSTORM_CMNG_PER_PORT_VARS_OFFSET(port) \
-        (IS_E1H_OFFSET ? (0x24a8 + (port * 0x50)) : (0x3a80 + (port * 0x50)))
-#define XSTORM_DEF_SB_HC_DISABLE_OFFSET(function, index) \
-        (IS_E1H_OFFSET ? (0xa01a + ((function>>1) * 0x28) + \
-        ((function&1) * 0xa0) + (index * 0x4)) : (0x141a + (function * \
-        0x28) + (index * 0x4)))
-#define XSTORM_DEF_SB_HOST_SB_ADDR_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0xa000 + ((function>>1) * 0x28) + \
-        ((function&1) * 0xa0)) : (0x1400 + (function * 0x28)))
-#define XSTORM_DEF_SB_HOST_STATUS_BLOCK_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0xa008 + ((function>>1) * 0x28) + \
-        ((function&1) * 0xa0)) : (0x1408 + (function * 0x28)))
-#define XSTORM_E1HOV_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x2c10 + (function * 0x8)) : 0xffffffff)
-#define XSTORM_ETH_STATS_QUERY_ADDR_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x2418 + (function * 0x8)) : (0x3a50 + \
-        (function * 0x8)))
-#define XSTORM_FAIRNESS_PER_VN_VARS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x2588 + (function * 0x90)) : (0x3b60 + \
-        (function * 0x90)))
-#define XSTORM_FUNCTION_MODE_OFFSET \
-        (IS_E1H_OFFSET ? 0x2c50 : 0xffffffff)
-#define XSTORM_HC_BTR_OFFSET(port) \
-        (IS_E1H_OFFSET ? (0xa144 + (port * 0x30)) : (0x1454 + (port * 0x18)))
-#define XSTORM_ISCSI_HQ_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x80c0 + (function * 0x8)) : (0x1c30 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_LOCAL_MAC_ADDR0_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8080 + (function * 0x8)) : (0x1c20 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_LOCAL_MAC_ADDR1_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8081 + (function * 0x8)) : (0x1c21 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_LOCAL_MAC_ADDR2_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8082 + (function * 0x8)) : (0x1c22 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_LOCAL_MAC_ADDR3_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8083 + (function * 0x8)) : (0x1c23 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_LOCAL_MAC_ADDR4_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8084 + (function * 0x8)) : (0x1c24 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_LOCAL_MAC_ADDR5_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8085 + (function * 0x8)) : (0x1c25 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_LOCAL_VLAN_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8086 + (function * 0x8)) : (0x1c26 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_NUM_OF_TASKS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8004 + (function * 0x8)) : (0x1c04 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8002 + (function * 0x8)) : (0x1c02 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_PAGE_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8000 + (function * 0x8)) : (0x1c00 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_R2TQ_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x80c4 + (function * 0x8)) : (0x1c34 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_SQ_SIZE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x80c2 + (function * 0x8)) : (0x1c32 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_TCP_VARS_ADV_WND_SCL_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8043 + (function * 0x8)) : (0x1c13 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_TCP_VARS_FLAGS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8042 + (function * 0x8)) : (0x1c12 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_TCP_VARS_TOS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8041 + (function * 0x8)) : (0x1c11 + \
-        (function * 0x8)))
-#define XSTORM_ISCSI_TCP_VARS_TTL_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x8040 + (function * 0x8)) : (0x1c10 + \
-        (function * 0x8)))
-#define XSTORM_PER_COUNTER_ID_STATS_OFFSET(port, stats_counter_id) \
-        (IS_E1H_OFFSET ? (0xc000 + (port * 0x360) + (stats_counter_id * \
-        0x30)) : (0x3378 + (port * 0x360) + (stats_counter_id * 0x30)))
-#define XSTORM_RATE_SHAPING_PER_VN_VARS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x2548 + (function * 0x90)) : (0x3b20 + \
-        (function * 0x90)))
-#define XSTORM_SPQ_PAGE_BASE_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x2000 + (function * 0x10)) : (0x3328 + \
-        (function * 0x10)))
-#define XSTORM_SPQ_PROD_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x2008 + (function * 0x10)) : (0x3330 + \
-        (function * 0x10)))
-#define XSTORM_STATS_FLAGS_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x23d8 + (function * 0x8)) : (0x3a40 + \
-        (function * 0x8)))
-#define XSTORM_TCP_GLOBAL_DEL_ACK_COUNTER_ENABLED_OFFSET(port) \
-        (IS_E1H_OFFSET ? (0x4000 + (port * 0x8)) : (0x1960 + (port * 0x8)))
-#define XSTORM_TCP_GLOBAL_DEL_ACK_COUNTER_MAX_COUNT_OFFSET(port) \
-        (IS_E1H_OFFSET ? (0x4001 + (port * 0x8)) : (0x1961 + (port * 0x8)))
-#define XSTORM_TCP_TX_SWS_TIMER_VAL_OFFSET(function) \
-        (IS_E1H_OFFSET ? (0x4060 + ((function>>1) * 0x8) + ((function&1) \
-        * 0x4)) : (0x1978 + (function * 0x4)))
+        (IRO[105].base)
+#define TSTORM_ETH_STATS_QUERY_ADDR_OFFSET(pfId) \
+        (IRO[96].base + ((pfId) * IRO[96].m1))
+#define TSTORM_FUNC_EN_OFFSET(funcId) \
+        (IRO[101].base + ((funcId) * IRO[101].m1))
+#define TSTORM_FUNCTION_COMMON_CONFIG_OFFSET(pfId) \
+        (IRO[195].base + ((pfId) * IRO[195].m1))
+#define TSTORM_FUNCTION_MODE_OFFSET (IRO[103].base)
+#define TSTORM_INDIRECTION_TABLE_OFFSET(pfId) \
+        (IRO[91].base + ((pfId) * IRO[91].m1))
+#define TSTORM_INDIRECTION_TABLE_SIZE (IRO[91].size)
+        #define \
+        TSTORM_ISCSI_CONN_BUF_PBL_OFFSET(pfId, iscsiConBufPblEntry) \
+        (IRO[260].base + ((pfId) * IRO[260].m1) + ((iscsiConBufPblEntry) \
+        * IRO[260].m2))
+#define TSTORM_ISCSI_ERROR_BITMAP_OFFSET(pfId) \
+        (IRO[264].base + ((pfId) * IRO[264].m1))
+#define TSTORM_ISCSI_L2_ISCSI_OOO_CID_TABLE_OFFSET(pfId) \
+        (IRO[265].base + ((pfId) * IRO[265].m1))
+#define TSTORM_ISCSI_L2_ISCSI_OOO_CLIENT_ID_TABLE_OFFSET(pfId) \
+        (IRO[266].base + ((pfId) * IRO[266].m1))
+#define TSTORM_ISCSI_L2_ISCSI_OOO_PROD_OFFSET(pfId) \
+        (IRO[267].base + ((pfId) * IRO[267].m1))
+#define TSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfId) \
+        (IRO[263].base + ((pfId) * IRO[263].m1))
+#define TSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfId) \
+        (IRO[262].base + ((pfId) * IRO[262].m1))
+#define TSTORM_ISCSI_PAGE_SIZE_OFFSET(pfId) \
+        (IRO[261].base + ((pfId) * IRO[261].m1))
+#define TSTORM_ISCSI_RQ_SIZE_OFFSET(pfId) \
+        (IRO[259].base + ((pfId) * IRO[259].m1))
+#define TSTORM_ISCSI_TCP_LOCAL_ADV_WND_OFFSET(pfId) \
+        (IRO[269].base + ((pfId) * IRO[269].m1))
+#define TSTORM_ISCSI_TCP_VARS_FLAGS_OFFSET(pfId) \
+        (IRO[256].base + ((pfId) * IRO[256].m1))
+#define TSTORM_ISCSI_TCP_VARS_LSB_LOCAL_MAC_ADDR_OFFSET(pfId) \
+        (IRO[257].base + ((pfId) * IRO[257].m1))
+#define TSTORM_ISCSI_TCP_VARS_MSB_LOCAL_MAC_ADDR_OFFSET(pfId) \
+        (IRO[258].base + ((pfId) * IRO[258].m1))
+#define TSTORM_MAC_FILTER_CONFIG_OFFSET(pfId) \
+        (IRO[196].base + ((pfId) * IRO[196].m1))
+        #define TSTORM_PER_COUNTER_ID_STATS_OFFSET(portId, tStatCntId) \
+        (IRO[100].base + ((portId) * IRO[100].m1) + ((tStatCntId) * \
+        IRO[100].m2))
+#define TSTORM_STATS_FLAGS_OFFSET(pfId) \
+        (IRO[95].base + ((pfId) * IRO[95].m1))
+#define TSTORM_TCP_MAX_CWND_OFFSET(pfId) \
+        (IRO[211].base + ((pfId) * IRO[211].m1))
+#define TSTORM_VF_TO_PF_OFFSET(funcId) \
+        (IRO[102].base + ((funcId) * IRO[102].m1))
+#define USTORM_AGG_DATA_OFFSET (IRO[201].base)
+#define USTORM_AGG_DATA_SIZE (IRO[201].size)
+#define USTORM_ASSERT_LIST_INDEX_OFFSET (IRO[170].base)
+#define USTORM_ASSERT_LIST_OFFSET(assertListEntry) \
+        (IRO[169].base + ((assertListEntry) * IRO[169].m1))
+#define USTORM_ETH_PAUSE_ENABLED_OFFSET(portId) \
+        (IRO[178].base + ((portId) * IRO[178].m1))
+#define USTORM_ETH_STATS_QUERY_ADDR_OFFSET(pfId) \
+        (IRO[172].base + ((pfId) * IRO[172].m1))
+#define USTORM_FCOE_EQ_PROD_OFFSET(pfId) \
+        (IRO[313].base + ((pfId) * IRO[313].m1))
+#define USTORM_FUNC_EN_OFFSET(funcId) \
+        (IRO[174].base + ((funcId) * IRO[174].m1))
+#define USTORM_FUNCTION_MODE_OFFSET (IRO[177].base)
+#define USTORM_ISCSI_CQ_SIZE_OFFSET(pfId) \
+        (IRO[277].base + ((pfId) * IRO[277].m1))
+#define USTORM_ISCSI_CQ_SQN_SIZE_OFFSET(pfId) \
+        (IRO[278].base + ((pfId) * IRO[278].m1))
+#define USTORM_ISCSI_ERROR_BITMAP_OFFSET(pfId) \
+        (IRO[282].base + ((pfId) * IRO[282].m1))
+#define USTORM_ISCSI_GLOBAL_BUF_PHYS_ADDR_OFFSET(pfId) \
+        (IRO[279].base + ((pfId) * IRO[279].m1))
+#define USTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfId) \
+        (IRO[275].base + ((pfId) * IRO[275].m1))
+#define USTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfId) \
+        (IRO[274].base + ((pfId) * IRO[274].m1))
+#define USTORM_ISCSI_PAGE_SIZE_OFFSET(pfId) \
+        (IRO[273].base + ((pfId) * IRO[273].m1))
+#define USTORM_ISCSI_R2TQ_SIZE_OFFSET(pfId) \
+        (IRO[276].base + ((pfId) * IRO[276].m1))
+#define USTORM_ISCSI_RQ_BUFFER_SIZE_OFFSET(pfId) \
+        (IRO[280].base + ((pfId) * IRO[280].m1))
+#define USTORM_ISCSI_RQ_SIZE_OFFSET(pfId) \
+        (IRO[281].base + ((pfId) * IRO[281].m1))
+#define USTORM_MEM_WORKAROUND_ADDRESS_OFFSET(pfId) \
+        (IRO[176].base + ((pfId) * IRO[176].m1))
+        #define USTORM_PER_COUNTER_ID_STATS_OFFSET(portId, uStatCntId) \
+        (IRO[173].base + ((portId) * IRO[173].m1) + ((uStatCntId) * \
+        IRO[173].m2))
+        #define USTORM_RX_PRODS_E1X_OFFSET(portId, clientId) \
+        (IRO[204].base + ((portId) * IRO[204].m1) + ((clientId) * \
+        IRO[204].m2))
+#define USTORM_RX_PRODS_E2_OFFSET(qzoneId) \
+        (IRO[205].base + ((qzoneId) * IRO[205].m1))
+#define USTORM_STATS_FLAGS_OFFSET(pfId) \
+        (IRO[171].base + ((pfId) * IRO[171].m1))
+#define USTORM_TPA_BTR_OFFSET (IRO[202].base)
+#define USTORM_TPA_BTR_SIZE (IRO[202].size)
+#define USTORM_VF_TO_PF_OFFSET(funcId) \
+        (IRO[175].base + ((funcId) * IRO[175].m1))
+#define XSTORM_AGG_INT_FINAL_CLEANUP_COMP_TYPE (IRO[59].base)
+#define XSTORM_AGG_INT_FINAL_CLEANUP_INDEX (IRO[58].base)
+#define XSTORM_ASSERT_LIST_INDEX_OFFSET (IRO[54].base)
+#define XSTORM_ASSERT_LIST_OFFSET(assertListEntry) \
+        (IRO[53].base + ((assertListEntry) * IRO[53].m1))
+#define XSTORM_CMNG_PER_PORT_VARS_OFFSET(portId) \
+        (IRO[47].base + ((portId) * IRO[47].m1))
+#define XSTORM_E1HOV_OFFSET(pfId) \
+        (IRO[55].base + ((pfId) * IRO[55].m1))
+#define XSTORM_ETH_STATS_QUERY_ADDR_OFFSET(pfId) \
+        (IRO[45].base + ((pfId) * IRO[45].m1))
+#define XSTORM_FAIRNESS_PER_VN_VARS_OFFSET(pfId) \
+        (IRO[49].base + ((pfId) * IRO[49].m1))
+#define XSTORM_FUNC_EN_OFFSET(funcId) \
+        (IRO[51].base + ((funcId) * IRO[51].m1))
+#define XSTORM_FUNCTION_MODE_OFFSET (IRO[56].base)
+#define XSTORM_ISCSI_HQ_SIZE_OFFSET(pfId) \
+        (IRO[290].base + ((pfId) * IRO[290].m1))
+#define XSTORM_ISCSI_LOCAL_MAC_ADDR0_OFFSET(pfId) \
+        (IRO[293].base + ((pfId) * IRO[293].m1))
+#define XSTORM_ISCSI_LOCAL_MAC_ADDR1_OFFSET(pfId) \
+        (IRO[294].base + ((pfId) * IRO[294].m1))
+#define XSTORM_ISCSI_LOCAL_MAC_ADDR2_OFFSET(pfId) \
+        (IRO[295].base + ((pfId) * IRO[295].m1))
+#define XSTORM_ISCSI_LOCAL_MAC_ADDR3_OFFSET(pfId) \
+        (IRO[296].base + ((pfId) * IRO[296].m1))
+#define XSTORM_ISCSI_LOCAL_MAC_ADDR4_OFFSET(pfId) \
+        (IRO[297].base + ((pfId) * IRO[297].m1))
+#define XSTORM_ISCSI_LOCAL_MAC_ADDR5_OFFSET(pfId) \
+        (IRO[298].base + ((pfId) * IRO[298].m1))
+#define XSTORM_ISCSI_LOCAL_VLAN_OFFSET(pfId) \
+        (IRO[299].base + ((pfId) * IRO[299].m1))
+#define XSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfId) \
+        (IRO[289].base + ((pfId) * IRO[289].m1))
+#define XSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfId) \
+        (IRO[288].base + ((pfId) * IRO[288].m1))
+#define XSTORM_ISCSI_PAGE_SIZE_OFFSET(pfId) \
+        (IRO[287].base + ((pfId) * IRO[287].m1))
+#define XSTORM_ISCSI_R2TQ_SIZE_OFFSET(pfId) \
+        (IRO[292].base + ((pfId) * IRO[292].m1))
+#define XSTORM_ISCSI_SQ_SIZE_OFFSET(pfId) \
+        (IRO[291].base + ((pfId) * IRO[291].m1))
+#define XSTORM_ISCSI_TCP_VARS_ADV_WND_SCL_OFFSET(pfId) \
+        (IRO[286].base + ((pfId) * IRO[286].m1))
+#define XSTORM_ISCSI_TCP_VARS_FLAGS_OFFSET(pfId) \
+        (IRO[285].base + ((pfId) * IRO[285].m1))
+#define XSTORM_ISCSI_TCP_VARS_TOS_OFFSET(pfId) \
+        (IRO[284].base + ((pfId) * IRO[284].m1))
+#define XSTORM_ISCSI_TCP_VARS_TTL_OFFSET(pfId) \
+        (IRO[283].base + ((pfId) * IRO[283].m1))
+#define XSTORM_PATH_ID_OFFSET (IRO[65].base)
+        #define XSTORM_PER_COUNTER_ID_STATS_OFFSET(portId, xStatCntId) \
+        (IRO[50].base + ((portId) * IRO[50].m1) + ((xStatCntId) * \
+        IRO[50].m2))
+#define XSTORM_RATE_SHAPING_PER_VN_VARS_OFFSET(pfId) \
+        (IRO[48].base + ((pfId) * IRO[48].m1))
+#define XSTORM_SPQ_DATA_OFFSET(funcId) \
+        (IRO[32].base + ((funcId) * IRO[32].m1))
+#define XSTORM_SPQ_DATA_SIZE (IRO[32].size)
+#define XSTORM_SPQ_PAGE_BASE_OFFSET(funcId) \
+        (IRO[30].base + ((funcId) * IRO[30].m1))
+#define XSTORM_SPQ_PROD_OFFSET(funcId) \
+        (IRO[31].base + ((funcId) * IRO[31].m1))
+#define XSTORM_STATS_FLAGS_OFFSET(pfId) \
+        (IRO[43].base + ((pfId) * IRO[43].m1))
+#define XSTORM_TCP_GLOBAL_DEL_ACK_COUNTER_ENABLED_OFFSET(portId) \
+        (IRO[206].base + ((portId) * IRO[206].m1))
+#define XSTORM_TCP_GLOBAL_DEL_ACK_COUNTER_MAX_COUNT_OFFSET(portId) \
+        (IRO[207].base + ((portId) * IRO[207].m1))
+#define XSTORM_TCP_TX_SWS_TIMER_VAL_OFFSET(pfId) \
+        (IRO[209].base + (((pfId)>>1) * IRO[209].m1) + (((pfId)&1) * \
+        IRO[209].m2))
+#define XSTORM_VF_TO_PF_OFFSET(funcId) \
+        (IRO[52].base + ((funcId) * IRO[52].m1))
 #define COMMON_ASM_INVALID_ASSERT_OPCODE 0x0
 
-/**
-* This file defines HSI constants for the ETH flow
-*/
-#ifdef _EVEREST_MICROCODE
-#include "microcode_constants.h"
-#include "eth_rx_bd.h"
-#include "eth_tx_bd.h"
-#include "eth_rx_cqe.h"
-#include "eth_rx_sge.h"
-#include "eth_rx_cqe_next_page.h"
-#endif
-
 /* RSS hash types */
 #define DEFAULT_HASH_TYPE 0
 #define IPV4_HASH_TYPE 1
@@ -389,11 +292,17 @@
 #define U_ETH_NUM_OF_SGES_TO_FETCH 8
 #define U_ETH_MAX_SGES_FOR_PACKET 3
 
+/*Tx params*/
+#define X_ETH_NO_VLAN 0
+#define X_ETH_OUTBAND_VLAN 1
+#define X_ETH_INBAND_VLAN 2
 /* Rx ring params */
 #define U_ETH_LOCAL_BD_RING_SIZE 8
 #define U_ETH_LOCAL_SGE_RING_SIZE 10
 #define U_ETH_SGL_SIZE 8
-
+        /* The fw will padd the buffer with this value, so the IP header \
+        will be align to 4 Byte */
+#define IP_HEADER_ALIGNMENT_PADDING 2
 
 #define U_ETH_SGES_PER_PAGE_INVERSE_MASK \
         (0xFFFF - ((PAGE_SIZE/((STRUCT_SIZE(eth_rx_sge))/8))-1))
@@ -409,16 +318,15 @@
 #define U_ETH_UNDEFINED_Q 0xFF
 
 /* values of command IDs in the ramrod message */
-#define RAMROD_CMD_ID_ETH_PORT_SETUP 80
-#define RAMROD_CMD_ID_ETH_CLIENT_SETUP 85
-#define RAMROD_CMD_ID_ETH_STAT_QUERY 90
-#define RAMROD_CMD_ID_ETH_UPDATE 100
-#define RAMROD_CMD_ID_ETH_HALT 105
-#define RAMROD_CMD_ID_ETH_SET_MAC 110
-#define RAMROD_CMD_ID_ETH_CFC_DEL 115
-#define RAMROD_CMD_ID_ETH_PORT_DEL 120
-#define RAMROD_CMD_ID_ETH_FORWARD_SETUP 125
-
+#define RAMROD_CMD_ID_ETH_UNUSED 0
+#define RAMROD_CMD_ID_ETH_CLIENT_SETUP 1
+#define RAMROD_CMD_ID_ETH_UPDATE 2
+#define RAMROD_CMD_ID_ETH_HALT 3
+#define RAMROD_CMD_ID_ETH_FORWARD_SETUP 4
+#define RAMROD_CMD_ID_ETH_ACTIVATE 5
+#define RAMROD_CMD_ID_ETH_DEACTIVATE 6
+#define RAMROD_CMD_ID_ETH_EMPTY 7
+#define RAMROD_CMD_ID_ETH_TERMINATE 8
 
 /* command values for set mac command */
 #define T_ETH_MAC_COMMAND_SET 0
@@ -431,7 +339,9 @@
 
 /* Maximal L2 clients supported */
 #define ETH_MAX_RX_CLIENTS_E1 18
-#define ETH_MAX_RX_CLIENTS_E1H 26
+#define ETH_MAX_RX_CLIENTS_E1H 28
+
+#define MAX_STAT_COUNTER_ID ETH_MAX_RX_CLIENTS_E1H
 
 /* Maximal aggregation queues supported */
 #define ETH_MAX_AGGREGATION_QUEUES_E1 32
@@ -443,6 +353,20 @@
 #define ETH_RSS_MODE_VLAN_PRI 2
 #define ETH_RSS_MODE_E1HOV_PRI 3
 #define ETH_RSS_MODE_IP_DSCP 4
+#define ETH_RSS_MODE_E2_INTEG 5
+
+
+/* ETH vlan filtering modes */
+#define ETH_VLAN_FILTER_ANY_VLAN 0 /* Don't filter by vlan */
+#define ETH_VLAN_FILTER_SPECIFIC_VLAN \
+        1 /* Only the vlan_id is allowed */
+#define ETH_VLAN_FILTER_CLASSIFY \
+        2 /* vlan will be added to CAM for classification */
+
+/* Fast path CQE selection */
+#define ETH_FP_CQE_REGULAR 0
+#define ETH_FP_CQE_SGL 1
+#define ETH_FP_CQE_RAW 2
 
 
 /**
@@ -458,6 +382,7 @@
 #define RESERVED_CONNECTION_TYPE_0 5
 #define RESERVED_CONNECTION_TYPE_1 6
 #define RESERVED_CONNECTION_TYPE_2 7
+#define NONE_CONNECTION_TYPE 8
 
 
 #define PROTOCOL_STATE_BIT_OFFSET 6
@@ -466,6 +391,16 @@
 #define TOE_STATE (TOE_CONNECTION_TYPE << PROTOCOL_STATE_BIT_OFFSET)
 #define RDMA_STATE (RDMA_CONNECTION_TYPE << PROTOCOL_STATE_BIT_OFFSET)
 
+/* values of command IDs in the ramrod message */
+#define RAMROD_CMD_ID_COMMON_FUNCTION_START 1
+#define RAMROD_CMD_ID_COMMON_FUNCTION_STOP 2
+#define RAMROD_CMD_ID_COMMON_CFC_DEL 3
+#define RAMROD_CMD_ID_COMMON_CFC_DEL_WB 4
+#define RAMROD_CMD_ID_COMMON_SET_MAC 5
+#define RAMROD_CMD_ID_COMMON_STAT_QUERY 6
+#define RAMROD_CMD_ID_COMMON_STOP_TRAFFIC 7
+#define RAMROD_CMD_ID_COMMON_START_TRAFFIC 8
+
 /* microcode fixed page page size 4K (chains and ring segments) */
 #define MC_PAGE_SIZE 4096
 
@@ -473,46 +408,26 @@
 /* Host coalescing constants */
 #define HC_IGU_BC_MODE 0
 #define HC_IGU_NBC_MODE 1
+/* Host coalescing constants. E1 includes E1H as well */
+
+/* Number of indices per slow-path SB */
+#define HC_SP_SB_MAX_INDICES 16
+
+/* Number of indices per SB */
+#define HC_SB_MAX_INDICES_E1X 8
+#define HC_SB_MAX_INDICES_E2 8
+
+#define HC_SB_MAX_SB_E1X 32
+#define HC_SB_MAX_SB_E2 136
+
+#define HC_SP_SB_ID 0xde
 
 #define HC_REGULAR_SEGMENT 0
 #define HC_DEFAULT_SEGMENT 1
+#define HC_SB_MAX_SM 2
 
-/* index numbers */
-#define HC_USTORM_DEF_SB_NUM_INDICES 8
-#define HC_CSTORM_DEF_SB_NUM_INDICES 8
-#define HC_XSTORM_DEF_SB_NUM_INDICES 4
-#define HC_TSTORM_DEF_SB_NUM_INDICES 4
-#define HC_USTORM_SB_NUM_INDICES 4
-#define HC_CSTORM_SB_NUM_INDICES 4
-
-/* index values - which counter to update */
-
-#define HC_INDEX_U_TOE_RX_CQ_CONS 0
-#define HC_INDEX_U_ETH_RX_CQ_CONS 1
-#define HC_INDEX_U_ETH_RX_BD_CONS 2
-#define HC_INDEX_U_FCOE_EQ_CONS 3
-
-#define HC_INDEX_C_TOE_TX_CQ_CONS 0
-#define HC_INDEX_C_ETH_TX_CQ_CONS 1
-#define HC_INDEX_C_ISCSI_EQ_CONS 2
-
-#define HC_INDEX_DEF_X_SPQ_CONS 0
-
-#define HC_INDEX_DEF_C_RDMA_EQ_CONS 0
-#define HC_INDEX_DEF_C_RDMA_NAL_PROD 1
-#define HC_INDEX_DEF_C_ETH_FW_TX_CQ_CONS 2
-#define HC_INDEX_DEF_C_ETH_SLOW_PATH 3
-#define HC_INDEX_DEF_C_ETH_RDMA_CQ_CONS 4
-#define HC_INDEX_DEF_C_ETH_ISCSI_CQ_CONS 5
-#define HC_INDEX_DEF_C_ETH_FCOE_CQ_CONS 6
-
-#define HC_INDEX_DEF_U_ETH_RDMA_RX_CQ_CONS 0
-#define HC_INDEX_DEF_U_ETH_ISCSI_RX_CQ_CONS 1
-#define HC_INDEX_DEF_U_ETH_RDMA_RX_BD_CONS 2
-#define HC_INDEX_DEF_U_ETH_ISCSI_RX_BD_CONS 3
-#define HC_INDEX_DEF_U_ETH_FCOE_RX_CQ_CONS 4
-#define HC_INDEX_DEF_U_ETH_FCOE_RX_BD_CONS 5
-
+#define HC_SB_MAX_DYNAMIC_INDICES 4
+#define HC_FUNCTION_DISABLED 0xff
 /* used by the driver to get the SB offset */
 #define USTORM_ID 0
 #define CSTORM_ID 1
@@ -529,45 +444,17 @@
 
 
 /**** DEFINES FOR TIMERS/CLOCKS RESOLUTIONS ****/
-#define EMULATION_FREQUENCY_FACTOR 1600
-#define FPGA_FREQUENCY_FACTOR 100
 
 #define TIMERS_TICK_SIZE_CHIP (1e-3)
-#define TIMERS_TICK_SIZE_EMUL \
- ((TIMERS_TICK_SIZE_CHIP)/((EMULATION_FREQUENCY_FACTOR)))
-#define TIMERS_TICK_SIZE_FPGA \
- ((TIMERS_TICK_SIZE_CHIP)/((FPGA_FREQUENCY_FACTOR)))
 
 #define TSEMI_CLK1_RESUL_CHIP (1e-3)
-#define TSEMI_CLK1_RESUL_EMUL \
- ((TSEMI_CLK1_RESUL_CHIP)/(EMULATION_FREQUENCY_FACTOR))
-#define TSEMI_CLK1_RESUL_FPGA \
- ((TSEMI_CLK1_RESUL_CHIP)/(FPGA_FREQUENCY_FACTOR))
-
-#define USEMI_CLK1_RESUL_CHIP (TIMERS_TICK_SIZE_CHIP)
-#define USEMI_CLK1_RESUL_EMUL (TIMERS_TICK_SIZE_EMUL)
-#define USEMI_CLK1_RESUL_FPGA (TIMERS_TICK_SIZE_FPGA)
 
 #define XSEMI_CLK1_RESUL_CHIP (1e-3)
-#define XSEMI_CLK1_RESUL_EMUL \
- ((XSEMI_CLK1_RESUL_CHIP)/(EMULATION_FREQUENCY_FACTOR))
-#define XSEMI_CLK1_RESUL_FPGA \
- ((XSEMI_CLK1_RESUL_CHIP)/(FPGA_FREQUENCY_FACTOR))
-
-#define XSEMI_CLK2_RESUL_CHIP (1e-6)
-#define XSEMI_CLK2_RESUL_EMUL \
- ((XSEMI_CLK2_RESUL_CHIP)/(EMULATION_FREQUENCY_FACTOR))
-#define XSEMI_CLK2_RESUL_FPGA \
- ((XSEMI_CLK2_RESUL_CHIP)/(FPGA_FREQUENCY_FACTOR))
 
 #define SDM_TIMER_TICK_RESUL_CHIP (4*(1e-6))
-#define SDM_TIMER_TICK_RESUL_EMUL \
- ((SDM_TIMER_TICK_RESUL_CHIP)/(EMULATION_FREQUENCY_FACTOR))
-#define SDM_TIMER_TICK_RESUL_FPGA \
- ((SDM_TIMER_TICK_RESUL_CHIP)/(FPGA_FREQUENCY_FACTOR))
-
 
 /**** END DEFINES FOR TIMERS/CLOCKS RESOLUTIONS ****/
+
 #define XSTORM_IP_ID_ROLL_HALF 0x8000
 #define XSTORM_IP_ID_ROLL_ALL 0
 
@@ -576,10 +463,36 @@
 #define NUM_OF_PROTOCOLS 4
 #define NUM_OF_SAFC_BITS 16
 #define MAX_COS_NUMBER 4
-#define MAX_T_STAT_COUNTER_ID 18
-#define MAX_X_STAT_COUNTER_ID 18
-#define MAX_U_STAT_COUNTER_ID 18
 
+#define FAIRNESS_COS_WRR_MODE 0
+#define FAIRNESS_COS_ETS_MODE 1
+
+
+/* Priority Flow Control (PFC) */
+#define MAX_PFC_PRIORITIES 8
+#define MAX_PFC_TRAFFIC_TYPES 8
+
+/* Available Traffic Types for Link Layer Flow Control */
+#define LLFC_TRAFFIC_TYPE_NW 0
+#define LLFC_TRAFFIC_TYPE_FCOE 1
+#define LLFC_TRAFFIC_TYPE_ISCSI 2
+        /***************** START OF E2 INTEGRATION \
+        CODE***************************************/
+#define LLFC_TRAFFIC_TYPE_NW_COS1_E2INTEG 3
+        /***************** END OF E2 INTEGRATION \
+        CODE***************************************/
+#define LLFC_TRAFFIC_TYPE_MAX 4
+
+        /* used by array traffic_type_to_priority[] to mark traffic type \
+        that is not mapped to priority*/
+#define LLFC_TRAFFIC_TYPE_TO_PRIORITY_UNMAPPED 0xFF
+
+#define LLFC_MODE_NONE 0
+#define LLFC_MODE_PFC 1
+#define LLFC_MODE_SAFC 2
+
+#define DCB_DISABLED 0
+#define DCB_ENABLED 1
 
 #define UNKNOWN_ADDRESS 0
 #define UNICAST_ADDRESS 1
@@ -587,8 +500,32 @@
 #define BROADCAST_ADDRESS 3
 
 #define SINGLE_FUNCTION 0
-#define MULTI_FUNCTION 1
+#define MULTI_FUNCTION_SD 1
+#define MULTI_FUNCTION_SI 2
 
 #define IP_V4 0
 #define IP_V6 1
 
+
+#define C_ERES_PER_PAGE \
+        (PAGE_SIZE / BITS_TO_BYTES(STRUCT_SIZE(event_ring_elem)))
+#define C_ERE_PER_PAGE_MASK (C_ERES_PER_PAGE - 1)
+
+#define EVENT_RING_OPCODE_VF_PF_CHANNEL 0
+#define EVENT_RING_OPCODE_FUNCTION_START 1
+#define EVENT_RING_OPCODE_FUNCTION_STOP 2
+#define EVENT_RING_OPCODE_CFC_DEL 3
+#define EVENT_RING_OPCODE_CFC_DEL_WB 4
+#define EVENT_RING_OPCODE_SET_MAC 5
+#define EVENT_RING_OPCODE_STAT_QUERY 6
+#define EVENT_RING_OPCODE_STOP_TRAFFIC 7
+#define EVENT_RING_OPCODE_START_TRAFFIC 8
+#define EVENT_RING_OPCODE_FORWARD_SETUP 9
+
+#define VF_PF_CHANNEL_STATE_READY 0
+#define VF_PF_CHANNEL_STATE_WAITING_FOR_ACK 1
+
+#define VF_PF_CHANNEL_STATE_MAX_NUMBER 2
+
+
+#endif /* BNX2X_FW_DEFS_H */
diff --git a/drivers/net/bnx2x/bnx2x_fw_file_hdr.h b/drivers/net/bnx2x/bnx2x_fw_file_hdr.h
index 3f5ee5d7cc2a..f807262911e5 100644
--- a/drivers/net/bnx2x/bnx2x_fw_file_hdr.h
+++ b/drivers/net/bnx2x/bnx2x_fw_file_hdr.h
@@ -31,6 +31,7 @@ struct bnx2x_fw_file_hdr {
         struct bnx2x_fw_file_section csem_pram_data;
         struct bnx2x_fw_file_section xsem_int_table_data;
         struct bnx2x_fw_file_section xsem_pram_data;
+        struct bnx2x_fw_file_section iro_arr;
         struct bnx2x_fw_file_section fw_version;
 };
 
diff --git a/drivers/net/bnx2x/bnx2x_hsi.h b/drivers/net/bnx2x/bnx2x_hsi.h
index 60d141cd9950..18c8e23a0e82 100644
--- a/drivers/net/bnx2x/bnx2x_hsi.h
+++ b/drivers/net/bnx2x/bnx2x_hsi.h
@@ -6,6 +6,10 @@
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation.
  */
+#ifndef BNX2X_HSI_H
+#define BNX2X_HSI_H
+
+#include "bnx2x_fw_defs.h"
 
 struct license_key {
         u32 reserved[6];
@@ -326,6 +330,7 @@ struct port_hw_cfg {			    /* port 0: 0x12c  port 1: 0x2bc */
         u32 lane_config;
 #define PORT_HW_CFG_LANE_SWAP_CFG_MASK              0x0000ffff
 #define PORT_HW_CFG_LANE_SWAP_CFG_SHIFT             0
+
 #define PORT_HW_CFG_LANE_SWAP_CFG_TX_MASK           0x000000ff
 #define PORT_HW_CFG_LANE_SWAP_CFG_TX_SHIFT          0
 #define PORT_HW_CFG_LANE_SWAP_CFG_RX_MASK           0x0000ff00
@@ -658,6 +663,7 @@ struct shm_dev_info {						    /* size */
 #define FUNC_7                          7
 #define E1_FUNC_MAX                     2
 #define E1H_FUNC_MAX                    8
+#define E2_FUNC_MAX         4   /* per path */
 
 #define VN_0                            0
 #define VN_1                            1
@@ -816,6 +822,9 @@ struct drv_func_mb {
 #define FW_MSG_CODE_DRV_LOAD_COMMON                     0x10100000
 #define FW_MSG_CODE_DRV_LOAD_PORT                       0x10110000
 #define FW_MSG_CODE_DRV_LOAD_FUNCTION                   0x10120000
+        /* Load common chip is supported from bc 6.0.0  */
+#define REQ_BC_VER_4_DRV_LOAD_COMMON_CHIP       0x00060000
+#define FW_MSG_CODE_DRV_LOAD_COMMON_CHIP        0x10130000
 #define FW_MSG_CODE_DRV_LOAD_REFUSED                    0x10200000
 #define FW_MSG_CODE_DRV_LOAD_DONE                       0x11100000
 #define FW_MSG_CODE_DRV_UNLOAD_COMMON                   0x20100000
@@ -1016,11 +1025,22 @@ struct shmem_region {			       /*   SharedMem Offset (size) */
         struct mgmtfw_state     mgmtfw_state;          /* 0x4ac     (0x1b8) */
 
         struct drv_port_mb      port_mb[PORT_MAX];     /* 0x664 (16*2=0x20) */
-        struct drv_func_mb      func_mb[E1H_FUNC_MAX];
+        struct drv_func_mb      func_mb[];             /* 0x684
+                                             (44*2/4/8=0x58/0xb0/0x160) */
 
-        struct mf_cfg           mf_cfg;
+}; /* 57710 = 0x6dc | 57711 = 0x7E4 | 57712 = 0x734 */
 
-};                                                     /* 0x6dc */
+struct fw_flr_ack {
+        u32     pf_ack;
+        u32     vf_ack[1];
+        u32     iov_dis_ack;
+};
+
+struct fw_flr_mb {
+        u32     aggint;
+        u32     opgen_addr;
+        struct  fw_flr_ack ack;
+};
 
 
 struct shmem2_region {
@@ -1040,7 +1060,20 @@ struct shmem2_region {
          * For backwards compatibility, if the mf_cfg_addr does not exist
          * (the size filed is smaller than 0xc) the mf_cfg resides at the
          * end of struct shmem_region
+     */
+        u32     mf_cfg_addr;
+#define SHMEM_MF_CFG_ADDR_NONE                      0x00000000
+
+        struct fw_flr_mb flr_mb;
+        u32     reserved[3];
+        /*
+         * The other shmemX_base_addr holds the other path's shmem address
+         * required for example in case of common phy init, or for path1 to know
+         * the address of mcp debug trace which is located in offset from shmem
+         * of path0
          */
+        u32 other_shmem_base_addr;
+        u32 other_shmem2_base_addr;
 };
 
 
@@ -1096,7 +1129,7 @@ struct emac_stats {
 };
 
 
-struct bmac_stats {
+struct bmac1_stats {
     u32     tx_stat_gtpkt_lo;
     u32     tx_stat_gtpkt_hi;
     u32     tx_stat_gtxpf_lo;
@@ -1200,10 +1233,126 @@ struct bmac_stats {
     u32     rx_stat_gripj_hi;
 };
 
+struct bmac2_stats {
+        u32     tx_stat_gtpk_lo; /* gtpok */
+        u32     tx_stat_gtpk_hi; /* gtpok */
+        u32     tx_stat_gtxpf_lo; /* gtpf */
+        u32     tx_stat_gtxpf_hi; /* gtpf */
+        u32     tx_stat_gtpp_lo; /* NEW BMAC2 */
+        u32     tx_stat_gtpp_hi; /* NEW BMAC2 */
+        u32     tx_stat_gtfcs_lo;
+        u32     tx_stat_gtfcs_hi;
+        u32     tx_stat_gtuca_lo; /* NEW BMAC2 */
+        u32     tx_stat_gtuca_hi; /* NEW BMAC2 */
+        u32     tx_stat_gtmca_lo;
+        u32     tx_stat_gtmca_hi;
+        u32     tx_stat_gtbca_lo;
+        u32     tx_stat_gtbca_hi;
+        u32     tx_stat_gtovr_lo;
+        u32     tx_stat_gtovr_hi;
+        u32     tx_stat_gtfrg_lo;
+        u32     tx_stat_gtfrg_hi;
+        u32     tx_stat_gtpkt1_lo; /* gtpkt */
+        u32     tx_stat_gtpkt1_hi; /* gtpkt */
+        u32     tx_stat_gt64_lo;
+        u32     tx_stat_gt64_hi;
+        u32     tx_stat_gt127_lo;
+        u32     tx_stat_gt127_hi;
+        u32     tx_stat_gt255_lo;
+        u32     tx_stat_gt255_hi;
+        u32     tx_stat_gt511_lo;
+        u32     tx_stat_gt511_hi;
+        u32     tx_stat_gt1023_lo;
+        u32     tx_stat_gt1023_hi;
+        u32     tx_stat_gt1518_lo;
+        u32     tx_stat_gt1518_hi;
+        u32     tx_stat_gt2047_lo;
+        u32     tx_stat_gt2047_hi;
+        u32     tx_stat_gt4095_lo;
+        u32     tx_stat_gt4095_hi;
+        u32     tx_stat_gt9216_lo;
+        u32     tx_stat_gt9216_hi;
+        u32     tx_stat_gt16383_lo;
+        u32     tx_stat_gt16383_hi;
+        u32     tx_stat_gtmax_lo;
+        u32     tx_stat_gtmax_hi;
+        u32     tx_stat_gtufl_lo;
+        u32     tx_stat_gtufl_hi;
+        u32     tx_stat_gterr_lo;
+        u32     tx_stat_gterr_hi;
+        u32     tx_stat_gtbyt_lo;
+        u32     tx_stat_gtbyt_hi;
+
+        u32     rx_stat_gr64_lo;
+        u32     rx_stat_gr64_hi;
+        u32     rx_stat_gr127_lo;
+        u32     rx_stat_gr127_hi;
+        u32     rx_stat_gr255_lo;
+        u32     rx_stat_gr255_hi;
+        u32     rx_stat_gr511_lo;
+        u32     rx_stat_gr511_hi;
+        u32     rx_stat_gr1023_lo;
+        u32     rx_stat_gr1023_hi;
+        u32     rx_stat_gr1518_lo;
+        u32     rx_stat_gr1518_hi;
+        u32     rx_stat_gr2047_lo;
+        u32     rx_stat_gr2047_hi;
+        u32     rx_stat_gr4095_lo;
+        u32     rx_stat_gr4095_hi;
+        u32     rx_stat_gr9216_lo;
+        u32     rx_stat_gr9216_hi;
+        u32     rx_stat_gr16383_lo;
+        u32     rx_stat_gr16383_hi;
+        u32     rx_stat_grmax_lo;
+        u32     rx_stat_grmax_hi;
+        u32     rx_stat_grpkt_lo;
+        u32     rx_stat_grpkt_hi;
+        u32     rx_stat_grfcs_lo;
+        u32     rx_stat_grfcs_hi;
+        u32     rx_stat_gruca_lo;
+        u32     rx_stat_gruca_hi;
+        u32     rx_stat_grmca_lo;
+        u32     rx_stat_grmca_hi;
+        u32     rx_stat_grbca_lo;
+        u32     rx_stat_grbca_hi;
+        u32     rx_stat_grxpf_lo; /* grpf */
+        u32     rx_stat_grxpf_hi; /* grpf */
+        u32     rx_stat_grpp_lo;
+        u32     rx_stat_grpp_hi;
+        u32     rx_stat_grxuo_lo; /* gruo */
+        u32     rx_stat_grxuo_hi; /* gruo */
+        u32     rx_stat_grjbr_lo;
+        u32     rx_stat_grjbr_hi;
+        u32     rx_stat_grovr_lo;
+        u32     rx_stat_grovr_hi;
+        u32     rx_stat_grxcf_lo; /* grcf */
+        u32     rx_stat_grxcf_hi; /* grcf */
+        u32     rx_stat_grflr_lo;
+        u32     rx_stat_grflr_hi;
+        u32     rx_stat_grpok_lo;
+        u32     rx_stat_grpok_hi;
+        u32     rx_stat_grmeg_lo;
+        u32     rx_stat_grmeg_hi;
+        u32     rx_stat_grmeb_lo;
+        u32     rx_stat_grmeb_hi;
+        u32     rx_stat_grbyt_lo;
+        u32     rx_stat_grbyt_hi;
+        u32     rx_stat_grund_lo;
+        u32     rx_stat_grund_hi;
+        u32     rx_stat_grfrg_lo;
+        u32     rx_stat_grfrg_hi;
+        u32     rx_stat_grerb_lo; /* grerrbyt */
+        u32     rx_stat_grerb_hi; /* grerrbyt */
+        u32     rx_stat_grfre_lo; /* grfrerr */
+        u32     rx_stat_grfre_hi; /* grfrerr */
+        u32     rx_stat_gripj_lo;
+        u32     rx_stat_gripj_hi;
+};
 
 union mac_stats {
-    struct emac_stats   emac_stats;
-    struct bmac_stats   bmac_stats;
+        struct emac_stats        emac_stats;
+        struct bmac1_stats       bmac1_stats;
+        struct bmac2_stats       bmac2_stats;
 };
 
 
@@ -1377,17 +1526,17 @@ struct host_func_stats {
 };
 
 
-#define BCM_5710_FW_MAJOR_VERSION                       5
-#define BCM_5710_FW_MINOR_VERSION                       2
-#define BCM_5710_FW_REVISION_VERSION                    13
-#define BCM_5710_FW_ENGINEERING_VERSION                 0
+#define BCM_5710_FW_MAJOR_VERSION                       6
+#define BCM_5710_FW_MINOR_VERSION                       0
+#define BCM_5710_FW_REVISION_VERSION                    34
+#define BCM_5710_FW_ENGINEERING_VERSION                 0
 #define BCM_5710_FW_COMPILE_FLAGS                       1
 
 
 /*
  * attention bits
  */
-struct atten_def_status_block {
+struct atten_sp_status_block {
         __le32 attn_bits;
         __le32 attn_bits_ack;
         u8 status_block_id;
@@ -1445,7 +1594,60 @@ struct doorbell_set_prod {
 
 
 /*
- * IGU driver acknowledgement register
+ * 3 lines. status block
+ */
+struct hc_status_block_e1x {
+        __le16 index_values[HC_SB_MAX_INDICES_E1X];
+        __le16 running_index[HC_SB_MAX_SM];
+        u32 rsrv;
+};
+
+/*
+ * host status block
+ */
+struct host_hc_status_block_e1x {
+        struct hc_status_block_e1x sb;
+};
+
+
+/*
+ * 3 lines. status block
+ */
+struct hc_status_block_e2 {
+        __le16 index_values[HC_SB_MAX_INDICES_E2];
+        __le16 running_index[HC_SB_MAX_SM];
+        u32 reserved;
+};
+
+/*
+ * host status block
+ */
+struct host_hc_status_block_e2 {
+        struct hc_status_block_e2 sb;
+};
+
+
+/*
+ * 5 lines. slow-path status block
+ */
+struct hc_sp_status_block {
+        __le16 index_values[HC_SP_SB_MAX_INDICES];
+        __le16 running_index;
+        __le16 rsrv;
+        u32 rsrv1;
+};
+
+/*
+ * host status block
+ */
+struct host_sp_status_block {
+        struct atten_sp_status_block atten_status_block;
+        struct hc_sp_status_block sp_sb;
+};
+
+
+/*
+ * IGU driver acknowledgment register
  */
 struct igu_ack_register {
 #if defined(__BIG_ENDIAN)
@@ -1535,6 +1737,24 @@ union igu_consprod_reg {
 
 
 /*
+ * Control register for the IGU command register
+ */
+struct igu_ctrl_reg {
+        u32 ctrl_data;
+#define IGU_CTRL_REG_ADDRESS (0xFFF<<0)
+#define IGU_CTRL_REG_ADDRESS_SHIFT 0
+#define IGU_CTRL_REG_FID (0x7F<<12)
+#define IGU_CTRL_REG_FID_SHIFT 12
+#define IGU_CTRL_REG_RESERVED (0x1<<19)
+#define IGU_CTRL_REG_RESERVED_SHIFT 19
+#define IGU_CTRL_REG_TYPE (0x1<<20)
+#define IGU_CTRL_REG_TYPE_SHIFT 20
+#define IGU_CTRL_REG_UNUSED (0x7FF<<21)
+#define IGU_CTRL_REG_UNUSED_SHIFT 21
+};
+
+
+/*
  * Parser parsing flags field
  */
 struct parsing_flags {
@@ -1603,8 +1823,14 @@ struct dmae_command {
 #define DMAE_COMMAND_DST_RESET_SHIFT 14
 #define DMAE_COMMAND_E1HVN (0x3<<15)
 #define DMAE_COMMAND_E1HVN_SHIFT 15
-#define DMAE_COMMAND_RESERVED0 (0x7FFF<<17)
-#define DMAE_COMMAND_RESERVED0_SHIFT 17
+#define DMAE_COMMAND_DST_VN (0x3<<17)
+#define DMAE_COMMAND_DST_VN_SHIFT 17
+#define DMAE_COMMAND_C_FUNC (0x1<<19)
+#define DMAE_COMMAND_C_FUNC_SHIFT 19
+#define DMAE_COMMAND_ERR_POLICY (0x3<<20)
+#define DMAE_COMMAND_ERR_POLICY_SHIFT 20
+#define DMAE_COMMAND_RESERVED0 (0x3FF<<22)
+#define DMAE_COMMAND_RESERVED0_SHIFT 22
         u32 src_addr_lo;
         u32 src_addr_hi;
         u32 dst_addr_lo;
@@ -1629,11 +1855,11 @@ struct dmae_command {
         u16 crc16_c;
 #endif
 #if defined(__BIG_ENDIAN)
-        u16 reserved2;
+        u16 reserved3;
         u16 crc_t10;
 #elif defined(__LITTLE_ENDIAN)
         u16 crc_t10;
-        u16 reserved2;
+        u16 reserved3;
 #endif
 #if defined(__BIG_ENDIAN)
         u16 xsum8;
@@ -1654,96 +1880,20 @@ struct double_regpair {
 
 
 /*
- * The eth storm context of Ustorm (configuration part)
+ * SDM operation gen command (generate aggregative interrupt)
  */
-struct ustorm_eth_st_context_config {
-#if defined(__BIG_ENDIAN)
-        u8 flags;
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_MC_ALIGNMENT (0x1<<0)
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_MC_ALIGNMENT_SHIFT 0
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_DYNAMIC_HC (0x1<<1)
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_DYNAMIC_HC_SHIFT 1
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_TPA (0x1<<2)
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_TPA_SHIFT 2
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_STATISTICS (0x1<<3)
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_STATISTICS_SHIFT 3
-#define __USTORM_ETH_ST_CONTEXT_CONFIG_RESERVED0 (0xF<<4)
-#define __USTORM_ETH_ST_CONTEXT_CONFIG_RESERVED0_SHIFT 4
-        u8 status_block_id;
-        u8 clientId;
-        u8 sb_index_numbers;
-#define USTORM_ETH_ST_CONTEXT_CONFIG_CQE_SB_INDEX_NUMBER (0xF<<0)
-#define USTORM_ETH_ST_CONTEXT_CONFIG_CQE_SB_INDEX_NUMBER_SHIFT 0
-#define USTORM_ETH_ST_CONTEXT_CONFIG_BD_SB_INDEX_NUMBER (0xF<<4)
-#define USTORM_ETH_ST_CONTEXT_CONFIG_BD_SB_INDEX_NUMBER_SHIFT 4
-#elif defined(__LITTLE_ENDIAN)
-        u8 sb_index_numbers;
-#define USTORM_ETH_ST_CONTEXT_CONFIG_CQE_SB_INDEX_NUMBER (0xF<<0)
-#define USTORM_ETH_ST_CONTEXT_CONFIG_CQE_SB_INDEX_NUMBER_SHIFT 0
-#define USTORM_ETH_ST_CONTEXT_CONFIG_BD_SB_INDEX_NUMBER (0xF<<4)
-#define USTORM_ETH_ST_CONTEXT_CONFIG_BD_SB_INDEX_NUMBER_SHIFT 4
-        u8 clientId;
-        u8 status_block_id;
-        u8 flags;
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_MC_ALIGNMENT (0x1<<0)
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_MC_ALIGNMENT_SHIFT 0
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_DYNAMIC_HC (0x1<<1)
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_DYNAMIC_HC_SHIFT 1
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_TPA (0x1<<2)
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_TPA_SHIFT 2
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_STATISTICS (0x1<<3)
-#define USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_STATISTICS_SHIFT 3
-#define __USTORM_ETH_ST_CONTEXT_CONFIG_RESERVED0 (0xF<<4)
-#define __USTORM_ETH_ST_CONTEXT_CONFIG_RESERVED0_SHIFT 4
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 bd_buff_size;
-        u8 statistics_counter_id;
-        u8 mc_alignment_log_size;
-#elif defined(__LITTLE_ENDIAN)
-        u8 mc_alignment_log_size;
-        u8 statistics_counter_id;
-        u16 bd_buff_size;
-#endif
-#if defined(__BIG_ENDIAN)
-        u8 __local_sge_prod;
-        u8 __local_bd_prod;
-        u16 sge_buff_size;
-#elif defined(__LITTLE_ENDIAN)
-        u16 sge_buff_size;
-        u8 __local_bd_prod;
-        u8 __local_sge_prod;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __sdm_bd_expected_counter;
-        u8 cstorm_agg_int;
-        u8 __expected_bds_on_ram;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __expected_bds_on_ram;
-        u8 cstorm_agg_int;
-        u16 __sdm_bd_expected_counter;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __ring_data_ram_addr;
-        u16 __hc_cstorm_ram_addr;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __hc_cstorm_ram_addr;
-        u16 __ring_data_ram_addr;
-#endif
-#if defined(__BIG_ENDIAN)
-        u8 reserved1;
-        u8 max_sges_for_packet;
-        u16 __bd_ring_ram_addr;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __bd_ring_ram_addr;
-        u8 max_sges_for_packet;
-        u8 reserved1;
-#endif
-        u32 bd_page_base_lo;
-        u32 bd_page_base_hi;
-        u32 sge_page_base_lo;
-        u32 sge_page_base_hi;
-        struct regpair reserved2;
+struct sdm_op_gen {
+        __le32 command;
+#define SDM_OP_GEN_COMP_PARAM (0x1F<<0)
+#define SDM_OP_GEN_COMP_PARAM_SHIFT 0
+#define SDM_OP_GEN_COMP_TYPE (0x7<<5)
+#define SDM_OP_GEN_COMP_TYPE_SHIFT 5
+#define SDM_OP_GEN_AGG_VECT_IDX (0xFF<<8)
+#define SDM_OP_GEN_AGG_VECT_IDX_SHIFT 8
+#define SDM_OP_GEN_AGG_VECT_IDX_VALID (0x1<<16)
+#define SDM_OP_GEN_AGG_VECT_IDX_VALID_SHIFT 16
+#define SDM_OP_GEN_RESERVED (0x7FFF<<17)
+#define SDM_OP_GEN_RESERVED_SHIFT 17
 };
 
 /*
@@ -1762,20 +1912,13 @@ struct eth_rx_sge {
         __le32 addr_hi;
 };
 
-/*
- * Local BDs and SGEs rings (in ETH)
- */
-struct eth_local_rx_rings {
-        struct eth_rx_bd __local_bd_ring[8];
-        struct eth_rx_sge __local_sge_ring[10];
-};
+
 
 /*
  * The eth storm context of Ustorm
  */
 struct ustorm_eth_st_context {
-        struct ustorm_eth_st_context_config common;
-        struct eth_local_rx_rings __rings;
+        u32 reserved0[48];
 };
 
 /*
@@ -1786,337 +1929,53 @@ struct tstorm_eth_st_context {
 };
 
 /*
- * The eth aggregative context section of Xstorm
- */
-struct xstorm_eth_extra_ag_context_section {
-#if defined(__BIG_ENDIAN)
-        u8 __tcp_agg_vars1;
-        u8 __reserved50;
-        u16 __mss;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __mss;
-        u8 __reserved50;
-        u8 __tcp_agg_vars1;
-#endif
-        u32 __snd_nxt;
-        u32 __tx_wnd;
-        u32 __snd_una;
-        u32 __reserved53;
-#if defined(__BIG_ENDIAN)
-        u8 __agg_val8_th;
-        u8 __agg_val8;
-        u16 __tcp_agg_vars2;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __tcp_agg_vars2;
-        u8 __agg_val8;
-        u8 __agg_val8_th;
-#endif
-        u32 __reserved58;
-        u32 __reserved59;
-        u32 __reserved60;
-        u32 __reserved61;
-#if defined(__BIG_ENDIAN)
-        u16 __agg_val7_th;
-        u16 __agg_val7;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __agg_val7;
-        u16 __agg_val7_th;
-#endif
-#if defined(__BIG_ENDIAN)
-        u8 __tcp_agg_vars5;
-        u8 __tcp_agg_vars4;
-        u8 __tcp_agg_vars3;
-        u8 __reserved62;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __reserved62;
-        u8 __tcp_agg_vars3;
-        u8 __tcp_agg_vars4;
-        u8 __tcp_agg_vars5;
-#endif
-        u32 __tcp_agg_vars6;
-#if defined(__BIG_ENDIAN)
-        u16 __agg_misc6;
-        u16 __tcp_agg_vars7;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __tcp_agg_vars7;
-        u16 __agg_misc6;
-#endif
-        u32 __agg_val10;
-        u32 __agg_val10_th;
-#if defined(__BIG_ENDIAN)
-        u16 __reserved3;
-        u8 __reserved2;
-        u8 __da_only_cnt;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __da_only_cnt;
-        u8 __reserved2;
-        u16 __reserved3;
-#endif
-};
-
-/*
  * The eth aggregative context of Xstorm
  */
 struct xstorm_eth_ag_context {
-#if defined(__BIG_ENDIAN)
-        u16 agg_val1;
-        u8 __agg_vars1;
-        u8 __state;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __state;
-        u8 __agg_vars1;
-        u16 agg_val1;
-#endif
+        u32 reserved0;
 #if defined(__BIG_ENDIAN)
         u8 cdu_reserved;
-        u8 __agg_vars4;
-        u8 __agg_vars3;
-        u8 __agg_vars2;
+        u8 reserved2;
+        u16 reserved1;
 #elif defined(__LITTLE_ENDIAN)
-        u8 __agg_vars2;
-        u8 __agg_vars3;
-        u8 __agg_vars4;
+        u16 reserved1;
+        u8 reserved2;
         u8 cdu_reserved;
 #endif
-        u32 __bd_prod;
-#if defined(__BIG_ENDIAN)
-        u16 __agg_vars5;
-        u16 __agg_val4_th;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __agg_val4_th;
-        u16 __agg_vars5;
-#endif
-        struct xstorm_eth_extra_ag_context_section __extra_section;
-#if defined(__BIG_ENDIAN)
-        u16 __agg_vars7;
-        u8 __agg_val3_th;
-        u8 __agg_vars6;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __agg_vars6;
-        u8 __agg_val3_th;
-        u16 __agg_vars7;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __agg_val11_th;
-        u16 __agg_val11;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __agg_val11;
-        u16 __agg_val11_th;
-#endif
-#if defined(__BIG_ENDIAN)
-        u8 __reserved1;
-        u8 __agg_val6_th;
-        u16 __agg_val9;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __agg_val9;
-        u8 __agg_val6_th;
-        u8 __reserved1;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __agg_val2_th;
-        u16 __agg_val2;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __agg_val2;
-        u16 __agg_val2_th;
-#endif
-        u32 __agg_vars8;
-#if defined(__BIG_ENDIAN)
-        u16 __agg_misc0;
-        u16 __agg_val4;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __agg_val4;
-        u16 __agg_misc0;
-#endif
-#if defined(__BIG_ENDIAN)
-        u8 __agg_val3;
-        u8 __agg_val6;
-        u8 __agg_val5_th;
-        u8 __agg_val5;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __agg_val5;
-        u8 __agg_val5_th;
-        u8 __agg_val6;
-        u8 __agg_val3;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __agg_misc1;
-        u16 __bd_ind_max_val;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __bd_ind_max_val;
-        u16 __agg_misc1;
-#endif
-        u32 __reserved57;
-        u32 __agg_misc4;
-        u32 __agg_misc5;
-};
-
-/*
- * The eth extra aggregative context section of Tstorm
- */
-struct tstorm_eth_extra_ag_context_section {
-        u32 __agg_val1;
-#if defined(__BIG_ENDIAN)
-        u8 __tcp_agg_vars2;
-        u8 __agg_val3;
-        u16 __agg_val2;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __agg_val2;
-        u8 __agg_val3;
-        u8 __tcp_agg_vars2;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __agg_val5;
-        u8 __agg_val6;
-        u8 __tcp_agg_vars3;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __tcp_agg_vars3;
-        u8 __agg_val6;
-        u16 __agg_val5;
-#endif
-        u32 __reserved63;
-        u32 __reserved64;
-        u32 __reserved65;
-        u32 __reserved66;
-        u32 __reserved67;
-        u32 __tcp_agg_vars1;
-        u32 __reserved61;
-        u32 __reserved62;
-        u32 __reserved2;
+        u32 reserved3[30];
 };
 
 /*
  * The eth aggregative context of Tstorm
  */
 struct tstorm_eth_ag_context {
-#if defined(__BIG_ENDIAN)
-        u16 __reserved54;
-        u8 __agg_vars1;
-        u8 __state;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __state;
-        u8 __agg_vars1;
-        u16 __reserved54;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __agg_val4;
-        u16 __agg_vars2;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __agg_vars2;
-        u16 __agg_val4;
-#endif
-        struct tstorm_eth_extra_ag_context_section __extra_section;
+        u32 __reserved0[14];
 };
 
+
 /*
  * The eth aggregative context of Cstorm
  */
 struct cstorm_eth_ag_context {
-        u32 __agg_vars1;
-#if defined(__BIG_ENDIAN)
-        u8 __aux1_th;
-        u8 __aux1_val;
-        u16 __agg_vars2;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __agg_vars2;
-        u8 __aux1_val;
-        u8 __aux1_th;
-#endif
-        u32 __num_of_treated_packet;
-        u32 __last_packet_treated;
-#if defined(__BIG_ENDIAN)
-        u16 __reserved58;
-        u16 __reserved57;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __reserved57;
-        u16 __reserved58;
-#endif
-#if defined(__BIG_ENDIAN)
-        u8 __reserved62;
-        u8 __reserved61;
-        u8 __reserved60;
-        u8 __reserved59;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __reserved59;
-        u8 __reserved60;
-        u8 __reserved61;
-        u8 __reserved62;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __reserved64;
-        u16 __reserved63;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __reserved63;
-        u16 __reserved64;
-#endif
-        u32 __reserved65;
-#if defined(__BIG_ENDIAN)
-        u16 __agg_vars3;
-        u16 __rq_inv_cnt;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __rq_inv_cnt;
-        u16 __agg_vars3;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __packet_index_th;
-        u16 __packet_index;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __packet_index;
-        u16 __packet_index_th;
-#endif
+        u32 __reserved0[10];
 };
 
+
 /*
  * The eth aggregative context of Ustorm
  */
 struct ustorm_eth_ag_context {
-#if defined(__BIG_ENDIAN)
-        u8 __aux_counter_flags;
-        u8 __agg_vars2;
-        u8 __agg_vars1;
-        u8 __state;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __state;
-        u8 __agg_vars1;
-        u8 __agg_vars2;
-        u8 __aux_counter_flags;
-#endif
+        u32 __reserved0;
 #if defined(__BIG_ENDIAN)
         u8 cdu_usage;
-        u8 __agg_misc2;
-        u16 __agg_misc1;
+        u8 __reserved2;
+        u16 __reserved1;
 #elif defined(__LITTLE_ENDIAN)
-        u16 __agg_misc1;
-        u8 __agg_misc2;
+        u16 __reserved1;
+        u8 __reserved2;
         u8 cdu_usage;
 #endif
-        u32 __agg_misc4;
-#if defined(__BIG_ENDIAN)
-        u8 __agg_val3_th;
-        u8 __agg_val3;
-        u16 __agg_misc3;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __agg_misc3;
-        u8 __agg_val3;
-        u8 __agg_val3_th;
-#endif
-        u32 __agg_val1;
-        u32 __agg_misc4_th;
-#if defined(__BIG_ENDIAN)
-        u16 __agg_val2_th;
-        u16 __agg_val2;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __agg_val2;
-        u16 __agg_val2_th;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __reserved2;
-        u8 __decision_rules;
-        u8 __decision_rule_enable_bits;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __decision_rule_enable_bits;
-        u8 __decision_rules;
-        u16 __reserved2;
-#endif
+        u32 __reserved3[6];
 };
 
 /*
@@ -2140,18 +1999,16 @@ struct timers_block_context {
  */
 struct eth_tx_bd_flags {
         u8 as_bitfield;
-#define ETH_TX_BD_FLAGS_VLAN_TAG (0x1<<0)
-#define ETH_TX_BD_FLAGS_VLAN_TAG_SHIFT 0
-#define ETH_TX_BD_FLAGS_IP_CSUM (0x1<<1)
-#define ETH_TX_BD_FLAGS_IP_CSUM_SHIFT 1
-#define ETH_TX_BD_FLAGS_L4_CSUM (0x1<<2)
-#define ETH_TX_BD_FLAGS_L4_CSUM_SHIFT 2
-#define ETH_TX_BD_FLAGS_END_BD (0x1<<3)
-#define ETH_TX_BD_FLAGS_END_BD_SHIFT 3
+#define ETH_TX_BD_FLAGS_IP_CSUM (0x1<<0)
+#define ETH_TX_BD_FLAGS_IP_CSUM_SHIFT 0
+#define ETH_TX_BD_FLAGS_L4_CSUM (0x1<<1)
+#define ETH_TX_BD_FLAGS_L4_CSUM_SHIFT 1
+#define ETH_TX_BD_FLAGS_VLAN_MODE (0x3<<2)
+#define ETH_TX_BD_FLAGS_VLAN_MODE_SHIFT 2
 #define ETH_TX_BD_FLAGS_START_BD (0x1<<4)
 #define ETH_TX_BD_FLAGS_START_BD_SHIFT 4
-#define ETH_TX_BD_FLAGS_HDR_POOL (0x1<<5)
-#define ETH_TX_BD_FLAGS_HDR_POOL_SHIFT 5
+#define ETH_TX_BD_FLAGS_IS_UDP (0x1<<5)
+#define ETH_TX_BD_FLAGS_IS_UDP_SHIFT 5
 #define ETH_TX_BD_FLAGS_SW_LSO (0x1<<6)
 #define ETH_TX_BD_FLAGS_SW_LSO_SHIFT 6
 #define ETH_TX_BD_FLAGS_IPV6 (0x1<<7)
@@ -2166,7 +2023,7 @@ struct eth_tx_start_bd {
         __le32 addr_hi;
         __le16 nbd;
         __le16 nbytes;
-        __le16 vlan;
+        __le16 vlan_or_ethertype;
         struct eth_tx_bd_flags bd_flags;
         u8 general_data;
 #define ETH_TX_START_BD_HDR_NBDS (0x3F<<0)
@@ -2179,48 +2036,48 @@ struct eth_tx_start_bd {
  * Tx regular BD structure
  */
 struct eth_tx_bd {
-        u32 addr_lo;
-        u32 addr_hi;
-        u16 total_pkt_bytes;
-        u16 nbytes;
+        __le32 addr_lo;
+        __le32 addr_hi;
+        __le16 total_pkt_bytes;
+        __le16 nbytes;
         u8 reserved[4];
 };
 
 /*
- * Tx parsing BD structure for ETH,Relevant in START
+ * Tx parsing BD structure for ETH E1/E1h
  */
-struct eth_tx_parse_bd {
+struct eth_tx_parse_bd_e1x {
         u8 global_data;
-#define ETH_TX_PARSE_BD_IP_HDR_START_OFFSET (0xF<<0)
-#define ETH_TX_PARSE_BD_IP_HDR_START_OFFSET_SHIFT 0
-#define ETH_TX_PARSE_BD_UDP_CS_FLG (0x1<<4)
-#define ETH_TX_PARSE_BD_UDP_CS_FLG_SHIFT 4
-#define ETH_TX_PARSE_BD_PSEUDO_CS_WITHOUT_LEN (0x1<<5)
-#define ETH_TX_PARSE_BD_PSEUDO_CS_WITHOUT_LEN_SHIFT 5
-#define ETH_TX_PARSE_BD_LLC_SNAP_EN (0x1<<6)
-#define ETH_TX_PARSE_BD_LLC_SNAP_EN_SHIFT 6
-#define ETH_TX_PARSE_BD_NS_FLG (0x1<<7)
-#define ETH_TX_PARSE_BD_NS_FLG_SHIFT 7
+#define ETH_TX_PARSE_BD_E1X_IP_HDR_START_OFFSET_W (0xF<<0)
+#define ETH_TX_PARSE_BD_E1X_IP_HDR_START_OFFSET_W_SHIFT 0
+#define ETH_TX_PARSE_BD_E1X_RESERVED0 (0x1<<4)
+#define ETH_TX_PARSE_BD_E1X_RESERVED0_SHIFT 4
+#define ETH_TX_PARSE_BD_E1X_PSEUDO_CS_WITHOUT_LEN (0x1<<5)
+#define ETH_TX_PARSE_BD_E1X_PSEUDO_CS_WITHOUT_LEN_SHIFT 5
+#define ETH_TX_PARSE_BD_E1X_LLC_SNAP_EN (0x1<<6)
+#define ETH_TX_PARSE_BD_E1X_LLC_SNAP_EN_SHIFT 6
+#define ETH_TX_PARSE_BD_E1X_NS_FLG (0x1<<7)
+#define ETH_TX_PARSE_BD_E1X_NS_FLG_SHIFT 7
         u8 tcp_flags;
-#define ETH_TX_PARSE_BD_FIN_FLG (0x1<<0)
-#define ETH_TX_PARSE_BD_FIN_FLG_SHIFT 0
-#define ETH_TX_PARSE_BD_SYN_FLG (0x1<<1)
-#define ETH_TX_PARSE_BD_SYN_FLG_SHIFT 1
-#define ETH_TX_PARSE_BD_RST_FLG (0x1<<2)
-#define ETH_TX_PARSE_BD_RST_FLG_SHIFT 2
-#define ETH_TX_PARSE_BD_PSH_FLG (0x1<<3)
-#define ETH_TX_PARSE_BD_PSH_FLG_SHIFT 3
-#define ETH_TX_PARSE_BD_ACK_FLG (0x1<<4)
-#define ETH_TX_PARSE_BD_ACK_FLG_SHIFT 4
-#define ETH_TX_PARSE_BD_URG_FLG (0x1<<5)
-#define ETH_TX_PARSE_BD_URG_FLG_SHIFT 5
-#define ETH_TX_PARSE_BD_ECE_FLG (0x1<<6)
-#define ETH_TX_PARSE_BD_ECE_FLG_SHIFT 6
-#define ETH_TX_PARSE_BD_CWR_FLG (0x1<<7)
-#define ETH_TX_PARSE_BD_CWR_FLG_SHIFT 7
-        u8 ip_hlen;
+#define ETH_TX_PARSE_BD_E1X_FIN_FLG (0x1<<0)
+#define ETH_TX_PARSE_BD_E1X_FIN_FLG_SHIFT 0
+#define ETH_TX_PARSE_BD_E1X_SYN_FLG (0x1<<1)
+#define ETH_TX_PARSE_BD_E1X_SYN_FLG_SHIFT 1
+#define ETH_TX_PARSE_BD_E1X_RST_FLG (0x1<<2)
+#define ETH_TX_PARSE_BD_E1X_RST_FLG_SHIFT 2
+#define ETH_TX_PARSE_BD_E1X_PSH_FLG (0x1<<3)
+#define ETH_TX_PARSE_BD_E1X_PSH_FLG_SHIFT 3
+#define ETH_TX_PARSE_BD_E1X_ACK_FLG (0x1<<4)
+#define ETH_TX_PARSE_BD_E1X_ACK_FLG_SHIFT 4
+#define ETH_TX_PARSE_BD_E1X_URG_FLG (0x1<<5)
+#define ETH_TX_PARSE_BD_E1X_URG_FLG_SHIFT 5
+#define ETH_TX_PARSE_BD_E1X_ECE_FLG (0x1<<6)
+#define ETH_TX_PARSE_BD_E1X_ECE_FLG_SHIFT 6
+#define ETH_TX_PARSE_BD_E1X_CWR_FLG (0x1<<7)
+#define ETH_TX_PARSE_BD_E1X_CWR_FLG_SHIFT 7
+        u8 ip_hlen_w;
         s8 reserved;
-        __le16 total_hlen;
+        __le16 total_hlen_w;
         __le16 tcp_pseudo_csum;
         __le16 lso_mss;
         __le16 ip_id;
@@ -2228,6 +2085,27 @@ struct eth_tx_parse_bd {
 };
 
 /*
+ * Tx parsing BD structure for ETH E2
+ */
+struct eth_tx_parse_bd_e2 {
+        __le16 dst_mac_addr_lo;
+        __le16 dst_mac_addr_mid;
+        __le16 dst_mac_addr_hi;
+        __le16 src_mac_addr_lo;
+        __le16 src_mac_addr_mid;
+        __le16 src_mac_addr_hi;
+        __le32 parsing_data;
+#define ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W (0x1FFF<<0)
+#define ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W_SHIFT 0
+#define ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW (0xF<<13)
+#define ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW_SHIFT 13
+#define ETH_TX_PARSE_BD_E2_LSO_MSS (0x3FFF<<17)
+#define ETH_TX_PARSE_BD_E2_LSO_MSS_SHIFT 17
+#define ETH_TX_PARSE_BD_E2_IPV6_WITH_EXT_HDR (0x1<<31)
+#define ETH_TX_PARSE_BD_E2_IPV6_WITH_EXT_HDR_SHIFT 31
+};
+
+/*
  * The last BD in the BD memory will hold a pointer to the next BD memory
  */
 struct eth_tx_next_bd {
@@ -2242,79 +2120,24 @@ struct eth_tx_next_bd {
 union eth_tx_bd_types {
         struct eth_tx_start_bd start_bd;
         struct eth_tx_bd reg_bd;
-        struct eth_tx_parse_bd parse_bd;
+        struct eth_tx_parse_bd_e1x parse_bd_e1x;
+        struct eth_tx_parse_bd_e2 parse_bd_e2;
         struct eth_tx_next_bd next_bd;
 };
 
+
 /*
  * The eth storm context of Xstorm
  */
 struct xstorm_eth_st_context {
-        u32 tx_bd_page_base_lo;
-        u32 tx_bd_page_base_hi;
-#if defined(__BIG_ENDIAN)
-        u16 tx_bd_cons;
-        u8 statistics_data;
-#define XSTORM_ETH_ST_CONTEXT_STATISTICS_COUNTER_ID (0x7F<<0)
-#define XSTORM_ETH_ST_CONTEXT_STATISTICS_COUNTER_ID_SHIFT 0
-#define XSTORM_ETH_ST_CONTEXT_STATISTICS_ENABLE (0x1<<7)
-#define XSTORM_ETH_ST_CONTEXT_STATISTICS_ENABLE_SHIFT 7
-        u8 __local_tx_bd_prod;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __local_tx_bd_prod;
-        u8 statistics_data;
-#define XSTORM_ETH_ST_CONTEXT_STATISTICS_COUNTER_ID (0x7F<<0)
-#define XSTORM_ETH_ST_CONTEXT_STATISTICS_COUNTER_ID_SHIFT 0
-#define XSTORM_ETH_ST_CONTEXT_STATISTICS_ENABLE (0x1<<7)
-#define XSTORM_ETH_ST_CONTEXT_STATISTICS_ENABLE_SHIFT 7
-        u16 tx_bd_cons;
-#endif
-        u32 __reserved1;
-        u32 __reserved2;
-#if defined(__BIG_ENDIAN)
-        u8 __ram_cache_index;
-        u8 __double_buffer_client;
-        u16 __pkt_cons;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __pkt_cons;
-        u8 __double_buffer_client;
-        u8 __ram_cache_index;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __statistics_address;
-        u16 __gso_next;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __gso_next;
-        u16 __statistics_address;
-#endif
-#if defined(__BIG_ENDIAN)
-        u8 __local_tx_bd_cons;
-        u8 safc_group_num;
-        u8 safc_group_en;
-        u8 __is_eth_conn;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __is_eth_conn;
-        u8 safc_group_en;
-        u8 safc_group_num;
-        u8 __local_tx_bd_cons;
-#endif
-        union eth_tx_bd_types __bds[13];
+        u32 reserved0[60];
 };
 
 /*
  * The eth storm context of Cstorm
  */
 struct cstorm_eth_st_context {
-#if defined(__BIG_ENDIAN)
-        u16 __reserved0;
-        u8 sb_index_number;
-        u8 status_block_id;
-#elif defined(__LITTLE_ENDIAN)
-        u8 status_block_id;
-        u8 sb_index_number;
-        u16 __reserved0;
-#endif
-        u32 __reserved1[3];
+        u32 __reserved0[4];
 };
 
 /*
@@ -2362,103 +2185,114 @@ struct eth_tx_doorbell {
 
 
 /*
- * cstorm default status block, generated by ustorm
+ * client init fc data
  */
-struct cstorm_def_status_block_u {
-        __le16 index_values[HC_USTORM_DEF_SB_NUM_INDICES];
-        __le16 status_block_index;
-        u8 func;
-        u8 status_block_id;
-        __le32 __flags;
-};
-
-/*
- * cstorm default status block, generated by cstorm
- */
-struct cstorm_def_status_block_c {
-        __le16 index_values[HC_CSTORM_DEF_SB_NUM_INDICES];
-        __le16 status_block_index;
-        u8 func;
-        u8 status_block_id;
-        __le32 __flags;
-};
-
-/*
- * xstorm status block
- */
-struct xstorm_def_status_block {
-        __le16 index_values[HC_XSTORM_DEF_SB_NUM_INDICES];
-        __le16 status_block_index;
-        u8 func;
-        u8 status_block_id;
-        __le32 __flags;
+struct client_init_fc_data {
+        __le16 cqe_pause_thr_low;
+        __le16 cqe_pause_thr_high;
+        __le16 bd_pause_thr_low;
+        __le16 bd_pause_thr_high;
+        __le16 sge_pause_thr_low;
+        __le16 sge_pause_thr_high;
+        __le16 rx_cos_mask;
+        u8 safc_group_num;
+        u8 safc_group_en_flg;
+        u8 traffic_type;
+        u8 reserved0;
+        __le16 reserved1;
+        __le32 reserved2;
 };
 
-/*
- * tstorm status block
- */
-struct tstorm_def_status_block {
-        __le16 index_values[HC_TSTORM_DEF_SB_NUM_INDICES];
-        __le16 status_block_index;
-        u8 func;
-        u8 status_block_id;
-        __le32 __flags;
-};
 
 /*
- * host status block
+ * client init ramrod data
  */
-struct host_def_status_block {
-        struct atten_def_status_block atten_status_block;
-        struct cstorm_def_status_block_u u_def_status_block;
-        struct cstorm_def_status_block_c c_def_status_block;
-        struct xstorm_def_status_block x_def_status_block;
-        struct tstorm_def_status_block t_def_status_block;
+struct client_init_general_data {
+        u8 client_id;
+        u8 statistics_counter_id;
+        u8 statistics_en_flg;
+        u8 is_fcoe_flg;
+        u8 activate_flg;
+        u8 sp_client_id;
+        __le16 reserved0;
+        __le32 reserved1[2];
 };
 
 
 /*
- * cstorm status block, generated by ustorm
+ * client init rx data
  */
-struct cstorm_status_block_u {
-        __le16 index_values[HC_USTORM_SB_NUM_INDICES];
-        __le16 status_block_index;
-        u8 func;
+struct client_init_rx_data {
+        u8 tpa_en_flg;
+        u8 vmqueue_mode_en_flg;
+        u8 extra_data_over_sgl_en_flg;
+        u8 cache_line_alignment_log_size;
+        u8 enable_dynamic_hc;
+        u8 max_sges_for_packet;
+        u8 client_qzone_id;
+        u8 drop_ip_cs_err_flg;
+        u8 drop_tcp_cs_err_flg;
+        u8 drop_ttl0_flg;
+        u8 drop_udp_cs_err_flg;
+        u8 inner_vlan_removal_enable_flg;
+        u8 outer_vlan_removal_enable_flg;
         u8 status_block_id;
-        __le32 __flags;
+        u8 rx_sb_index_number;
+        u8 reserved0[3];
+        __le16 bd_buff_size;
+        __le16 sge_buff_size;
+        __le16 mtu;
+        struct regpair bd_page_base;
+        struct regpair sge_page_base;
+        struct regpair cqe_page_base;
+        u8 is_leading_rss;
+        u8 is_approx_mcast;
+        __le16 max_agg_size;
+        __le32 reserved2[3];
+};
+
+/*
+ * client init tx data
+ */
+struct client_init_tx_data {
+        u8 enforce_security_flg;
+        u8 tx_status_block_id;
+        u8 tx_sb_index_number;
+        u8 reserved0;
+        __le16 mtu;
+        __le16 reserved1;
+        struct regpair tx_bd_page_base;
+        __le32 reserved2[2];
 };
 
 /*
- * cstorm status block, generated by cstorm
+ * client init ramrod data
  */
-struct cstorm_status_block_c {
-        __le16 index_values[HC_CSTORM_SB_NUM_INDICES];
-        __le16 status_block_index;
-        u8 func;
-        u8 status_block_id;
-        __le32 __flags;
+struct client_init_ramrod_data {
+        struct client_init_general_data general;
+        struct client_init_rx_data rx;
+        struct client_init_tx_data tx;
+        struct client_init_fc_data fc;
 };
 
+
 /*
- * host status block
+ * The data contain client ID need to the ramrod
  */
-struct host_status_block {
-        struct cstorm_status_block_u u_status_block;
-        struct cstorm_status_block_c c_status_block;
+struct eth_common_ramrod_data {
+        u32 client_id;
+        u32 reserved1;
 };
 
 
 /*
- * The data for RSS setup ramrod
+ * union for sgl and raw data.
  */
-struct eth_client_setup_ramrod_data {
-        u32 client_id;
-        u8 is_rdma;
-        u8 is_fcoe;
-        u16 reserved1;
+union eth_sgl_or_raw_data {
+        __le16 sgl[8];
+        u32 raw_data[4];
 };
 
-
 /*
  * regular eth FP CQE parameters struct
  */
@@ -2476,8 +2310,8 @@ struct eth_fast_path_rx_cqe {
 #define ETH_FAST_PATH_RX_CQE_START_FLG_SHIFT 4
 #define ETH_FAST_PATH_RX_CQE_END_FLG (0x1<<5)
 #define ETH_FAST_PATH_RX_CQE_END_FLG_SHIFT 5
-#define ETH_FAST_PATH_RX_CQE_RESERVED0 (0x3<<6)
-#define ETH_FAST_PATH_RX_CQE_RESERVED0_SHIFT 6
+#define ETH_FAST_PATH_RX_CQE_SGL_RAW_SEL (0x3<<6)
+#define ETH_FAST_PATH_RX_CQE_SGL_RAW_SEL_SHIFT 6
         u8 status_flags;
 #define ETH_FAST_PATH_RX_CQE_RSS_HASH_TYPE (0x7<<0)
 #define ETH_FAST_PATH_RX_CQE_RSS_HASH_TYPE_SHIFT 0
@@ -2498,7 +2332,7 @@ struct eth_fast_path_rx_cqe {
         __le16 pkt_len;
         __le16 len_on_bd;
         struct parsing_flags pars_flags;
-        __le16 sgl[8];
+        union eth_sgl_or_raw_data sgl_or_raw_data;
 };
 
 
@@ -2510,11 +2344,10 @@ struct eth_halt_ramrod_data {
         u32 reserved0;
 };
 
-
 /*
  * The data for statistics query ramrod
  */
-struct eth_query_ramrod_data {
+struct common_query_ramrod_data {
 #if defined(__BIG_ENDIAN)
         u8 reserved0;
         u8 collect_port;
@@ -2597,9 +2430,9 @@ struct spe_hdr {
         __le16 type;
 #define SPE_HDR_CONN_TYPE (0xFF<<0)
 #define SPE_HDR_CONN_TYPE_SHIFT 0
-#define SPE_HDR_COMMON_RAMROD (0xFF<<8)
-#define SPE_HDR_COMMON_RAMROD_SHIFT 8
-        __le16 reserved;
+#define SPE_HDR_FUNCTION_ID (0xFF<<8)
+#define SPE_HDR_FUNCTION_ID_SHIFT 8
+        __le16 reserved1;
 };
 
 /*
@@ -2607,12 +2440,10 @@ struct spe_hdr {
  */
 union eth_specific_data {
         u8 protocol_data[8];
-        struct regpair mac_config_addr;
-        struct eth_client_setup_ramrod_data client_setup_ramrod_data;
+        struct regpair client_init_ramrod_init_data;
         struct eth_halt_ramrod_data halt_ramrod_data;
-        struct regpair leading_cqe_addr;
         struct regpair update_data_addr;
-        struct eth_query_ramrod_data query_ramrod_data;
+        struct eth_common_ramrod_data common_ramrod_data;
 };
 
 /*
@@ -2637,7 +2468,7 @@ struct eth_tx_bds_array {
  */
 struct tstorm_eth_function_common_config {
 #if defined(__BIG_ENDIAN)
-        u8 leading_client_id;
+        u8 reserved1;
         u8 rss_result_mask;
         u16 config_flags;
 #define TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_IPV4_CAPABILITY (0x1<<0)
@@ -2650,16 +2481,12 @@ struct tstorm_eth_function_common_config {
 #define TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_IPV6_TCP_CAPABILITY_SHIFT 3
 #define TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_MODE (0x7<<4)
 #define TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_MODE_SHIFT 4
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_DEFAULT_ENABLE (0x1<<7)
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_DEFAULT_ENABLE_SHIFT 7
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_VLAN_IN_CAM (0x1<<8)
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_VLAN_IN_CAM_SHIFT 8
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_E1HOV_IN_CAM (0x1<<9)
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_E1HOV_IN_CAM_SHIFT 9
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_ENABLE_TPA (0x1<<10)
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_ENABLE_TPA_SHIFT 10
-#define __TSTORM_ETH_FUNCTION_COMMON_CONFIG_RESERVED0 (0x1F<<11)
-#define __TSTORM_ETH_FUNCTION_COMMON_CONFIG_RESERVED0_SHIFT 11
+#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_ENABLE_TPA (0x1<<7)
+#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_ENABLE_TPA_SHIFT 7
+#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_VLAN_FILTERING_ENABLE (0x1<<8)
+#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_VLAN_FILTERING_ENABLE_SHIFT 8
+#define __TSTORM_ETH_FUNCTION_COMMON_CONFIG_RESERVED0 (0x7F<<9)
+#define __TSTORM_ETH_FUNCTION_COMMON_CONFIG_RESERVED0_SHIFT 9
 #elif defined(__LITTLE_ENDIAN)
         u16 config_flags;
 #define TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_IPV4_CAPABILITY (0x1<<0)
@@ -2672,18 +2499,14 @@ struct tstorm_eth_function_common_config {
 #define TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_IPV6_TCP_CAPABILITY_SHIFT 3
 #define TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_MODE (0x7<<4)
 #define TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_MODE_SHIFT 4
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_DEFAULT_ENABLE (0x1<<7)
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_DEFAULT_ENABLE_SHIFT 7
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_VLAN_IN_CAM (0x1<<8)
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_VLAN_IN_CAM_SHIFT 8
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_E1HOV_IN_CAM (0x1<<9)
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_E1HOV_IN_CAM_SHIFT 9
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_ENABLE_TPA (0x1<<10)
-#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_ENABLE_TPA_SHIFT 10
-#define __TSTORM_ETH_FUNCTION_COMMON_CONFIG_RESERVED0 (0x1F<<11)
-#define __TSTORM_ETH_FUNCTION_COMMON_CONFIG_RESERVED0_SHIFT 11
+#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_ENABLE_TPA (0x1<<7)
+#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_ENABLE_TPA_SHIFT 7
+#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_VLAN_FILTERING_ENABLE (0x1<<8)
+#define TSTORM_ETH_FUNCTION_COMMON_CONFIG_VLAN_FILTERING_ENABLE_SHIFT 8
+#define __TSTORM_ETH_FUNCTION_COMMON_CONFIG_RESERVED0 (0x7F<<9)
+#define __TSTORM_ETH_FUNCTION_COMMON_CONFIG_RESERVED0_SHIFT 9
         u8 rss_result_mask;
-        u8 leading_client_id;
+        u8 reserved1;
 #endif
         u16 vlan_id[2];
 };
@@ -2731,90 +2554,42 @@ struct mac_configuration_hdr {
         u8 length;
         u8 offset;
         u16 client_id;
-        u32 reserved1;
-};
-
-/*
- * MAC address in list for ramrod
- */
-struct tstorm_cam_entry {
-        __le16 lsb_mac_addr;
-        __le16 middle_mac_addr;
-        __le16 msb_mac_addr;
-        __le16 flags;
-#define TSTORM_CAM_ENTRY_PORT_ID (0x1<<0)
-#define TSTORM_CAM_ENTRY_PORT_ID_SHIFT 0
-#define TSTORM_CAM_ENTRY_RSRVVAL0 (0x7<<1)
-#define TSTORM_CAM_ENTRY_RSRVVAL0_SHIFT 1
-#define TSTORM_CAM_ENTRY_RESERVED0 (0xFFF<<4)
-#define TSTORM_CAM_ENTRY_RESERVED0_SHIFT 4
-};
-
-/*
- * MAC filtering: CAM target table entry
- */
-struct tstorm_cam_target_table_entry {
-        u8 flags;
-#define TSTORM_CAM_TARGET_TABLE_ENTRY_BROADCAST (0x1<<0)
-#define TSTORM_CAM_TARGET_TABLE_ENTRY_BROADCAST_SHIFT 0
-#define TSTORM_CAM_TARGET_TABLE_ENTRY_OVERRIDE_VLAN_REMOVAL (0x1<<1)
-#define TSTORM_CAM_TARGET_TABLE_ENTRY_OVERRIDE_VLAN_REMOVAL_SHIFT 1
-#define TSTORM_CAM_TARGET_TABLE_ENTRY_ACTION_TYPE (0x1<<2)
-#define TSTORM_CAM_TARGET_TABLE_ENTRY_ACTION_TYPE_SHIFT 2
-#define TSTORM_CAM_TARGET_TABLE_ENTRY_RDMA_MAC (0x1<<3)
-#define TSTORM_CAM_TARGET_TABLE_ENTRY_RDMA_MAC_SHIFT 3
-#define TSTORM_CAM_TARGET_TABLE_ENTRY_RESERVED0 (0xF<<4)
-#define TSTORM_CAM_TARGET_TABLE_ENTRY_RESERVED0_SHIFT 4
-        u8 reserved1;
-        u16 vlan_id;
-        u32 clients_bit_vector;
+        u16 echo;
+        u16 reserved1;
 };
 
 /*
  * MAC address in list for ramrod
  */
 struct mac_configuration_entry {
-        struct tstorm_cam_entry cam_entry;
-        struct tstorm_cam_target_table_entry target_table_entry;
-};
-
-/*
- * MAC filtering configuration command
- */
-struct mac_configuration_cmd {
-        struct mac_configuration_hdr hdr;
-        struct mac_configuration_entry config_table[64];
-};
-
-
-/*
- * MAC address in list for ramrod
- */
-struct mac_configuration_entry_e1h {
         __le16 lsb_mac_addr;
         __le16 middle_mac_addr;
         __le16 msb_mac_addr;
         __le16 vlan_id;
-        __le16 e1hov_id;
-        u8 reserved0;
+        u8 pf_id;
         u8 flags;
-#define MAC_CONFIGURATION_ENTRY_E1H_PORT (0x1<<0)
-#define MAC_CONFIGURATION_ENTRY_E1H_PORT_SHIFT 0
-#define MAC_CONFIGURATION_ENTRY_E1H_ACTION_TYPE (0x1<<1)
-#define MAC_CONFIGURATION_ENTRY_E1H_ACTION_TYPE_SHIFT 1
-#define MAC_CONFIGURATION_ENTRY_E1H_RDMA_MAC (0x1<<2)
-#define MAC_CONFIGURATION_ENTRY_E1H_RDMA_MAC_SHIFT 2
-#define MAC_CONFIGURATION_ENTRY_E1H_RESERVED1 (0x1F<<3)
-#define MAC_CONFIGURATION_ENTRY_E1H_RESERVED1_SHIFT 3
+#define MAC_CONFIGURATION_ENTRY_ACTION_TYPE (0x1<<0)
+#define MAC_CONFIGURATION_ENTRY_ACTION_TYPE_SHIFT 0
+#define MAC_CONFIGURATION_ENTRY_RDMA_MAC (0x1<<1)
+#define MAC_CONFIGURATION_ENTRY_RDMA_MAC_SHIFT 1
+#define MAC_CONFIGURATION_ENTRY_VLAN_FILTERING_MODE (0x3<<2)
+#define MAC_CONFIGURATION_ENTRY_VLAN_FILTERING_MODE_SHIFT 2
+#define MAC_CONFIGURATION_ENTRY_OVERRIDE_VLAN_REMOVAL (0x1<<4)
+#define MAC_CONFIGURATION_ENTRY_OVERRIDE_VLAN_REMOVAL_SHIFT 4
+#define MAC_CONFIGURATION_ENTRY_BROADCAST (0x1<<5)
+#define MAC_CONFIGURATION_ENTRY_BROADCAST_SHIFT 5
+#define MAC_CONFIGURATION_ENTRY_RESERVED1 (0x3<<6)
+#define MAC_CONFIGURATION_ENTRY_RESERVED1_SHIFT 6
+        u16 reserved0;
         u32 clients_bit_vector;
 };
 
 /*
  * MAC filtering configuration command
  */
-struct mac_configuration_cmd_e1h {
+struct mac_configuration_cmd {
         struct mac_configuration_hdr hdr;
-        struct mac_configuration_entry_e1h config_table[32];
+        struct mac_configuration_entry config_table[64];
 };
 
 
@@ -2827,65 +2602,6 @@ struct tstorm_eth_approximate_match_multicast_filtering {
 
 
 /*
- * Configuration parameters per client in Tstorm
- */
-struct tstorm_eth_client_config {
-#if defined(__BIG_ENDIAN)
-        u8 reserved0;
-        u8 statistics_counter_id;
-        u16 mtu;
-#elif defined(__LITTLE_ENDIAN)
-        u16 mtu;
-        u8 statistics_counter_id;
-        u8 reserved0;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 drop_flags;
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_IP_CS_ERR (0x1<<0)
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_IP_CS_ERR_SHIFT 0
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_TCP_CS_ERR (0x1<<1)
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_TCP_CS_ERR_SHIFT 1
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_TTL0 (0x1<<2)
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_TTL0_SHIFT 2
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_UDP_CS_ERR (0x1<<3)
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_UDP_CS_ERR_SHIFT 3
-#define __TSTORM_ETH_CLIENT_CONFIG_RESERVED2 (0xFFF<<4)
-#define __TSTORM_ETH_CLIENT_CONFIG_RESERVED2_SHIFT 4
-        u16 config_flags;
-#define TSTORM_ETH_CLIENT_CONFIG_VLAN_REM_ENABLE (0x1<<0)
-#define TSTORM_ETH_CLIENT_CONFIG_VLAN_REM_ENABLE_SHIFT 0
-#define TSTORM_ETH_CLIENT_CONFIG_E1HOV_REM_ENABLE (0x1<<1)
-#define TSTORM_ETH_CLIENT_CONFIG_E1HOV_REM_ENABLE_SHIFT 1
-#define TSTORM_ETH_CLIENT_CONFIG_STATSITICS_ENABLE (0x1<<2)
-#define TSTORM_ETH_CLIENT_CONFIG_STATSITICS_ENABLE_SHIFT 2
-#define __TSTORM_ETH_CLIENT_CONFIG_RESERVED1 (0x1FFF<<3)
-#define __TSTORM_ETH_CLIENT_CONFIG_RESERVED1_SHIFT 3
-#elif defined(__LITTLE_ENDIAN)
-        u16 config_flags;
-#define TSTORM_ETH_CLIENT_CONFIG_VLAN_REM_ENABLE (0x1<<0)
-#define TSTORM_ETH_CLIENT_CONFIG_VLAN_REM_ENABLE_SHIFT 0
-#define TSTORM_ETH_CLIENT_CONFIG_E1HOV_REM_ENABLE (0x1<<1)
-#define TSTORM_ETH_CLIENT_CONFIG_E1HOV_REM_ENABLE_SHIFT 1
-#define TSTORM_ETH_CLIENT_CONFIG_STATSITICS_ENABLE (0x1<<2)
-#define TSTORM_ETH_CLIENT_CONFIG_STATSITICS_ENABLE_SHIFT 2
-#define __TSTORM_ETH_CLIENT_CONFIG_RESERVED1 (0x1FFF<<3)
-#define __TSTORM_ETH_CLIENT_CONFIG_RESERVED1_SHIFT 3
-        u16 drop_flags;
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_IP_CS_ERR (0x1<<0)
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_IP_CS_ERR_SHIFT 0
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_TCP_CS_ERR (0x1<<1)
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_TCP_CS_ERR_SHIFT 1
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_TTL0 (0x1<<2)
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_TTL0_SHIFT 2
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_UDP_CS_ERR (0x1<<3)
-#define TSTORM_ETH_CLIENT_CONFIG_DROP_UDP_CS_ERR_SHIFT 3
-#define __TSTORM_ETH_CLIENT_CONFIG_RESERVED2 (0xFFF<<4)
-#define __TSTORM_ETH_CLIENT_CONFIG_RESERVED2_SHIFT 4
-#endif
-};
-
-
-/*
  * MAC filtering configuration parameters per port in Tstorm
  */
 struct tstorm_eth_mac_filter_config {
@@ -2895,8 +2611,8 @@ struct tstorm_eth_mac_filter_config {
         u32 mcast_accept_all;
         u32 bcast_drop_all;
         u32 bcast_accept_all;
-        u32 strict_vlan;
         u32 vlan_filter[2];
+        u32 unmatched_unicast;
         u32 reserved;
 };
 
@@ -2919,41 +2635,6 @@ struct tstorm_eth_tpa_exist {
 
 
 /*
- * rx rings pause data for E1h only
- */
-struct ustorm_eth_rx_pause_data_e1h {
-#if defined(__BIG_ENDIAN)
-        u16 bd_thr_low;
-        u16 cqe_thr_low;
-#elif defined(__LITTLE_ENDIAN)
-        u16 cqe_thr_low;
-        u16 bd_thr_low;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 cos;
-        u16 sge_thr_low;
-#elif defined(__LITTLE_ENDIAN)
-        u16 sge_thr_low;
-        u16 cos;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 bd_thr_high;
-        u16 cqe_thr_high;
-#elif defined(__LITTLE_ENDIAN)
-        u16 cqe_thr_high;
-        u16 bd_thr_high;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 reserved0;
-        u16 sge_thr_high;
-#elif defined(__LITTLE_ENDIAN)
-        u16 sge_thr_high;
-        u16 reserved0;
-#endif
-};
-
-
-/*
  * Three RX producers for ETH
  */
 struct ustorm_eth_rx_producers {
@@ -2975,6 +2656,18 @@ struct ustorm_eth_rx_producers {
 
 
 /*
+ * cfc delete event data
+ */
+struct cfc_del_event_data {
+        u32 cid;
+        u8 error;
+        u8 reserved0;
+        u16 reserved1;
+        u32 reserved2;
+};
+
+
+/*
  * per-port SAFC demo variables
  */
 struct cmng_flags_per_port {
@@ -2990,8 +2683,10 @@ struct cmng_flags_per_port {
 #define CMNG_FLAGS_PER_PORT_RATE_SHAPING_PROTOCOL_SHIFT 3
 #define CMNG_FLAGS_PER_PORT_FAIRNESS_COS (0x1<<4)
 #define CMNG_FLAGS_PER_PORT_FAIRNESS_COS_SHIFT 4
-#define __CMNG_FLAGS_PER_PORT_RESERVED0 (0x7FFFFFF<<5)
-#define __CMNG_FLAGS_PER_PORT_RESERVED0_SHIFT 5
+#define CMNG_FLAGS_PER_PORT_FAIRNESS_COS_MODE (0x1<<5)
+#define CMNG_FLAGS_PER_PORT_FAIRNESS_COS_MODE_SHIFT 5
+#define __CMNG_FLAGS_PER_PORT_RESERVED0 (0x3FFFFFF<<6)
+#define __CMNG_FLAGS_PER_PORT_RESERVED0_SHIFT 6
 };
 
 
@@ -3025,30 +2720,92 @@ struct safc_struct_per_port {
         u8 __reserved0;
         u16 __reserved1;
 #endif
+        u8 cos_to_traffic_types[MAX_COS_NUMBER];
+        u32 __reserved2;
         u16 cos_to_pause_mask[NUM_OF_SAFC_BITS];
 };
 
 /*
+ * per-port PFC variables
+ */
+struct pfc_struct_per_port {
+        u8 priority_to_traffic_types[MAX_PFC_PRIORITIES];
+#if defined(__BIG_ENDIAN)
+        u16 pfc_pause_quanta_in_nanosec;
+        u8 __reserved0;
+        u8 priority_non_pausable_mask;
+#elif defined(__LITTLE_ENDIAN)
+        u8 priority_non_pausable_mask;
+        u8 __reserved0;
+        u16 pfc_pause_quanta_in_nanosec;
+#endif
+};
+
+/*
+ * Priority and cos
+ */
+struct priority_cos {
+#if defined(__BIG_ENDIAN)
+        u16 reserved1;
+        u8 cos;
+        u8 priority;
+#elif defined(__LITTLE_ENDIAN)
+        u8 priority;
+        u8 cos;
+        u16 reserved1;
+#endif
+        u32 reserved2;
+};
+
+/*
  * Per-port congestion management variables
  */
 struct cmng_struct_per_port {
         struct rate_shaping_vars_per_port rs_vars;
         struct fairness_vars_per_port fair_vars;
         struct safc_struct_per_port safc_vars;
+        struct pfc_struct_per_port pfc_vars;
+#if defined(__BIG_ENDIAN)
+        u16 __reserved1;
+        u8 dcb_enabled;
+        u8 llfc_mode;
+#elif defined(__LITTLE_ENDIAN)
+        u8 llfc_mode;
+        u8 dcb_enabled;
+        u16 __reserved1;
+#endif
+        struct priority_cos
+                traffic_type_to_priority_cos[MAX_PFC_TRAFFIC_TYPES];
         struct cmng_flags_per_port flags;
 };
 
 
+
+/*
+ * Dynamic HC counters set by the driver
+ */
+struct hc_dynamic_drv_counter {
+        u32 val[HC_SB_MAX_DYNAMIC_INDICES];
+};
+
+/*
+ * zone A per-queue data
+ */
+struct cstorm_queue_zone_data {
+        struct hc_dynamic_drv_counter hc_dyn_drv_cnt;
+        struct regpair reserved[2];
+};
+
 /*
  * Dynamic host coalescing init parameters
  */
 struct dynamic_hc_config {
         u32 threshold[3];
-        u8 shift_per_protocol[HC_USTORM_SB_NUM_INDICES];
-        u8 hc_timeout0[HC_USTORM_SB_NUM_INDICES];
-        u8 hc_timeout1[HC_USTORM_SB_NUM_INDICES];
-        u8 hc_timeout2[HC_USTORM_SB_NUM_INDICES];
-        u8 hc_timeout3[HC_USTORM_SB_NUM_INDICES];
+        u8 shift_per_protocol[HC_SB_MAX_DYNAMIC_INDICES];
+        u8 hc_timeout0[HC_SB_MAX_DYNAMIC_INDICES];
+        u8 hc_timeout1[HC_SB_MAX_DYNAMIC_INDICES];
+        u8 hc_timeout2[HC_SB_MAX_DYNAMIC_INDICES];
+        u8 hc_timeout3[HC_SB_MAX_DYNAMIC_INDICES];
 };
 
 
@@ -3072,7 +2829,7 @@ struct xstorm_per_client_stats {
  * Common statistics collected by the Xstorm (per port)
  */
 struct xstorm_common_stats {
- struct xstorm_per_client_stats client_statistics[MAX_X_STAT_COUNTER_ID];
+        struct xstorm_per_client_stats client_statistics[MAX_STAT_COUNTER_ID];
 };
 
 /*
@@ -3109,7 +2866,7 @@ struct tstorm_per_client_stats {
  */
 struct tstorm_common_stats {
         struct tstorm_per_port_stats port_statistics;
- struct tstorm_per_client_stats client_statistics[MAX_T_STAT_COUNTER_ID];
+        struct tstorm_per_client_stats client_statistics[MAX_STAT_COUNTER_ID];
 };
 
 /*
@@ -3130,7 +2887,7 @@ struct ustorm_per_client_stats {
  * Protocol-common statistics collected by the Ustorm
  */
 struct ustorm_common_stats {
- struct ustorm_per_client_stats client_statistics[MAX_U_STAT_COUNTER_ID];
+        struct ustorm_per_client_stats client_statistics[MAX_STAT_COUNTER_ID];
 };
 
 /*
@@ -3144,6 +2901,70 @@ struct eth_stats_query {
 
 
 /*
+ * set mac event data
+ */
+struct set_mac_event_data {
+        u16 echo;
+        u16 reserved0;
+        u32 reserved1;
+        u32 reserved2;
+};
+
+/*
+ * union for all event ring message types
+ */
+union event_data {
+        struct set_mac_event_data set_mac_event;
+        struct cfc_del_event_data cfc_del_event;
+};
+
+
+/*
+ * per PF event ring data
+ */
+struct event_ring_data {
+        struct regpair base_addr;
+#if defined(__BIG_ENDIAN)
+        u8 index_id;
+        u8 sb_id;
+        u16 producer;
+#elif defined(__LITTLE_ENDIAN)
+        u16 producer;
+        u8 sb_id;
+        u8 index_id;
+#endif
+        u32 reserved0;
+};
+
+
+/*
+ * event ring message element (each element is 128 bits)
+ */
+struct event_ring_msg {
+        u8 opcode;
+        u8 reserved0;
+        u16 reserved1;
+        union event_data data;
+};
+
+/*
+ * event ring next page element (128 bits)
+ */
+struct event_ring_next {
+        struct regpair addr;
+        u32 reserved[2];
+};
+
+/*
+ * union for event ring element types (each element is 128 bits)
+ */
+union event_ring_elem {
+        struct event_ring_msg message;
+        struct event_ring_next next_page;
+};
+
+
+/*
  * per-vnic fairness variables
  */
 struct fairness_vars_per_vn {
@@ -3182,6 +3003,137 @@ struct fw_version {
 
 
 /*
+ * Dynamic Host-Coalescing - Driver(host) counters
+ */
+struct hc_dynamic_sb_drv_counters {
+        u32 dynamic_hc_drv_counter[HC_SB_MAX_DYNAMIC_INDICES];
+};
+
+
+/*
+ * 2 bytes. configuration/state parameters for a single protocol index
+ */
+struct hc_index_data {
+#if defined(__BIG_ENDIAN)
+        u8 flags;
+#define HC_INDEX_DATA_SM_ID (0x1<<0)
+#define HC_INDEX_DATA_SM_ID_SHIFT 0
+#define HC_INDEX_DATA_HC_ENABLED (0x1<<1)
+#define HC_INDEX_DATA_HC_ENABLED_SHIFT 1
+#define HC_INDEX_DATA_DYNAMIC_HC_ENABLED (0x1<<2)
+#define HC_INDEX_DATA_DYNAMIC_HC_ENABLED_SHIFT 2
+#define HC_INDEX_DATA_RESERVE (0x1F<<3)
+#define HC_INDEX_DATA_RESERVE_SHIFT 3
+        u8 timeout;
+#elif defined(__LITTLE_ENDIAN)
+        u8 timeout;
+        u8 flags;
+#define HC_INDEX_DATA_SM_ID (0x1<<0)
+#define HC_INDEX_DATA_SM_ID_SHIFT 0
+#define HC_INDEX_DATA_HC_ENABLED (0x1<<1)
+#define HC_INDEX_DATA_HC_ENABLED_SHIFT 1
+#define HC_INDEX_DATA_DYNAMIC_HC_ENABLED (0x1<<2)
+#define HC_INDEX_DATA_DYNAMIC_HC_ENABLED_SHIFT 2
+#define HC_INDEX_DATA_RESERVE (0x1F<<3)
+#define HC_INDEX_DATA_RESERVE_SHIFT 3
+#endif
+};
+
+
+/*
+ * HC state-machine
+ */
+struct hc_status_block_sm {
+#if defined(__BIG_ENDIAN)
+        u8 igu_seg_id;
+        u8 igu_sb_id;
+        u8 timer_value;
+        u8 __flags;
+#elif defined(__LITTLE_ENDIAN)
+        u8 __flags;
+        u8 timer_value;
+        u8 igu_sb_id;
+        u8 igu_seg_id;
+#endif
+        u32 time_to_expire;
+};
+
+/*
+ * hold PCI identification variables- used in various places in firmware
+ */
+struct pci_entity {
+#if defined(__BIG_ENDIAN)
+        u8 vf_valid;
+        u8 vf_id;
+        u8 vnic_id;
+        u8 pf_id;
+#elif defined(__LITTLE_ENDIAN)
+        u8 pf_id;
+        u8 vnic_id;
+        u8 vf_id;
+        u8 vf_valid;
+#endif
+};
+
+/*
+ * The fast-path status block meta-data, common to all chips
+ */
+struct hc_sb_data {
+        struct regpair host_sb_addr;
+        struct hc_status_block_sm state_machine[HC_SB_MAX_SM];
+        struct pci_entity p_func;
+#if defined(__BIG_ENDIAN)
+        u8 rsrv0;
+        u8 dhc_qzone_id;
+        u8 __dynamic_hc_level;
+        u8 same_igu_sb_1b;
+#elif defined(__LITTLE_ENDIAN)
+        u8 same_igu_sb_1b;
+        u8 __dynamic_hc_level;
+        u8 dhc_qzone_id;
+        u8 rsrv0;
+#endif
+        struct regpair rsrv1[2];
+};
+
+
+/*
+ * The fast-path status block meta-data
+ */
+struct hc_sp_status_block_data {
+        struct regpair host_sb_addr;
+#if defined(__BIG_ENDIAN)
+        u16 rsrv;
+        u8 igu_seg_id;
+        u8 igu_sb_id;
+#elif defined(__LITTLE_ENDIAN)
+        u8 igu_sb_id;
+        u8 igu_seg_id;
+        u16 rsrv;
+#endif
+        struct pci_entity p_func;
+};
+
+
+/*
+ * The fast-path status block meta-data
+ */
+struct hc_status_block_data_e1x {
+        struct hc_index_data index_data[HC_SB_MAX_INDICES_E1X];
+        struct hc_sb_data common;
+};
+
+
+/*
+ * The fast-path status block meta-data
+ */
+struct hc_status_block_data_e2 {
+        struct hc_index_data index_data[HC_SB_MAX_INDICES_E2];
+        struct hc_sb_data common;
+};
+
+
+/*
  * FW version stored in first line of pram
  */
 struct pram_fw_version {
@@ -3204,11 +3156,21 @@ struct pram_fw_version {
 
 
 /*
+ * Ethernet slow path element
+ */
+union protocol_common_specific_data {
+        u8 protocol_data[8];
+        struct regpair phy_address;
+        struct regpair mac_config_addr;
+        struct common_query_ramrod_data query_ramrod_data;
+};
+
+/*
  * The send queue element
  */
 struct protocol_common_spe {
         struct spe_hdr hdr;
-        struct regpair phy_address;
+        union protocol_common_specific_data data;
 };
 
 
@@ -3241,7 +3203,7 @@ struct rate_shaping_vars_per_vn {
  */
 struct slow_path_element {
         struct spe_hdr hdr;
-        u8 protocol_data[8];
+        struct regpair protocol_data;
 };
 
 
@@ -3254,3 +3216,97 @@ struct stats_indication_flags {
 };
 
 
+/*
+ * per-port PFC variables
+ */
+struct storm_pfc_struct_per_port {
+#if defined(__BIG_ENDIAN)
+        u16 mid_mac_addr;
+        u16 msb_mac_addr;
+#elif defined(__LITTLE_ENDIAN)
+        u16 msb_mac_addr;
+        u16 mid_mac_addr;
+#endif
+#if defined(__BIG_ENDIAN)
+        u16 pfc_pause_quanta_in_nanosec;
+        u16 lsb_mac_addr;
+#elif defined(__LITTLE_ENDIAN)
+        u16 lsb_mac_addr;
+        u16 pfc_pause_quanta_in_nanosec;
+#endif
+};
+
+/*
+ * Per-port congestion management variables
+ */
+struct storm_cmng_struct_per_port {
+        struct storm_pfc_struct_per_port pfc_vars;
+};
+
+
+/*
+ * zone A per-queue data
+ */
+struct tstorm_queue_zone_data {
+        struct regpair reserved[4];
+};
+
+
+/*
+ * zone B per-VF data
+ */
+struct tstorm_vf_zone_data {
+        struct regpair reserved;
+};
+
+
+/*
+ * zone A per-queue data
+ */
+struct ustorm_queue_zone_data {
+        struct ustorm_eth_rx_producers eth_rx_producers;
+        struct regpair reserved[3];
+};
+
+
+/*
+ * zone B per-VF data
+ */
+struct ustorm_vf_zone_data {
+        struct regpair reserved;
+};
+
+
+/*
+ * data per VF-PF channel
+ */
+struct vf_pf_channel_data {
+#if defined(__BIG_ENDIAN)
+        u16 reserved0;
+        u8 valid;
+        u8 state;
+#elif defined(__LITTLE_ENDIAN)
+        u8 state;
+        u8 valid;
+        u16 reserved0;
+#endif
+        u32 reserved1;
+};
+
+
+/*
+ * zone A per-queue data
+ */
+struct xstorm_queue_zone_data {
+        struct regpair reserved[4];
+};
+
+
+/*
+ * zone B per-VF data
+ */
+struct xstorm_vf_zone_data {
+        struct regpair reserved;
+};
+
+#endif /* BNX2X_HSI_H */
diff --git a/drivers/net/bnx2x/bnx2x_init.h b/drivers/net/bnx2x/bnx2x_init.h
index 65b26cbfe3e7..a9d54874a559 100644
--- a/drivers/net/bnx2x/bnx2x_init.h
+++ b/drivers/net/bnx2x/bnx2x_init.h
@@ -97,6 +97,9 @@
 #define MISC_AEU_BLOCK          35
 #define PGLUE_B_BLOCK           36
 #define IGU_BLOCK               37
+#define ATC_BLOCK               38
+#define QM_4PORT_BLOCK          39
+#define XSEM_4PORT_BLOCK                40
 
 
 /* Returns the index of start or end of a specific block stage in ops array*/
@@ -148,5 +151,46 @@ union init_op {
         struct raw_op           raw;
 };
 
+#define INITOP_SET              0       /* set the HW directly */
+#define INITOP_CLEAR            1       /* clear the HW directly */
+#define INITOP_INIT             2       /* set the init-value array */
+
+/****************************************************************************
+* ILT management
+****************************************************************************/
+struct ilt_line {
+        dma_addr_t page_mapping;
+        void *page;
+        u32 size;
+};
+
+struct ilt_client_info {
+        u32 page_size;
+        u16 start;
+        u16 end;
+        u16 client_num;
+        u16 flags;
+#define ILT_CLIENT_SKIP_INIT    0x1
+#define ILT_CLIENT_SKIP_MEM     0x2
+};
+
+struct bnx2x_ilt {
+        u32 start_line;
+        struct ilt_line         *lines;
+        struct ilt_client_info  clients[4];
+#define ILT_CLIENT_CDU  0
+#define ILT_CLIENT_QM   1
+#define ILT_CLIENT_SRC  2
+#define ILT_CLIENT_TM   3
+};
+
+/****************************************************************************
+* SRC configuration
+****************************************************************************/
+struct src_ent {
+        u8 opaque[56];
+        u64 next;
+};
+
 #endif /* BNX2X_INIT_H */
 
diff --git a/drivers/net/bnx2x/bnx2x_init_ops.h b/drivers/net/bnx2x/bnx2x_init_ops.h
index 2b1363a6fe78..e65de784182c 100644
--- a/drivers/net/bnx2x/bnx2x_init_ops.h
+++ b/drivers/net/bnx2x/bnx2x_init_ops.h
@@ -151,6 +151,15 @@ static void bnx2x_init_wr_wb(struct bnx2x *bp, u32 addr, const u32 *data,
                 bnx2x_init_ind_wr(bp, addr, data, len);
 }
 
+static void bnx2x_wr_64(struct bnx2x *bp, u32 reg, u32 val_lo, u32 val_hi)
+{
+        u32 wb_write[2];
+
+        wb_write[0] = val_lo;
+        wb_write[1] = val_hi;
+        REG_WR_DMAE_LEN(bp, reg, wb_write, 2);
+}
+
 static void bnx2x_init_wr_zp(struct bnx2x *bp, u32 addr, u32 len, u32 blob_off)
 {
         const u8 *data = NULL;
@@ -477,18 +486,30 @@ static void bnx2x_init_pxp_arb(struct bnx2x *bp, int r_order, int w_order)
         REG_WR(bp, PXP2_REG_RQ_RD_MBS0, r_order);
         REG_WR(bp, PXP2_REG_RQ_RD_MBS1, r_order);
 
-        if (r_order == MAX_RD_ORD)
+        if ((CHIP_IS_E1(bp) || CHIP_IS_E1H(bp)) && (r_order == MAX_RD_ORD))
                 REG_WR(bp, PXP2_REG_RQ_PDR_LIMIT, 0xe00);
 
-        REG_WR(bp, PXP2_REG_WR_USDMDP_TH, (0x18 << w_order));
+        if (CHIP_IS_E2(bp))
+                REG_WR(bp, PXP2_REG_WR_USDMDP_TH, (0x8 << w_order));
+        else
+                REG_WR(bp, PXP2_REG_WR_USDMDP_TH, (0x18 << w_order));
 
-        if (CHIP_IS_E1H(bp)) {
+        if (CHIP_IS_E1H(bp) || CHIP_IS_E2(bp)) {
                 /*    MPS      w_order     optimal TH      presently TH
                  *    128         0             0               2
                  *    256         1             1               3
                  *    >=512       2             2               3
                  */
-                val = ((w_order == 0) ? 2 : 3);
+                /* DMAE is special */
+                if (CHIP_IS_E2(bp)) {
+                        /* E2 can use optimal TH */
+                        val = w_order;
+                        REG_WR(bp, PXP2_REG_WR_DMAE_MPS, val);
+                } else {
+                        val = ((w_order == 0) ? 2 : 3);
+                        REG_WR(bp, PXP2_REG_WR_DMAE_MPS, 2);
+                }
+
                 REG_WR(bp, PXP2_REG_WR_HC_MPS, val);
                 REG_WR(bp, PXP2_REG_WR_USDM_MPS, val);
                 REG_WR(bp, PXP2_REG_WR_CSDM_MPS, val);
@@ -498,9 +519,344 @@ static void bnx2x_init_pxp_arb(struct bnx2x *bp, int r_order, int w_order)
                 REG_WR(bp, PXP2_REG_WR_TM_MPS, val);
                 REG_WR(bp, PXP2_REG_WR_SRC_MPS, val);
                 REG_WR(bp, PXP2_REG_WR_DBG_MPS, val);
-                REG_WR(bp, PXP2_REG_WR_DMAE_MPS, 2); /* DMAE is special */
                 REG_WR(bp, PXP2_REG_WR_CDU_MPS, val);
         }
+
+        /* Validate number of tags suppoted by device */
+#define PCIE_REG_PCIER_TL_HDR_FC_ST             0x2980
+        val = REG_RD(bp, PCIE_REG_PCIER_TL_HDR_FC_ST);
+        val &= 0xFF;
+        if (val <= 0x20)
+                REG_WR(bp, PXP2_REG_PGL_TAGS_LIMIT, 0x20);
+}
+
+/****************************************************************************
+* ILT management
+****************************************************************************/
+/*
+ * This codes hides the low level HW interaction for ILT management and
+ * configuration. The API consists of a shadow ILT table which is set by the
+ * driver and a set of routines to use it to configure the HW.
+ *
+ */
+
+/* ILT HW init operations */
+
+/* ILT memory management operations */
+#define ILT_MEMOP_ALLOC         0
+#define ILT_MEMOP_FREE          1
+
+/* the phys address is shifted right 12 bits and has an added
+ * 1=valid bit added to the 53rd bit
+ * then since this is a wide register(TM)
+ * we split it into two 32 bit writes
+ */
+#define ILT_ADDR1(x)            ((u32)(((u64)x >> 12) & 0xFFFFFFFF))
+#define ILT_ADDR2(x)            ((u32)((1 << 20) | ((u64)x >> 44)))
+#define ILT_RANGE(f, l)         (((l) << 10) | f)
+
+static int bnx2x_ilt_line_mem_op(struct bnx2x *bp, struct ilt_line *line,
+                                 u32 size, u8 memop)
+{
+        if (memop == ILT_MEMOP_FREE) {
+                BNX2X_ILT_FREE(line->page, line->page_mapping, line->size);
+                return 0;
+        }
+        BNX2X_ILT_ZALLOC(line->page, &line->page_mapping, size);
+        if (!line->page)
+                return -1;
+        line->size = size;
+        return 0;
+}
+
+
+static int bnx2x_ilt_client_mem_op(struct bnx2x *bp, int cli_num, u8 memop)
+{
+        int i, rc;
+        struct bnx2x_ilt *ilt = BP_ILT(bp);
+        struct ilt_client_info *ilt_cli = &ilt->clients[cli_num];
+
+        if (!ilt || !ilt->lines)
+                return -1;
+
+        if (ilt_cli->flags & (ILT_CLIENT_SKIP_INIT | ILT_CLIENT_SKIP_MEM))
+                return 0;
+
+        for (rc = 0, i = ilt_cli->start; i <= ilt_cli->end && !rc; i++) {
+                rc = bnx2x_ilt_line_mem_op(bp, &ilt->lines[i],
+                                           ilt_cli->page_size, memop);
+        }
+        return rc;
+}
+
+int bnx2x_ilt_mem_op(struct bnx2x *bp, u8 memop)
+{
+        int rc = bnx2x_ilt_client_mem_op(bp, ILT_CLIENT_CDU, memop);
+        if (!rc)
+                rc = bnx2x_ilt_client_mem_op(bp, ILT_CLIENT_QM, memop);
+        if (!rc)
+                rc = bnx2x_ilt_client_mem_op(bp, ILT_CLIENT_SRC, memop);
+        if (!rc)
+                rc = bnx2x_ilt_client_mem_op(bp, ILT_CLIENT_TM, memop);
+
+        return rc;
+}
+
+static void bnx2x_ilt_line_wr(struct bnx2x *bp, int abs_idx,
+                              dma_addr_t page_mapping)
+{
+        u32 reg;
+
+        if (CHIP_IS_E1(bp))
+                reg = PXP2_REG_RQ_ONCHIP_AT + abs_idx*8;
+        else
+                reg = PXP2_REG_RQ_ONCHIP_AT_B0 + abs_idx*8;
+
+        bnx2x_wr_64(bp, reg, ILT_ADDR1(page_mapping), ILT_ADDR2(page_mapping));
+}
+
+static void bnx2x_ilt_line_init_op(struct bnx2x *bp, struct bnx2x_ilt *ilt,
+                                   int idx, u8 initop)
+{
+        dma_addr_t      null_mapping;
+        int abs_idx = ilt->start_line + idx;
+
+
+        switch (initop) {
+        case INITOP_INIT:
+                /* set in the init-value array */
+        case INITOP_SET:
+                bnx2x_ilt_line_wr(bp, abs_idx, ilt->lines[idx].page_mapping);
+                break;
+        case INITOP_CLEAR:
+                null_mapping = 0;
+                bnx2x_ilt_line_wr(bp, abs_idx, null_mapping);
+                break;
+        }
+}
+
+void bnx2x_ilt_boundry_init_op(struct bnx2x *bp,
+                                      struct ilt_client_info *ilt_cli,
+                                      u32 ilt_start, u8 initop)
+{
+        u32 start_reg = 0;
+        u32 end_reg = 0;
+
+        /* The boundary is either SET or INIT,
+           CLEAR => SET and for now SET ~~ INIT */
+
+        /* find the appropriate regs */
+        if (CHIP_IS_E1(bp)) {
+                switch (ilt_cli->client_num) {
+                case ILT_CLIENT_CDU:
+                        start_reg = PXP2_REG_PSWRQ_CDU0_L2P;
+                        break;
+                case ILT_CLIENT_QM:
+                        start_reg = PXP2_REG_PSWRQ_QM0_L2P;
+                        break;
+                case ILT_CLIENT_SRC:
+                        start_reg = PXP2_REG_PSWRQ_SRC0_L2P;
+                        break;
+                case ILT_CLIENT_TM:
+                        start_reg = PXP2_REG_PSWRQ_TM0_L2P;
+                        break;
+                }
+                REG_WR(bp, start_reg + BP_FUNC(bp)*4,
+                       ILT_RANGE((ilt_start + ilt_cli->start),
+                                 (ilt_start + ilt_cli->end)));
+        } else {
+                switch (ilt_cli->client_num) {
+                case ILT_CLIENT_CDU:
+                        start_reg = PXP2_REG_RQ_CDU_FIRST_ILT;
+                        end_reg = PXP2_REG_RQ_CDU_LAST_ILT;
+                        break;
+                case ILT_CLIENT_QM:
+                        start_reg = PXP2_REG_RQ_QM_FIRST_ILT;
+                        end_reg = PXP2_REG_RQ_QM_LAST_ILT;
+                        break;
+                case ILT_CLIENT_SRC:
+                        start_reg = PXP2_REG_RQ_SRC_FIRST_ILT;
+                        end_reg = PXP2_REG_RQ_SRC_LAST_ILT;
+                        break;
+                case ILT_CLIENT_TM:
+                        start_reg = PXP2_REG_RQ_TM_FIRST_ILT;
+                        end_reg = PXP2_REG_RQ_TM_LAST_ILT;
+                        break;
+                }
+                REG_WR(bp, start_reg, (ilt_start + ilt_cli->start));
+                REG_WR(bp, end_reg, (ilt_start + ilt_cli->end));
+        }
+}
+
+void bnx2x_ilt_client_init_op_ilt(struct bnx2x *bp, struct bnx2x_ilt *ilt,
+                                  struct ilt_client_info *ilt_cli, u8 initop)
+{
+        int i;
+
+        if (ilt_cli->flags & ILT_CLIENT_SKIP_INIT)
+                return;
+
+        for (i = ilt_cli->start; i <= ilt_cli->end; i++)
+                bnx2x_ilt_line_init_op(bp, ilt, i, initop);
+
+        /* init/clear the ILT boundries */
+        bnx2x_ilt_boundry_init_op(bp, ilt_cli, ilt->start_line, initop);
+}
+
+void bnx2x_ilt_client_init_op(struct bnx2x *bp,
+                              struct ilt_client_info *ilt_cli, u8 initop)
+{
+        struct bnx2x_ilt *ilt = BP_ILT(bp);
+
+        bnx2x_ilt_client_init_op_ilt(bp, ilt, ilt_cli, initop);
+}
+
+static void bnx2x_ilt_client_id_init_op(struct bnx2x *bp,
+                                        int cli_num, u8 initop)
+{
+        struct bnx2x_ilt *ilt = BP_ILT(bp);
+        struct ilt_client_info *ilt_cli = &ilt->clients[cli_num];
+
+        bnx2x_ilt_client_init_op(bp, ilt_cli, initop);
+}
+
+void bnx2x_ilt_init_op(struct bnx2x *bp, u8 initop)
+{
+        bnx2x_ilt_client_id_init_op(bp, ILT_CLIENT_CDU, initop);
+        bnx2x_ilt_client_id_init_op(bp, ILT_CLIENT_QM, initop);
+        bnx2x_ilt_client_id_init_op(bp, ILT_CLIENT_SRC, initop);
+        bnx2x_ilt_client_id_init_op(bp, ILT_CLIENT_TM, initop);
+}
+
+static void bnx2x_ilt_init_client_psz(struct bnx2x *bp, int cli_num,
+                                            u32 psz_reg, u8 initop)
+{
+        struct bnx2x_ilt *ilt = BP_ILT(bp);
+        struct ilt_client_info *ilt_cli = &ilt->clients[cli_num];
+
+        if (ilt_cli->flags & ILT_CLIENT_SKIP_INIT)
+                return;
+
+        switch (initop) {
+        case INITOP_INIT:
+                /* set in the init-value array */
+        case INITOP_SET:
+                REG_WR(bp, psz_reg, ILOG2(ilt_cli->page_size >> 12));
+                break;
+        case INITOP_CLEAR:
+                break;
+        }
+}
+
+/*
+ * called during init common stage, ilt clients should be initialized
+ * prioir to calling this function
+ */
+void bnx2x_ilt_init_page_size(struct bnx2x *bp, u8 initop)
+{
+        bnx2x_ilt_init_client_psz(bp, ILT_CLIENT_CDU,
+                                  PXP2_REG_RQ_CDU_P_SIZE, initop);
+        bnx2x_ilt_init_client_psz(bp, ILT_CLIENT_QM,
+                                  PXP2_REG_RQ_QM_P_SIZE, initop);
+        bnx2x_ilt_init_client_psz(bp, ILT_CLIENT_SRC,
+                                  PXP2_REG_RQ_SRC_P_SIZE, initop);
+        bnx2x_ilt_init_client_psz(bp, ILT_CLIENT_TM,
+                                  PXP2_REG_RQ_TM_P_SIZE, initop);
+}
+
+/****************************************************************************
+* QM initializations
+****************************************************************************/
+#define QM_QUEUES_PER_FUNC      16 /* E1 has 32, but only 16 are used */
+#define QM_INIT_MIN_CID_COUNT   31
+#define QM_INIT(cid_cnt)        (cid_cnt > QM_INIT_MIN_CID_COUNT)
+
+/* called during init port stage */
+void bnx2x_qm_init_cid_count(struct bnx2x *bp, int qm_cid_count,
+                             u8 initop)
+{
+        int port = BP_PORT(bp);
+
+        if (QM_INIT(qm_cid_count)) {
+                switch (initop) {
+                case INITOP_INIT:
+                        /* set in the init-value array */
+                case INITOP_SET:
+                        REG_WR(bp, QM_REG_CONNNUM_0 + port*4,
+                               qm_cid_count/16 - 1);
+                        break;
+                case INITOP_CLEAR:
+                        break;
+                }
+        }
+}
+
+static void bnx2x_qm_set_ptr_table(struct bnx2x *bp, int qm_cid_count)
+{
+        int i;
+        u32 wb_data[2];
+
+        wb_data[0] = wb_data[1] = 0;
+
+        for (i = 0; i < 4 * QM_QUEUES_PER_FUNC; i++) {
+                REG_WR(bp, QM_REG_BASEADDR + i*4,
+                       qm_cid_count * 4 * (i % QM_QUEUES_PER_FUNC));
+                bnx2x_init_ind_wr(bp, QM_REG_PTRTBL + i*8,
+                                  wb_data, 2);
+
+                if (CHIP_IS_E1H(bp)) {
+                        REG_WR(bp, QM_REG_BASEADDR_EXT_A + i*4,
+                               qm_cid_count * 4 * (i % QM_QUEUES_PER_FUNC));
+                        bnx2x_init_ind_wr(bp, QM_REG_PTRTBL_EXT_A + i*8,
+                                          wb_data, 2);
+                }
+        }
+}
+
+/* called during init common stage */
+void bnx2x_qm_init_ptr_table(struct bnx2x *bp, int qm_cid_count,
+                             u8 initop)
+{
+        if (!QM_INIT(qm_cid_count))
+                return;
+
+        switch (initop) {
+        case INITOP_INIT:
+                /* set in the init-value array */
+        case INITOP_SET:
+                bnx2x_qm_set_ptr_table(bp, qm_cid_count);
+                break;
+        case INITOP_CLEAR:
+                break;
+        }
+}
+
+/****************************************************************************
+* SRC initializations
+****************************************************************************/
+
+/* called during init func stage */
+void bnx2x_src_init_t2(struct bnx2x *bp, struct src_ent *t2,
+                       dma_addr_t t2_mapping, int src_cid_count)
+{
+        int i;
+        int port = BP_PORT(bp);
+
+        /* Initialize T2 */
+        for (i = 0; i < src_cid_count-1; i++)
+                t2[i].next = (u64)(t2_mapping + (i+1)*sizeof(struct src_ent));
+
+        /* tell the searcher where the T2 table is */
+        REG_WR(bp, SRC_REG_COUNTFREE0 + port*4, src_cid_count);
+
+        bnx2x_wr_64(bp, SRC_REG_FIRSTFREE0 + port*16,
+                    U64_LO(t2_mapping), U64_HI(t2_mapping));
+
+        bnx2x_wr_64(bp, SRC_REG_LASTFREE0 + port*16,
+                    U64_LO((u64)t2_mapping +
+                           (src_cid_count-1) * sizeof(struct src_ent)),
+                    U64_HI((u64)t2_mapping +
+                           (src_cid_count-1) * sizeof(struct src_ent)));
 }
 
 #endif /* BNX2X_INIT_OPS_H */
diff --git a/drivers/net/bnx2x/bnx2x_link.c b/drivers/net/bnx2x/bnx2x_link.c
index a07a3a6abd40..3e99bf9c42b9 100644
--- a/drivers/net/bnx2x/bnx2x_link.c
+++ b/drivers/net/bnx2x/bnx2x_link.c
@@ -28,7 +28,7 @@
 
 /********************************************************/
 #define ETH_HLEN                        14
-#define ETH_OVREHEAD            (ETH_HLEN + 8)/* 8 for CRC + VLAN*/
+#define ETH_OVREHEAD            (ETH_HLEN + 8 + 8)/* 16 for CRC + VLAN + LLC */
 #define ETH_MIN_PACKET_SIZE             60
 #define ETH_MAX_PACKET_SIZE             1500
 #define ETH_MAX_JUMBO_PACKET_SIZE       9600
@@ -377,9 +377,60 @@ static u8 bnx2x_emac_enable(struct link_params *params,
         return 0;
 }
 
+static void bnx2x_update_bmac2(struct link_params *params,
+                               struct link_vars *vars,
+                               u8 is_lb)
+{
+        /*
+         * Set rx control: Strip CRC and enable BigMAC to relay
+         * control packets to the system as well
+         */
+        u32 wb_data[2];
+        struct bnx2x *bp = params->bp;
+        u32 bmac_addr = params->port ? NIG_REG_INGRESS_BMAC1_MEM :
+                NIG_REG_INGRESS_BMAC0_MEM;
+        u32 val = 0x14;
+
+        if (vars->flow_ctrl & BNX2X_FLOW_CTRL_RX)
+                /* Enable BigMAC to react on received Pause packets */
+                val |= (1<<5);
+        wb_data[0] = val;
+        wb_data[1] = 0;
+        REG_WR_DMAE(bp, bmac_addr + BIGMAC2_REGISTER_RX_CONTROL,
+                        wb_data, 2);
+        udelay(30);
+
+        /* Tx control */
+        val = 0xc0;
+        if (vars->flow_ctrl & BNX2X_FLOW_CTRL_TX)
+                val |= 0x800000;
+        wb_data[0] = val;
+        wb_data[1] = 0;
+        REG_WR_DMAE(bp, bmac_addr + BIGMAC2_REGISTER_TX_CONTROL,
+                        wb_data, 2);
+
+        val = 0x8000;
+        wb_data[0] = val;
+        wb_data[1] = 0;
+        REG_WR_DMAE(bp, bmac_addr + BIGMAC2_REGISTER_TX_PAUSE_CONTROL,
+                        wb_data, 2);
 
+        /* mac control */
+        val = 0x3; /* Enable RX and TX */
+        if (is_lb) {
+                val |= 0x4; /* Local loopback */
+                DP(NETIF_MSG_LINK, "enable bmac loopback\n");
+        }
 
-static u8 bnx2x_bmac_enable(struct link_params *params, struct link_vars *vars,
+        wb_data[0] = val;
+        wb_data[1] = 0;
+        REG_WR_DMAE(bp, bmac_addr + BIGMAC2_REGISTER_BMAC_CONTROL,
+                        wb_data, 2);
+}
+
+
+static u8 bnx2x_bmac1_enable(struct link_params *params,
+                             struct link_vars *vars,
                           u8 is_lb)
 {
         struct bnx2x *bp = params->bp;
@@ -389,17 +440,7 @@ static u8 bnx2x_bmac_enable(struct link_params *params, struct link_vars *vars,
         u32 wb_data[2];
         u32 val;
 
-        DP(NETIF_MSG_LINK, "Enabling BigMAC\n");
-        /* reset and unreset the BigMac */
-        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_CLEAR,
-               (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port));
-        msleep(1);
-
-        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_SET,
-               (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port));
-
-        /* enable access for bmac registers */
-        REG_WR(bp, NIG_REG_BMAC0_REGS_OUT_EN + port*4, 0x1);
+        DP(NETIF_MSG_LINK, "Enabling BigMAC1\n");
 
         /* XGXS control */
         wb_data[0] = 0x3c;
@@ -479,6 +520,103 @@ static u8 bnx2x_bmac_enable(struct link_params *params, struct link_vars *vars,
                             wb_data, 2);
         }
 
+
+        return 0;
+}
+
+static u8 bnx2x_bmac2_enable(struct link_params *params,
+                             struct link_vars *vars,
+                             u8 is_lb)
+{
+        struct bnx2x *bp = params->bp;
+        u8 port = params->port;
+        u32 bmac_addr = port ? NIG_REG_INGRESS_BMAC1_MEM :
+                               NIG_REG_INGRESS_BMAC0_MEM;
+        u32 wb_data[2];
+
+        DP(NETIF_MSG_LINK, "Enabling BigMAC2\n");
+
+        wb_data[0] = 0;
+        wb_data[1] = 0;
+        REG_WR_DMAE(bp, bmac_addr + BIGMAC2_REGISTER_BMAC_CONTROL,
+                        wb_data, 2);
+        udelay(30);
+
+        /* XGXS control: Reset phy HW, MDIO registers, PHY PLL and BMAC */
+        wb_data[0] = 0x3c;
+        wb_data[1] = 0;
+        REG_WR_DMAE(bp, bmac_addr +
+                        BIGMAC2_REGISTER_BMAC_XGXS_CONTROL,
+                        wb_data, 2);
+
+        udelay(30);
+
+        /* tx MAC SA */
+        wb_data[0] = ((params->mac_addr[2] << 24) |
+                       (params->mac_addr[3] << 16) |
+                       (params->mac_addr[4] << 8) |
+                        params->mac_addr[5]);
+        wb_data[1] = ((params->mac_addr[0] << 8) |
+                        params->mac_addr[1]);
+        REG_WR_DMAE(bp, bmac_addr + BIGMAC2_REGISTER_TX_SOURCE_ADDR,
+                        wb_data, 2);
+
+        udelay(30);
+
+        /* Configure SAFC */
+        wb_data[0] = 0x1000200;
+        wb_data[1] = 0;
+        REG_WR_DMAE(bp, bmac_addr + BIGMAC2_REGISTER_RX_LLFC_MSG_FLDS,
+                        wb_data, 2);
+        udelay(30);
+
+        /* set rx mtu */
+        wb_data[0] = ETH_MAX_JUMBO_PACKET_SIZE + ETH_OVREHEAD;
+        wb_data[1] = 0;
+        REG_WR_DMAE(bp, bmac_addr + BIGMAC2_REGISTER_RX_MAX_SIZE,
+                        wb_data, 2);
+        udelay(30);
+
+        /* set tx mtu */
+        wb_data[0] = ETH_MAX_JUMBO_PACKET_SIZE + ETH_OVREHEAD;
+        wb_data[1] = 0;
+        REG_WR_DMAE(bp, bmac_addr + BIGMAC2_REGISTER_TX_MAX_SIZE,
+                        wb_data, 2);
+        udelay(30);
+        /* set cnt max size */
+        wb_data[0] = ETH_MAX_JUMBO_PACKET_SIZE + ETH_OVREHEAD - 2;
+        wb_data[1] = 0;
+        REG_WR_DMAE(bp, bmac_addr + BIGMAC2_REGISTER_CNT_MAX_SIZE,
+                        wb_data, 2);
+        udelay(30);
+        bnx2x_update_bmac2(params, vars, is_lb);
+
+        return 0;
+}
+
+u8 bnx2x_bmac_enable(struct link_params *params,
+                            struct link_vars *vars,
+                            u8 is_lb)
+{
+        u8 rc, port = params->port;
+        struct bnx2x *bp = params->bp;
+        u32 val;
+        /* reset and unreset the BigMac */
+        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_CLEAR,
+                     (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port));
+        udelay(10);
+
+        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_SET,
+                     (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port));
+
+        /* enable access for bmac registers */
+        REG_WR(bp, NIG_REG_BMAC0_REGS_OUT_EN + port*4, 0x1);
+
+        /* Enable BMAC according to BMAC type*/
+        if (CHIP_IS_E2(bp))
+                rc = bnx2x_bmac2_enable(params, vars, is_lb);
+        else
+                rc = bnx2x_bmac1_enable(params, vars, is_lb);
         REG_WR(bp, NIG_REG_XGXS_SERDES0_MODE_SEL + port*4, 0x1);
         REG_WR(bp, NIG_REG_XGXS_LANE_SEL_P0 + port*4, 0x0);
         REG_WR(bp, NIG_REG_EGRESS_EMAC0_PORT + port*4, 0x0);
@@ -493,7 +631,7 @@ static u8 bnx2x_bmac_enable(struct link_params *params, struct link_vars *vars,
         REG_WR(bp, NIG_REG_BMAC0_OUT_EN + port*4, 0x1);
 
         vars->mac_type = MAC_TYPE_BMAC;
-        return 0;
+        return rc;
 }
 
 
@@ -519,13 +657,25 @@ static void bnx2x_bmac_rx_disable(struct bnx2x *bp, u8 port)
                         (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port) &&
             nig_bmac_enable) {
 
-                /* Clear Rx Enable bit in BMAC_CONTROL register */
-                REG_RD_DMAE(bp, bmac_addr + BIGMAC_REGISTER_BMAC_CONTROL,
-                            wb_data, 2);
-                wb_data[0] &= ~BMAC_CONTROL_RX_ENABLE;
-                REG_WR_DMAE(bp, bmac_addr + BIGMAC_REGISTER_BMAC_CONTROL,
-                            wb_data, 2);
-
+                if (CHIP_IS_E2(bp)) {
+                        /* Clear Rx Enable bit in BMAC_CONTROL register */
+                        REG_RD_DMAE(bp, bmac_addr +
+                                        BIGMAC2_REGISTER_BMAC_CONTROL,
+                                        wb_data, 2);
+                        wb_data[0] &= ~BMAC_CONTROL_RX_ENABLE;
+                        REG_WR_DMAE(bp, bmac_addr +
+                                        BIGMAC2_REGISTER_BMAC_CONTROL,
+                                        wb_data, 2);
+                } else {
+                        /* Clear Rx Enable bit in BMAC_CONTROL register */
+                        REG_RD_DMAE(bp, bmac_addr +
+                                        BIGMAC_REGISTER_BMAC_CONTROL,
+                                        wb_data, 2);
+                        wb_data[0] &= ~BMAC_CONTROL_RX_ENABLE;
+                        REG_WR_DMAE(bp, bmac_addr +
+                                        BIGMAC_REGISTER_BMAC_CONTROL,
+                                        wb_data, 2);
+                }
                 msleep(1);
         }
 }
@@ -821,23 +971,31 @@ u8 bnx2x_phy_write(struct link_params *params, u8 phy_addr,
         return -EINVAL;
 }
 
-static void bnx2x_set_aer_mmd(struct link_params *params,
-                              struct bnx2x_phy *phy)
+static void bnx2x_set_aer_mmd_xgxs(struct link_params *params,
+                                   struct bnx2x_phy *phy)
 {
-        struct bnx2x *bp = params->bp;
         u32 ser_lane;
-        u16 offset;
-
+        u16 offset, aer_val;
+        struct bnx2x *bp = params->bp;
         ser_lane = ((params->lane_config &
                      PORT_HW_CFG_LANE_SWAP_CFG_MASTER_MASK) >>
                      PORT_HW_CFG_LANE_SWAP_CFG_MASTER_SHIFT);
 
-        offset = (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) ?
-                (phy->addr + ser_lane) : 0;
-
+        offset = phy->addr + ser_lane;
+        if (CHIP_IS_E2(bp))
+                aer_val = 0x2800 + offset - 1;
+        else
+                aer_val = 0x3800 + offset;
         CL45_WR_OVER_CL22(bp, phy,
-                              MDIO_REG_BANK_AER_BLOCK,
-                              MDIO_AER_BLOCK_AER_REG, 0x3800 + offset);
+                                MDIO_REG_BANK_AER_BLOCK,
+                                MDIO_AER_BLOCK_AER_REG, aer_val);
+}
+static void bnx2x_set_aer_mmd_serdes(struct bnx2x *bp,
+                                     struct bnx2x_phy *phy)
+{
+        CL45_WR_OVER_CL22(bp, phy,
+                                MDIO_REG_BANK_AER_BLOCK,
+                                MDIO_AER_BLOCK_AER_REG, 0x3800);
 }
 
 /******************************************************************/
@@ -2046,12 +2204,12 @@ static u8 bnx2x_init_serdes(struct bnx2x_phy *phy,
         u8 rc;
         vars->phy_flags |= PHY_SGMII_FLAG;
         bnx2x_calc_ieee_aneg_adv(phy, params, &vars->ieee_fc);
-        bnx2x_set_aer_mmd(params, phy);
+        bnx2x_set_aer_mmd_serdes(params->bp, phy);
         rc = bnx2x_reset_unicore(params, phy, 1);
         /* reset the SerDes and wait for reset bit return low */
         if (rc != 0)
                 return rc;
-        bnx2x_set_aer_mmd(params, phy);
+        bnx2x_set_aer_mmd_serdes(params->bp, phy);
 
         return rc;
 }
@@ -2076,7 +2234,7 @@ static u8 bnx2x_init_xgxs(struct bnx2x_phy *phy,
                 vars->phy_flags &= ~PHY_SGMII_FLAG;
 
         bnx2x_calc_ieee_aneg_adv(phy, params, &vars->ieee_fc);
-        bnx2x_set_aer_mmd(params, phy);
+        bnx2x_set_aer_mmd_xgxs(params, phy);
         bnx2x_set_master_ln(params, phy);
 
         rc = bnx2x_reset_unicore(params, phy, 0);
@@ -2084,7 +2242,7 @@ static u8 bnx2x_init_xgxs(struct bnx2x_phy *phy,
         if (rc != 0)
                 return rc;
 
-        bnx2x_set_aer_mmd(params, phy);
+        bnx2x_set_aer_mmd_xgxs(params, phy);
 
         /* setting the masterLn_def again after the reset */
         bnx2x_set_master_ln(params, phy);
@@ -2358,7 +2516,7 @@ static void bnx2x_set_xgxs_loopback(struct bnx2x_phy *phy,
                                0x6041);
                 msleep(200);
                 /* set aer mmd back */
-                bnx2x_set_aer_mmd(params, phy);
+                bnx2x_set_aer_mmd_xgxs(params, phy);
 
                 /* and md_devad */
                 REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_DEVAD + port*0x18,
@@ -2721,7 +2879,10 @@ static void bnx2x_common_ext_link_reset(struct bnx2x_phy *phy,
         struct bnx2x *bp = params->bp;
         u8 gpio_port;
         /* HW reset */
-        gpio_port = params->port;
+        if (CHIP_IS_E2(bp))
+                gpio_port = BP_PATH(bp);
+        else
+                gpio_port = params->port;
         bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
                             MISC_REGISTERS_GPIO_OUTPUT_LOW,
                             gpio_port);
@@ -2799,8 +2960,9 @@ static u8 bnx2x_update_link_up(struct link_params *params,
         }
 
         /* PBF - link up */
-        rc |= bnx2x_pbf_update(params, vars->flow_ctrl,
-                              vars->line_speed);
+        if (!(CHIP_IS_E2(bp)))
+                rc |= bnx2x_pbf_update(params, vars->flow_ctrl,
+                                       vars->line_speed);
 
         /* disable drain */
         REG_WR(bp, NIG_REG_EGRESS_DRAIN0_MODE + port*4, 0);
@@ -3443,7 +3605,10 @@ static u8 bnx2x_8073_config_init(struct bnx2x_phy *phy,
         u8 gpio_port;
         DP(NETIF_MSG_LINK, "Init 8073\n");
 
-        gpio_port = params->port;
+        if (CHIP_IS_E2(bp))
+                gpio_port = BP_PATH(bp);
+        else
+                gpio_port = params->port;
         /* Restore normal power mode*/
         bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
                             MISC_REGISTERS_GPIO_OUTPUT_HIGH, gpio_port);
@@ -3680,7 +3845,10 @@ static void bnx2x_8073_link_reset(struct bnx2x_phy *phy,
 {
         struct bnx2x *bp = params->bp;
         u8 gpio_port;
-        gpio_port = params->port;
+        if (CHIP_IS_E2(bp))
+                gpio_port = BP_PATH(bp);
+        else
+                gpio_port = params->port;
         DP(NETIF_MSG_LINK, "Setting 8073 port %d into low power mode\n",
            gpio_port);
         bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
@@ -4066,6 +4234,7 @@ static u8 bnx2x_verify_sfp_module(struct bnx2x_phy *phy,
                           "verification\n");
                 return -EINVAL;
         }
+
         fw_cmd_param = FW_PARAM_SET(phy->addr, phy->type, phy->mdio_ctrl);
         fw_resp = bnx2x_fw_command(bp, cmd, fw_cmd_param);
         if (fw_resp == FW_MSG_CODE_VRFY_OPT_MDL_SUCCESS) {
@@ -6370,7 +6539,10 @@ static u8 bnx2x_populate_int_phy(struct bnx2x *bp, u32 shmem_base, u8 port,
         phy->mdio_ctrl = bnx2x_get_emac_base(bp,
                                             SHARED_HW_CFG_MDC_MDIO_ACCESS1_BOTH,
                                             port);
-        phy->def_md_devad = DEFAULT_PHY_DEV_ADDR;
+        if (CHIP_IS_E2(bp))
+                phy->def_md_devad = E2_DEFAULT_PHY_DEV_ADDR;
+        else
+                phy->def_md_devad = DEFAULT_PHY_DEV_ADDR;
 
         DP(NETIF_MSG_LINK, "Internal phy port=%d, addr=0x%x, mdio_ctl=0x%x\n",
                    port, phy->addr, phy->mdio_ctrl);
@@ -6741,7 +6913,9 @@ u8 bnx2x_phy_init(struct link_params *params, struct link_vars *vars)
                 }
 
                 bnx2x_emac_enable(params, vars, 0);
-                bnx2x_pbf_update(params, vars->flow_ctrl, vars->line_speed);
+                if (!(CHIP_IS_E2(bp)))
+                        bnx2x_pbf_update(params, vars->flow_ctrl,
+                                         vars->line_speed);
                 /* disable drain */
                 REG_WR(bp, NIG_REG_EGRESS_DRAIN0_MODE + params->port*4, 0);
 
@@ -6931,18 +7105,34 @@ u8 bnx2x_link_reset(struct link_params *params, struct link_vars *vars,
 /****************************************************************************/
 /*                              Common function                             */
 /****************************************************************************/
-static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp, u32 shmem_base, u32 shmem2_base, u8 phy_index)
+static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp,
+                                     u32 shmem_base_path[],
+                                     u32 shmem2_base_path[], u8 phy_index,
+                                     u32 chip_id)
 {
         struct bnx2x_phy phy[PORT_MAX];
         struct bnx2x_phy *phy_blk[PORT_MAX];
         u16 val;
         s8 port;
+        s8 port_of_path = 0;
 
         /* PART1 - Reset both phys */
         for (port = PORT_MAX - 1; port >= PORT_0; port--) {
+                u32 shmem_base, shmem2_base;
+                /* In E2, same phy is using for port0 of the two paths */
+                if (CHIP_IS_E2(bp)) {
+                        shmem_base = shmem_base_path[port];
+                        shmem2_base = shmem2_base_path[port];
+                        port_of_path = 0;
+                } else {
+                        shmem_base = shmem_base_path[0];
+                        shmem2_base = shmem2_base_path[0];
+                        port_of_path = port;
+                }
+
                 /* Extract the ext phy address for the port */
                 if (bnx2x_populate_phy(bp, phy_index, shmem_base, shmem2_base,
-                                       port, &phy[port]) !=
+                                       port_of_path, &phy[port]) !=
                     0) {
                         DP(NETIF_MSG_LINK, "populate_phy failed\n");
                         return -EINVAL;
@@ -6980,9 +7170,15 @@ static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp, u32 shmem_base, u32 shmem
         /* PART2 - Download firmware to both phys */
         for (port = PORT_MAX - 1; port >= PORT_0; port--) {
                 u16 fw_ver1;
+                if (CHIP_IS_E2(bp))
+                        port_of_path = 0;
+                else
+                        port_of_path = port;
 
+                DP(NETIF_MSG_LINK, "Loading spirom for phy address 0x%x\n",
+                           phy_blk[port]->addr);
                 bnx2x_8073_8727_external_rom_boot(bp, phy_blk[port],
-                                                  port);
+                                                  port_of_path);
 
                 bnx2x_cl45_read(bp, phy_blk[port],
                               MDIO_PMA_DEVAD,
@@ -7038,9 +7234,10 @@ static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp, u32 shmem_base, u32 shmem
         }
         return 0;
 }
-
-static u8 bnx2x_8726_common_init_phy(struct bnx2x *bp, u32 shmem_base,
-                                     u32 shmem2_base, u8 phy_index)
+static u8 bnx2x_8726_common_init_phy(struct bnx2x *bp,
+                                     u32 shmem_base_path[],
+                                     u32 shmem2_base_path[], u8 phy_index,
+                                     u32 chip_id)
 {
         u32 val;
         s8 port;
@@ -7055,6 +7252,16 @@ static u8 bnx2x_8726_common_init_phy(struct bnx2x *bp, u32 shmem_base,
         bnx2x_ext_phy_hw_reset(bp, 1);
         msleep(5);
         for (port = 0; port < PORT_MAX; port++) {
+                u32 shmem_base, shmem2_base;
+
+                /* In E2, same phy is using for port0 of the two paths */
+                if (CHIP_IS_E2(bp)) {
+                        shmem_base = shmem_base_path[port];
+                        shmem2_base = shmem2_base_path[port];
+                } else {
+                        shmem_base = shmem_base_path[0];
+                        shmem2_base = shmem2_base_path[0];
+                }
                 /* Extract the ext phy address for the port */
                 if (bnx2x_populate_phy(bp, phy_index, shmem_base, shmem2_base,
                                        port, &phy) !=
@@ -7076,14 +7283,16 @@ static u8 bnx2x_8726_common_init_phy(struct bnx2x *bp, u32 shmem_base,
 
         return 0;
 }
-static u8 bnx2x_8727_common_init_phy(struct bnx2x *bp, u32 shmem_base,
-                                     u32 shmem2_base, u8 phy_index)
+static u8 bnx2x_8727_common_init_phy(struct bnx2x *bp,
+                                     u32 shmem_base_path[],
+                                     u32 shmem2_base_path[], u8 phy_index,
+                                     u32 chip_id)
 {
         s8 port;
         u32 swap_val, swap_override;
         struct bnx2x_phy phy[PORT_MAX];
         struct bnx2x_phy *phy_blk[PORT_MAX];
-        DP(NETIF_MSG_LINK, "Executing BCM8727 common init\n");
+        s8 port_of_path;
         swap_val = REG_RD(bp,  NIG_REG_PORT_SWAP);
         swap_override = REG_RD(bp,  NIG_REG_STRAP_OVERRIDE);
 
@@ -7098,19 +7307,33 @@ static u8 bnx2x_8727_common_init_phy(struct bnx2x *bp, u32 shmem_base,
 
         /* PART1 - Reset both phys */
         for (port = PORT_MAX - 1; port >= PORT_0; port--) {
+                u32 shmem_base, shmem2_base;
+
+                /* In E2, same phy is using for port0 of the two paths */
+                if (CHIP_IS_E2(bp)) {
+                        shmem_base = shmem_base_path[port];
+                        shmem2_base = shmem2_base_path[port];
+                        port_of_path = 0;
+                } else {
+                        shmem_base = shmem_base_path[0];
+                        shmem2_base = shmem2_base_path[0];
+                        port_of_path = port;
+                }
+
                 /* Extract the ext phy address for the port */
                 if (bnx2x_populate_phy(bp, phy_index, shmem_base, shmem2_base,
-                                       port, &phy[port]) !=
+                                       port_of_path, &phy[port]) !=
                                        0) {
                         DP(NETIF_MSG_LINK, "populate phy failed\n");
                         return -EINVAL;
                 }
                 /* disable attentions */
-                bnx2x_bits_dis(bp, NIG_REG_MASK_INTERRUPT_PORT0 + port*4,
-                             (NIG_MASK_XGXS0_LINK_STATUS |
-                              NIG_MASK_XGXS0_LINK10G |
-                              NIG_MASK_SERDES0_LINK_STATUS |
-                              NIG_MASK_MI_INT));
+                bnx2x_bits_dis(bp, NIG_REG_MASK_INTERRUPT_PORT0 +
+                               port_of_path*4,
+                               (NIG_MASK_XGXS0_LINK_STATUS |
+                                NIG_MASK_XGXS0_LINK10G |
+                                NIG_MASK_SERDES0_LINK_STATUS |
+                                NIG_MASK_MI_INT));
 
 
                 /* Reset the phy */
@@ -7132,9 +7355,14 @@ static u8 bnx2x_8727_common_init_phy(struct bnx2x *bp, u32 shmem_base,
         /* PART2 - Download firmware to both phys */
         for (port = PORT_MAX - 1; port >= PORT_0; port--) {
                 u16 fw_ver1;
-
+                 if (CHIP_IS_E2(bp))
+                        port_of_path = 0;
+                else
+                        port_of_path = port;
+                DP(NETIF_MSG_LINK, "Loading spirom for phy address 0x%x\n",
+                           phy_blk[port]->addr);
                 bnx2x_8073_8727_external_rom_boot(bp, phy_blk[port],
-                                                  port);
+                                                  port_of_path);
                 bnx2x_cl45_read(bp, phy_blk[port],
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_ROM_VER1, &fw_ver1);
@@ -7150,29 +7378,32 @@ static u8 bnx2x_8727_common_init_phy(struct bnx2x *bp, u32 shmem_base,
         return 0;
 }
 
-static u8 bnx2x_ext_phy_common_init(struct bnx2x *bp, u32 shmem_base,
-                                    u32 shmem2_base, u8 phy_index,
-                                    u32 ext_phy_type)
+static u8 bnx2x_ext_phy_common_init(struct bnx2x *bp, u32 shmem_base_path[],
+                                    u32 shmem2_base_path[], u8 phy_index,
+                                    u32 ext_phy_type, u32 chip_id)
 {
         u8 rc = 0;
 
         switch (ext_phy_type) {
         case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
-                rc = bnx2x_8073_common_init_phy(bp, shmem_base,
-                                                shmem2_base, phy_index);
+                rc = bnx2x_8073_common_init_phy(bp, shmem_base_path,
+                                                shmem2_base_path,
+                                                phy_index, chip_id);
                 break;
 
         case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
         case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727_NOC:
-                rc = bnx2x_8727_common_init_phy(bp, shmem_base,
-                                                shmem2_base, phy_index);
+                rc = bnx2x_8727_common_init_phy(bp, shmem_base_path,
+                                                shmem2_base_path,
+                                                phy_index, chip_id);
                 break;
 
         case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
                 /* GPIO1 affects both ports, so there's need to pull
                 it for single port alone */
-                rc = bnx2x_8726_common_init_phy(bp, shmem_base,
-                                                shmem2_base, phy_index);
+                rc = bnx2x_8726_common_init_phy(bp, shmem_base_path,
+                                                shmem2_base_path,
+                                                phy_index, chip_id);
                 break;
         case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE:
                 rc = -EINVAL;
@@ -7187,8 +7418,8 @@ static u8 bnx2x_ext_phy_common_init(struct bnx2x *bp, u32 shmem_base,
         return rc;
 }
 
-u8 bnx2x_common_init_phy(struct bnx2x *bp, u32 shmem_base,
-                         u32 shmem2_base)
+u8 bnx2x_common_init_phy(struct bnx2x *bp, u32 shmem_base_path[],
+                         u32 shmem2_base_path[], u32 chip_id)
 {
         u8 rc = 0;
         u8 phy_index;
@@ -7202,12 +7433,13 @@ u8 bnx2x_common_init_phy(struct bnx2x *bp, u32 shmem_base,
         for (phy_index = EXT_PHY1; phy_index < MAX_PHYS;
               phy_index++) {
                 ext_phy_config = bnx2x_get_ext_phy_config(bp,
-                                                          shmem_base,
+                                                          shmem_base_path[0],
                                                           phy_index, 0);
                 ext_phy_type = XGXS_EXT_PHY_TYPE(ext_phy_config);
-                rc |= bnx2x_ext_phy_common_init(bp, shmem_base,
-                                                shmem2_base,
-                                                phy_index, ext_phy_type);
+                rc |= bnx2x_ext_phy_common_init(bp, shmem_base_path,
+                                                shmem2_base_path,
+                                                phy_index, ext_phy_type,
+                                                chip_id);
         }
         return rc;
 }
diff --git a/drivers/net/bnx2x/bnx2x_link.h b/drivers/net/bnx2x/bnx2x_link.h
index e98ea3d19471..58a4c7199276 100644
--- a/drivers/net/bnx2x/bnx2x_link.h
+++ b/drivers/net/bnx2x/bnx2x_link.h
@@ -22,7 +22,8 @@
 /***********************************************************/
 /*                         Defines                         */
 /***********************************************************/
-#define DEFAULT_PHY_DEV_ADDR 3
+#define DEFAULT_PHY_DEV_ADDR    3
+#define E2_DEFAULT_PHY_DEV_ADDR 5
 
 
 
@@ -315,7 +316,8 @@ u8 bnx2x_test_link(struct link_params *input, struct link_vars *vars,
                    u8 is_serdes);
 
 /* One-time initialization for external phy after power up */
-u8 bnx2x_common_init_phy(struct bnx2x *bp, u32 shmem_base, u32 shmem2_base);
+u8 bnx2x_common_init_phy(struct bnx2x *bp, u32 shmem_base_path[],
+                         u32 shmem2_base_path[], u32 chip_id);
 
 /* Reset the external PHY using GPIO */
 void bnx2x_ext_phy_hw_reset(struct bnx2x *bp, u8 port);
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index 67587fe9e358..ff99a2fc0426 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -23,7 +23,6 @@
 #include <linux/errno.h>
 #include <linux/ioport.h>
 #include <linux/slab.h>
-#include <linux/vmalloc.h>
 #include <linux/interrupt.h>
 #include <linux/pci.h>
 #include <linux/init.h>
@@ -57,7 +56,6 @@
 #include "bnx2x_init_ops.h"
 #include "bnx2x_cmn.h"
 
-
 #include <linux/firmware.h>
 #include "bnx2x_fw_file_hdr.h"
 /* FW files */
@@ -66,8 +64,9 @@
         __stringify(BCM_5710_FW_MINOR_VERSION) "."      \
         __stringify(BCM_5710_FW_REVISION_VERSION) "."   \
         __stringify(BCM_5710_FW_ENGINEERING_VERSION)
-#define FW_FILE_NAME_E1         "bnx2x-e1-" FW_FILE_VERSION ".fw"
-#define FW_FILE_NAME_E1H        "bnx2x-e1h-" FW_FILE_VERSION ".fw"
+#define FW_FILE_NAME_E1         "bnx2x/bnx2x-e1-" FW_FILE_VERSION ".fw"
+#define FW_FILE_NAME_E1H        "bnx2x/bnx2x-e1h-" FW_FILE_VERSION ".fw"
+#define FW_FILE_NAME_E2         "bnx2x/bnx2x-e2-" FW_FILE_VERSION ".fw"
 
 /* Time in jiffies before concluding the transmitter is hung */
 #define TX_TIMEOUT              (5*HZ)
@@ -77,18 +76,20 @@ static char version[] __devinitdata =
         DRV_MODULE_NAME " " DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
 
 MODULE_AUTHOR("Eliezer Tamir");
-MODULE_DESCRIPTION("Broadcom NetXtreme II BCM57710/57711/57711E Driver");
+MODULE_DESCRIPTION("Broadcom NetXtreme II "
+                   "BCM57710/57711/57711E/57712/57712E Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_MODULE_VERSION);
 MODULE_FIRMWARE(FW_FILE_NAME_E1);
 MODULE_FIRMWARE(FW_FILE_NAME_E1H);
+MODULE_FIRMWARE(FW_FILE_NAME_E2);
 
 static int multi_mode = 1;
 module_param(multi_mode, int, 0);
 MODULE_PARM_DESC(multi_mode, " Multi queue mode "
                              "(0 Disable; 1 Enable (default))");
 
-static int num_queues;
+int num_queues;
 module_param(num_queues, int, 0);
 MODULE_PARM_DESC(num_queues, " Number of queues for multi_mode=1"
                                 " (default is as a number of CPUs)");
@@ -124,6 +125,8 @@ enum bnx2x_board_type {
         BCM57710 = 0,
         BCM57711 = 1,
         BCM57711E = 2,
+        BCM57712 = 3,
+        BCM57712E = 4
 };
 
 /* indexed by board_type, above */
@@ -132,14 +135,24 @@ static struct {
 } board_info[] __devinitdata = {
         { "Broadcom NetXtreme II BCM57710 XGb" },
         { "Broadcom NetXtreme II BCM57711 XGb" },
-        { "Broadcom NetXtreme II BCM57711E XGb" }
+        { "Broadcom NetXtreme II BCM57711E XGb" },
+        { "Broadcom NetXtreme II BCM57712 XGb" },
+        { "Broadcom NetXtreme II BCM57712E XGb" }
 };
 
+#ifndef PCI_DEVICE_ID_NX2_57712
+#define PCI_DEVICE_ID_NX2_57712         0x1662
+#endif
+#ifndef PCI_DEVICE_ID_NX2_57712E
+#define PCI_DEVICE_ID_NX2_57712E        0x1663
+#endif
 
 static DEFINE_PCI_DEVICE_TABLE(bnx2x_pci_tbl) = {
         { PCI_VDEVICE(BROADCOM, PCI_DEVICE_ID_NX2_57710), BCM57710 },
         { PCI_VDEVICE(BROADCOM, PCI_DEVICE_ID_NX2_57711), BCM57711 },
         { PCI_VDEVICE(BROADCOM, PCI_DEVICE_ID_NX2_57711E), BCM57711E },
+        { PCI_VDEVICE(BROADCOM, PCI_DEVICE_ID_NX2_57712), BCM57712 },
+        { PCI_VDEVICE(BROADCOM, PCI_DEVICE_ID_NX2_57712E), BCM57712E },
         { 0 }
 };
 
@@ -149,6 +162,244 @@ MODULE_DEVICE_TABLE(pci, bnx2x_pci_tbl);
 * General service functions
 ****************************************************************************/
 
+static inline void __storm_memset_dma_mapping(struct bnx2x *bp,
+                                       u32 addr, dma_addr_t mapping)
+{
+        REG_WR(bp,  addr, U64_LO(mapping));
+        REG_WR(bp,  addr + 4, U64_HI(mapping));
+}
+
+static inline void __storm_memset_fill(struct bnx2x *bp,
+                                       u32 addr, size_t size, u32 val)
+{
+        int i;
+        for (i = 0; i < size/4; i++)
+                REG_WR(bp,  addr + (i * 4), val);
+}
+
+static inline void storm_memset_ustats_zero(struct bnx2x *bp,
+                                            u8 port, u16 stat_id)
+{
+        size_t size = sizeof(struct ustorm_per_client_stats);
+
+        u32 addr = BAR_USTRORM_INTMEM +
+                        USTORM_PER_COUNTER_ID_STATS_OFFSET(port, stat_id);
+
+        __storm_memset_fill(bp, addr, size, 0);
+}
+
+static inline void storm_memset_tstats_zero(struct bnx2x *bp,
+                                            u8 port, u16 stat_id)
+{
+        size_t size = sizeof(struct tstorm_per_client_stats);
+
+        u32 addr = BAR_TSTRORM_INTMEM +
+                        TSTORM_PER_COUNTER_ID_STATS_OFFSET(port, stat_id);
+
+        __storm_memset_fill(bp, addr, size, 0);
+}
+
+static inline void storm_memset_xstats_zero(struct bnx2x *bp,
+                                            u8 port, u16 stat_id)
+{
+        size_t size = sizeof(struct xstorm_per_client_stats);
+
+        u32 addr = BAR_XSTRORM_INTMEM +
+                        XSTORM_PER_COUNTER_ID_STATS_OFFSET(port, stat_id);
+
+        __storm_memset_fill(bp, addr, size, 0);
+}
+
+
+static inline void storm_memset_spq_addr(struct bnx2x *bp,
+                                         dma_addr_t mapping, u16 abs_fid)
+{
+        u32 addr = XSEM_REG_FAST_MEMORY +
+                        XSTORM_SPQ_PAGE_BASE_OFFSET(abs_fid);
+
+        __storm_memset_dma_mapping(bp, addr, mapping);
+}
+
+static inline void storm_memset_ov(struct bnx2x *bp, u16 ov, u16 abs_fid)
+{
+        REG_WR16(bp, BAR_XSTRORM_INTMEM + XSTORM_E1HOV_OFFSET(abs_fid), ov);
+}
+
+static inline void storm_memset_func_cfg(struct bnx2x *bp,
+                                struct tstorm_eth_function_common_config *tcfg,
+                                u16 abs_fid)
+{
+        size_t size = sizeof(struct tstorm_eth_function_common_config);
+
+        u32 addr = BAR_TSTRORM_INTMEM +
+                        TSTORM_FUNCTION_COMMON_CONFIG_OFFSET(abs_fid);
+
+        __storm_memset_struct(bp, addr, size, (u32 *)tcfg);
+}
+
+static inline void storm_memset_xstats_flags(struct bnx2x *bp,
+                                struct stats_indication_flags *flags,
+                                u16 abs_fid)
+{
+        size_t size = sizeof(struct stats_indication_flags);
+
+        u32 addr = BAR_XSTRORM_INTMEM + XSTORM_STATS_FLAGS_OFFSET(abs_fid);
+
+        __storm_memset_struct(bp, addr, size, (u32 *)flags);
+}
+
+static inline void storm_memset_tstats_flags(struct bnx2x *bp,
+                                struct stats_indication_flags *flags,
+                                u16 abs_fid)
+{
+        size_t size = sizeof(struct stats_indication_flags);
+
+        u32 addr = BAR_TSTRORM_INTMEM + TSTORM_STATS_FLAGS_OFFSET(abs_fid);
+
+        __storm_memset_struct(bp, addr, size, (u32 *)flags);
+}
+
+static inline void storm_memset_ustats_flags(struct bnx2x *bp,
+                                struct stats_indication_flags *flags,
+                                u16 abs_fid)
+{
+        size_t size = sizeof(struct stats_indication_flags);
+
+        u32 addr = BAR_USTRORM_INTMEM + USTORM_STATS_FLAGS_OFFSET(abs_fid);
+
+        __storm_memset_struct(bp, addr, size, (u32 *)flags);
+}
+
+static inline void storm_memset_cstats_flags(struct bnx2x *bp,
+                                struct stats_indication_flags *flags,
+                                u16 abs_fid)
+{
+        size_t size = sizeof(struct stats_indication_flags);
+
+        u32 addr = BAR_CSTRORM_INTMEM + CSTORM_STATS_FLAGS_OFFSET(abs_fid);
+
+        __storm_memset_struct(bp, addr, size, (u32 *)flags);
+}
+
+static inline void storm_memset_xstats_addr(struct bnx2x *bp,
+                                           dma_addr_t mapping, u16 abs_fid)
+{
+        u32 addr = BAR_XSTRORM_INTMEM +
+                XSTORM_ETH_STATS_QUERY_ADDR_OFFSET(abs_fid);
+
+        __storm_memset_dma_mapping(bp, addr, mapping);
+}
+
+static inline void storm_memset_tstats_addr(struct bnx2x *bp,
+                                           dma_addr_t mapping, u16 abs_fid)
+{
+        u32 addr = BAR_TSTRORM_INTMEM +
+                TSTORM_ETH_STATS_QUERY_ADDR_OFFSET(abs_fid);
+
+        __storm_memset_dma_mapping(bp, addr, mapping);
+}
+
+static inline void storm_memset_ustats_addr(struct bnx2x *bp,
+                                           dma_addr_t mapping, u16 abs_fid)
+{
+        u32 addr = BAR_USTRORM_INTMEM +
+                USTORM_ETH_STATS_QUERY_ADDR_OFFSET(abs_fid);
+
+        __storm_memset_dma_mapping(bp, addr, mapping);
+}
+
+static inline void storm_memset_cstats_addr(struct bnx2x *bp,
+                                           dma_addr_t mapping, u16 abs_fid)
+{
+        u32 addr = BAR_CSTRORM_INTMEM +
+                CSTORM_ETH_STATS_QUERY_ADDR_OFFSET(abs_fid);
+
+        __storm_memset_dma_mapping(bp, addr, mapping);
+}
+
+static inline void storm_memset_vf_to_pf(struct bnx2x *bp, u16 abs_fid,
+                                         u16 pf_id)
+{
+        REG_WR8(bp, BAR_XSTRORM_INTMEM + XSTORM_VF_TO_PF_OFFSET(abs_fid),
+                pf_id);
+        REG_WR8(bp, BAR_CSTRORM_INTMEM + CSTORM_VF_TO_PF_OFFSET(abs_fid),
+                pf_id);
+        REG_WR8(bp, BAR_TSTRORM_INTMEM + TSTORM_VF_TO_PF_OFFSET(abs_fid),
+                pf_id);
+        REG_WR8(bp, BAR_USTRORM_INTMEM + USTORM_VF_TO_PF_OFFSET(abs_fid),
+                pf_id);
+}
+
+static inline void storm_memset_func_en(struct bnx2x *bp, u16 abs_fid,
+                                        u8 enable)
+{
+        REG_WR8(bp, BAR_XSTRORM_INTMEM + XSTORM_FUNC_EN_OFFSET(abs_fid),
+                enable);
+        REG_WR8(bp, BAR_CSTRORM_INTMEM + CSTORM_FUNC_EN_OFFSET(abs_fid),
+                enable);
+        REG_WR8(bp, BAR_TSTRORM_INTMEM + TSTORM_FUNC_EN_OFFSET(abs_fid),
+                enable);
+        REG_WR8(bp, BAR_USTRORM_INTMEM + USTORM_FUNC_EN_OFFSET(abs_fid),
+                enable);
+}
+
+static inline void storm_memset_eq_data(struct bnx2x *bp,
+                                struct event_ring_data *eq_data,
+                                u16 pfid)
+{
+        size_t size = sizeof(struct event_ring_data);
+
+        u32 addr = BAR_CSTRORM_INTMEM + CSTORM_EVENT_RING_DATA_OFFSET(pfid);
+
+        __storm_memset_struct(bp, addr, size, (u32 *)eq_data);
+}
+
+static inline void storm_memset_eq_prod(struct bnx2x *bp, u16 eq_prod,
+                                        u16 pfid)
+{
+        u32 addr = BAR_CSTRORM_INTMEM + CSTORM_EVENT_RING_PROD_OFFSET(pfid);
+        REG_WR16(bp, addr, eq_prod);
+}
+
+static inline void storm_memset_hc_timeout(struct bnx2x *bp, u8 port,
+                                             u16 fw_sb_id, u8 sb_index,
+                                             u8 ticks)
+{
+
+        int index_offset = CHIP_IS_E2(bp) ?
+                offsetof(struct hc_status_block_data_e2, index_data) :
+                offsetof(struct hc_status_block_data_e1x, index_data);
+        u32 addr = BAR_CSTRORM_INTMEM +
+                        CSTORM_STATUS_BLOCK_DATA_OFFSET(fw_sb_id) +
+                        index_offset +
+                        sizeof(struct hc_index_data)*sb_index +
+                        offsetof(struct hc_index_data, timeout);
+        REG_WR8(bp, addr, ticks);
+        DP(NETIF_MSG_HW, "port %x fw_sb_id %d sb_index %d ticks %d\n",
+                          port, fw_sb_id, sb_index, ticks);
+}
+static inline void storm_memset_hc_disable(struct bnx2x *bp, u8 port,
+                                             u16 fw_sb_id, u8 sb_index,
+                                             u8 disable)
+{
+        u32 enable_flag = disable ? 0 : (1 << HC_INDEX_DATA_HC_ENABLED_SHIFT);
+        int index_offset = CHIP_IS_E2(bp) ?
+                offsetof(struct hc_status_block_data_e2, index_data) :
+                offsetof(struct hc_status_block_data_e1x, index_data);
+        u32 addr = BAR_CSTRORM_INTMEM +
+                        CSTORM_STATUS_BLOCK_DATA_OFFSET(fw_sb_id) +
+                        index_offset +
+                        sizeof(struct hc_index_data)*sb_index +
+                        offsetof(struct hc_index_data, flags);
+        u16 flags = REG_RD16(bp, addr);
+        /* clear and set */
+        flags &= ~HC_INDEX_DATA_HC_ENABLED;
+        flags |= enable_flag;
+        REG_WR16(bp, addr, flags);
+        DP(NETIF_MSG_HW, "port %x fw_sb_id %d sb_index %d disable %d\n",
+                          port, fw_sb_id, sb_index, disable);
+}
+
 /* used only at init
  * locking is done by mcp
  */
@@ -172,6 +423,75 @@ static u32 bnx2x_reg_rd_ind(struct bnx2x *bp, u32 addr)
         return val;
 }
 
+#define DMAE_DP_SRC_GRC         "grc src_addr [%08x]"
+#define DMAE_DP_SRC_PCI         "pci src_addr [%x:%08x]"
+#define DMAE_DP_DST_GRC         "grc dst_addr [%08x]"
+#define DMAE_DP_DST_PCI         "pci dst_addr [%x:%08x]"
+#define DMAE_DP_DST_NONE        "dst_addr [none]"
+
+void bnx2x_dp_dmae(struct bnx2x *bp, struct dmae_command *dmae, int msglvl)
+{
+        u32 src_type = dmae->opcode & DMAE_COMMAND_SRC;
+
+        switch (dmae->opcode & DMAE_COMMAND_DST) {
+        case DMAE_CMD_DST_PCI:
+                if (src_type == DMAE_CMD_SRC_PCI)
+                        DP(msglvl, "DMAE: opcode 0x%08x\n"
+                           "src [%x:%08x], len [%d*4], dst [%x:%08x]\n"
+                           "comp_addr [%x:%08x], comp_val 0x%08x\n",
+                           dmae->opcode, dmae->src_addr_hi, dmae->src_addr_lo,
+                           dmae->len, dmae->dst_addr_hi, dmae->dst_addr_lo,
+                           dmae->comp_addr_hi, dmae->comp_addr_lo,
+                           dmae->comp_val);
+                else
+                        DP(msglvl, "DMAE: opcode 0x%08x\n"
+                           "src [%08x], len [%d*4], dst [%x:%08x]\n"
+                           "comp_addr [%x:%08x], comp_val 0x%08x\n",
+                           dmae->opcode, dmae->src_addr_lo >> 2,
+                           dmae->len, dmae->dst_addr_hi, dmae->dst_addr_lo,
+                           dmae->comp_addr_hi, dmae->comp_addr_lo,
+                           dmae->comp_val);
+                break;
+        case DMAE_CMD_DST_GRC:
+                if (src_type == DMAE_CMD_SRC_PCI)
+                        DP(msglvl, "DMAE: opcode 0x%08x\n"
+                           "src [%x:%08x], len [%d*4], dst_addr [%08x]\n"
+                           "comp_addr [%x:%08x], comp_val 0x%08x\n",
+                           dmae->opcode, dmae->src_addr_hi, dmae->src_addr_lo,
+                           dmae->len, dmae->dst_addr_lo >> 2,
+                           dmae->comp_addr_hi, dmae->comp_addr_lo,
+                           dmae->comp_val);
+                else
+                        DP(msglvl, "DMAE: opcode 0x%08x\n"
+                           "src [%08x], len [%d*4], dst [%08x]\n"
+                           "comp_addr [%x:%08x], comp_val 0x%08x\n",
+                           dmae->opcode, dmae->src_addr_lo >> 2,
+                           dmae->len, dmae->dst_addr_lo >> 2,
+                           dmae->comp_addr_hi, dmae->comp_addr_lo,
+                           dmae->comp_val);
+                break;
+        default:
+                if (src_type == DMAE_CMD_SRC_PCI)
+                        DP(msglvl, "DMAE: opcode 0x%08x\n"
+                           DP_LEVEL "src_addr [%x:%08x]  len [%d * 4]  "
+                                    "dst_addr [none]\n"
+                           DP_LEVEL "comp_addr [%x:%08x]  comp_val 0x%08x\n",
+                           dmae->opcode, dmae->src_addr_hi, dmae->src_addr_lo,
+                           dmae->len, dmae->comp_addr_hi, dmae->comp_addr_lo,
+                           dmae->comp_val);
+                else
+                        DP(msglvl, "DMAE: opcode 0x%08x\n"
+                           DP_LEVEL "src_addr [%08x]  len [%d * 4]  "
+                                    "dst_addr [none]\n"
+                           DP_LEVEL "comp_addr [%x:%08x]  comp_val 0x%08x\n",
+                           dmae->opcode, dmae->src_addr_lo >> 2,
+                           dmae->len, dmae->comp_addr_hi, dmae->comp_addr_lo,
+                           dmae->comp_val);
+                break;
+        }
+
+}
+
 const u32 dmae_reg_go_c[] = {
         DMAE_REG_GO_C0, DMAE_REG_GO_C1, DMAE_REG_GO_C2, DMAE_REG_GO_C3,
         DMAE_REG_GO_C4, DMAE_REG_GO_C5, DMAE_REG_GO_C6, DMAE_REG_GO_C7,
@@ -195,85 +515,137 @@ void bnx2x_post_dmae(struct bnx2x *bp, struct dmae_command *dmae, int idx)
         REG_WR(bp, dmae_reg_go_c[idx], 1);
 }
 
-void bnx2x_write_dmae(struct bnx2x *bp, dma_addr_t dma_addr, u32 dst_addr,
-                      u32 len32)
+u32 bnx2x_dmae_opcode_add_comp(u32 opcode, u8 comp_type)
 {
-        struct dmae_command dmae;
-        u32 *wb_comp = bnx2x_sp(bp, wb_comp);
-        int cnt = 200;
+        return opcode | ((comp_type << DMAE_COMMAND_C_DST_SHIFT) |
+                           DMAE_CMD_C_ENABLE);
+}
 
-        if (!bp->dmae_ready) {
-                u32 *data = bnx2x_sp(bp, wb_data[0]);
+u32 bnx2x_dmae_opcode_clr_src_reset(u32 opcode)
+{
+        return opcode & ~DMAE_CMD_SRC_RESET;
+}
 
-                DP(BNX2X_MSG_OFF, "DMAE is not ready (dst_addr %08x  len32 %d)"
-                   "  using indirect\n", dst_addr, len32);
-                bnx2x_init_ind_wr(bp, dst_addr, data, len32);
-                return;
-        }
+u32 bnx2x_dmae_opcode(struct bnx2x *bp, u8 src_type, u8 dst_type,
+                             bool with_comp, u8 comp_type)
+{
+        u32 opcode = 0;
+
+        opcode |= ((src_type << DMAE_COMMAND_SRC_SHIFT) |
+                   (dst_type << DMAE_COMMAND_DST_SHIFT));
 
-        memset(&dmae, 0, sizeof(struct dmae_command));
+        opcode |= (DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET);
+
+        opcode |= (BP_PORT(bp) ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0);
+        opcode |= ((BP_E1HVN(bp) << DMAE_CMD_E1HVN_SHIFT) |
+                   (BP_E1HVN(bp) << DMAE_COMMAND_DST_VN_SHIFT));
+        opcode |= (DMAE_COM_SET_ERR << DMAE_COMMAND_ERR_POLICY_SHIFT);
 
-        dmae.opcode = (DMAE_CMD_SRC_PCI | DMAE_CMD_DST_GRC |
-                       DMAE_CMD_C_DST_PCI | DMAE_CMD_C_ENABLE |
-                       DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET |
 #ifdef __BIG_ENDIAN
-                       DMAE_CMD_ENDIANITY_B_DW_SWAP |
+        opcode |= DMAE_CMD_ENDIANITY_B_DW_SWAP;
 #else
-                       DMAE_CMD_ENDIANITY_DW_SWAP |
+        opcode |= DMAE_CMD_ENDIANITY_DW_SWAP;
 #endif
-                       (BP_PORT(bp) ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0) |
-                       (BP_E1HVN(bp) << DMAE_CMD_E1HVN_SHIFT));
-        dmae.src_addr_lo = U64_LO(dma_addr);
-        dmae.src_addr_hi = U64_HI(dma_addr);
-        dmae.dst_addr_lo = dst_addr >> 2;
-        dmae.dst_addr_hi = 0;
-        dmae.len = len32;
-        dmae.comp_addr_lo = U64_LO(bnx2x_sp_mapping(bp, wb_comp));
-        dmae.comp_addr_hi = U64_HI(bnx2x_sp_mapping(bp, wb_comp));
-        dmae.comp_val = DMAE_COMP_VAL;
-
-        DP(BNX2X_MSG_OFF, "DMAE: opcode 0x%08x\n"
-           DP_LEVEL "src_addr  [%x:%08x]  len [%d *4]  "
-                    "dst_addr [%x:%08x (%08x)]\n"
-           DP_LEVEL "comp_addr [%x:%08x]  comp_val 0x%08x\n",
-           dmae.opcode, dmae.src_addr_hi, dmae.src_addr_lo,
-           dmae.len, dmae.dst_addr_hi, dmae.dst_addr_lo, dst_addr,
-           dmae.comp_addr_hi, dmae.comp_addr_lo, dmae.comp_val);
-        DP(BNX2X_MSG_OFF, "data [0x%08x 0x%08x 0x%08x 0x%08x]\n",
+        if (with_comp)
+                opcode = bnx2x_dmae_opcode_add_comp(opcode, comp_type);
+        return opcode;
+}
+
+void bnx2x_prep_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae,
+                               u8 src_type, u8 dst_type)
+{
+        memset(dmae, 0, sizeof(struct dmae_command));
+
+        /* set the opcode */
+        dmae->opcode = bnx2x_dmae_opcode(bp, src_type, dst_type,
+                                         true, DMAE_COMP_PCI);
+
+        /* fill in the completion parameters */
+        dmae->comp_addr_lo = U64_LO(bnx2x_sp_mapping(bp, wb_comp));
+        dmae->comp_addr_hi = U64_HI(bnx2x_sp_mapping(bp, wb_comp));
+        dmae->comp_val = DMAE_COMP_VAL;
+}
+
+/* issue a dmae command over the init-channel and wailt for completion */
+int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae)
+{
+        u32 *wb_comp = bnx2x_sp(bp, wb_comp);
+        int cnt = CHIP_REV_IS_SLOW(bp) ? (400000) : 40;
+        int rc = 0;
+
+        DP(BNX2X_MSG_OFF, "data before [0x%08x 0x%08x 0x%08x 0x%08x]\n",
            bp->slowpath->wb_data[0], bp->slowpath->wb_data[1],
            bp->slowpath->wb_data[2], bp->slowpath->wb_data[3]);
 
+        /* lock the dmae channel */
         mutex_lock(&bp->dmae_mutex);
 
+        /* reset completion */
         *wb_comp = 0;
 
-        bnx2x_post_dmae(bp, &dmae, INIT_DMAE_C(bp));
+        /* post the command on the channel used for initializations */
+        bnx2x_post_dmae(bp, dmae, INIT_DMAE_C(bp));
 
+        /* wait for completion */
         udelay(5);
-
-        while (*wb_comp != DMAE_COMP_VAL) {
+        while ((*wb_comp & ~DMAE_PCI_ERR_FLAG) != DMAE_COMP_VAL) {
                 DP(BNX2X_MSG_OFF, "wb_comp 0x%08x\n", *wb_comp);
 
                 if (!cnt) {
                         BNX2X_ERR("DMAE timeout!\n");
-                        break;
+                        rc = DMAE_TIMEOUT;
+                        goto unlock;
                 }
                 cnt--;
-                /* adjust delay for emulation/FPGA */
-                if (CHIP_REV_IS_SLOW(bp))
-                        msleep(100);
-                else
-                        udelay(5);
+                udelay(50);
+        }
+        if (*wb_comp & DMAE_PCI_ERR_FLAG) {
+                BNX2X_ERR("DMAE PCI error!\n");
+                rc = DMAE_PCI_ERROR;
         }
 
+        DP(BNX2X_MSG_OFF, "data after [0x%08x 0x%08x 0x%08x 0x%08x]\n",
+           bp->slowpath->wb_data[0], bp->slowpath->wb_data[1],
+           bp->slowpath->wb_data[2], bp->slowpath->wb_data[3]);
+
+unlock:
         mutex_unlock(&bp->dmae_mutex);
+        return rc;
+}
+
+void bnx2x_write_dmae(struct bnx2x *bp, dma_addr_t dma_addr, u32 dst_addr,
+                      u32 len32)
+{
+        struct dmae_command dmae;
+
+        if (!bp->dmae_ready) {
+                u32 *data = bnx2x_sp(bp, wb_data[0]);
+
+                DP(BNX2X_MSG_OFF, "DMAE is not ready (dst_addr %08x  len32 %d)"
+                   "  using indirect\n", dst_addr, len32);
+                bnx2x_init_ind_wr(bp, dst_addr, data, len32);
+                return;
+        }
+
+        /* set opcode and fixed command fields */
+        bnx2x_prep_dmae_with_comp(bp, &dmae, DMAE_SRC_PCI, DMAE_DST_GRC);
+
+        /* fill in addresses and len */
+        dmae.src_addr_lo = U64_LO(dma_addr);
+        dmae.src_addr_hi = U64_HI(dma_addr);
+        dmae.dst_addr_lo = dst_addr >> 2;
+        dmae.dst_addr_hi = 0;
+        dmae.len = len32;
+
+        bnx2x_dp_dmae(bp, &dmae, BNX2X_MSG_OFF);
+
+        /* issue the command and wait for completion */
+        bnx2x_issue_dmae_with_comp(bp, &dmae);
 }
 
 void bnx2x_read_dmae(struct bnx2x *bp, u32 src_addr, u32 len32)
 {
         struct dmae_command dmae;
-        u32 *wb_comp = bnx2x_sp(bp, wb_comp);
-        int cnt = 200;
 
         if (!bp->dmae_ready) {
                 u32 *data = bnx2x_sp(bp, wb_data[0]);
@@ -286,62 +658,20 @@ void bnx2x_read_dmae(struct bnx2x *bp, u32 src_addr, u32 len32)
                 return;
         }
 
-        memset(&dmae, 0, sizeof(struct dmae_command));
+        /* set opcode and fixed command fields */
+        bnx2x_prep_dmae_with_comp(bp, &dmae, DMAE_SRC_GRC, DMAE_DST_PCI);
 
-        dmae.opcode = (DMAE_CMD_SRC_GRC | DMAE_CMD_DST_PCI |
-                       DMAE_CMD_C_DST_PCI | DMAE_CMD_C_ENABLE |
-                       DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET |
-#ifdef __BIG_ENDIAN
-                       DMAE_CMD_ENDIANITY_B_DW_SWAP |
-#else
-                       DMAE_CMD_ENDIANITY_DW_SWAP |
-#endif
-                       (BP_PORT(bp) ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0) |
-                       (BP_E1HVN(bp) << DMAE_CMD_E1HVN_SHIFT));
+        /* fill in addresses and len */
         dmae.src_addr_lo = src_addr >> 2;
         dmae.src_addr_hi = 0;
         dmae.dst_addr_lo = U64_LO(bnx2x_sp_mapping(bp, wb_data));
         dmae.dst_addr_hi = U64_HI(bnx2x_sp_mapping(bp, wb_data));
         dmae.len = len32;
-        dmae.comp_addr_lo = U64_LO(bnx2x_sp_mapping(bp, wb_comp));
-        dmae.comp_addr_hi = U64_HI(bnx2x_sp_mapping(bp, wb_comp));
-        dmae.comp_val = DMAE_COMP_VAL;
-
-        DP(BNX2X_MSG_OFF, "DMAE: opcode 0x%08x\n"
-           DP_LEVEL "src_addr  [%x:%08x]  len [%d *4]  "
-                    "dst_addr [%x:%08x (%08x)]\n"
-           DP_LEVEL "comp_addr [%x:%08x]  comp_val 0x%08x\n",
-           dmae.opcode, dmae.src_addr_hi, dmae.src_addr_lo,
-           dmae.len, dmae.dst_addr_hi, dmae.dst_addr_lo, src_addr,
-           dmae.comp_addr_hi, dmae.comp_addr_lo, dmae.comp_val);
-
-        mutex_lock(&bp->dmae_mutex);
-
-        memset(bnx2x_sp(bp, wb_data[0]), 0, sizeof(u32) * 4);
-        *wb_comp = 0;
 
-        bnx2x_post_dmae(bp, &dmae, INIT_DMAE_C(bp));
-
-        udelay(5);
-
-        while (*wb_comp != DMAE_COMP_VAL) {
-
-                if (!cnt) {
-                        BNX2X_ERR("DMAE timeout!\n");
-                        break;
-                }
-                cnt--;
-                /* adjust delay for emulation/FPGA */
-                if (CHIP_REV_IS_SLOW(bp))
-                        msleep(100);
-                else
-                        udelay(5);
-        }
-        DP(BNX2X_MSG_OFF, "data [0x%08x 0x%08x 0x%08x 0x%08x]\n",
-           bp->slowpath->wb_data[0], bp->slowpath->wb_data[1],
-           bp->slowpath->wb_data[2], bp->slowpath->wb_data[3]);
+        bnx2x_dp_dmae(bp, &dmae, BNX2X_MSG_OFF);
 
-        mutex_unlock(&bp->dmae_mutex);
+        /* issue the command and wait for completion */
+        bnx2x_issue_dmae_with_comp(bp, &dmae);
 }
 
 void bnx2x_write_dmae_phys_len(struct bnx2x *bp, dma_addr_t phys_addr,
@@ -508,19 +838,24 @@ static void bnx2x_fw_dump(struct bnx2x *bp)
         u32 mark, offset;
         __be32 data[9];
         int word;
-
+        u32 trace_shmem_base;
         if (BP_NOMCP(bp)) {
                 BNX2X_ERR("NO MCP - can not dump\n");
                 return;
         }
 
-        addr = bp->common.shmem_base - 0x0800 + 4;
+        if (BP_PATH(bp) == 0)
+                trace_shmem_base = bp->common.shmem_base;
+        else
+                trace_shmem_base = SHMEM2_RD(bp, other_shmem_base_addr);
+        addr = trace_shmem_base - 0x0800 + 4;
         mark = REG_RD(bp, addr);
-        mark = MCP_REG_MCPR_SCRATCH + ((mark + 0x3) & ~0x3) - 0x08000000;
+        mark = (CHIP_IS_E1x(bp) ? MCP_REG_MCPR_SCRATCH : MCP_A_REG_MCPR_SCRATCH)
+                        + ((mark + 0x3) & ~0x3) - 0x08000000;
         pr_err("begin fw dump (mark 0x%x)\n", mark);
 
         pr_err("");
-        for (offset = mark; offset <= bp->common.shmem_base; offset += 0x8*4) {
+        for (offset = mark; offset <= trace_shmem_base; offset += 0x8*4) {
                 for (word = 0; word < 8; word++)
                         data[word] = htonl(REG_RD(bp, offset + 4*word));
                 data[8] = 0x0;
@@ -538,7 +873,12 @@ static void bnx2x_fw_dump(struct bnx2x *bp)
 void bnx2x_panic_dump(struct bnx2x *bp)
 {
         int i;
-        u16 j, start, end;
+        u16 j;
+        struct hc_sp_status_block_data sp_sb_data;
+        int func = BP_FUNC(bp);
+#ifdef BNX2X_STOP_ON_ERROR
+        u16 start = 0, end = 0;
+#endif
 
         bp->stats_state = STATS_STATE_DISABLED;
         DP(BNX2X_MSG_STATS, "stats_state - DISABLED\n");
@@ -547,44 +887,143 @@ void bnx2x_panic_dump(struct bnx2x *bp)
 
         /* Indices */
         /* Common */
-        BNX2X_ERR("def_c_idx(0x%x)  def_u_idx(0x%x)  def_x_idx(0x%x)"
-                  "  def_t_idx(0x%x)  def_att_idx(0x%x)  attn_state(0x%x)"
+        BNX2X_ERR("def_idx(0x%x)  def_att_idx(0x%x)  attn_state(0x%x)"
                   "  spq_prod_idx(0x%x)\n",
-                  bp->def_c_idx, bp->def_u_idx, bp->def_x_idx, bp->def_t_idx,
-                  bp->def_att_idx, bp->attn_state, bp->spq_prod_idx);
+                  bp->def_idx, bp->def_att_idx,
+                  bp->attn_state, bp->spq_prod_idx);
+        BNX2X_ERR("DSB: attn bits(0x%x)  ack(0x%x)  id(0x%x)  idx(0x%x)\n",
+                  bp->def_status_blk->atten_status_block.attn_bits,
+                  bp->def_status_blk->atten_status_block.attn_bits_ack,
+                  bp->def_status_blk->atten_status_block.status_block_id,
+                  bp->def_status_blk->atten_status_block.attn_bits_index);
+        BNX2X_ERR("     def (");
+        for (i = 0; i < HC_SP_SB_MAX_INDICES; i++)
+                pr_cont("0x%x%s",
+                       bp->def_status_blk->sp_sb.index_values[i],
+                       (i == HC_SP_SB_MAX_INDICES - 1) ? ")  " : " ");
+
+        for (i = 0; i < sizeof(struct hc_sp_status_block_data)/sizeof(u32); i++)
+                *((u32 *)&sp_sb_data + i) = REG_RD(bp, BAR_CSTRORM_INTMEM +
+                        CSTORM_SP_STATUS_BLOCK_DATA_OFFSET(func) +
+                        i*sizeof(u32));
+
+        pr_cont("igu_sb_id(0x%x)  igu_seg_id (0x%x) "
+                         "pf_id(0x%x)  vnic_id(0x%x)  "
+                         "vf_id(0x%x)  vf_valid (0x%x)\n",
+               sp_sb_data.igu_sb_id,
+               sp_sb_data.igu_seg_id,
+               sp_sb_data.p_func.pf_id,
+               sp_sb_data.p_func.vnic_id,
+               sp_sb_data.p_func.vf_id,
+               sp_sb_data.p_func.vf_valid);
+
 
-        /* Rx */
         for_each_queue(bp, i) {
                 struct bnx2x_fastpath *fp = &bp->fp[i];
-
+                int loop;
+                struct hc_status_block_data_e2 sb_data_e2;
+                struct hc_status_block_data_e1x sb_data_e1x;
+                struct hc_status_block_sm  *hc_sm_p =
+                        CHIP_IS_E2(bp) ?
+                        sb_data_e2.common.state_machine :
+                        sb_data_e1x.common.state_machine;
+                struct hc_index_data *hc_index_p =
+                        CHIP_IS_E2(bp) ?
+                        sb_data_e2.index_data :
+                        sb_data_e1x.index_data;
+                int data_size;
+                u32 *sb_data_p;
+
+                /* Rx */
                 BNX2X_ERR("fp%d: rx_bd_prod(0x%x)  rx_bd_cons(0x%x)"
-                          "  *rx_bd_cons_sb(0x%x)  rx_comp_prod(0x%x)"
+                          "  rx_comp_prod(0x%x)"
                           "  rx_comp_cons(0x%x)  *rx_cons_sb(0x%x)\n",
                           i, fp->rx_bd_prod, fp->rx_bd_cons,
-                          le16_to_cpu(*fp->rx_bd_cons_sb), fp->rx_comp_prod,
+                          fp->rx_comp_prod,
                           fp->rx_comp_cons, le16_to_cpu(*fp->rx_cons_sb));
                 BNX2X_ERR("     rx_sge_prod(0x%x)  last_max_sge(0x%x)"
-                          "  fp_u_idx(0x%x) *sb_u_idx(0x%x)\n",
+                          "  fp_hc_idx(0x%x)\n",
                           fp->rx_sge_prod, fp->last_max_sge,
-                          le16_to_cpu(fp->fp_u_idx),
-                          fp->status_blk->u_status_block.status_block_index);
-        }
-
-        /* Tx */
-        for_each_queue(bp, i) {
-                struct bnx2x_fastpath *fp = &bp->fp[i];
+                          le16_to_cpu(fp->fp_hc_idx));
 
+                /* Tx */
                 BNX2X_ERR("fp%d: tx_pkt_prod(0x%x)  tx_pkt_cons(0x%x)"
                           "  tx_bd_prod(0x%x)  tx_bd_cons(0x%x)"
                           "  *tx_cons_sb(0x%x)\n",
                           i, fp->tx_pkt_prod, fp->tx_pkt_cons, fp->tx_bd_prod,
                           fp->tx_bd_cons, le16_to_cpu(*fp->tx_cons_sb));
-                BNX2X_ERR("     fp_c_idx(0x%x)  *sb_c_idx(0x%x)"
-                          "  tx_db_prod(0x%x)\n", le16_to_cpu(fp->fp_c_idx),
-                          fp->status_blk->c_status_block.status_block_index,
-                          fp->tx_db.data.prod);
+
+                loop = CHIP_IS_E2(bp) ?
+                        HC_SB_MAX_INDICES_E2 : HC_SB_MAX_INDICES_E1X;
+
+                /* host sb data */
+
+                BNX2X_ERR("     run indexes (");
+                for (j = 0; j < HC_SB_MAX_SM; j++)
+                        pr_cont("0x%x%s",
+                               fp->sb_running_index[j],
+                               (j == HC_SB_MAX_SM - 1) ? ")" : " ");
+
+                BNX2X_ERR("     indexes (");
+                for (j = 0; j < loop; j++)
+                        pr_cont("0x%x%s",
+                               fp->sb_index_values[j],
+                               (j == loop - 1) ? ")" : " ");
+                /* fw sb data */
+                data_size = CHIP_IS_E2(bp) ?
+                        sizeof(struct hc_status_block_data_e2) :
+                        sizeof(struct hc_status_block_data_e1x);
+                data_size /= sizeof(u32);
+                sb_data_p = CHIP_IS_E2(bp) ?
+                        (u32 *)&sb_data_e2 :
+                        (u32 *)&sb_data_e1x;
+                /* copy sb data in here */
+                for (j = 0; j < data_size; j++)
+                        *(sb_data_p + j) = REG_RD(bp, BAR_CSTRORM_INTMEM +
+                                CSTORM_STATUS_BLOCK_DATA_OFFSET(fp->fw_sb_id) +
+                                j * sizeof(u32));
+
+                if (CHIP_IS_E2(bp)) {
+                        pr_cont("pf_id(0x%x)  vf_id (0x%x)  vf_valid(0x%x) "
+                                "vnic_id(0x%x)  same_igu_sb_1b(0x%x)\n",
+                                sb_data_e2.common.p_func.pf_id,
+                                sb_data_e2.common.p_func.vf_id,
+                                sb_data_e2.common.p_func.vf_valid,
+                                sb_data_e2.common.p_func.vnic_id,
+                                sb_data_e2.common.same_igu_sb_1b);
+                } else {
+                        pr_cont("pf_id(0x%x)  vf_id (0x%x)  vf_valid(0x%x) "
+                                "vnic_id(0x%x)  same_igu_sb_1b(0x%x)\n",
+                                sb_data_e1x.common.p_func.pf_id,
+                                sb_data_e1x.common.p_func.vf_id,
+                                sb_data_e1x.common.p_func.vf_valid,
+                                sb_data_e1x.common.p_func.vnic_id,
+                                sb_data_e1x.common.same_igu_sb_1b);
+                }
+
+                /* SB_SMs data */
+                for (j = 0; j < HC_SB_MAX_SM; j++) {
+                        pr_cont("SM[%d] __flags (0x%x) "
+                               "igu_sb_id (0x%x)  igu_seg_id(0x%x) "
+                               "time_to_expire (0x%x) "
+                               "timer_value(0x%x)\n", j,
+                               hc_sm_p[j].__flags,
+                               hc_sm_p[j].igu_sb_id,
+                               hc_sm_p[j].igu_seg_id,
+                               hc_sm_p[j].time_to_expire,
+                               hc_sm_p[j].timer_value);
+                }
+
+                /* Indecies data */
+                for (j = 0; j < loop; j++) {
+                        pr_cont("INDEX[%d] flags (0x%x) "
+                                         "timeout (0x%x)\n", j,
+                               hc_index_p[j].flags,
+                               hc_index_p[j].timeout);
+                }
         }
 
+#ifdef BNX2X_STOP_ON_ERROR
         /* Rings */
         /* Rx */
         for_each_queue(bp, i) {
@@ -642,13 +1081,13 @@ void bnx2x_panic_dump(struct bnx2x *bp)
                                   i, j, tx_bd[0], tx_bd[1], tx_bd[2], tx_bd[3]);
                 }
         }
-
+#endif
         bnx2x_fw_dump(bp);
         bnx2x_mc_assert(bp);
         BNX2X_ERR("end crash dump -----------------\n");
 }
 
-void bnx2x_int_enable(struct bnx2x *bp)
+static void bnx2x_hc_int_enable(struct bnx2x *bp)
 {
         int port = BP_PORT(bp);
         u32 addr = port ? HC_REG_CONFIG_1 : HC_REG_CONFIG_0;
@@ -672,14 +1111,19 @@ void bnx2x_int_enable(struct bnx2x *bp)
                         HC_CONFIG_0_REG_INT_LINE_EN_0 |
                         HC_CONFIG_0_REG_ATTN_BIT_EN_0);
 
-                DP(NETIF_MSG_INTR, "write %x to HC %d (addr 0x%x)\n",
-                   val, port, addr);
+                if (!CHIP_IS_E1(bp)) {
+                        DP(NETIF_MSG_INTR, "write %x to HC %d (addr 0x%x)\n",
+                           val, port, addr);
 
-                REG_WR(bp, addr, val);
+                        REG_WR(bp, addr, val);
 
-                val &= ~HC_CONFIG_0_REG_MSI_MSIX_INT_EN_0;
+                        val &= ~HC_CONFIG_0_REG_MSI_MSIX_INT_EN_0;
+                }
         }
 
+        if (CHIP_IS_E1(bp))
+                REG_WR(bp, HC_REG_INT_MASK + port*4, 0x1FFFF);
+
         DP(NETIF_MSG_INTR, "write %x to HC %d (addr 0x%x)  mode %s\n",
            val, port, addr, (msix ? "MSI-X" : (msi ? "MSI" : "INTx")));
 
@@ -690,9 +1134,9 @@ void bnx2x_int_enable(struct bnx2x *bp)
         mmiowb();
         barrier();
 
-        if (CHIP_IS_E1H(bp)) {
+        if (!CHIP_IS_E1(bp)) {
                 /* init leading/trailing edge */
-                if (IS_E1HMF(bp)) {
+                if (IS_MF(bp)) {
                         val = (0xee0f | (1 << (BP_E1HVN(bp) + 4)));
                         if (bp->port.pmf)
                                 /* enable nig and gpio3 attention */
@@ -708,16 +1152,91 @@ void bnx2x_int_enable(struct bnx2x *bp)
         mmiowb();
 }
 
-static void bnx2x_int_disable(struct bnx2x *bp)
+static void bnx2x_igu_int_enable(struct bnx2x *bp)
+{
+        u32 val;
+        int msix = (bp->flags & USING_MSIX_FLAG) ? 1 : 0;
+        int msi = (bp->flags & USING_MSI_FLAG) ? 1 : 0;
+
+        val = REG_RD(bp, IGU_REG_PF_CONFIGURATION);
+
+        if (msix) {
+                val &= ~(IGU_PF_CONF_INT_LINE_EN |
+                         IGU_PF_CONF_SINGLE_ISR_EN);
+                val |= (IGU_PF_CONF_FUNC_EN |
+                        IGU_PF_CONF_MSI_MSIX_EN |
+                        IGU_PF_CONF_ATTN_BIT_EN);
+        } else if (msi) {
+                val &= ~IGU_PF_CONF_INT_LINE_EN;
+                val |= (IGU_PF_CONF_FUNC_EN |
+                        IGU_PF_CONF_MSI_MSIX_EN |
+                        IGU_PF_CONF_ATTN_BIT_EN |
+                        IGU_PF_CONF_SINGLE_ISR_EN);
+        } else {
+                val &= ~IGU_PF_CONF_MSI_MSIX_EN;
+                val |= (IGU_PF_CONF_FUNC_EN |
+                        IGU_PF_CONF_INT_LINE_EN |
+                        IGU_PF_CONF_ATTN_BIT_EN |
+                        IGU_PF_CONF_SINGLE_ISR_EN);
+        }
+
+        DP(NETIF_MSG_INTR, "write 0x%x to IGU  mode %s\n",
+           val, (msix ? "MSI-X" : (msi ? "MSI" : "INTx")));
+
+        REG_WR(bp, IGU_REG_PF_CONFIGURATION, val);
+
+        barrier();
+
+        /* init leading/trailing edge */
+        if (IS_MF(bp)) {
+                val = (0xee0f | (1 << (BP_E1HVN(bp) + 4)));
+                if (bp->port.pmf)
+                        /* enable nig and gpio3 attention */
+                        val |= 0x1100;
+        } else
+                val = 0xffff;
+
+        REG_WR(bp, IGU_REG_TRAILING_EDGE_LATCH, val);
+        REG_WR(bp, IGU_REG_LEADING_EDGE_LATCH, val);
+
+        /* Make sure that interrupts are indeed enabled from here on */
+        mmiowb();
+}
+
+void bnx2x_int_enable(struct bnx2x *bp)
+{
+        if (bp->common.int_block == INT_BLOCK_HC)
+                bnx2x_hc_int_enable(bp);
+        else
+                bnx2x_igu_int_enable(bp);
+}
+
+static void bnx2x_hc_int_disable(struct bnx2x *bp)
 {
         int port = BP_PORT(bp);
         u32 addr = port ? HC_REG_CONFIG_1 : HC_REG_CONFIG_0;
         u32 val = REG_RD(bp, addr);
 
-        val &= ~(HC_CONFIG_0_REG_SINGLE_ISR_EN_0 |
-                 HC_CONFIG_0_REG_MSI_MSIX_INT_EN_0 |
-                 HC_CONFIG_0_REG_INT_LINE_EN_0 |
-                 HC_CONFIG_0_REG_ATTN_BIT_EN_0);
+        /*
+         * in E1 we must use only PCI configuration space to disable
+         * MSI/MSIX capablility
+         * It's forbitten to disable IGU_PF_CONF_MSI_MSIX_EN in HC block
+         */
+        if (CHIP_IS_E1(bp)) {
+                /*  Since IGU_PF_CONF_MSI_MSIX_EN still always on
+                 *  Use mask register to prevent from HC sending interrupts
+                 *  after we exit the function
+                 */
+                REG_WR(bp, HC_REG_INT_MASK + port*4, 0);
+
+                val &= ~(HC_CONFIG_0_REG_SINGLE_ISR_EN_0 |
+                         HC_CONFIG_0_REG_INT_LINE_EN_0 |
+                         HC_CONFIG_0_REG_ATTN_BIT_EN_0);
+        } else
+                val &= ~(HC_CONFIG_0_REG_SINGLE_ISR_EN_0 |
+                         HC_CONFIG_0_REG_MSI_MSIX_INT_EN_0 |
+                         HC_CONFIG_0_REG_INT_LINE_EN_0 |
+                         HC_CONFIG_0_REG_ATTN_BIT_EN_0);
 
         DP(NETIF_MSG_INTR, "write %x to HC %d (addr 0x%x)\n",
            val, port, addr);
@@ -730,6 +1249,32 @@ static void bnx2x_int_disable(struct bnx2x *bp)
                 BNX2X_ERR("BUG! proper val not read from IGU!\n");
 }
 
+static void bnx2x_igu_int_disable(struct bnx2x *bp)
+{
+        u32 val = REG_RD(bp, IGU_REG_PF_CONFIGURATION);
+
+        val &= ~(IGU_PF_CONF_MSI_MSIX_EN |
+                 IGU_PF_CONF_INT_LINE_EN |
+                 IGU_PF_CONF_ATTN_BIT_EN);
+
+        DP(NETIF_MSG_INTR, "write %x to IGU\n", val);
+
+        /* flush all outstanding writes */
+        mmiowb();
+
+        REG_WR(bp, IGU_REG_PF_CONFIGURATION, val);
+        if (REG_RD(bp, IGU_REG_PF_CONFIGURATION) != val)
+                BNX2X_ERR("BUG! proper val not read from IGU!\n");
+}
+
+void bnx2x_int_disable(struct bnx2x *bp)
+{
+        if (bp->common.int_block == INT_BLOCK_HC)
+                bnx2x_hc_int_disable(bp);
+        else
+                bnx2x_igu_int_disable(bp);
+}
+
 void bnx2x_int_disable_sync(struct bnx2x *bp, int disable_hw)
 {
         int msix = (bp->flags & USING_MSIX_FLAG) ? 1 : 0;
@@ -800,7 +1345,6 @@ static bool bnx2x_trylock_hw_lock(struct bnx2x *bp, u32 resource)
         return false;
 }
 
-
 #ifdef BCM_CNIC
 static void bnx2x_cnic_cfc_comp(struct bnx2x *bp, int cid);
 #endif
@@ -817,76 +1361,35 @@ void bnx2x_sp_event(struct bnx2x_fastpath *fp,
            fp->index, cid, command, bp->state,
            rr_cqe->ramrod_cqe.ramrod_type);
 
-        bp->spq_left++;
-
-        if (fp->index) {
-                switch (command | fp->state) {
-                case (RAMROD_CMD_ID_ETH_CLIENT_SETUP |
-                                                BNX2X_FP_STATE_OPENING):
-                        DP(NETIF_MSG_IFUP, "got MULTI[%d] setup ramrod\n",
-                           cid);
-                        fp->state = BNX2X_FP_STATE_OPEN;
-                        break;
-
-                case (RAMROD_CMD_ID_ETH_HALT | BNX2X_FP_STATE_HALTING):
-                        DP(NETIF_MSG_IFDOWN, "got MULTI[%d] halt ramrod\n",
-                           cid);
-                        fp->state = BNX2X_FP_STATE_HALTED;
-                        break;
-
-                default:
-                        BNX2X_ERR("unexpected MC reply (%d)  "
-                                  "fp[%d] state is %x\n",
-                                  command, fp->index, fp->state);
-                        break;
-                }
-                mb(); /* force bnx2x_wait_ramrod() to see the change */
-                return;
-        }
-
-        switch (command | bp->state) {
-        case (RAMROD_CMD_ID_ETH_PORT_SETUP | BNX2X_STATE_OPENING_WAIT4_PORT):
-                DP(NETIF_MSG_IFUP, "got setup ramrod\n");
-                bp->state = BNX2X_STATE_OPEN;
+        switch (command | fp->state) {
+        case (RAMROD_CMD_ID_ETH_CLIENT_SETUP | BNX2X_FP_STATE_OPENING):
+                DP(NETIF_MSG_IFUP, "got MULTI[%d] setup ramrod\n", cid);
+                fp->state = BNX2X_FP_STATE_OPEN;
                 break;
 
-        case (RAMROD_CMD_ID_ETH_HALT | BNX2X_STATE_CLOSING_WAIT4_HALT):
-                DP(NETIF_MSG_IFDOWN, "got halt ramrod\n");
-                bp->state = BNX2X_STATE_CLOSING_WAIT4_DELETE;
+        case (RAMROD_CMD_ID_ETH_HALT | BNX2X_FP_STATE_HALTING):
+                DP(NETIF_MSG_IFDOWN, "got MULTI[%d] halt ramrod\n", cid);
                 fp->state = BNX2X_FP_STATE_HALTED;
                 break;
 
-        case (RAMROD_CMD_ID_ETH_CFC_DEL | BNX2X_STATE_CLOSING_WAIT4_HALT):
-                DP(NETIF_MSG_IFDOWN, "got delete ramrod for MULTI[%d]\n", cid);
-                bnx2x_fp(bp, cid, state) = BNX2X_FP_STATE_CLOSED;
-                break;
-
-#ifdef BCM_CNIC
-        case (RAMROD_CMD_ID_ETH_CFC_DEL | BNX2X_STATE_OPEN):
-                DP(NETIF_MSG_IFDOWN, "got delete ramrod for CID %d\n", cid);
-                bnx2x_cnic_cfc_comp(bp, cid);
-                break;
-#endif
-
-        case (RAMROD_CMD_ID_ETH_SET_MAC | BNX2X_STATE_OPEN):
-        case (RAMROD_CMD_ID_ETH_SET_MAC | BNX2X_STATE_DIAG):
-                DP(NETIF_MSG_IFUP, "got set mac ramrod\n");
-                bp->set_mac_pending--;
-                smp_wmb();
-                break;
-
-        case (RAMROD_CMD_ID_ETH_SET_MAC | BNX2X_STATE_CLOSING_WAIT4_HALT):
-                DP(NETIF_MSG_IFDOWN, "got (un)set mac ramrod\n");
-                bp->set_mac_pending--;
-                smp_wmb();
+        case (RAMROD_CMD_ID_ETH_TERMINATE | BNX2X_FP_STATE_TERMINATING):
+                DP(NETIF_MSG_IFDOWN, "got MULTI[%d] teminate ramrod\n", cid);
+                fp->state = BNX2X_FP_STATE_TERMINATED;
                 break;
 
         default:
-                BNX2X_ERR("unexpected MC reply (%d)  bp->state is %x\n",
-                          command, bp->state);
+                BNX2X_ERR("unexpected MC reply (%d)  "
+                          "fp[%d] state is %x\n",
+                          command, fp->index, fp->state);
                 break;
         }
-        mb(); /* force bnx2x_wait_ramrod() to see the change */
+
+        smp_mb__before_atomic_inc();
+        atomic_inc(&bp->spq_left);
+        /* push the change in fp->state and towards the memory */
+        smp_wmb();
+
+        return;
 }
 
 irqreturn_t bnx2x_interrupt(int irq, void *dev_instance)
@@ -914,25 +1417,22 @@ irqreturn_t bnx2x_interrupt(int irq, void *dev_instance)
                 return IRQ_HANDLED;
 #endif
 
-        for (i = 0; i < BNX2X_NUM_QUEUES(bp); i++) {
+        for_each_queue(bp, i) {
                 struct bnx2x_fastpath *fp = &bp->fp[i];
 
-                mask = 0x2 << fp->sb_id;
+                mask = 0x2 << (fp->index + CNIC_CONTEXT_USE);
                 if (status & mask) {
                         /* Handle Rx and Tx according to SB id */
                         prefetch(fp->rx_cons_sb);
-                        prefetch(&fp->status_blk->u_status_block.
-                                                status_block_index);
                         prefetch(fp->tx_cons_sb);
-                        prefetch(&fp->status_blk->c_status_block.
-                                                status_block_index);
+                        prefetch(&fp->sb_running_index[SM_RX_ID]);
                         napi_schedule(&bnx2x_fp(bp, fp->index, napi));
                         status &= ~mask;
                 }
         }
 
 #ifdef BCM_CNIC
-        mask = 0x2 << CNIC_SB_ID(bp);
+        mask = 0x2;
         if (status & (mask | 0x1)) {
                 struct cnic_ops *c_ops = NULL;
 
@@ -1273,12 +1773,12 @@ void bnx2x_calc_fc_adv(struct bnx2x *bp)
                 MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_MASK) {
         case MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_NONE:
                 bp->port.advertising[cfg_idx] &= ~(ADVERTISED_Asym_Pause |
-                                          ADVERTISED_Pause);
+                                                   ADVERTISED_Pause);
                 break;
 
         case MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH:
                 bp->port.advertising[cfg_idx] |= (ADVERTISED_Asym_Pause |
-                                         ADVERTISED_Pause);
+                                                  ADVERTISED_Pause);
                 break;
 
         case MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC:
@@ -1287,12 +1787,11 @@ void bnx2x_calc_fc_adv(struct bnx2x *bp)
 
         default:
                 bp->port.advertising[cfg_idx] &= ~(ADVERTISED_Asym_Pause |
-                                          ADVERTISED_Pause);
+                                                   ADVERTISED_Pause);
                 break;
         }
 }
 
-
 u8 bnx2x_initial_phy_init(struct bnx2x *bp, int load_mode)
 {
         if (!BP_NOMCP(bp)) {
@@ -1302,7 +1801,7 @@ u8 bnx2x_initial_phy_init(struct bnx2x *bp, int load_mode)
                 /* Initialize link parameters structure variables */
                 /* It is recommended to turn off RX FC for jumbo frames
                    for better performance */
-                if (bp->dev->mtu > 5000)
+                if ((CHIP_IS_E1x(bp)) && (bp->dev->mtu > 5000))
                         bp->link_params.req_fc_auto_adv = BNX2X_FLOW_CTRL_TX;
                 else
                         bp->link_params.req_fc_auto_adv = BNX2X_FLOW_CTRL_BOTH;
@@ -1416,13 +1915,11 @@ static void bnx2x_init_port_minmax(struct bnx2x *bp)
 static void bnx2x_calc_vn_weight_sum(struct bnx2x *bp)
 {
         int all_zero = 1;
-        int port = BP_PORT(bp);
         int vn;
 
         bp->vn_weight_sum = 0;
         for (vn = VN_0; vn < E1HVN_MAX; vn++) {
-                int func = 2*vn + port;
-                u32 vn_cfg = SHMEM_RD(bp, mf_cfg.func_mf_config[func].config);
+                u32 vn_cfg = bp->mf_config[vn];
                 u32 vn_min_rate = ((vn_cfg & FUNC_MF_CFG_MIN_BW_MASK) >>
                                    FUNC_MF_CFG_MIN_BW_SHIFT) * 100;
 
@@ -1450,11 +1947,12 @@ static void bnx2x_calc_vn_weight_sum(struct bnx2x *bp)
                                         CMNG_FLAGS_PER_PORT_FAIRNESS_VN;
 }
 
-static void bnx2x_init_vn_minmax(struct bnx2x *bp, int func)
+static void bnx2x_init_vn_minmax(struct bnx2x *bp, int vn)
 {
         struct rate_shaping_vars_per_vn m_rs_vn;
         struct fairness_vars_per_vn m_fair_vn;
-        u32 vn_cfg = SHMEM_RD(bp, mf_cfg.func_mf_config[func].config);
+        u32 vn_cfg = bp->mf_config[vn];
+        int func = 2*vn + BP_PORT(bp);
         u16 vn_min_rate, vn_max_rate;
         int i;
 
@@ -1467,11 +1965,12 @@ static void bnx2x_init_vn_minmax(struct bnx2x *bp, int func)
                 vn_min_rate = ((vn_cfg & FUNC_MF_CFG_MIN_BW_MASK) >>
                                 FUNC_MF_CFG_MIN_BW_SHIFT) * 100;
                 /* If min rate is zero - set it to 1 */
-                if (!vn_min_rate)
+                if (bp->vn_weight_sum && (vn_min_rate == 0))
                         vn_min_rate = DEF_MIN_RATE;
                 vn_max_rate = ((vn_cfg & FUNC_MF_CFG_MAX_BW_MASK) >>
                                 FUNC_MF_CFG_MAX_BW_SHIFT) * 100;
         }
+
         DP(NETIF_MSG_IFUP,
            "func %d: vn_min_rate %d  vn_max_rate %d  vn_weight_sum %d\n",
            func, vn_min_rate, vn_max_rate, bp->vn_weight_sum);
@@ -1512,6 +2011,83 @@ static void bnx2x_init_vn_minmax(struct bnx2x *bp, int func)
                        ((u32 *)(&m_fair_vn))[i]);
 }
 
+static int bnx2x_get_cmng_fns_mode(struct bnx2x *bp)
+{
+        if (CHIP_REV_IS_SLOW(bp))
+                return CMNG_FNS_NONE;
+        if (IS_MF(bp))
+                return CMNG_FNS_MINMAX;
+
+        return CMNG_FNS_NONE;
+}
+
+static void bnx2x_read_mf_cfg(struct bnx2x *bp)
+{
+        int vn;
+
+        if (BP_NOMCP(bp))
+                return; /* what should be the default bvalue in this case */
+
+        for (vn = VN_0; vn < E1HVN_MAX; vn++) {
+                int /*abs*/func = 2*vn + BP_PORT(bp);
+                bp->mf_config[vn] =
+                        MF_CFG_RD(bp, func_mf_config[func].config);
+        }
+}
+
+static void bnx2x_cmng_fns_init(struct bnx2x *bp, u8 read_cfg, u8 cmng_type)
+{
+
+        if (cmng_type == CMNG_FNS_MINMAX) {
+                int vn;
+
+                /* clear cmng_enables */
+                bp->cmng.flags.cmng_enables = 0;
+
+                /* read mf conf from shmem */
+                if (read_cfg)
+                        bnx2x_read_mf_cfg(bp);
+
+                /* Init rate shaping and fairness contexts */
+                bnx2x_init_port_minmax(bp);
+
+                /* vn_weight_sum and enable fairness if not 0 */
+                bnx2x_calc_vn_weight_sum(bp);
+
+                /* calculate and set min-max rate for each vn */
+                for (vn = VN_0; vn < E1HVN_MAX; vn++)
+                        bnx2x_init_vn_minmax(bp, vn);
+
+                /* always enable rate shaping and fairness */
+                bp->cmng.flags.cmng_enables |=
+                                        CMNG_FLAGS_PER_PORT_RATE_SHAPING_VN;
+                if (!bp->vn_weight_sum)
+                        DP(NETIF_MSG_IFUP, "All MIN values are zeroes"
+                                   "  fairness will be disabled\n");
+                return;
+        }
+
+        /* rate shaping and fairness are disabled */
+        DP(NETIF_MSG_IFUP,
+           "rate shaping and fairness are disabled\n");
+}
+
+static inline void bnx2x_link_sync_notify(struct bnx2x *bp)
+{
+        int port = BP_PORT(bp);
+        int func;
+        int vn;
+
+        /* Set the attention towards other drivers on the same port */
+        for (vn = VN_0; vn < E1HVN_MAX; vn++) {
+                if (vn == BP_E1HVN(bp))
+                        continue;
+
+                func = ((vn << 1) | port);
+                REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_0 +
+                       (LINK_SYNC_ATTENTION_BIT_FUNC_0 + func)*4, 1);
+        }
+}
 
 /* This function is called upon link interrupt */
 static void bnx2x_link_attn(struct bnx2x *bp)
@@ -1525,7 +2101,7 @@ static void bnx2x_link_attn(struct bnx2x *bp)
         if (bp->link_vars.link_up) {
 
                 /* dropless flow control */
-                if (CHIP_IS_E1H(bp) && bp->dropless_fc) {
+                if (!CHIP_IS_E1(bp) && bp->dropless_fc) {
                         int port = BP_PORT(bp);
                         u32 pause_enabled = 0;
 
@@ -1553,37 +2129,19 @@ static void bnx2x_link_attn(struct bnx2x *bp)
         if (prev_link_status != bp->link_vars.link_status)
                 bnx2x_link_report(bp);
 
-        if (IS_E1HMF(bp)) {
-                int port = BP_PORT(bp);
-                int func;
-                int vn;
-
-                /* Set the attention towards other drivers on the same port */
-                for (vn = VN_0; vn < E1HVN_MAX; vn++) {
-                        if (vn == BP_E1HVN(bp))
-                                continue;
-
-                        func = ((vn << 1) | port);
-                        REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_0 +
-                               (LINK_SYNC_ATTENTION_BIT_FUNC_0 + func)*4, 1);
-                }
-
-                if (bp->link_vars.link_up) {
-                        int i;
+        if (IS_MF(bp))
+                bnx2x_link_sync_notify(bp);
 
-                        /* Init rate shaping and fairness contexts */
-                        bnx2x_init_port_minmax(bp);
+        if (bp->link_vars.link_up && bp->link_vars.line_speed) {
+                int cmng_fns = bnx2x_get_cmng_fns_mode(bp);
 
-                        for (vn = VN_0; vn < E1HVN_MAX; vn++)
-                                bnx2x_init_vn_minmax(bp, 2*vn + port);
-
-                        /* Store it to internal memory */
-                        for (i = 0;
-                             i < sizeof(struct cmng_struct_per_port) / 4; i++)
-                                REG_WR(bp, BAR_XSTRORM_INTMEM +
-                                  XSTORM_CMNG_PER_PORT_VARS_OFFSET(port) + i*4,
-                                       ((u32 *)(&bp->cmng))[i]);
-                }
+                if (cmng_fns != CMNG_FNS_NONE) {
+                        bnx2x_cmng_fns_init(bp, false, cmng_fns);
+                        storm_memset_cmng(bp, &bp->cmng, BP_PORT(bp));
+                } else
+                        /* rate shaping and fairness are disabled */
+                        DP(NETIF_MSG_IFUP,
+                           "single function mode without fairness\n");
         }
 }
 
@@ -1599,7 +2157,9 @@ void bnx2x__link_status_update(struct bnx2x *bp)
         else
                 bnx2x_stats_handle(bp, STATS_EVENT_STOP);
 
-        bnx2x_calc_vn_weight_sum(bp);
+        /* the link status update could be the result of a DCC event
+           hence re-read the shmem mf configuration */
+        bnx2x_read_mf_cfg(bp);
 
         /* indicate link status */
         bnx2x_link_report(bp);
@@ -1615,8 +2175,13 @@ static void bnx2x_pmf_update(struct bnx2x *bp)
 
         /* enable nig attention */
         val = (0xff0f | (1 << (BP_E1HVN(bp) + 4)));
-        REG_WR(bp, HC_REG_TRAILING_EDGE_0 + port*8, val);
-        REG_WR(bp, HC_REG_LEADING_EDGE_0 + port*8, val);
+        if (bp->common.int_block == INT_BLOCK_HC) {
+                REG_WR(bp, HC_REG_TRAILING_EDGE_0 + port*8, val);
+                REG_WR(bp, HC_REG_LEADING_EDGE_0 + port*8, val);
+        } else if (CHIP_IS_E2(bp)) {
+                REG_WR(bp, IGU_REG_TRAILING_EDGE_LATCH, val);
+                REG_WR(bp, IGU_REG_LEADING_EDGE_LATCH, val);
+        }
 
         bnx2x_stats_handle(bp, STATS_EVENT_PMF);
 }
@@ -1632,22 +2197,23 @@ static void bnx2x_pmf_update(struct bnx2x *bp)
 /* send the MCP a request, block until there is a reply */
 u32 bnx2x_fw_command(struct bnx2x *bp, u32 command, u32 param)
 {
-        int func = BP_FUNC(bp);
+        int mb_idx = BP_FW_MB_IDX(bp);
         u32 seq = ++bp->fw_seq;
         u32 rc = 0;
         u32 cnt = 1;
         u8 delay = CHIP_REV_IS_SLOW(bp) ? 100 : 10;
 
         mutex_lock(&bp->fw_mb_mutex);
-        SHMEM_WR(bp, func_mb[func].drv_mb_param, param);
-        SHMEM_WR(bp, func_mb[func].drv_mb_header, (command | seq));
+        SHMEM_WR(bp, func_mb[mb_idx].drv_mb_param, param);
+        SHMEM_WR(bp, func_mb[mb_idx].drv_mb_header, (command | seq));
+
         DP(BNX2X_MSG_MCP, "wrote command (%x) to FW MB\n", (command | seq));
 
         do {
                 /* let the FW do it's magic ... */
                 msleep(delay);
 
-                rc = SHMEM_RD(bp, func_mb[func].fw_mb_header);
+                rc = SHMEM_RD(bp, func_mb[mb_idx].fw_mb_header);
 
                 /* Give the FW up to 5 second (500*10ms) */
         } while ((seq != (rc & FW_MSG_SEQ_NUMBER_MASK)) && (cnt++ < 500));
@@ -1669,6 +2235,315 @@ u32 bnx2x_fw_command(struct bnx2x *bp, u32 command, u32 param)
         return rc;
 }
 
+/* must be called under rtnl_lock */
+void bnx2x_rxq_set_mac_filters(struct bnx2x *bp, u16 cl_id, u32 filters)
+{
+        u32 mask = (1 << cl_id);
+
+        /* initial seeting is BNX2X_ACCEPT_NONE */
+        u8 drop_all_ucast = 1, drop_all_bcast = 1, drop_all_mcast = 1;
+        u8 accp_all_ucast = 0, accp_all_bcast = 0, accp_all_mcast = 0;
+        u8 unmatched_unicast = 0;
+
+        if (filters & BNX2X_PROMISCUOUS_MODE) {
+                /* promiscious - accept all, drop none */
+                drop_all_ucast = drop_all_bcast = drop_all_mcast = 0;
+                accp_all_ucast = accp_all_bcast = accp_all_mcast = 1;
+        }
+        if (filters & BNX2X_ACCEPT_UNICAST) {
+                /* accept matched ucast */
+                drop_all_ucast = 0;
+        }
+        if (filters & BNX2X_ACCEPT_MULTICAST) {
+                /* accept matched mcast */
+                drop_all_mcast = 0;
+        }
+        if (filters & BNX2X_ACCEPT_ALL_UNICAST) {
+                /* accept all mcast */
+                drop_all_ucast = 0;
+                accp_all_ucast = 1;
+        }
+        if (filters & BNX2X_ACCEPT_ALL_MULTICAST) {
+                /* accept all mcast */
+                drop_all_mcast = 0;
+                accp_all_mcast = 1;
+        }
+        if (filters & BNX2X_ACCEPT_BROADCAST) {
+                /* accept (all) bcast */
+                drop_all_bcast = 0;
+                accp_all_bcast = 1;
+        }
+
+        bp->mac_filters.ucast_drop_all = drop_all_ucast ?
+                bp->mac_filters.ucast_drop_all | mask :
+                bp->mac_filters.ucast_drop_all & ~mask;
+
+        bp->mac_filters.mcast_drop_all = drop_all_mcast ?
+                bp->mac_filters.mcast_drop_all | mask :
+                bp->mac_filters.mcast_drop_all & ~mask;
+
+        bp->mac_filters.bcast_drop_all = drop_all_bcast ?
+                bp->mac_filters.bcast_drop_all | mask :
+                bp->mac_filters.bcast_drop_all & ~mask;
+
+        bp->mac_filters.ucast_accept_all = accp_all_ucast ?
+                bp->mac_filters.ucast_accept_all | mask :
+                bp->mac_filters.ucast_accept_all & ~mask;
+
+        bp->mac_filters.mcast_accept_all = accp_all_mcast ?
+                bp->mac_filters.mcast_accept_all | mask :
+                bp->mac_filters.mcast_accept_all & ~mask;
+
+        bp->mac_filters.bcast_accept_all = accp_all_bcast ?
+                bp->mac_filters.bcast_accept_all | mask :
+                bp->mac_filters.bcast_accept_all & ~mask;
+
+        bp->mac_filters.unmatched_unicast = unmatched_unicast ?
+                bp->mac_filters.unmatched_unicast | mask :
+                bp->mac_filters.unmatched_unicast & ~mask;
+}
+
+void bnx2x_func_init(struct bnx2x *bp, struct bnx2x_func_init_params *p)
+{
+        struct tstorm_eth_function_common_config tcfg = {0};
+        u16 rss_flgs;
+
+        /* tpa */
+        if (p->func_flgs & FUNC_FLG_TPA)
+                tcfg.config_flags |=
+                TSTORM_ETH_FUNCTION_COMMON_CONFIG_ENABLE_TPA;
+
+        /* set rss flags */
+        rss_flgs = (p->rss->mode <<
+                TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_MODE_SHIFT);
+
+        if (p->rss->cap & RSS_IPV4_CAP)
+                rss_flgs |= RSS_IPV4_CAP_MASK;
+        if (p->rss->cap & RSS_IPV4_TCP_CAP)
+                rss_flgs |= RSS_IPV4_TCP_CAP_MASK;
+        if (p->rss->cap & RSS_IPV6_CAP)
+                rss_flgs |= RSS_IPV6_CAP_MASK;
+        if (p->rss->cap & RSS_IPV6_TCP_CAP)
+                rss_flgs |= RSS_IPV6_TCP_CAP_MASK;
+
+        tcfg.config_flags |= rss_flgs;
+        tcfg.rss_result_mask = p->rss->result_mask;
+
+        storm_memset_func_cfg(bp, &tcfg, p->func_id);
+
+        /* Enable the function in the FW */
+        storm_memset_vf_to_pf(bp, p->func_id, p->pf_id);
+        storm_memset_func_en(bp, p->func_id, 1);
+
+        /* statistics */
+        if (p->func_flgs & FUNC_FLG_STATS) {
+                struct stats_indication_flags stats_flags = {0};
+                stats_flags.collect_eth = 1;
+
+                storm_memset_xstats_flags(bp, &stats_flags, p->func_id);
+                storm_memset_xstats_addr(bp, p->fw_stat_map, p->func_id);
+
+                storm_memset_tstats_flags(bp, &stats_flags, p->func_id);
+                storm_memset_tstats_addr(bp, p->fw_stat_map, p->func_id);
+
+                storm_memset_ustats_flags(bp, &stats_flags, p->func_id);
+                storm_memset_ustats_addr(bp, p->fw_stat_map, p->func_id);
+
+                storm_memset_cstats_flags(bp, &stats_flags, p->func_id);
+                storm_memset_cstats_addr(bp, p->fw_stat_map, p->func_id);
+        }
+
+        /* spq */
+        if (p->func_flgs & FUNC_FLG_SPQ) {
+                storm_memset_spq_addr(bp, p->spq_map, p->func_id);
+                REG_WR(bp, XSEM_REG_FAST_MEMORY +
+                       XSTORM_SPQ_PROD_OFFSET(p->func_id), p->spq_prod);
+        }
+}
+
+static inline u16 bnx2x_get_cl_flags(struct bnx2x *bp,
+                                     struct bnx2x_fastpath *fp)
+{
+        u16 flags = 0;
+
+        /* calculate queue flags */
+        flags |= QUEUE_FLG_CACHE_ALIGN;
+        flags |= QUEUE_FLG_HC;
+        flags |= IS_MF(bp) ? QUEUE_FLG_OV : 0;
+
+        flags |= QUEUE_FLG_VLAN;
+        DP(NETIF_MSG_IFUP, "vlan removal enabled\n");
+
+        if (!fp->disable_tpa)
+                flags |= QUEUE_FLG_TPA;
+
+        flags |= QUEUE_FLG_STATS;
+
+        return flags;
+}
+
+static void bnx2x_pf_rx_cl_prep(struct bnx2x *bp,
+        struct bnx2x_fastpath *fp, struct rxq_pause_params *pause,
+        struct bnx2x_rxq_init_params *rxq_init)
+{
+        u16 max_sge = 0;
+        u16 sge_sz = 0;
+        u16 tpa_agg_size = 0;
+
+        /* calculate queue flags */
+        u16 flags = bnx2x_get_cl_flags(bp, fp);
+
+        if (!fp->disable_tpa) {
+                pause->sge_th_hi = 250;
+                pause->sge_th_lo = 150;
+                tpa_agg_size = min_t(u32,
+                        (min_t(u32, 8, MAX_SKB_FRAGS) *
+                        SGE_PAGE_SIZE * PAGES_PER_SGE), 0xffff);
+                max_sge = SGE_PAGE_ALIGN(bp->dev->mtu) >>
+                        SGE_PAGE_SHIFT;
+                max_sge = ((max_sge + PAGES_PER_SGE - 1) &
+                          (~(PAGES_PER_SGE-1))) >> PAGES_PER_SGE_SHIFT;
+                sge_sz = (u16)min_t(u32, SGE_PAGE_SIZE * PAGES_PER_SGE,
+                                    0xffff);
+        }
+
+        /* pause - not for e1 */
+        if (!CHIP_IS_E1(bp)) {
+                pause->bd_th_hi = 350;
+                pause->bd_th_lo = 250;
+                pause->rcq_th_hi = 350;
+                pause->rcq_th_lo = 250;
+                pause->sge_th_hi = 0;
+                pause->sge_th_lo = 0;
+                pause->pri_map = 1;
+        }
+
+        /* rxq setup */
+        rxq_init->flags = flags;
+        rxq_init->cxt = &bp->context.vcxt[fp->cid].eth;
+        rxq_init->dscr_map = fp->rx_desc_mapping;
+        rxq_init->sge_map = fp->rx_sge_mapping;
+        rxq_init->rcq_map = fp->rx_comp_mapping;
+        rxq_init->rcq_np_map = fp->rx_comp_mapping + BCM_PAGE_SIZE;
+        rxq_init->mtu = bp->dev->mtu;
+        rxq_init->buf_sz = bp->rx_buf_size;
+        rxq_init->cl_qzone_id = fp->cl_qzone_id;
+        rxq_init->cl_id = fp->cl_id;
+        rxq_init->spcl_id = fp->cl_id;
+        rxq_init->stat_id = fp->cl_id;
+        rxq_init->tpa_agg_sz = tpa_agg_size;
+        rxq_init->sge_buf_sz = sge_sz;
+        rxq_init->max_sges_pkt = max_sge;
+        rxq_init->cache_line_log = BNX2X_RX_ALIGN_SHIFT;
+        rxq_init->fw_sb_id = fp->fw_sb_id;
+
+        rxq_init->sb_cq_index = U_SB_ETH_RX_CQ_INDEX;
+
+        rxq_init->cid = HW_CID(bp, fp->cid);
+
+        rxq_init->hc_rate = bp->rx_ticks ? (1000000 / bp->rx_ticks) : 0;
+}
+
+static void bnx2x_pf_tx_cl_prep(struct bnx2x *bp,
+        struct bnx2x_fastpath *fp, struct bnx2x_txq_init_params *txq_init)
+{
+        u16 flags = bnx2x_get_cl_flags(bp, fp);
+
+        txq_init->flags = flags;
+        txq_init->cxt = &bp->context.vcxt[fp->cid].eth;
+        txq_init->dscr_map = fp->tx_desc_mapping;
+        txq_init->stat_id = fp->cl_id;
+        txq_init->cid = HW_CID(bp, fp->cid);
+        txq_init->sb_cq_index = C_SB_ETH_TX_CQ_INDEX;
+        txq_init->traffic_type = LLFC_TRAFFIC_TYPE_NW;
+        txq_init->fw_sb_id = fp->fw_sb_id;
+        txq_init->hc_rate = bp->tx_ticks ? (1000000 / bp->tx_ticks) : 0;
+}
+
+void bnx2x_pf_init(struct bnx2x *bp)
+{
+        struct bnx2x_func_init_params func_init = {0};
+        struct bnx2x_rss_params rss = {0};
+        struct event_ring_data eq_data = { {0} };
+        u16 flags;
+
+        /* pf specific setups */
+        if (!CHIP_IS_E1(bp))
+                storm_memset_ov(bp, bp->mf_ov, BP_FUNC(bp));
+
+        if (CHIP_IS_E2(bp)) {
+                /* reset IGU PF statistics: MSIX + ATTN */
+                /* PF */
+                REG_WR(bp, IGU_REG_STATISTIC_NUM_MESSAGE_SENT +
+                           BNX2X_IGU_STAS_MSG_VF_CNT*4 +
+                           (CHIP_MODE_IS_4_PORT(bp) ?
+                                BP_FUNC(bp) : BP_VN(bp))*4, 0);
+                /* ATTN */
+                REG_WR(bp, IGU_REG_STATISTIC_NUM_MESSAGE_SENT +
+                           BNX2X_IGU_STAS_MSG_VF_CNT*4 +
+                           BNX2X_IGU_STAS_MSG_PF_CNT*4 +
+                           (CHIP_MODE_IS_4_PORT(bp) ?
+                                BP_FUNC(bp) : BP_VN(bp))*4, 0);
+        }
+
+        /* function setup flags */
+        flags = (FUNC_FLG_STATS | FUNC_FLG_LEADING | FUNC_FLG_SPQ);
+
+        if (CHIP_IS_E1x(bp))
+                flags |= (bp->flags & TPA_ENABLE_FLAG) ? FUNC_FLG_TPA : 0;
+        else
+                flags |= FUNC_FLG_TPA;
+
+        /* function setup */
+
+        /**
+         * Although RSS is meaningless when there is a single HW queue we
+         * still need it enabled in order to have HW Rx hash generated.
+         */
+        rss.cap = (RSS_IPV4_CAP | RSS_IPV4_TCP_CAP |
+                   RSS_IPV6_CAP | RSS_IPV6_TCP_CAP);
+        rss.mode = bp->multi_mode;
+        rss.result_mask = MULTI_MASK;
+        func_init.rss = &rss;
+
+        func_init.func_flgs = flags;
+        func_init.pf_id = BP_FUNC(bp);
+        func_init.func_id = BP_FUNC(bp);
+        func_init.fw_stat_map = bnx2x_sp_mapping(bp, fw_stats);
+        func_init.spq_map = bp->spq_mapping;
+        func_init.spq_prod = bp->spq_prod_idx;
+
+        bnx2x_func_init(bp, &func_init);
+
+        memset(&(bp->cmng), 0, sizeof(struct cmng_struct_per_port));
+
+        /*
+        Congestion management values depend on the link rate
+        There is no active link so initial link rate is set to 10 Gbps.
+        When the link comes up The congestion management values are
+        re-calculated according to the actual link rate.
+        */
+        bp->link_vars.line_speed = SPEED_10000;
+        bnx2x_cmng_fns_init(bp, true, bnx2x_get_cmng_fns_mode(bp));
+
+        /* Only the PMF sets the HW */
+        if (bp->port.pmf)
+                storm_memset_cmng(bp, &bp->cmng, BP_PORT(bp));
+
+        /* no rx until link is up */
+        bp->rx_mode = BNX2X_RX_MODE_NONE;
+        bnx2x_set_storm_rx_mode(bp);
+
+        /* init Event Queue */
+        eq_data.base_addr.hi = U64_HI(bp->eq_mapping);
+        eq_data.base_addr.lo = U64_LO(bp->eq_mapping);
+        eq_data.producer = bp->eq_prod;
+        eq_data.index_id = HC_SP_INDEX_EQ_CONS;
+        eq_data.sb_id = DEF_SB_ID;
+        storm_memset_eq_data(bp, &eq_data, BP_FUNC(bp));
+}
+
+
 static void bnx2x_e1h_disable(struct bnx2x *bp)
 {
         int port = BP_PORT(bp);
@@ -1695,40 +2570,6 @@ static void bnx2x_e1h_enable(struct bnx2x *bp)
          */
 }
 
-static void bnx2x_update_min_max(struct bnx2x *bp)
-{
-        int port = BP_PORT(bp);
-        int vn, i;
-
-        /* Init rate shaping and fairness contexts */
-        bnx2x_init_port_minmax(bp);
-
-        bnx2x_calc_vn_weight_sum(bp);
-
-        for (vn = VN_0; vn < E1HVN_MAX; vn++)
-                bnx2x_init_vn_minmax(bp, 2*vn + port);
-
-        if (bp->port.pmf) {
-                int func;
-
-                /* Set the attention towards other drivers on the same port */
-                for (vn = VN_0; vn < E1HVN_MAX; vn++) {
-                        if (vn == BP_E1HVN(bp))
-                                continue;
-
-                        func = ((vn << 1) | port);
-                        REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_0 +
-                               (LINK_SYNC_ATTENTION_BIT_FUNC_0 + func)*4, 1);
-                }
-
-                /* Store it to internal memory */
-                for (i = 0; i < sizeof(struct cmng_struct_per_port) / 4; i++)
-                        REG_WR(bp, BAR_XSTRORM_INTMEM +
-                               XSTORM_CMNG_PER_PORT_VARS_OFFSET(port) + i*4,
-                               ((u32 *)(&bp->cmng))[i]);
-        }
-}
-
 static void bnx2x_dcc_event(struct bnx2x *bp, u32 dcc_event)
 {
         DP(BNX2X_MSG_MCP, "dcc_event 0x%x\n", dcc_event);
@@ -1740,7 +2581,7 @@ static void bnx2x_dcc_event(struct bnx2x *bp, u32 dcc_event)
                  * where the bp->flags can change so it is done without any
                  * locks
                  */
-                if (bp->mf_config & FUNC_MF_CFG_FUNC_DISABLED) {
+                if (bp->mf_config[BP_VN(bp)] & FUNC_MF_CFG_FUNC_DISABLED) {
                         DP(NETIF_MSG_IFDOWN, "mf_cfg function disabled\n");
                         bp->flags |= MF_FUNC_DIS;
 
@@ -1755,7 +2596,9 @@ static void bnx2x_dcc_event(struct bnx2x *bp, u32 dcc_event)
         }
         if (dcc_event & DRV_STATUS_DCC_BANDWIDTH_ALLOCATION) {
 
-                bnx2x_update_min_max(bp);
+                bnx2x_cmng_fns_init(bp, true, CMNG_FNS_MINMAX);
+                bnx2x_link_sync_notify(bp);
+                storm_memset_cmng(bp, &bp->cmng, BP_PORT(bp));
                 dcc_event &= ~DRV_STATUS_DCC_BANDWIDTH_ALLOCATION;
         }
 
@@ -1790,16 +2633,17 @@ static inline void bnx2x_sp_prod_update(struct bnx2x *bp)
         /* Make sure that BD data is updated before writing the producer */
         wmb();
 
-        REG_WR(bp, BAR_XSTRORM_INTMEM + XSTORM_SPQ_PROD_OFFSET(func),
-               bp->spq_prod_idx);
+        REG_WR16(bp, BAR_XSTRORM_INTMEM + XSTORM_SPQ_PROD_OFFSET(func),
+                 bp->spq_prod_idx);
         mmiowb();
 }
 
 /* the slow path queue is odd since completions arrive on the fastpath ring */
 int bnx2x_sp_post(struct bnx2x *bp, int command, int cid,
-                         u32 data_hi, u32 data_lo, int common)
+                  u32 data_hi, u32 data_lo, int common)
 {
         struct eth_spe *spe;
+        u16 type;
 
 #ifdef BNX2X_STOP_ON_ERROR
         if (unlikely(bp->panic))
@@ -1808,7 +2652,7 @@ int bnx2x_sp_post(struct bnx2x *bp, int command, int cid,
 
         spin_lock_bh(&bp->spq_lock);
 
-        if (!bp->spq_left) {
+        if (!atomic_read(&bp->spq_left)) {
                 BNX2X_ERR("BUG! SPQ ring full!\n");
                 spin_unlock_bh(&bp->spq_lock);
                 bnx2x_panic();
@@ -1821,22 +2665,42 @@ int bnx2x_sp_post(struct bnx2x *bp, int command, int cid,
         spe->hdr.conn_and_cmd_data =
                         cpu_to_le32((command << SPE_HDR_CMD_ID_SHIFT) |
                                     HW_CID(bp, cid));
-        spe->hdr.type = cpu_to_le16(ETH_CONNECTION_TYPE);
+
         if (common)
-                spe->hdr.type |=
-                        cpu_to_le16((1 << SPE_HDR_COMMON_RAMROD_SHIFT));
+                /* Common ramrods:
+                 *      FUNC_START, FUNC_STOP, CFC_DEL, STATS, SET_MAC
+                 *      TRAFFIC_STOP, TRAFFIC_START
+                 */
+                type = (NONE_CONNECTION_TYPE << SPE_HDR_CONN_TYPE_SHIFT)
+                        & SPE_HDR_CONN_TYPE;
+        else
+                /* ETH ramrods: SETUP, HALT */
+                type = (ETH_CONNECTION_TYPE << SPE_HDR_CONN_TYPE_SHIFT)
+                        & SPE_HDR_CONN_TYPE;
+
+        type |= ((BP_FUNC(bp) << SPE_HDR_FUNCTION_ID_SHIFT) &
+                 SPE_HDR_FUNCTION_ID);
 
-        spe->data.mac_config_addr.hi = cpu_to_le32(data_hi);
-        spe->data.mac_config_addr.lo = cpu_to_le32(data_lo);
+        spe->hdr.type = cpu_to_le16(type);
 
-        bp->spq_left--;
+        spe->data.update_data_addr.hi = cpu_to_le32(data_hi);
+        spe->data.update_data_addr.lo = cpu_to_le32(data_lo);
+
+        /* stats ramrod has it's own slot on the spq */
+        if (command != RAMROD_CMD_ID_COMMON_STAT_QUERY)
+                /* It's ok if the actual decrement is issued towards the memory
+                 * somewhere between the spin_lock and spin_unlock. Thus no
+                 * more explict memory barrier is needed.
+                 */
+                atomic_dec(&bp->spq_left);
 
         DP(BNX2X_MSG_SP/*NETIF_MSG_TIMER*/,
-           "SPQE[%x] (%x:%x)  command %d  hw_cid %x  data (%x:%x)  left %x\n",
+           "SPQE[%x] (%x:%x)  command %d  hw_cid %x  data (%x:%x) "
+           "type(0x%x) left %x\n",
            bp->spq_prod_idx, (u32)U64_HI(bp->spq_mapping),
            (u32)(U64_LO(bp->spq_mapping) +
            (void *)bp->spq_prod_bd - (void *)bp->spq), command,
-           HW_CID(bp, cid), data_hi, data_lo, bp->spq_left);
+           HW_CID(bp, cid), data_hi, data_lo, type, atomic_read(&bp->spq_left));
 
         bnx2x_sp_prod_update(bp);
         spin_unlock_bh(&bp->spq_lock);
@@ -1873,32 +2737,27 @@ static void bnx2x_release_alr(struct bnx2x *bp)
         REG_WR(bp, GRCBASE_MCP + 0x9c, 0);
 }
 
+#define BNX2X_DEF_SB_ATT_IDX    0x0001
+#define BNX2X_DEF_SB_IDX        0x0002
+
 static inline u16 bnx2x_update_dsb_idx(struct bnx2x *bp)
 {
-        struct host_def_status_block *def_sb = bp->def_status_blk;
+        struct host_sp_status_block *def_sb = bp->def_status_blk;
         u16 rc = 0;
 
         barrier(); /* status block is written to by the chip */
         if (bp->def_att_idx != def_sb->atten_status_block.attn_bits_index) {
                 bp->def_att_idx = def_sb->atten_status_block.attn_bits_index;
-                rc |= 1;
-        }
-        if (bp->def_c_idx != def_sb->c_def_status_block.status_block_index) {
-                bp->def_c_idx = def_sb->c_def_status_block.status_block_index;
-                rc |= 2;
-        }
-        if (bp->def_u_idx != def_sb->u_def_status_block.status_block_index) {
-                bp->def_u_idx = def_sb->u_def_status_block.status_block_index;
-                rc |= 4;
-        }
-        if (bp->def_x_idx != def_sb->x_def_status_block.status_block_index) {
-                bp->def_x_idx = def_sb->x_def_status_block.status_block_index;
-                rc |= 8;
+                rc |= BNX2X_DEF_SB_ATT_IDX;
         }
-        if (bp->def_t_idx != def_sb->t_def_status_block.status_block_index) {
-                bp->def_t_idx = def_sb->t_def_status_block.status_block_index;
-                rc |= 16;
+
+        if (bp->def_idx != def_sb->sp_sb.running_index) {
+                bp->def_idx = def_sb->sp_sb.running_index;
+                rc |= BNX2X_DEF_SB_IDX;
         }
+
+        /* Do not reorder: indecies reading should complete before handling */
+        barrier();
         return rc;
 }
 
@@ -1909,14 +2768,13 @@ static inline u16 bnx2x_update_dsb_idx(struct bnx2x *bp)
 static void bnx2x_attn_int_asserted(struct bnx2x *bp, u32 asserted)
 {
         int port = BP_PORT(bp);
-        u32 hc_addr = (HC_REG_COMMAND_REG + port*32 +
-                       COMMAND_REG_ATTN_BITS_SET);
         u32 aeu_addr = port ? MISC_REG_AEU_MASK_ATTN_FUNC_1 :
                               MISC_REG_AEU_MASK_ATTN_FUNC_0;
         u32 nig_int_mask_addr = port ? NIG_REG_MASK_INTERRUPT_PORT1 :
                                        NIG_REG_MASK_INTERRUPT_PORT0;
         u32 aeu_mask;
         u32 nig_mask = 0;
+        u32 reg_addr;
 
         if (bp->attn_state & asserted)
                 BNX2X_ERR("IGU ERROR\n");
@@ -1991,9 +2849,15 @@ static void bnx2x_attn_int_asserted(struct bnx2x *bp, u32 asserted)
 
         } /* if hardwired */
 
-        DP(NETIF_MSG_HW, "about to mask 0x%08x at HC addr 0x%x\n",
-           asserted, hc_addr);
-        REG_WR(bp, hc_addr, asserted);
+        if (bp->common.int_block == INT_BLOCK_HC)
+                reg_addr = (HC_REG_COMMAND_REG + port*32 +
+                            COMMAND_REG_ATTN_BITS_SET);
+        else
+                reg_addr = (BAR_IGU_INTMEM + IGU_CMD_ATTN_BIT_SET_UPPER*8);
+
+        DP(NETIF_MSG_HW, "about to mask 0x%08x at %s addr 0x%x\n", asserted,
+           (bp->common.int_block == INT_BLOCK_HC) ? "HC" : "IGU", reg_addr);
+        REG_WR(bp, reg_addr, asserted);
 
         /* now set back the mask */
         if (asserted & ATTN_NIG_FOR_FUNC) {
@@ -2114,6 +2978,10 @@ static inline void bnx2x_attn_int_deasserted2(struct bnx2x *bp, u32 attn)
                 /* RQ_USDMDP_FIFO_OVERFLOW */
                 if (val & 0x18000)
                         BNX2X_ERR("FATAL error from PXP\n");
+                if (CHIP_IS_E2(bp)) {
+                        val = REG_RD(bp, PXP_REG_PXP_INT_STS_CLR_1);
+                        BNX2X_ERR("PXP hw attention-1 0x%x\n", val);
+                }
         }
 
         if (attn & HW_INTERRUT_ASSERT_SET_2) {
@@ -2144,9 +3012,10 @@ static inline void bnx2x_attn_int_deasserted3(struct bnx2x *bp, u32 attn)
                         int func = BP_FUNC(bp);
 
                         REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_12 + func*4, 0);
-                        bp->mf_config = SHMEM_RD(bp,
-                                           mf_cfg.func_mf_config[func].config);
-                        val = SHMEM_RD(bp, func_mb[func].drv_status);
+                        bp->mf_config[BP_VN(bp)] = MF_CFG_RD(bp,
+                                        func_mf_config[BP_ABS_FUNC(bp)].config);
+                        val = SHMEM_RD(bp,
+                                       func_mb[BP_FW_MB_IDX(bp)].drv_status);
                         if (val & DRV_STATUS_DCC_EVENT_MASK)
                                 bnx2x_dcc_event(bp,
                                             (val & DRV_STATUS_DCC_EVENT_MASK));
@@ -2176,13 +3045,13 @@ static inline void bnx2x_attn_int_deasserted3(struct bnx2x *bp, u32 attn)
         if (attn & EVEREST_LATCHED_ATTN_IN_USE_MASK) {
                 BNX2X_ERR("LATCHED attention 0x%08x (masked)\n", attn);
                 if (attn & BNX2X_GRC_TIMEOUT) {
-                        val = CHIP_IS_E1H(bp) ?
-                                REG_RD(bp, MISC_REG_GRC_TIMEOUT_ATTN) : 0;
+                        val = CHIP_IS_E1(bp) ? 0 :
+                                        REG_RD(bp, MISC_REG_GRC_TIMEOUT_ATTN);
                         BNX2X_ERR("GRC time-out 0x%08x\n", val);
                 }
                 if (attn & BNX2X_GRC_RSV) {
-                        val = CHIP_IS_E1H(bp) ?
-                                REG_RD(bp, MISC_REG_GRC_RSV_ATTN) : 0;
+                        val = CHIP_IS_E1(bp) ? 0 :
+                                        REG_RD(bp, MISC_REG_GRC_RSV_ATTN);
                         BNX2X_ERR("GRC reserved 0x%08x\n", val);
                 }
                 REG_WR(bp, MISC_REG_AEU_CLR_LATCH_SIGNAL, 0x7ff);
@@ -2195,6 +3064,7 @@ static inline void bnx2x_attn_int_deasserted3(struct bnx2x *bp, u32 attn)
 #define RESET_DONE_FLAG_MASK    (~LOAD_COUNTER_MASK)
 #define RESET_DONE_FLAG_SHIFT   LOAD_COUNTER_BITS
 #define CHIP_PARITY_SUPPORTED(bp)   (CHIP_IS_E1(bp) || CHIP_IS_E1H(bp))
+
 /*
  * should be run under rtnl lock
  */
@@ -2487,6 +3357,74 @@ bool bnx2x_chk_parity_attn(struct bnx2x *bp)
                                         attn.sig[3]);
 }
 
+
+static inline void bnx2x_attn_int_deasserted4(struct bnx2x *bp, u32 attn)
+{
+        u32 val;
+        if (attn & AEU_INPUTS_ATTN_BITS_PGLUE_HW_INTERRUPT) {
+
+                val = REG_RD(bp, PGLUE_B_REG_PGLUE_B_INT_STS_CLR);
+                BNX2X_ERR("PGLUE hw attention 0x%x\n", val);
+                if (val & PGLUE_B_PGLUE_B_INT_STS_REG_ADDRESS_ERROR)
+                        BNX2X_ERR("PGLUE_B_PGLUE_B_INT_STS_REG_"
+                                  "ADDRESS_ERROR\n");
+                if (val & PGLUE_B_PGLUE_B_INT_STS_REG_INCORRECT_RCV_BEHAVIOR)
+                        BNX2X_ERR("PGLUE_B_PGLUE_B_INT_STS_REG_"
+                                  "INCORRECT_RCV_BEHAVIOR\n");
+                if (val & PGLUE_B_PGLUE_B_INT_STS_REG_WAS_ERROR_ATTN)
+                        BNX2X_ERR("PGLUE_B_PGLUE_B_INT_STS_REG_"
+                                  "WAS_ERROR_ATTN\n");
+                if (val & PGLUE_B_PGLUE_B_INT_STS_REG_VF_LENGTH_VIOLATION_ATTN)
+                        BNX2X_ERR("PGLUE_B_PGLUE_B_INT_STS_REG_"
+                                  "VF_LENGTH_VIOLATION_ATTN\n");
+                if (val &
+                    PGLUE_B_PGLUE_B_INT_STS_REG_VF_GRC_SPACE_VIOLATION_ATTN)
+                        BNX2X_ERR("PGLUE_B_PGLUE_B_INT_STS_REG_"
+                                  "VF_GRC_SPACE_VIOLATION_ATTN\n");
+                if (val &
+                    PGLUE_B_PGLUE_B_INT_STS_REG_VF_MSIX_BAR_VIOLATION_ATTN)
+                        BNX2X_ERR("PGLUE_B_PGLUE_B_INT_STS_REG_"
+                                  "VF_MSIX_BAR_VIOLATION_ATTN\n");
+                if (val & PGLUE_B_PGLUE_B_INT_STS_REG_TCPL_ERROR_ATTN)
+                        BNX2X_ERR("PGLUE_B_PGLUE_B_INT_STS_REG_"
+                                  "TCPL_ERROR_ATTN\n");
+                if (val & PGLUE_B_PGLUE_B_INT_STS_REG_TCPL_IN_TWO_RCBS_ATTN)
+                        BNX2X_ERR("PGLUE_B_PGLUE_B_INT_STS_REG_"
+                                  "TCPL_IN_TWO_RCBS_ATTN\n");
+                if (val & PGLUE_B_PGLUE_B_INT_STS_REG_CSSNOOP_FIFO_OVERFLOW)
+                        BNX2X_ERR("PGLUE_B_PGLUE_B_INT_STS_REG_"
+                                  "CSSNOOP_FIFO_OVERFLOW\n");
+        }
+        if (attn & AEU_INPUTS_ATTN_BITS_ATC_HW_INTERRUPT) {
+                val = REG_RD(bp, ATC_REG_ATC_INT_STS_CLR);
+                BNX2X_ERR("ATC hw attention 0x%x\n", val);
+                if (val & ATC_ATC_INT_STS_REG_ADDRESS_ERROR)
+                        BNX2X_ERR("ATC_ATC_INT_STS_REG_ADDRESS_ERROR\n");
+                if (val & ATC_ATC_INT_STS_REG_ATC_TCPL_TO_NOT_PEND)
+                        BNX2X_ERR("ATC_ATC_INT_STS_REG"
+                                  "_ATC_TCPL_TO_NOT_PEND\n");
+                if (val & ATC_ATC_INT_STS_REG_ATC_GPA_MULTIPLE_HITS)
+                        BNX2X_ERR("ATC_ATC_INT_STS_REG_"
+                                  "ATC_GPA_MULTIPLE_HITS\n");
+                if (val & ATC_ATC_INT_STS_REG_ATC_RCPL_TO_EMPTY_CNT)
+                        BNX2X_ERR("ATC_ATC_INT_STS_REG_"
+                                  "ATC_RCPL_TO_EMPTY_CNT\n");
+                if (val & ATC_ATC_INT_STS_REG_ATC_TCPL_ERROR)
+                        BNX2X_ERR("ATC_ATC_INT_STS_REG_ATC_TCPL_ERROR\n");
+                if (val & ATC_ATC_INT_STS_REG_ATC_IREQ_LESS_THAN_STU)
+                        BNX2X_ERR("ATC_ATC_INT_STS_REG_"
+                                  "ATC_IREQ_LESS_THAN_STU\n");
+        }
+
+        if (attn & (AEU_INPUTS_ATTN_BITS_PGLUE_PARITY_ERROR |
+                    AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR)) {
+                BNX2X_ERR("FATAL parity attention set4 0x%x\n",
+                (u32)(attn & (AEU_INPUTS_ATTN_BITS_PGLUE_PARITY_ERROR |
+                    AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR)));
+        }
+
+}
+
 static void bnx2x_attn_int_deasserted(struct bnx2x *bp, u32 deasserted)
 {
         struct attn_route attn, *group_mask;
@@ -2517,17 +3455,28 @@ static void bnx2x_attn_int_deasserted(struct bnx2x *bp, u32 deasserted)
         attn.sig[1] = REG_RD(bp, MISC_REG_AEU_AFTER_INVERT_2_FUNC_0 + port*4);
         attn.sig[2] = REG_RD(bp, MISC_REG_AEU_AFTER_INVERT_3_FUNC_0 + port*4);
         attn.sig[3] = REG_RD(bp, MISC_REG_AEU_AFTER_INVERT_4_FUNC_0 + port*4);
-        DP(NETIF_MSG_HW, "attn: %08x %08x %08x %08x\n",
-           attn.sig[0], attn.sig[1], attn.sig[2], attn.sig[3]);
+        if (CHIP_IS_E2(bp))
+                attn.sig[4] =
+                      REG_RD(bp, MISC_REG_AEU_AFTER_INVERT_5_FUNC_0 + port*4);
+        else
+                attn.sig[4] = 0;
+
+        DP(NETIF_MSG_HW, "attn: %08x %08x %08x %08x %08x\n",
+           attn.sig[0], attn.sig[1], attn.sig[2], attn.sig[3], attn.sig[4]);
 
         for (index = 0; index < MAX_DYNAMIC_ATTN_GRPS; index++) {
                 if (deasserted & (1 << index)) {
                         group_mask = &bp->attn_group[index];
 
-                        DP(NETIF_MSG_HW, "group[%d]: %08x %08x %08x %08x\n",
-                           index, group_mask->sig[0], group_mask->sig[1],
-                           group_mask->sig[2], group_mask->sig[3]);
+                        DP(NETIF_MSG_HW, "group[%d]: %08x %08x "
+                                         "%08x %08x %08x\n",
+                           index,
+                           group_mask->sig[0], group_mask->sig[1],
+                           group_mask->sig[2], group_mask->sig[3],
+                           group_mask->sig[4]);
 
+                        bnx2x_attn_int_deasserted4(bp,
+                                        attn.sig[4] & group_mask->sig[4]);
                         bnx2x_attn_int_deasserted3(bp,
                                         attn.sig[3] & group_mask->sig[3]);
                         bnx2x_attn_int_deasserted1(bp,
@@ -2541,11 +3490,15 @@ static void bnx2x_attn_int_deasserted(struct bnx2x *bp, u32 deasserted)
 
         bnx2x_release_alr(bp);
 
-        reg_addr = (HC_REG_COMMAND_REG + port*32 + COMMAND_REG_ATTN_BITS_CLR);
+        if (bp->common.int_block == INT_BLOCK_HC)
+                reg_addr = (HC_REG_COMMAND_REG + port*32 +
+                            COMMAND_REG_ATTN_BITS_CLR);
+        else
+                reg_addr = (BAR_IGU_INTMEM + IGU_CMD_ATTN_BIT_CLR_UPPER*8);
 
         val = ~deasserted;
-        DP(NETIF_MSG_HW, "about to mask 0x%08x at HC addr 0x%x\n",
-           val, reg_addr);
+        DP(NETIF_MSG_HW, "about to mask 0x%08x at %s addr 0x%x\n", val,
+           (bp->common.int_block == INT_BLOCK_HC) ? "HC" : "IGU", reg_addr);
         REG_WR(bp, reg_addr, val);
 
         if (~bp->attn_state & deasserted)
@@ -2598,6 +3551,141 @@ static void bnx2x_attn_int(struct bnx2x *bp)
                 bnx2x_attn_int_deasserted(bp, deasserted);
 }
 
+static inline void bnx2x_update_eq_prod(struct bnx2x *bp, u16 prod)
+{
+        /* No memory barriers */
+        storm_memset_eq_prod(bp, prod, BP_FUNC(bp));
+        mmiowb(); /* keep prod updates ordered */
+}
+
+#ifdef BCM_CNIC
+static int  bnx2x_cnic_handle_cfc_del(struct bnx2x *bp, u32 cid,
+                                      union event_ring_elem *elem)
+{
+        if (!bp->cnic_eth_dev.starting_cid  ||
+            cid < bp->cnic_eth_dev.starting_cid)
+                return 1;
+
+        DP(BNX2X_MSG_SP, "got delete ramrod for CNIC CID %d\n", cid);
+
+        if (unlikely(elem->message.data.cfc_del_event.error)) {
+                BNX2X_ERR("got delete ramrod for CNIC CID %d with error!\n",
+                          cid);
+                bnx2x_panic_dump(bp);
+        }
+        bnx2x_cnic_cfc_comp(bp, cid);
+        return 0;
+}
+#endif
+
+static void bnx2x_eq_int(struct bnx2x *bp)
+{
+        u16 hw_cons, sw_cons, sw_prod;
+        union event_ring_elem *elem;
+        u32 cid;
+        u8 opcode;
+        int spqe_cnt = 0;
+
+        hw_cons = le16_to_cpu(*bp->eq_cons_sb);
+
+        /* The hw_cos range is 1-255, 257 - the sw_cons range is 0-254, 256.
+         * when we get the the next-page we nned to adjust so the loop
+         * condition below will be met. The next element is the size of a
+         * regular element and hence incrementing by 1
+         */
+        if ((hw_cons & EQ_DESC_MAX_PAGE) == EQ_DESC_MAX_PAGE)
+                hw_cons++;
+
+        /* This function may never run in parralel with itself for a
+         * specific bp, thus there is no need in "paired" read memory
+         * barrier here.
+         */
+        sw_cons = bp->eq_cons;
+        sw_prod = bp->eq_prod;
+
+        DP(BNX2X_MSG_SP, "EQ:  hw_cons %u  sw_cons %u bp->spq_left %u\n",
+                        hw_cons, sw_cons, atomic_read(&bp->spq_left));
+
+        for (; sw_cons != hw_cons;
+              sw_prod = NEXT_EQ_IDX(sw_prod), sw_cons = NEXT_EQ_IDX(sw_cons)) {
+
+
+                elem = &bp->eq_ring[EQ_DESC(sw_cons)];
+
+                cid = SW_CID(elem->message.data.cfc_del_event.cid);
+                opcode = elem->message.opcode;
+
+
+                /* handle eq element */
+                switch (opcode) {
+                case EVENT_RING_OPCODE_STAT_QUERY:
+                        DP(NETIF_MSG_TIMER, "got statistics comp event\n");
+                        /* nothing to do with stats comp */
+                        continue;
+
+                case EVENT_RING_OPCODE_CFC_DEL:
+                        /* handle according to cid range */
+                        /*
+                         * we may want to verify here that the bp state is
+                         * HALTING
+                         */
+                        DP(NETIF_MSG_IFDOWN,
+                           "got delete ramrod for MULTI[%d]\n", cid);
+#ifdef BCM_CNIC
+                        if (!bnx2x_cnic_handle_cfc_del(bp, cid, elem))
+                                goto next_spqe;
+#endif
+                        bnx2x_fp(bp, cid, state) =
+                                                BNX2X_FP_STATE_CLOSED;
+
+                        goto next_spqe;
+                }
+
+                switch (opcode | bp->state) {
+                case (EVENT_RING_OPCODE_FUNCTION_START |
+                      BNX2X_STATE_OPENING_WAIT4_PORT):
+                        DP(NETIF_MSG_IFUP, "got setup ramrod\n");
+                        bp->state = BNX2X_STATE_FUNC_STARTED;
+                        break;
+
+                case (EVENT_RING_OPCODE_FUNCTION_STOP |
+                      BNX2X_STATE_CLOSING_WAIT4_HALT):
+                        DP(NETIF_MSG_IFDOWN, "got halt ramrod\n");
+                        bp->state = BNX2X_STATE_CLOSING_WAIT4_UNLOAD;
+                        break;
+
+                case (EVENT_RING_OPCODE_SET_MAC | BNX2X_STATE_OPEN):
+                case (EVENT_RING_OPCODE_SET_MAC | BNX2X_STATE_DIAG):
+                        DP(NETIF_MSG_IFUP, "got set mac ramrod\n");
+                        bp->set_mac_pending = 0;
+                        break;
+
+                case (EVENT_RING_OPCODE_SET_MAC |
+                      BNX2X_STATE_CLOSING_WAIT4_HALT):
+                        DP(NETIF_MSG_IFDOWN, "got (un)set mac ramrod\n");
+                        bp->set_mac_pending = 0;
+                        break;
+                default:
+                        /* unknown event log error and continue */
+                        BNX2X_ERR("Unknown EQ event %d\n",
+                                  elem->message.opcode);
+                }
+next_spqe:
+                spqe_cnt++;
+        } /* for */
+
+        smp_mb__before_atomic_inc();
+        atomic_add(spqe_cnt, &bp->spq_left);
+
+        bp->eq_cons = sw_cons;
+        bp->eq_prod = sw_prod;
+        /* Make sure that above mem writes were issued towards the memory */
+        smp_wmb();
+
+        /* update producer */
+        bnx2x_update_eq_prod(bp, bp->eq_prod);
+}
+
 static void bnx2x_sp_task(struct work_struct *work)
 {
         struct bnx2x *bp = container_of(work, struct bnx2x, sp_task.work);
@@ -2616,31 +3704,29 @@ static void bnx2x_sp_task(struct work_struct *work)
         DP(NETIF_MSG_INTR, "got a slowpath interrupt (status 0x%x)\n", status);
 
         /* HW attentions */
-        if (status & 0x1) {
+        if (status & BNX2X_DEF_SB_ATT_IDX) {
                 bnx2x_attn_int(bp);
-                status &= ~0x1;
+                status &= ~BNX2X_DEF_SB_ATT_IDX;
         }
 
-        /* CStorm events: STAT_QUERY */
-        if (status & 0x2) {
-                DP(BNX2X_MSG_SP, "CStorm events: STAT_QUERY\n");
-                status &= ~0x2;
+        /* SP events: STAT_QUERY and others */
+        if (status & BNX2X_DEF_SB_IDX) {
+
+                /* Handle EQ completions */
+                bnx2x_eq_int(bp);
+
+                bnx2x_ack_sb(bp, bp->igu_dsb_id, USTORM_ID,
+                        le16_to_cpu(bp->def_idx), IGU_INT_NOP, 1);
+
+                status &= ~BNX2X_DEF_SB_IDX;
         }
 
         if (unlikely(status))
                 DP(NETIF_MSG_INTR, "got an unknown interrupt! (status 0x%x)\n",
                    status);
 
-        bnx2x_ack_sb(bp, DEF_SB_ID, ATTENTION_ID, le16_to_cpu(bp->def_att_idx),
-                     IGU_INT_NOP, 1);
-        bnx2x_ack_sb(bp, DEF_SB_ID, USTORM_ID, le16_to_cpu(bp->def_u_idx),
-                     IGU_INT_NOP, 1);
-        bnx2x_ack_sb(bp, DEF_SB_ID, CSTORM_ID, le16_to_cpu(bp->def_c_idx),
-                     IGU_INT_NOP, 1);
-        bnx2x_ack_sb(bp, DEF_SB_ID, XSTORM_ID, le16_to_cpu(bp->def_x_idx),
-                     IGU_INT_NOP, 1);
-        bnx2x_ack_sb(bp, DEF_SB_ID, TSTORM_ID, le16_to_cpu(bp->def_t_idx),
-                     IGU_INT_ENABLE, 1);
+        bnx2x_ack_sb(bp, bp->igu_dsb_id, ATTENTION_ID,
+             le16_to_cpu(bp->def_att_idx), IGU_INT_ENABLE, 1);
 }
 
 irqreturn_t bnx2x_msix_sp_int(int irq, void *dev_instance)
@@ -2654,7 +3740,8 @@ irqreturn_t bnx2x_msix_sp_int(int irq, void *dev_instance)
                 return IRQ_HANDLED;
         }
 
-        bnx2x_ack_sb(bp, DEF_SB_ID, TSTORM_ID, 0, IGU_INT_DISABLE, 0);
+        bnx2x_ack_sb(bp, bp->igu_dsb_id, USTORM_ID, 0,
+                     IGU_INT_DISABLE, 0);
 
 #ifdef BNX2X_STOP_ON_ERROR
         if (unlikely(bp->panic))
@@ -2698,7 +3785,7 @@ static void bnx2x_timer(unsigned long data)
         }
 
         if (!BP_NOMCP(bp)) {
-                int func = BP_FUNC(bp);
+                int mb_idx = BP_FW_MB_IDX(bp);
                 u32 drv_pulse;
                 u32 mcp_pulse;
 
@@ -2706,9 +3793,9 @@ static void bnx2x_timer(unsigned long data)
                 bp->fw_drv_pulse_wr_seq &= DRV_PULSE_SEQ_MASK;
                 /* TBD - add SYSTEM_TIME */
                 drv_pulse = bp->fw_drv_pulse_wr_seq;
-                SHMEM_WR(bp, func_mb[func].drv_pulse_mb, drv_pulse);
+                SHMEM_WR(bp, func_mb[mb_idx].drv_pulse_mb, drv_pulse);
 
-                mcp_pulse = (SHMEM_RD(bp, func_mb[func].mcp_pulse_mb) &
+                mcp_pulse = (SHMEM_RD(bp, func_mb[mb_idx].mcp_pulse_mb) &
                              MCP_PULSE_SEQ_MASK);
                 /* The delta between driver pulse and mcp response
                  * should be 1 (before mcp response) or 0 (after mcp response)
@@ -2736,324 +3823,310 @@ timer_restart:
  * nic init service functions
  */
 
-static void bnx2x_zero_sb(struct bnx2x *bp, int sb_id)
+static inline void bnx2x_fill(struct bnx2x *bp, u32 addr, int fill, u32 len)
 {
-        int port = BP_PORT(bp);
+        u32 i;
+        if (!(len%4) && !(addr%4))
+                for (i = 0; i < len; i += 4)
+                        REG_WR(bp, addr + i, fill);
+        else
+                for (i = 0; i < len; i++)
+                        REG_WR8(bp, addr + i, fill);
 
-        /* "CSTORM" */
-        bnx2x_init_fill(bp, CSEM_REG_FAST_MEMORY +
-                        CSTORM_SB_HOST_STATUS_BLOCK_U_OFFSET(port, sb_id), 0,
-                        CSTORM_SB_STATUS_BLOCK_U_SIZE / 4);
-        bnx2x_init_fill(bp, CSEM_REG_FAST_MEMORY +
-                        CSTORM_SB_HOST_STATUS_BLOCK_C_OFFSET(port, sb_id), 0,
-                        CSTORM_SB_STATUS_BLOCK_C_SIZE / 4);
 }
 
-void bnx2x_init_sb(struct bnx2x *bp, struct host_status_block *sb,
-                          dma_addr_t mapping, int sb_id)
+/* helper: writes FP SP data to FW - data_size in dwords */
+static inline void bnx2x_wr_fp_sb_data(struct bnx2x *bp,
+                                       int fw_sb_id,
+                                       u32 *sb_data_p,
+                                       u32 data_size)
 {
-        int port = BP_PORT(bp);
-        int func = BP_FUNC(bp);
         int index;
-        u64 section;
+        for (index = 0; index < data_size; index++)
+                REG_WR(bp, BAR_CSTRORM_INTMEM +
+                        CSTORM_STATUS_BLOCK_DATA_OFFSET(fw_sb_id) +
+                        sizeof(u32)*index,
+                        *(sb_data_p + index));
+}
+
+static inline void bnx2x_zero_fp_sb(struct bnx2x *bp, int fw_sb_id)
+{
+        u32 *sb_data_p;
+        u32 data_size = 0;
+        struct hc_status_block_data_e2 sb_data_e2;
+        struct hc_status_block_data_e1x sb_data_e1x;
+
+        /* disable the function first */
+        if (CHIP_IS_E2(bp)) {
+                memset(&sb_data_e2, 0, sizeof(struct hc_status_block_data_e2));
+                sb_data_e2.common.p_func.pf_id = HC_FUNCTION_DISABLED;
+                sb_data_e2.common.p_func.vf_id = HC_FUNCTION_DISABLED;
+                sb_data_e2.common.p_func.vf_valid = false;
+                sb_data_p = (u32 *)&sb_data_e2;
+                data_size = sizeof(struct hc_status_block_data_e2)/sizeof(u32);
+        } else {
+                memset(&sb_data_e1x, 0,
+                       sizeof(struct hc_status_block_data_e1x));
+                sb_data_e1x.common.p_func.pf_id = HC_FUNCTION_DISABLED;
+                sb_data_e1x.common.p_func.vf_id = HC_FUNCTION_DISABLED;
+                sb_data_e1x.common.p_func.vf_valid = false;
+                sb_data_p = (u32 *)&sb_data_e1x;
+                data_size = sizeof(struct hc_status_block_data_e1x)/sizeof(u32);
+        }
+        bnx2x_wr_fp_sb_data(bp, fw_sb_id, sb_data_p, data_size);
 
-        /* USTORM */
-        section = ((u64)mapping) + offsetof(struct host_status_block,
-                                            u_status_block);
-        sb->u_status_block.status_block_id = sb_id;
-
-        REG_WR(bp, BAR_CSTRORM_INTMEM +
-               CSTORM_SB_HOST_SB_ADDR_U_OFFSET(port, sb_id), U64_LO(section));
-        REG_WR(bp, BAR_CSTRORM_INTMEM +
-               ((CSTORM_SB_HOST_SB_ADDR_U_OFFSET(port, sb_id)) + 4),
-               U64_HI(section));
-        REG_WR8(bp, BAR_CSTRORM_INTMEM + FP_USB_FUNC_OFF +
-                CSTORM_SB_HOST_STATUS_BLOCK_U_OFFSET(port, sb_id), func);
-
-        for (index = 0; index < HC_USTORM_SB_NUM_INDICES; index++)
-                REG_WR16(bp, BAR_CSTRORM_INTMEM +
-                         CSTORM_SB_HC_DISABLE_U_OFFSET(port, sb_id, index), 1);
+        bnx2x_fill(bp, BAR_CSTRORM_INTMEM +
+                        CSTORM_STATUS_BLOCK_OFFSET(fw_sb_id), 0,
+                        CSTORM_STATUS_BLOCK_SIZE);
+        bnx2x_fill(bp, BAR_CSTRORM_INTMEM +
+                        CSTORM_SYNC_BLOCK_OFFSET(fw_sb_id), 0,
+                        CSTORM_SYNC_BLOCK_SIZE);
+}
 
-        /* CSTORM */
-        section = ((u64)mapping) + offsetof(struct host_status_block,
-                                            c_status_block);
-        sb->c_status_block.status_block_id = sb_id;
+/* helper:  writes SP SB data to FW */
+static inline void bnx2x_wr_sp_sb_data(struct bnx2x *bp,
+                struct hc_sp_status_block_data *sp_sb_data)
+{
+        int func = BP_FUNC(bp);
+        int i;
+        for (i = 0; i < sizeof(struct hc_sp_status_block_data)/sizeof(u32); i++)
+                REG_WR(bp, BAR_CSTRORM_INTMEM +
+                        CSTORM_SP_STATUS_BLOCK_DATA_OFFSET(func) +
+                        i*sizeof(u32),
+                        *((u32 *)sp_sb_data + i));
+}
 
-        REG_WR(bp, BAR_CSTRORM_INTMEM +
-               CSTORM_SB_HOST_SB_ADDR_C_OFFSET(port, sb_id), U64_LO(section));
-        REG_WR(bp, BAR_CSTRORM_INTMEM +
-               ((CSTORM_SB_HOST_SB_ADDR_C_OFFSET(port, sb_id)) + 4),
-               U64_HI(section));
-        REG_WR8(bp, BAR_CSTRORM_INTMEM + FP_CSB_FUNC_OFF +
-                CSTORM_SB_HOST_STATUS_BLOCK_C_OFFSET(port, sb_id), func);
+static inline void bnx2x_zero_sp_sb(struct bnx2x *bp)
+{
+        int func = BP_FUNC(bp);
+        struct hc_sp_status_block_data sp_sb_data;
+        memset(&sp_sb_data, 0, sizeof(struct hc_sp_status_block_data));
 
-        for (index = 0; index < HC_CSTORM_SB_NUM_INDICES; index++)
-                REG_WR16(bp, BAR_CSTRORM_INTMEM +
-                         CSTORM_SB_HC_DISABLE_C_OFFSET(port, sb_id, index), 1);
+        sp_sb_data.p_func.pf_id = HC_FUNCTION_DISABLED;
+        sp_sb_data.p_func.vf_id = HC_FUNCTION_DISABLED;
+        sp_sb_data.p_func.vf_valid = false;
+
+        bnx2x_wr_sp_sb_data(bp, &sp_sb_data);
+
+        bnx2x_fill(bp, BAR_CSTRORM_INTMEM +
+                        CSTORM_SP_STATUS_BLOCK_OFFSET(func), 0,
+                        CSTORM_SP_STATUS_BLOCK_SIZE);
+        bnx2x_fill(bp, BAR_CSTRORM_INTMEM +
+                        CSTORM_SP_SYNC_BLOCK_OFFSET(func), 0,
+                        CSTORM_SP_SYNC_BLOCK_SIZE);
 
-        bnx2x_ack_sb(bp, sb_id, CSTORM_ID, 0, IGU_INT_ENABLE, 0);
 }
 
-static void bnx2x_zero_def_sb(struct bnx2x *bp)
+
+static inline
+void bnx2x_setup_ndsb_state_machine(struct hc_status_block_sm *hc_sm,
+                                           int igu_sb_id, int igu_seg_id)
 {
-        int func = BP_FUNC(bp);
+        hc_sm->igu_sb_id = igu_sb_id;
+        hc_sm->igu_seg_id = igu_seg_id;
+        hc_sm->timer_value = 0xFF;
+        hc_sm->time_to_expire = 0xFFFFFFFF;
+}
 
-        bnx2x_init_fill(bp, TSEM_REG_FAST_MEMORY +
-                        TSTORM_DEF_SB_HOST_STATUS_BLOCK_OFFSET(func), 0,
-                        sizeof(struct tstorm_def_status_block)/4);
-        bnx2x_init_fill(bp, CSEM_REG_FAST_MEMORY +
-                        CSTORM_DEF_SB_HOST_STATUS_BLOCK_U_OFFSET(func), 0,
-                        sizeof(struct cstorm_def_status_block_u)/4);
-        bnx2x_init_fill(bp, CSEM_REG_FAST_MEMORY +
-                        CSTORM_DEF_SB_HOST_STATUS_BLOCK_C_OFFSET(func), 0,
-                        sizeof(struct cstorm_def_status_block_c)/4);
-        bnx2x_init_fill(bp, XSEM_REG_FAST_MEMORY +
-                        XSTORM_DEF_SB_HOST_STATUS_BLOCK_OFFSET(func), 0,
-                        sizeof(struct xstorm_def_status_block)/4);
+void bnx2x_init_sb(struct bnx2x *bp, dma_addr_t mapping, int vfid,
+                          u8 vf_valid, int fw_sb_id, int igu_sb_id)
+{
+        int igu_seg_id;
+
+        struct hc_status_block_data_e2 sb_data_e2;
+        struct hc_status_block_data_e1x sb_data_e1x;
+        struct hc_status_block_sm  *hc_sm_p;
+        struct hc_index_data *hc_index_p;
+        int data_size;
+        u32 *sb_data_p;
+
+        if (CHIP_INT_MODE_IS_BC(bp))
+                igu_seg_id = HC_SEG_ACCESS_NORM;
+        else
+                igu_seg_id = IGU_SEG_ACCESS_NORM;
+
+        bnx2x_zero_fp_sb(bp, fw_sb_id);
+
+        if (CHIP_IS_E2(bp)) {
+                memset(&sb_data_e2, 0, sizeof(struct hc_status_block_data_e2));
+                sb_data_e2.common.p_func.pf_id = BP_FUNC(bp);
+                sb_data_e2.common.p_func.vf_id = vfid;
+                sb_data_e2.common.p_func.vf_valid = vf_valid;
+                sb_data_e2.common.p_func.vnic_id = BP_VN(bp);
+                sb_data_e2.common.same_igu_sb_1b = true;
+                sb_data_e2.common.host_sb_addr.hi = U64_HI(mapping);
+                sb_data_e2.common.host_sb_addr.lo = U64_LO(mapping);
+                hc_sm_p = sb_data_e2.common.state_machine;
+                hc_index_p = sb_data_e2.index_data;
+                sb_data_p = (u32 *)&sb_data_e2;
+                data_size = sizeof(struct hc_status_block_data_e2)/sizeof(u32);
+        } else {
+                memset(&sb_data_e1x, 0,
+                       sizeof(struct hc_status_block_data_e1x));
+                sb_data_e1x.common.p_func.pf_id = BP_FUNC(bp);
+                sb_data_e1x.common.p_func.vf_id = 0xff;
+                sb_data_e1x.common.p_func.vf_valid = false;
+                sb_data_e1x.common.p_func.vnic_id = BP_VN(bp);
+                sb_data_e1x.common.same_igu_sb_1b = true;
+                sb_data_e1x.common.host_sb_addr.hi = U64_HI(mapping);
+                sb_data_e1x.common.host_sb_addr.lo = U64_LO(mapping);
+                hc_sm_p = sb_data_e1x.common.state_machine;
+                hc_index_p = sb_data_e1x.index_data;
+                sb_data_p = (u32 *)&sb_data_e1x;
+                data_size = sizeof(struct hc_status_block_data_e1x)/sizeof(u32);
+        }
+
+        bnx2x_setup_ndsb_state_machine(&hc_sm_p[SM_RX_ID],
+                                       igu_sb_id, igu_seg_id);
+        bnx2x_setup_ndsb_state_machine(&hc_sm_p[SM_TX_ID],
+                                       igu_sb_id, igu_seg_id);
+
+        DP(NETIF_MSG_HW, "Init FW SB %d\n", fw_sb_id);
+
+        /* write indecies to HW */
+        bnx2x_wr_fp_sb_data(bp, fw_sb_id, sb_data_p, data_size);
+}
+
+static void bnx2x_update_coalesce_sb_index(struct bnx2x *bp, u16 fw_sb_id,
+                                        u8 sb_index, u8 disable, u16 usec)
+{
+        int port = BP_PORT(bp);
+        u8 ticks = usec / BNX2X_BTR;
+
+        storm_memset_hc_timeout(bp, port, fw_sb_id, sb_index, ticks);
+
+        disable = disable ? 1 : (usec ? 0 : 1);
+        storm_memset_hc_disable(bp, port, fw_sb_id, sb_index, disable);
 }
 
-static void bnx2x_init_def_sb(struct bnx2x *bp,
-                              struct host_def_status_block *def_sb,
-                              dma_addr_t mapping, int sb_id)
+static void bnx2x_update_coalesce_sb(struct bnx2x *bp, u16 fw_sb_id,
+                                     u16 tx_usec, u16 rx_usec)
 {
+        bnx2x_update_coalesce_sb_index(bp, fw_sb_id, U_SB_ETH_RX_CQ_INDEX,
+                                    false, rx_usec);
+        bnx2x_update_coalesce_sb_index(bp, fw_sb_id, C_SB_ETH_TX_CQ_INDEX,
+                                    false, tx_usec);
+}
+
+static void bnx2x_init_def_sb(struct bnx2x *bp)
+{
+        struct host_sp_status_block *def_sb = bp->def_status_blk;
+        dma_addr_t mapping = bp->def_status_blk_mapping;
+        int igu_sp_sb_index;
+        int igu_seg_id;
         int port = BP_PORT(bp);
         int func = BP_FUNC(bp);
-        int index, val, reg_offset;
+        int reg_offset;
         u64 section;
+        int index;
+        struct hc_sp_status_block_data sp_sb_data;
+        memset(&sp_sb_data, 0, sizeof(struct hc_sp_status_block_data));
+
+        if (CHIP_INT_MODE_IS_BC(bp)) {
+                igu_sp_sb_index = DEF_SB_IGU_ID;
+                igu_seg_id = HC_SEG_ACCESS_DEF;
+        } else {
+                igu_sp_sb_index = bp->igu_dsb_id;
+                igu_seg_id = IGU_SEG_ACCESS_DEF;
+        }
 
         /* ATTN */
-        section = ((u64)mapping) + offsetof(struct host_def_status_block,
+        section = ((u64)mapping) + offsetof(struct host_sp_status_block,
                                             atten_status_block);
-        def_sb->atten_status_block.status_block_id = sb_id;
+        def_sb->atten_status_block.status_block_id = igu_sp_sb_index;
 
         bp->attn_state = 0;
 
         reg_offset = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
                              MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
-
         for (index = 0; index < MAX_DYNAMIC_ATTN_GRPS; index++) {
-                bp->attn_group[index].sig[0] = REG_RD(bp,
-                                                     reg_offset + 0x10*index);
-                bp->attn_group[index].sig[1] = REG_RD(bp,
-                                               reg_offset + 0x4 + 0x10*index);
-                bp->attn_group[index].sig[2] = REG_RD(bp,
-                                               reg_offset + 0x8 + 0x10*index);
-                bp->attn_group[index].sig[3] = REG_RD(bp,
-                                               reg_offset + 0xc + 0x10*index);
+                int sindex;
+                /* take care of sig[0]..sig[4] */
+                for (sindex = 0; sindex < 4; sindex++)
+                        bp->attn_group[index].sig[sindex] =
+                           REG_RD(bp, reg_offset + sindex*0x4 + 0x10*index);
+
+                if (CHIP_IS_E2(bp))
+                        /*
+                         * enable5 is separate from the rest of the registers,
+                         * and therefore the address skip is 4
+                         * and not 16 between the different groups
+                         */
+                        bp->attn_group[index].sig[4] = REG_RD(bp,
+                                        reg_offset + 0x10 + 0x4*index);
+                else
+                        bp->attn_group[index].sig[4] = 0;
         }
 
-        reg_offset = (port ? HC_REG_ATTN_MSG1_ADDR_L :
-                             HC_REG_ATTN_MSG0_ADDR_L);
-
-        REG_WR(bp, reg_offset, U64_LO(section));
-        REG_WR(bp, reg_offset + 4, U64_HI(section));
-
-        reg_offset = (port ? HC_REG_ATTN_NUM_P1 : HC_REG_ATTN_NUM_P0);
+        if (bp->common.int_block == INT_BLOCK_HC) {
+                reg_offset = (port ? HC_REG_ATTN_MSG1_ADDR_L :
+                                     HC_REG_ATTN_MSG0_ADDR_L);
 
-        val = REG_RD(bp, reg_offset);
-        val |= sb_id;
-        REG_WR(bp, reg_offset, val);
+                REG_WR(bp, reg_offset, U64_LO(section));
+                REG_WR(bp, reg_offset + 4, U64_HI(section));
+        } else if (CHIP_IS_E2(bp)) {
+                REG_WR(bp, IGU_REG_ATTN_MSG_ADDR_L, U64_LO(section));
+                REG_WR(bp, IGU_REG_ATTN_MSG_ADDR_H, U64_HI(section));
+        }
 
-        /* USTORM */
-        section = ((u64)mapping) + offsetof(struct host_def_status_block,
-                                            u_def_status_block);
-        def_sb->u_def_status_block.status_block_id = sb_id;
-
-        REG_WR(bp, BAR_CSTRORM_INTMEM +
-               CSTORM_DEF_SB_HOST_SB_ADDR_U_OFFSET(func), U64_LO(section));
-        REG_WR(bp, BAR_CSTRORM_INTMEM +
-               ((CSTORM_DEF_SB_HOST_SB_ADDR_U_OFFSET(func)) + 4),
-               U64_HI(section));
-        REG_WR8(bp, BAR_CSTRORM_INTMEM + DEF_USB_FUNC_OFF +
-                CSTORM_DEF_SB_HOST_STATUS_BLOCK_U_OFFSET(func), func);
-
-        for (index = 0; index < HC_USTORM_DEF_SB_NUM_INDICES; index++)
-                REG_WR16(bp, BAR_CSTRORM_INTMEM +
-                         CSTORM_DEF_SB_HC_DISABLE_U_OFFSET(func, index), 1);
+        section = ((u64)mapping) + offsetof(struct host_sp_status_block,
+                                            sp_sb);
 
-        /* CSTORM */
-        section = ((u64)mapping) + offsetof(struct host_def_status_block,
-                                            c_def_status_block);
-        def_sb->c_def_status_block.status_block_id = sb_id;
-
-        REG_WR(bp, BAR_CSTRORM_INTMEM +
-               CSTORM_DEF_SB_HOST_SB_ADDR_C_OFFSET(func), U64_LO(section));
-        REG_WR(bp, BAR_CSTRORM_INTMEM +
-               ((CSTORM_DEF_SB_HOST_SB_ADDR_C_OFFSET(func)) + 4),
-               U64_HI(section));
-        REG_WR8(bp, BAR_CSTRORM_INTMEM + DEF_CSB_FUNC_OFF +
-                CSTORM_DEF_SB_HOST_STATUS_BLOCK_C_OFFSET(func), func);
-
-        for (index = 0; index < HC_CSTORM_DEF_SB_NUM_INDICES; index++)
-                REG_WR16(bp, BAR_CSTRORM_INTMEM +
-                         CSTORM_DEF_SB_HC_DISABLE_C_OFFSET(func, index), 1);
+        bnx2x_zero_sp_sb(bp);
 
-        /* TSTORM */
-        section = ((u64)mapping) + offsetof(struct host_def_status_block,
-                                            t_def_status_block);
-        def_sb->t_def_status_block.status_block_id = sb_id;
-
-        REG_WR(bp, BAR_TSTRORM_INTMEM +
-               TSTORM_DEF_SB_HOST_SB_ADDR_OFFSET(func), U64_LO(section));
-        REG_WR(bp, BAR_TSTRORM_INTMEM +
-               ((TSTORM_DEF_SB_HOST_SB_ADDR_OFFSET(func)) + 4),
-               U64_HI(section));
-        REG_WR8(bp, BAR_TSTRORM_INTMEM + DEF_TSB_FUNC_OFF +
-                TSTORM_DEF_SB_HOST_STATUS_BLOCK_OFFSET(func), func);
-
-        for (index = 0; index < HC_TSTORM_DEF_SB_NUM_INDICES; index++)
-                REG_WR16(bp, BAR_TSTRORM_INTMEM +
-                         TSTORM_DEF_SB_HC_DISABLE_OFFSET(func, index), 1);
+        sp_sb_data.host_sb_addr.lo      = U64_LO(section);
+        sp_sb_data.host_sb_addr.hi      = U64_HI(section);
+        sp_sb_data.igu_sb_id            = igu_sp_sb_index;
+        sp_sb_data.igu_seg_id           = igu_seg_id;
+        sp_sb_data.p_func.pf_id         = func;
+        sp_sb_data.p_func.vnic_id       = BP_VN(bp);
+        sp_sb_data.p_func.vf_id         = 0xff;
 
-        /* XSTORM */
-        section = ((u64)mapping) + offsetof(struct host_def_status_block,
-                                            x_def_status_block);
-        def_sb->x_def_status_block.status_block_id = sb_id;
-
-        REG_WR(bp, BAR_XSTRORM_INTMEM +
-               XSTORM_DEF_SB_HOST_SB_ADDR_OFFSET(func), U64_LO(section));
-        REG_WR(bp, BAR_XSTRORM_INTMEM +
-               ((XSTORM_DEF_SB_HOST_SB_ADDR_OFFSET(func)) + 4),
-               U64_HI(section));
-        REG_WR8(bp, BAR_XSTRORM_INTMEM + DEF_XSB_FUNC_OFF +
-                XSTORM_DEF_SB_HOST_STATUS_BLOCK_OFFSET(func), func);
-
-        for (index = 0; index < HC_XSTORM_DEF_SB_NUM_INDICES; index++)
-                REG_WR16(bp, BAR_XSTRORM_INTMEM +
-                         XSTORM_DEF_SB_HC_DISABLE_OFFSET(func, index), 1);
+        bnx2x_wr_sp_sb_data(bp, &sp_sb_data);
 
         bp->stats_pending = 0;
         bp->set_mac_pending = 0;
 
-        bnx2x_ack_sb(bp, sb_id, CSTORM_ID, 0, IGU_INT_ENABLE, 0);
+        bnx2x_ack_sb(bp, bp->igu_dsb_id, USTORM_ID, 0, IGU_INT_ENABLE, 0);
 }
 
 void bnx2x_update_coalesce(struct bnx2x *bp)
 {
-        int port = BP_PORT(bp);
         int i;
 
-        for_each_queue(bp, i) {
-                int sb_id = bp->fp[i].sb_id;
-
-                /* HC_INDEX_U_ETH_RX_CQ_CONS */
-                REG_WR8(bp, BAR_CSTRORM_INTMEM +
-                        CSTORM_SB_HC_TIMEOUT_U_OFFSET(port, sb_id,
-                                                      U_SB_ETH_RX_CQ_INDEX),
-                        bp->rx_ticks/(4 * BNX2X_BTR));
-                REG_WR16(bp, BAR_CSTRORM_INTMEM +
-                         CSTORM_SB_HC_DISABLE_U_OFFSET(port, sb_id,
-                                                       U_SB_ETH_RX_CQ_INDEX),
-                         (bp->rx_ticks/(4 * BNX2X_BTR)) ? 0 : 1);
-
-                /* HC_INDEX_C_ETH_TX_CQ_CONS */
-                REG_WR8(bp, BAR_CSTRORM_INTMEM +
-                        CSTORM_SB_HC_TIMEOUT_C_OFFSET(port, sb_id,
-                                                      C_SB_ETH_TX_CQ_INDEX),
-                        bp->tx_ticks/(4 * BNX2X_BTR));
-                REG_WR16(bp, BAR_CSTRORM_INTMEM +
-                         CSTORM_SB_HC_DISABLE_C_OFFSET(port, sb_id,
-                                                       C_SB_ETH_TX_CQ_INDEX),
-                         (bp->tx_ticks/(4 * BNX2X_BTR)) ? 0 : 1);
-        }
+        for_each_queue(bp, i)
+                bnx2x_update_coalesce_sb(bp, bp->fp[i].fw_sb_id,
+                                         bp->rx_ticks, bp->tx_ticks);
 }
 
 static void bnx2x_init_sp_ring(struct bnx2x *bp)
 {
-        int func = BP_FUNC(bp);
-
         spin_lock_init(&bp->spq_lock);
+        atomic_set(&bp->spq_left, MAX_SPQ_PENDING);
 
-        bp->spq_left = MAX_SPQ_PENDING;
         bp->spq_prod_idx = 0;
         bp->dsb_sp_prod = BNX2X_SP_DSB_INDEX;
         bp->spq_prod_bd = bp->spq;
         bp->spq_last_bd = bp->spq_prod_bd + MAX_SP_DESC_CNT;
-
-        REG_WR(bp, XSEM_REG_FAST_MEMORY + XSTORM_SPQ_PAGE_BASE_OFFSET(func),
-               U64_LO(bp->spq_mapping));
-        REG_WR(bp,
-               XSEM_REG_FAST_MEMORY + XSTORM_SPQ_PAGE_BASE_OFFSET(func) + 4,
-               U64_HI(bp->spq_mapping));
-
-        REG_WR(bp, XSEM_REG_FAST_MEMORY + XSTORM_SPQ_PROD_OFFSET(func),
-               bp->spq_prod_idx);
 }
 
-static void bnx2x_init_context(struct bnx2x *bp)
+static void bnx2x_init_eq_ring(struct bnx2x *bp)
 {
         int i;
+        for (i = 1; i <= NUM_EQ_PAGES; i++) {
+                union event_ring_elem *elem =
+                        &bp->eq_ring[EQ_DESC_CNT_PAGE * i - 1];
 
-        /* Rx */
-        for_each_queue(bp, i) {
-                struct eth_context *context = bnx2x_sp(bp, context[i].eth);
-                struct bnx2x_fastpath *fp = &bp->fp[i];
-                u8 cl_id = fp->cl_id;
-
-                context->ustorm_st_context.common.sb_index_numbers =
-                                                BNX2X_RX_SB_INDEX_NUM;
-                context->ustorm_st_context.common.clientId = cl_id;
-                context->ustorm_st_context.common.status_block_id = fp->sb_id;
-                context->ustorm_st_context.common.flags =
-                        (USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_MC_ALIGNMENT |
-                         USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_STATISTICS);
-                context->ustorm_st_context.common.statistics_counter_id =
-                                                cl_id;
-                context->ustorm_st_context.common.mc_alignment_log_size =
-                                                BNX2X_RX_ALIGN_SHIFT;
-                context->ustorm_st_context.common.bd_buff_size =
-                                                bp->rx_buf_size;
-                context->ustorm_st_context.common.bd_page_base_hi =
-                                                U64_HI(fp->rx_desc_mapping);
-                context->ustorm_st_context.common.bd_page_base_lo =
-                                                U64_LO(fp->rx_desc_mapping);
-                if (!fp->disable_tpa) {
-                        context->ustorm_st_context.common.flags |=
-                                USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_TPA;
-                        context->ustorm_st_context.common.sge_buff_size =
-                                (u16)min_t(u32, SGE_PAGE_SIZE*PAGES_PER_SGE,
-                                           0xffff);
-                        context->ustorm_st_context.common.sge_page_base_hi =
-                                                U64_HI(fp->rx_sge_mapping);
-                        context->ustorm_st_context.common.sge_page_base_lo =
-                                                U64_LO(fp->rx_sge_mapping);
-
-                        context->ustorm_st_context.common.max_sges_for_packet =
-                                SGE_PAGE_ALIGN(bp->dev->mtu) >> SGE_PAGE_SHIFT;
-                        context->ustorm_st_context.common.max_sges_for_packet =
-                                ((context->ustorm_st_context.common.
-                                  max_sges_for_packet + PAGES_PER_SGE - 1) &
-                                 (~(PAGES_PER_SGE - 1))) >> PAGES_PER_SGE_SHIFT;
-                }
-
-                context->ustorm_ag_context.cdu_usage =
-                        CDU_RSRVD_VALUE_TYPE_A(HW_CID(bp, i),
-                                               CDU_REGION_NUMBER_UCM_AG,
-                                               ETH_CONNECTION_TYPE);
-
-                context->xstorm_ag_context.cdu_reserved =
-                        CDU_RSRVD_VALUE_TYPE_A(HW_CID(bp, i),
-                                               CDU_REGION_NUMBER_XCM_AG,
-                                               ETH_CONNECTION_TYPE);
-        }
-
-        /* Tx */
-        for_each_queue(bp, i) {
-                struct bnx2x_fastpath *fp = &bp->fp[i];
-                struct eth_context *context =
-                        bnx2x_sp(bp, context[i].eth);
-
-                context->cstorm_st_context.sb_index_number =
-                                                C_SB_ETH_TX_CQ_INDEX;
-                context->cstorm_st_context.status_block_id = fp->sb_id;
-
-                context->xstorm_st_context.tx_bd_page_base_hi =
-                                                U64_HI(fp->tx_desc_mapping);
-                context->xstorm_st_context.tx_bd_page_base_lo =
-                                                U64_LO(fp->tx_desc_mapping);
-                context->xstorm_st_context.statistics_data = (fp->cl_id |
-                                XSTORM_ETH_ST_CONTEXT_STATISTICS_ENABLE);
+                elem->next_page.addr.hi =
+                        cpu_to_le32(U64_HI(bp->eq_mapping +
+                                   BCM_PAGE_SIZE * (i % NUM_EQ_PAGES)));
+                elem->next_page.addr.lo =
+                        cpu_to_le32(U64_LO(bp->eq_mapping +
+                                   BCM_PAGE_SIZE*(i % NUM_EQ_PAGES)));
         }
+        bp->eq_cons = 0;
+        bp->eq_prod = NUM_EQ_DESC;
+        bp->eq_cons_sb = BNX2X_EQ_INDEX;
 }
 
 static void bnx2x_init_ind_table(struct bnx2x *bp)
@@ -3072,47 +4145,11 @@ static void bnx2x_init_ind_table(struct bnx2x *bp)
                         bp->fp->cl_id + (i % bp->num_queues));
 }
 
-void bnx2x_set_client_config(struct bnx2x *bp)
-{
-        struct tstorm_eth_client_config tstorm_client = {0};
-        int port = BP_PORT(bp);
-        int i;
-
-        tstorm_client.mtu = bp->dev->mtu;
-        tstorm_client.config_flags =
-                                (TSTORM_ETH_CLIENT_CONFIG_STATSITICS_ENABLE |
-                                 TSTORM_ETH_CLIENT_CONFIG_E1HOV_REM_ENABLE);
-#ifdef BCM_VLAN
-        if (bp->rx_mode && bp->vlgrp && (bp->flags & HW_VLAN_RX_FLAG)) {
-                tstorm_client.config_flags |=
-                                TSTORM_ETH_CLIENT_CONFIG_VLAN_REM_ENABLE;
-                DP(NETIF_MSG_IFUP, "vlan removal enabled\n");
-        }
-#endif
-
-        for_each_queue(bp, i) {
-                tstorm_client.statistics_counter_id = bp->fp[i].cl_id;
-
-                REG_WR(bp, BAR_TSTRORM_INTMEM +
-                       TSTORM_CLIENT_CONFIG_OFFSET(port, bp->fp[i].cl_id),
-                       ((u32 *)&tstorm_client)[0]);
-                REG_WR(bp, BAR_TSTRORM_INTMEM +
-                       TSTORM_CLIENT_CONFIG_OFFSET(port, bp->fp[i].cl_id) + 4,
-                       ((u32 *)&tstorm_client)[1]);
-        }
-
-        DP(BNX2X_MSG_OFF, "tstorm_client: 0x%08x 0x%08x\n",
-           ((u32 *)&tstorm_client)[0], ((u32 *)&tstorm_client)[1]);
-}
-
 void bnx2x_set_storm_rx_mode(struct bnx2x *bp)
 {
-        struct tstorm_eth_mac_filter_config tstorm_mac_filter = {0};
         int mode = bp->rx_mode;
-        int mask = bp->rx_mode_cl_mask;
-        int func = BP_FUNC(bp);
-        int port = BP_PORT(bp);
-        int i;
+        u16 cl_id;
+
         /* All but management unicast packets should pass to the host as well */
         u32 llh_mask =
                 NIG_LLH0_BRB1_DRV_MASK_REG_LLH0_BRB1_DRV_MASK_BRCST |
@@ -3120,28 +4157,32 @@ void bnx2x_set_storm_rx_mode(struct bnx2x *bp)
                 NIG_LLH0_BRB1_DRV_MASK_REG_LLH0_BRB1_DRV_MASK_VLAN |
                 NIG_LLH0_BRB1_DRV_MASK_REG_LLH0_BRB1_DRV_MASK_NO_VLAN;
 
-        DP(NETIF_MSG_IFUP, "rx mode %d  mask 0x%x\n", mode, mask);
-
         switch (mode) {
         case BNX2X_RX_MODE_NONE: /* no Rx */
-                tstorm_mac_filter.ucast_drop_all = mask;
-                tstorm_mac_filter.mcast_drop_all = mask;
-                tstorm_mac_filter.bcast_drop_all = mask;
+                cl_id = BP_L_ID(bp);
+                bnx2x_rxq_set_mac_filters(bp, cl_id, BNX2X_ACCEPT_NONE);
                 break;
 
         case BNX2X_RX_MODE_NORMAL:
-                tstorm_mac_filter.bcast_accept_all = mask;
+                cl_id = BP_L_ID(bp);
+                bnx2x_rxq_set_mac_filters(bp, cl_id,
+                        BNX2X_ACCEPT_UNICAST |
+                        BNX2X_ACCEPT_BROADCAST |
+                        BNX2X_ACCEPT_MULTICAST);
                 break;
 
         case BNX2X_RX_MODE_ALLMULTI:
-                tstorm_mac_filter.mcast_accept_all = mask;
-                tstorm_mac_filter.bcast_accept_all = mask;
+                cl_id = BP_L_ID(bp);
+                bnx2x_rxq_set_mac_filters(bp, cl_id,
+                        BNX2X_ACCEPT_UNICAST |
+                        BNX2X_ACCEPT_BROADCAST |
+                        BNX2X_ACCEPT_ALL_MULTICAST);
                 break;
 
         case BNX2X_RX_MODE_PROMISC:
-                tstorm_mac_filter.ucast_accept_all = mask;
-                tstorm_mac_filter.mcast_accept_all = mask;
-                tstorm_mac_filter.bcast_accept_all = mask;
+                cl_id = BP_L_ID(bp);
+                bnx2x_rxq_set_mac_filters(bp, cl_id, BNX2X_PROMISCUOUS_MODE);
+
                 /* pass management unicast packets as well */
                 llh_mask |= NIG_LLH0_BRB1_DRV_MASK_REG_LLH0_BRB1_DRV_MASK_UNCST;
                 break;
@@ -3152,262 +4193,64 @@ void bnx2x_set_storm_rx_mode(struct bnx2x *bp)
         }
 
         REG_WR(bp,
-               (port ? NIG_REG_LLH1_BRB1_DRV_MASK : NIG_REG_LLH0_BRB1_DRV_MASK),
+               BP_PORT(bp) ? NIG_REG_LLH1_BRB1_DRV_MASK :
+                             NIG_REG_LLH0_BRB1_DRV_MASK,
                llh_mask);
 
-        for (i = 0; i < sizeof(struct tstorm_eth_mac_filter_config)/4; i++) {
-                REG_WR(bp, BAR_TSTRORM_INTMEM +
-                       TSTORM_MAC_FILTER_CONFIG_OFFSET(func) + i * 4,
-                       ((u32 *)&tstorm_mac_filter)[i]);
+        DP(NETIF_MSG_IFUP, "rx mode %d\n"
+                "drop_ucast 0x%x\ndrop_mcast 0x%x\ndrop_bcast 0x%x\n"
+                "accp_ucast 0x%x\naccp_mcast 0x%x\naccp_bcast 0x%x\n", mode,
+                bp->mac_filters.ucast_drop_all,
+                bp->mac_filters.mcast_drop_all,
+                bp->mac_filters.bcast_drop_all,
+                bp->mac_filters.ucast_accept_all,
+                bp->mac_filters.mcast_accept_all,
+                bp->mac_filters.bcast_accept_all
+        );
 
-/*              DP(NETIF_MSG_IFUP, "tstorm_mac_filter[%d]: 0x%08x\n", i,
-                   ((u32 *)&tstorm_mac_filter)[i]); */
-        }
-
-        if (mode != BNX2X_RX_MODE_NONE)
-                bnx2x_set_client_config(bp);
+        storm_memset_mac_filters(bp, &bp->mac_filters, BP_FUNC(bp));
 }
 
 static void bnx2x_init_internal_common(struct bnx2x *bp)
 {
         int i;
 
-        /* Zero this manually as its initialization is
-           currently missing in the initTool */
-        for (i = 0; i < (USTORM_AGG_DATA_SIZE >> 2); i++)
-                REG_WR(bp, BAR_USTRORM_INTMEM +
-                       USTORM_AGG_DATA_OFFSET + i * 4, 0);
-}
-
-static void bnx2x_init_internal_port(struct bnx2x *bp)
-{
-        int port = BP_PORT(bp);
-
-        REG_WR(bp,
-               BAR_CSTRORM_INTMEM + CSTORM_HC_BTR_U_OFFSET(port), BNX2X_BTR);
-        REG_WR(bp,
-               BAR_CSTRORM_INTMEM + CSTORM_HC_BTR_C_OFFSET(port), BNX2X_BTR);
-        REG_WR(bp, BAR_TSTRORM_INTMEM + TSTORM_HC_BTR_OFFSET(port), BNX2X_BTR);
-        REG_WR(bp, BAR_XSTRORM_INTMEM + XSTORM_HC_BTR_OFFSET(port), BNX2X_BTR);
-}
-
-static void bnx2x_init_internal_func(struct bnx2x *bp)
-{
-        struct tstorm_eth_function_common_config tstorm_config = {0};
-        struct stats_indication_flags stats_flags = {0};
-        int port = BP_PORT(bp);
-        int func = BP_FUNC(bp);
-        int i, j;
-        u32 offset;
-        u16 max_agg_size;
-
-        tstorm_config.config_flags = RSS_FLAGS(bp);
-
-        if (is_multi(bp))
-                tstorm_config.rss_result_mask = MULTI_MASK;
-
-        /* Enable TPA if needed */
-        if (bp->flags & TPA_ENABLE_FLAG)
-                tstorm_config.config_flags |=
-                        TSTORM_ETH_FUNCTION_COMMON_CONFIG_ENABLE_TPA;
-
-        if (IS_E1HMF(bp))
-                tstorm_config.config_flags |=
-                                TSTORM_ETH_FUNCTION_COMMON_CONFIG_E1HOV_IN_CAM;
-
-        tstorm_config.leading_client_id = BP_L_ID(bp);
-
-        REG_WR(bp, BAR_TSTRORM_INTMEM +
-               TSTORM_FUNCTION_COMMON_CONFIG_OFFSET(func),
-               (*(u32 *)&tstorm_config));
-
-        bp->rx_mode = BNX2X_RX_MODE_NONE; /* no rx until link is up */
-        bp->rx_mode_cl_mask = (1 << BP_L_ID(bp));
-        bnx2x_set_storm_rx_mode(bp);
+        if (!CHIP_IS_E1(bp)) {
 
-        for_each_queue(bp, i) {
-                u8 cl_id = bp->fp[i].cl_id;
-
-                /* reset xstorm per client statistics */
-                offset = BAR_XSTRORM_INTMEM +
-                         XSTORM_PER_COUNTER_ID_STATS_OFFSET(port, cl_id);
-                for (j = 0;
-                     j < sizeof(struct xstorm_per_client_stats) / 4; j++)
-                        REG_WR(bp, offset + j*4, 0);
-
-                /* reset tstorm per client statistics */
-                offset = BAR_TSTRORM_INTMEM +
-                         TSTORM_PER_COUNTER_ID_STATS_OFFSET(port, cl_id);
-                for (j = 0;
-                     j < sizeof(struct tstorm_per_client_stats) / 4; j++)
-                        REG_WR(bp, offset + j*4, 0);
-
-                /* reset ustorm per client statistics */
-                offset = BAR_USTRORM_INTMEM +
-                         USTORM_PER_COUNTER_ID_STATS_OFFSET(port, cl_id);
-                for (j = 0;
-                     j < sizeof(struct ustorm_per_client_stats) / 4; j++)
-                        REG_WR(bp, offset + j*4, 0);
-        }
-
-        /* Init statistics related context */
-        stats_flags.collect_eth = 1;
-
-        REG_WR(bp, BAR_XSTRORM_INTMEM + XSTORM_STATS_FLAGS_OFFSET(func),
-               ((u32 *)&stats_flags)[0]);
-        REG_WR(bp, BAR_XSTRORM_INTMEM + XSTORM_STATS_FLAGS_OFFSET(func) + 4,
-               ((u32 *)&stats_flags)[1]);
-
-        REG_WR(bp, BAR_TSTRORM_INTMEM + TSTORM_STATS_FLAGS_OFFSET(func),
-               ((u32 *)&stats_flags)[0]);
-        REG_WR(bp, BAR_TSTRORM_INTMEM + TSTORM_STATS_FLAGS_OFFSET(func) + 4,
-               ((u32 *)&stats_flags)[1]);
-
-        REG_WR(bp, BAR_USTRORM_INTMEM + USTORM_STATS_FLAGS_OFFSET(func),
-               ((u32 *)&stats_flags)[0]);
-        REG_WR(bp, BAR_USTRORM_INTMEM + USTORM_STATS_FLAGS_OFFSET(func) + 4,
-               ((u32 *)&stats_flags)[1]);
-
-        REG_WR(bp, BAR_CSTRORM_INTMEM + CSTORM_STATS_FLAGS_OFFSET(func),
-               ((u32 *)&stats_flags)[0]);
-        REG_WR(bp, BAR_CSTRORM_INTMEM + CSTORM_STATS_FLAGS_OFFSET(func) + 4,
-               ((u32 *)&stats_flags)[1]);
-
-        REG_WR(bp, BAR_XSTRORM_INTMEM +
-               XSTORM_ETH_STATS_QUERY_ADDR_OFFSET(func),
-               U64_LO(bnx2x_sp_mapping(bp, fw_stats)));
-        REG_WR(bp, BAR_XSTRORM_INTMEM +
-               XSTORM_ETH_STATS_QUERY_ADDR_OFFSET(func) + 4,
-               U64_HI(bnx2x_sp_mapping(bp, fw_stats)));
-
-        REG_WR(bp, BAR_TSTRORM_INTMEM +
-               TSTORM_ETH_STATS_QUERY_ADDR_OFFSET(func),
-               U64_LO(bnx2x_sp_mapping(bp, fw_stats)));
-        REG_WR(bp, BAR_TSTRORM_INTMEM +
-               TSTORM_ETH_STATS_QUERY_ADDR_OFFSET(func) + 4,
-               U64_HI(bnx2x_sp_mapping(bp, fw_stats)));
-
-        REG_WR(bp, BAR_USTRORM_INTMEM +
-               USTORM_ETH_STATS_QUERY_ADDR_OFFSET(func),
-               U64_LO(bnx2x_sp_mapping(bp, fw_stats)));
-        REG_WR(bp, BAR_USTRORM_INTMEM +
-               USTORM_ETH_STATS_QUERY_ADDR_OFFSET(func) + 4,
-               U64_HI(bnx2x_sp_mapping(bp, fw_stats)));
-
-        if (CHIP_IS_E1H(bp)) {
+                /* xstorm needs to know whether to add  ovlan to packets or not,
+                 * in switch-independent we'll write 0 to here... */
                 REG_WR8(bp, BAR_XSTRORM_INTMEM + XSTORM_FUNCTION_MODE_OFFSET,
-                        IS_E1HMF(bp));
+                        bp->mf_mode);
                 REG_WR8(bp, BAR_TSTRORM_INTMEM + TSTORM_FUNCTION_MODE_OFFSET,
-                        IS_E1HMF(bp));
+                        bp->mf_mode);
                 REG_WR8(bp, BAR_CSTRORM_INTMEM + CSTORM_FUNCTION_MODE_OFFSET,
-                        IS_E1HMF(bp));
+                        bp->mf_mode);
                 REG_WR8(bp, BAR_USTRORM_INTMEM + USTORM_FUNCTION_MODE_OFFSET,
-                        IS_E1HMF(bp));
-
-                REG_WR16(bp, BAR_XSTRORM_INTMEM + XSTORM_E1HOV_OFFSET(func),
-                         bp->e1hov);
+                        bp->mf_mode);
         }
 
-        /* Init CQ ring mapping and aggregation size, the FW limit is 8 frags */
-        max_agg_size = min_t(u32, (min_t(u32, 8, MAX_SKB_FRAGS) *
-                                   SGE_PAGE_SIZE * PAGES_PER_SGE), 0xffff);
-        for_each_queue(bp, i) {
-                struct bnx2x_fastpath *fp = &bp->fp[i];
-
-                REG_WR(bp, BAR_USTRORM_INTMEM +
-                       USTORM_CQE_PAGE_BASE_OFFSET(port, fp->cl_id),
-                       U64_LO(fp->rx_comp_mapping));
-                REG_WR(bp, BAR_USTRORM_INTMEM +
-                       USTORM_CQE_PAGE_BASE_OFFSET(port, fp->cl_id) + 4,
-                       U64_HI(fp->rx_comp_mapping));
-
-                /* Next page */
-                REG_WR(bp, BAR_USTRORM_INTMEM +
-                       USTORM_CQE_PAGE_NEXT_OFFSET(port, fp->cl_id),
-                       U64_LO(fp->rx_comp_mapping + BCM_PAGE_SIZE));
+        /* Zero this manually as its initialization is
+           currently missing in the initTool */
+        for (i = 0; i < (USTORM_AGG_DATA_SIZE >> 2); i++)
                 REG_WR(bp, BAR_USTRORM_INTMEM +
-                       USTORM_CQE_PAGE_NEXT_OFFSET(port, fp->cl_id) + 4,
-                       U64_HI(fp->rx_comp_mapping + BCM_PAGE_SIZE));
-
-                REG_WR16(bp, BAR_USTRORM_INTMEM +
-                         USTORM_MAX_AGG_SIZE_OFFSET(port, fp->cl_id),
-                         max_agg_size);
-        }
-
-        /* dropless flow control */
-        if (CHIP_IS_E1H(bp)) {
-                struct ustorm_eth_rx_pause_data_e1h rx_pause = {0};
-
-                rx_pause.bd_thr_low = 250;
-                rx_pause.cqe_thr_low = 250;
-                rx_pause.cos = 1;
-                rx_pause.sge_thr_low = 0;
-                rx_pause.bd_thr_high = 350;
-                rx_pause.cqe_thr_high = 350;
-                rx_pause.sge_thr_high = 0;
-
-                for_each_queue(bp, i) {
-                        struct bnx2x_fastpath *fp = &bp->fp[i];
-
-                        if (!fp->disable_tpa) {
-                                rx_pause.sge_thr_low = 150;
-                                rx_pause.sge_thr_high = 250;
-                        }
-
-
-                        offset = BAR_USTRORM_INTMEM +
-                                 USTORM_ETH_RING_PAUSE_DATA_OFFSET(port,
-                                                                   fp->cl_id);
-                        for (j = 0;
-                             j < sizeof(struct ustorm_eth_rx_pause_data_e1h)/4;
-                             j++)
-                                REG_WR(bp, offset + j*4,
-                                       ((u32 *)&rx_pause)[j]);
-                }
-        }
-
-        memset(&(bp->cmng), 0, sizeof(struct cmng_struct_per_port));
-
-        /* Init rate shaping and fairness contexts */
-        if (IS_E1HMF(bp)) {
-                int vn;
-
-                /* During init there is no active link
-                   Until link is up, set link rate to 10Gbps */
-                bp->link_vars.line_speed = SPEED_10000;
-                bnx2x_init_port_minmax(bp);
-
-                if (!BP_NOMCP(bp))
-                        bp->mf_config =
-                              SHMEM_RD(bp, mf_cfg.func_mf_config[func].config);
-                bnx2x_calc_vn_weight_sum(bp);
-
-                for (vn = VN_0; vn < E1HVN_MAX; vn++)
-                        bnx2x_init_vn_minmax(bp, 2*vn + port);
-
-                /* Enable rate shaping and fairness */
-                bp->cmng.flags.cmng_enables |=
-                                        CMNG_FLAGS_PER_PORT_RATE_SHAPING_VN;
-
-        } else {
-                /* rate shaping and fairness are disabled */
-                DP(NETIF_MSG_IFUP,
-                   "single function mode  minmax will be disabled\n");
+                       USTORM_AGG_DATA_OFFSET + i * 4, 0);
+        if (CHIP_IS_E2(bp)) {
+                REG_WR8(bp, BAR_CSTRORM_INTMEM + CSTORM_IGU_MODE_OFFSET,
+                        CHIP_INT_MODE_IS_BC(bp) ?
+                        HC_IGU_BC_MODE : HC_IGU_NBC_MODE);
         }
+}
 
-
-        /* Store cmng structures to internal memory */
-        if (bp->port.pmf)
-                for (i = 0; i < sizeof(struct cmng_struct_per_port) / 4; i++)
-                        REG_WR(bp, BAR_XSTRORM_INTMEM +
-                               XSTORM_CMNG_PER_PORT_VARS_OFFSET(port) + i * 4,
-                               ((u32 *)(&bp->cmng))[i]);
+static void bnx2x_init_internal_port(struct bnx2x *bp)
+{
+        /* port */
 }
 
 static void bnx2x_init_internal(struct bnx2x *bp, u32 load_code)
 {
         switch (load_code) {
         case FW_MSG_CODE_DRV_LOAD_COMMON:
+        case FW_MSG_CODE_DRV_LOAD_COMMON_CHIP:
                 bnx2x_init_internal_common(bp);
                 /* no break */
 
@@ -3416,7 +4259,8 @@ static void bnx2x_init_internal(struct bnx2x *bp, u32 load_code)
                 /* no break */
 
         case FW_MSG_CODE_DRV_LOAD_FUNCTION:
-                bnx2x_init_internal_func(bp);
+                /* internal memory per function is
+                   initialized inside bnx2x_pf_init */
                 break;
 
         default:
@@ -3425,43 +4269,63 @@ static void bnx2x_init_internal(struct bnx2x *bp, u32 load_code)
         }
 }
 
+static void bnx2x_init_fp_sb(struct bnx2x *bp, int fp_idx)
+{
+        struct bnx2x_fastpath *fp = &bp->fp[fp_idx];
+
+        fp->state = BNX2X_FP_STATE_CLOSED;
+
+        fp->index = fp->cid = fp_idx;
+        fp->cl_id = BP_L_ID(bp) + fp_idx;
+        fp->fw_sb_id = bp->base_fw_ndsb + fp->cl_id + CNIC_CONTEXT_USE;
+        fp->igu_sb_id = bp->igu_base_sb + fp_idx + CNIC_CONTEXT_USE;
+        /* qZone id equals to FW (per path) client id */
+        fp->cl_qzone_id  = fp->cl_id +
+                           BP_PORT(bp)*(CHIP_IS_E2(bp) ? ETH_MAX_RX_CLIENTS_E2 :
+                                ETH_MAX_RX_CLIENTS_E1H);
+        /* init shortcut */
+        fp->ustorm_rx_prods_offset = CHIP_IS_E2(bp) ?
+                            USTORM_RX_PRODS_E2_OFFSET(fp->cl_qzone_id) :
+                            USTORM_RX_PRODS_E1X_OFFSET(BP_PORT(bp), fp->cl_id);
+        /* Setup SB indicies */
+        fp->rx_cons_sb = BNX2X_RX_SB_INDEX;
+        fp->tx_cons_sb = BNX2X_TX_SB_INDEX;
+
+        DP(NETIF_MSG_IFUP, "queue[%d]:  bnx2x_init_sb(%p,%p)  "
+                                   "cl_id %d  fw_sb %d  igu_sb %d\n",
+                   fp_idx, bp, fp->status_blk.e1x_sb, fp->cl_id, fp->fw_sb_id,
+                   fp->igu_sb_id);
+        bnx2x_init_sb(bp, fp->status_blk_mapping, BNX2X_VF_ID_INVALID, false,
+                      fp->fw_sb_id, fp->igu_sb_id);
+
+        bnx2x_update_fpsb_idx(fp);
+}
+
 void bnx2x_nic_init(struct bnx2x *bp, u32 load_code)
 {
         int i;
 
-        for_each_queue(bp, i) {
-                struct bnx2x_fastpath *fp = &bp->fp[i];
-
-                fp->bp = bp;
-                fp->state = BNX2X_FP_STATE_CLOSED;
-                fp->index = i;
-                fp->cl_id = BP_L_ID(bp) + i;
+        for_each_queue(bp, i)
+                bnx2x_init_fp_sb(bp, i);
 #ifdef BCM_CNIC
-                fp->sb_id = fp->cl_id + 1;
-#else
-                fp->sb_id = fp->cl_id;
+
+        bnx2x_init_sb(bp, bp->cnic_sb_mapping,
+                      BNX2X_VF_ID_INVALID, false,
+                      CNIC_SB_ID(bp), CNIC_IGU_SB_ID(bp));
+
 #endif
-                DP(NETIF_MSG_IFUP,
-                   "queue[%d]:  bnx2x_init_sb(%p,%p)  cl_id %d  sb %d\n",
-                   i, bp, fp->status_blk, fp->cl_id, fp->sb_id);
-                bnx2x_init_sb(bp, fp->status_blk, fp->status_blk_mapping,
-                              fp->sb_id);
-                bnx2x_update_fpsb_idx(fp);
-        }
 
         /* ensure status block indices were read */
         rmb();
 
-
-        bnx2x_init_def_sb(bp, bp->def_status_blk, bp->def_status_blk_mapping,
-                          DEF_SB_ID);
+        bnx2x_init_def_sb(bp);
         bnx2x_update_dsb_idx(bp);
-        bnx2x_update_coalesce(bp);
         bnx2x_init_rx_rings(bp);
-        bnx2x_init_tx_ring(bp);
+        bnx2x_init_tx_rings(bp);
         bnx2x_init_sp_ring(bp);
-        bnx2x_init_context(bp);
+        bnx2x_init_eq_ring(bp);
         bnx2x_init_internal(bp, load_code);
+        bnx2x_pf_init(bp);
         bnx2x_init_ind_table(bp);
         bnx2x_stats_init(bp);
 
@@ -3522,7 +4386,6 @@ gunzip_nomem1:
 static void bnx2x_gunzip_end(struct bnx2x *bp)
 {
         kfree(bp->strm->workspace);
-
         kfree(bp->strm);
         bp->strm = NULL;
 
@@ -3620,8 +4483,6 @@ static int bnx2x_int_mem_test(struct bnx2x *bp)
         else
                 factor = 1;
 
-        DP(NETIF_MSG_HW, "start part1\n");
-
         /* Disable inputs of parser neighbor blocks */
         REG_WR(bp, TSDM_REG_ENABLE_IN1, 0x0);
         REG_WR(bp, TCM_REG_PRS_IFEN, 0x0);
@@ -3758,9 +4619,19 @@ static int bnx2x_int_mem_test(struct bnx2x *bp)
 static void enable_blocks_attention(struct bnx2x *bp)
 {
         REG_WR(bp, PXP_REG_PXP_INT_MASK_0, 0);
-        REG_WR(bp, PXP_REG_PXP_INT_MASK_1, 0);
+        if (CHIP_IS_E2(bp))
+                REG_WR(bp, PXP_REG_PXP_INT_MASK_1, 0x40);
+        else
+                REG_WR(bp, PXP_REG_PXP_INT_MASK_1, 0);
         REG_WR(bp, DORQ_REG_DORQ_INT_MASK, 0);
         REG_WR(bp, CFC_REG_CFC_INT_MASK, 0);
+        /*
+         * mask read length error interrupts in brb for parser
+         * (parsing unit and 'checksum and crc' unit)
+         * these errors are legal (PU reads fixed length and CAC can cause
+         * read length error on truncated packets)
+         */
+        REG_WR(bp, BRB1_REG_BRB1_INT_MASK, 0xFC00);
         REG_WR(bp, QM_REG_QM_INT_MASK, 0);
         REG_WR(bp, TM_REG_TM_INT_MASK, 0);
         REG_WR(bp, XSDM_REG_XSDM_INT_MASK_0, 0);
@@ -3779,8 +4650,16 @@ static void enable_blocks_attention(struct bnx2x *bp)
         REG_WR(bp, CCM_REG_CCM_INT_MASK, 0);
 /*      REG_WR(bp, CSEM_REG_CSEM_INT_MASK_0, 0); */
 /*      REG_WR(bp, CSEM_REG_CSEM_INT_MASK_1, 0); */
+
         if (CHIP_REV_IS_FPGA(bp))
                 REG_WR(bp, PXP2_REG_PXP2_INT_MASK_0, 0x580000);
+        else if (CHIP_IS_E2(bp))
+                REG_WR(bp, PXP2_REG_PXP2_INT_MASK_0,
+                           (PXP2_PXP2_INT_MASK_0_REG_PGL_CPL_OF
+                                | PXP2_PXP2_INT_MASK_0_REG_PGL_CPL_AFT
+                                | PXP2_PXP2_INT_MASK_0_REG_PGL_PCIE_ATTN
+                                | PXP2_PXP2_INT_MASK_0_REG_PGL_READ_BLOCKED
+                                | PXP2_PXP2_INT_MASK_0_REG_PGL_WRITE_BLOCKED));
         else
                 REG_WR(bp, PXP2_REG_PXP2_INT_MASK_0, 0x480000);
         REG_WR(bp, TSDM_REG_TSDM_INT_MASK_0, 0);
@@ -3798,34 +4677,34 @@ static const struct {
         u32 addr;
         u32 mask;
 } bnx2x_parity_mask[] = {
-        {PXP_REG_PXP_PRTY_MASK, 0xffffffff},
-        {PXP2_REG_PXP2_PRTY_MASK_0, 0xffffffff},
-        {PXP2_REG_PXP2_PRTY_MASK_1, 0xffffffff},
-        {HC_REG_HC_PRTY_MASK, 0xffffffff},
-        {MISC_REG_MISC_PRTY_MASK, 0xffffffff},
-        {QM_REG_QM_PRTY_MASK, 0x0},
-        {DORQ_REG_DORQ_PRTY_MASK, 0x0},
+        {PXP_REG_PXP_PRTY_MASK,         0x3ffffff},
+        {PXP2_REG_PXP2_PRTY_MASK_0,     0xffffffff},
+        {PXP2_REG_PXP2_PRTY_MASK_1,     0x7f},
+        {HC_REG_HC_PRTY_MASK,           0x7},
+        {MISC_REG_MISC_PRTY_MASK,       0x1},
+        {QM_REG_QM_PRTY_MASK,           0x0},
+        {DORQ_REG_DORQ_PRTY_MASK,       0x0},
         {GRCBASE_UPB + PB_REG_PB_PRTY_MASK, 0x0},
         {GRCBASE_XPB + PB_REG_PB_PRTY_MASK, 0x0},
-        {SRC_REG_SRC_PRTY_MASK, 0x4}, /* bit 2 */
-        {CDU_REG_CDU_PRTY_MASK, 0x0},
-        {CFC_REG_CFC_PRTY_MASK, 0x0},
-        {DBG_REG_DBG_PRTY_MASK, 0x0},
-        {DMAE_REG_DMAE_PRTY_MASK, 0x0},
-        {BRB1_REG_BRB1_PRTY_MASK, 0x0},
-        {PRS_REG_PRS_PRTY_MASK, (1<<6)},/* bit 6 */
-        {TSDM_REG_TSDM_PRTY_MASK, 0x18},/* bit 3,4 */
-        {CSDM_REG_CSDM_PRTY_MASK, 0x8}, /* bit 3 */
-        {USDM_REG_USDM_PRTY_MASK, 0x38},/* bit 3,4,5 */
-        {XSDM_REG_XSDM_PRTY_MASK, 0x8}, /* bit 3 */
-        {TSEM_REG_TSEM_PRTY_MASK_0, 0x0},
-        {TSEM_REG_TSEM_PRTY_MASK_1, 0x0},
-        {USEM_REG_USEM_PRTY_MASK_0, 0x0},
-        {USEM_REG_USEM_PRTY_MASK_1, 0x0},
-        {CSEM_REG_CSEM_PRTY_MASK_0, 0x0},
-        {CSEM_REG_CSEM_PRTY_MASK_1, 0x0},
-        {XSEM_REG_XSEM_PRTY_MASK_0, 0x0},
-        {XSEM_REG_XSEM_PRTY_MASK_1, 0x0}
+        {SRC_REG_SRC_PRTY_MASK,         0x4}, /* bit 2 */
+        {CDU_REG_CDU_PRTY_MASK,         0x0},
+        {CFC_REG_CFC_PRTY_MASK,         0x0},
+        {DBG_REG_DBG_PRTY_MASK,         0x0},
+        {DMAE_REG_DMAE_PRTY_MASK,       0x0},
+        {BRB1_REG_BRB1_PRTY_MASK,       0x0},
+        {PRS_REG_PRS_PRTY_MASK,         (1<<6)},/* bit 6 */
+        {TSDM_REG_TSDM_PRTY_MASK,       0x18},  /* bit 3,4 */
+        {CSDM_REG_CSDM_PRTY_MASK,       0x8},   /* bit 3 */
+        {USDM_REG_USDM_PRTY_MASK,       0x38},  /* bit 3,4,5 */
+        {XSDM_REG_XSDM_PRTY_MASK,       0x8},   /* bit 3 */
+        {TSEM_REG_TSEM_PRTY_MASK_0,     0x0},
+        {TSEM_REG_TSEM_PRTY_MASK_1,     0x0},
+        {USEM_REG_USEM_PRTY_MASK_0,     0x0},
+        {USEM_REG_USEM_PRTY_MASK_1,     0x0},
+        {CSEM_REG_CSEM_PRTY_MASK_0,     0x0},
+        {CSEM_REG_CSEM_PRTY_MASK_1,     0x0},
+        {XSEM_REG_XSEM_PRTY_MASK_0,     0x0},
+        {XSEM_REG_XSEM_PRTY_MASK_1,     0x0}
 };
 
 static void enable_blocks_parity(struct bnx2x *bp)
@@ -3917,26 +4796,97 @@ static void bnx2x_setup_fan_failure_detection(struct bnx2x *bp)
         REG_WR(bp, MISC_REG_SPIO_EVENT_EN, val);
 }
 
-static int bnx2x_init_common(struct bnx2x *bp)
+static void bnx2x_pretend_func(struct bnx2x *bp, u8 pretend_func_num)
+{
+        u32 offset = 0;
+
+        if (CHIP_IS_E1(bp))
+                return;
+        if (CHIP_IS_E1H(bp) && (pretend_func_num >= E1H_FUNC_MAX))
+                return;
+
+        switch (BP_ABS_FUNC(bp)) {
+        case 0:
+                offset = PXP2_REG_PGL_PRETEND_FUNC_F0;
+                break;
+        case 1:
+                offset = PXP2_REG_PGL_PRETEND_FUNC_F1;
+                break;
+        case 2:
+                offset = PXP2_REG_PGL_PRETEND_FUNC_F2;
+                break;
+        case 3:
+                offset = PXP2_REG_PGL_PRETEND_FUNC_F3;
+                break;
+        case 4:
+                offset = PXP2_REG_PGL_PRETEND_FUNC_F4;
+                break;
+        case 5:
+                offset = PXP2_REG_PGL_PRETEND_FUNC_F5;
+                break;
+        case 6:
+                offset = PXP2_REG_PGL_PRETEND_FUNC_F6;
+                break;
+        case 7:
+                offset = PXP2_REG_PGL_PRETEND_FUNC_F7;
+                break;
+        default:
+                return;
+        }
+
+        REG_WR(bp, offset, pretend_func_num);
+        REG_RD(bp, offset);
+        DP(NETIF_MSG_HW, "Pretending to func %d\n", pretend_func_num);
+}
+
+static void bnx2x_pf_disable(struct bnx2x *bp)
+{
+        u32 val = REG_RD(bp, IGU_REG_PF_CONFIGURATION);
+        val &= ~IGU_PF_CONF_FUNC_EN;
+
+        REG_WR(bp, IGU_REG_PF_CONFIGURATION, val);
+        REG_WR(bp, PGLUE_B_REG_INTERNAL_PFID_ENABLE_MASTER, 0);
+        REG_WR(bp, CFC_REG_WEAK_ENABLE_PF, 0);
+}
+
+static int bnx2x_init_hw_common(struct bnx2x *bp, u32 load_code)
 {
         u32 val, i;
-#ifdef BCM_CNIC
-        u32 wb_write[2];
-#endif
 
-        DP(BNX2X_MSG_MCP, "starting common init  func %d\n", BP_FUNC(bp));
+        DP(BNX2X_MSG_MCP, "starting common init  func %d\n", BP_ABS_FUNC(bp));
 
         bnx2x_reset_common(bp);
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET, 0xffffffff);
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_SET, 0xfffc);
 
         bnx2x_init_block(bp, MISC_BLOCK, COMMON_STAGE);
-        if (CHIP_IS_E1H(bp))
-                REG_WR(bp, MISC_REG_E1HMF_MODE, IS_E1HMF(bp));
+        if (!CHIP_IS_E1(bp))
+                REG_WR(bp, MISC_REG_E1HMF_MODE, IS_MF(bp));
+
+        if (CHIP_IS_E2(bp)) {
+                u8 fid;
+
+                /**
+                 * 4-port mode or 2-port mode we need to turn of master-enable
+                 * for everyone, after that, turn it back on for self.
+                 * so, we disregard multi-function or not, and always disable
+                 * for all functions on the given path, this means 0,2,4,6 for
+                 * path 0 and 1,3,5,7 for path 1
+                 */
+                for (fid = BP_PATH(bp); fid  < E2_FUNC_MAX*2; fid += 2) {
+                        if (fid == BP_ABS_FUNC(bp)) {
+                                REG_WR(bp,
+                                    PGLUE_B_REG_INTERNAL_PFID_ENABLE_MASTER,
+                                    1);
+                                continue;
+                        }
 
-        REG_WR(bp, MISC_REG_LCPLL_CTRL_REG_2, 0x100);
-        msleep(30);
-        REG_WR(bp, MISC_REG_LCPLL_CTRL_REG_2, 0x0);
+                        bnx2x_pretend_func(bp, fid);
+                        /* clear pf enable */
+                        bnx2x_pf_disable(bp);
+                        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
+                }
+        }
 
         bnx2x_init_block(bp, PXP_BLOCK, COMMON_STAGE);
         if (CHIP_IS_E1(bp)) {
@@ -3964,12 +4914,7 @@ static int bnx2x_init_common(struct bnx2x *bp)
         REG_WR(bp, PXP2_REG_RD_CDURD_SWAP_MODE, 1);
 #endif
 
-        REG_WR(bp, PXP2_REG_RQ_CDU_P_SIZE, 2);
-#ifdef BCM_CNIC
-        REG_WR(bp, PXP2_REG_RQ_TM_P_SIZE, 5);
-        REG_WR(bp, PXP2_REG_RQ_QM_P_SIZE, 5);
-        REG_WR(bp, PXP2_REG_RQ_SRC_P_SIZE, 5);
-#endif
+        bnx2x_ilt_init_page_size(bp, INITOP_SET);
 
         if (CHIP_REV_IS_FPGA(bp) && CHIP_IS_E1H(bp))
                 REG_WR(bp, PXP2_REG_PGL_TAGS_LIMIT, 0x1);
@@ -3988,9 +4933,65 @@ static int bnx2x_init_common(struct bnx2x *bp)
                 return -EBUSY;
         }
 
+        /* Timers bug workaround E2 only. We need to set the entire ILT to
+         * have entries with value "0" and valid bit on.
+         * This needs to be done by the first PF that is loaded in a path
+         * (i.e. common phase)
+         */
+        if (CHIP_IS_E2(bp)) {
+                struct ilt_client_info ilt_cli;
+                struct bnx2x_ilt ilt;
+                memset(&ilt_cli, 0, sizeof(struct ilt_client_info));
+                memset(&ilt, 0, sizeof(struct bnx2x_ilt));
+
+                /* initalize dummy TM client */
+                ilt_cli.start = 0;
+                ilt_cli.end = ILT_NUM_PAGE_ENTRIES - 1;
+                ilt_cli.client_num = ILT_CLIENT_TM;
+
+                /* Step 1: set zeroes to all ilt page entries with valid bit on
+                 * Step 2: set the timers first/last ilt entry to point
+                 * to the entire range to prevent ILT range error for 3rd/4th
+                 * vnic (this code assumes existance of the vnic)
+                 *
+                 * both steps performed by call to bnx2x_ilt_client_init_op()
+                 * with dummy TM client
+                 *
+                 * we must use pretend since PXP2_REG_RQ_##blk##_FIRST_ILT
+                 * and his brother are split registers
+                 */
+                bnx2x_pretend_func(bp, (BP_PATH(bp) + 6));
+                bnx2x_ilt_client_init_op_ilt(bp, &ilt, &ilt_cli, INITOP_CLEAR);
+                bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
+
+                REG_WR(bp, PXP2_REG_RQ_DRAM_ALIGN, BNX2X_PXP_DRAM_ALIGN);
+                REG_WR(bp, PXP2_REG_RQ_DRAM_ALIGN_RD, BNX2X_PXP_DRAM_ALIGN);
+                REG_WR(bp, PXP2_REG_RQ_DRAM_ALIGN_SEL, 1);
+        }
+
+
         REG_WR(bp, PXP2_REG_RQ_DISABLE_INPUTS, 0);
         REG_WR(bp, PXP2_REG_RD_DISABLE_INPUTS, 0);
 
+        if (CHIP_IS_E2(bp)) {
+                int factor = CHIP_REV_IS_EMUL(bp) ? 1000 :
+                                (CHIP_REV_IS_FPGA(bp) ? 400 : 0);
+                bnx2x_init_block(bp, PGLUE_B_BLOCK, COMMON_STAGE);
+
+                bnx2x_init_block(bp, ATC_BLOCK, COMMON_STAGE);
+
+                /* let the HW do it's magic ... */
+                do {
+                        msleep(200);
+                        val = REG_RD(bp, ATC_REG_ATC_INIT_DONE);
+                } while (factor-- && (val != 1));
+
+                if (val != 1) {
+                        BNX2X_ERR("ATC_INIT failed\n");
+                        return -EBUSY;
+                }
+        }
+
         bnx2x_init_block(bp, DMAE_BLOCK, COMMON_STAGE);
 
         /* clean the DMAE memory */
@@ -4009,20 +5010,12 @@ static int bnx2x_init_common(struct bnx2x *bp)
 
         bnx2x_init_block(bp, QM_BLOCK, COMMON_STAGE);
 
-#ifdef BCM_CNIC
-        wb_write[0] = 0;
-        wb_write[1] = 0;
-        for (i = 0; i < 64; i++) {
-                REG_WR(bp, QM_REG_BASEADDR + i*4, 1024 * 4 * (i%16));
-                bnx2x_init_ind_wr(bp, QM_REG_PTRTBL + i*8, wb_write, 2);
+        if (CHIP_MODE_IS_4_PORT(bp))
+                bnx2x_init_block(bp, QM_4PORT_BLOCK, COMMON_STAGE);
+
+        /* QM queues pointers table */
+        bnx2x_qm_init_ptr_table(bp, bp->qm_cid_count, INITOP_SET);
 
-                if (CHIP_IS_E1H(bp)) {
-                        REG_WR(bp, QM_REG_BASEADDR_EXT_A + i*4, 1024*4*(i%16));
-                        bnx2x_init_ind_wr(bp, QM_REG_PTRTBL_EXT_A + i*8,
-                                          wb_write, 2);
-                }
-        }
-#endif
         /* soft reset pulse */
         REG_WR(bp, QM_REG_SOFT_RESET, 1);
         REG_WR(bp, QM_REG_SOFT_RESET, 0);
@@ -4032,21 +5025,35 @@ static int bnx2x_init_common(struct bnx2x *bp)
 #endif
 
         bnx2x_init_block(bp, DQ_BLOCK, COMMON_STAGE);
-        REG_WR(bp, DORQ_REG_DPM_CID_OFST, BCM_PAGE_SHIFT);
+        REG_WR(bp, DORQ_REG_DPM_CID_OFST, BNX2X_DB_SHIFT);
+
         if (!CHIP_REV_IS_SLOW(bp)) {
                 /* enable hw interrupt from doorbell Q */
                 REG_WR(bp, DORQ_REG_DORQ_INT_MASK, 0);
         }
 
         bnx2x_init_block(bp, BRB1_BLOCK, COMMON_STAGE);
+        if (CHIP_MODE_IS_4_PORT(bp)) {
+                REG_WR(bp, BRB1_REG_FULL_LB_XOFF_THRESHOLD, 248);
+                REG_WR(bp, BRB1_REG_FULL_LB_XON_THRESHOLD, 328);
+        }
+
         bnx2x_init_block(bp, PRS_BLOCK, COMMON_STAGE);
         REG_WR(bp, PRS_REG_A_PRSU_20, 0xf);
 #ifndef BCM_CNIC
         /* set NIC mode */
         REG_WR(bp, PRS_REG_NIC_MODE, 1);
 #endif
-        if (CHIP_IS_E1H(bp))
-                REG_WR(bp, PRS_REG_E1HOV_MODE, IS_E1HMF(bp));
+        if (!CHIP_IS_E1(bp))
+                REG_WR(bp, PRS_REG_E1HOV_MODE, IS_MF(bp));
+
+        if (CHIP_IS_E2(bp)) {
+                /* Bit-map indicating which L2 hdrs may appear after the
+                   basic Ethernet header */
+                int has_ovlan = IS_MF(bp);
+                REG_WR(bp, PRS_REG_HDRS_AFTER_BASIC, (has_ovlan ? 7 : 6));
+                REG_WR(bp, PRS_REG_MUST_HAVE_HDRS, (has_ovlan ? 1 : 0));
+        }
 
         bnx2x_init_block(bp, TSDM_BLOCK, COMMON_STAGE);
         bnx2x_init_block(bp, CSDM_BLOCK, COMMON_STAGE);
@@ -4063,6 +5070,9 @@ static int bnx2x_init_common(struct bnx2x *bp)
         bnx2x_init_block(bp, CSEM_BLOCK, COMMON_STAGE);
         bnx2x_init_block(bp, XSEM_BLOCK, COMMON_STAGE);
 
+        if (CHIP_MODE_IS_4_PORT(bp))
+                bnx2x_init_block(bp, XSEM_4PORT_BLOCK, COMMON_STAGE);
+
         /* sync semi rtc */
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_CLEAR,
                0x80000000);
@@ -4073,9 +5083,16 @@ static int bnx2x_init_common(struct bnx2x *bp)
         bnx2x_init_block(bp, XPB_BLOCK, COMMON_STAGE);
         bnx2x_init_block(bp, PBF_BLOCK, COMMON_STAGE);
 
+        if (CHIP_IS_E2(bp)) {
+                int has_ovlan = IS_MF(bp);
+                REG_WR(bp, PBF_REG_HDRS_AFTER_BASIC, (has_ovlan ? 7 : 6));
+                REG_WR(bp, PBF_REG_MUST_HAVE_HDRS, (has_ovlan ? 1 : 0));
+        }
+
         REG_WR(bp, SRC_REG_SOFT_RST, 1);
         for (i = SRC_REG_KEYRSS0_0; i <= SRC_REG_KEYRSS1_9; i += 4)
                 REG_WR(bp, i, random32());
+
         bnx2x_init_block(bp, SRCH_BLOCK, COMMON_STAGE);
 #ifdef BCM_CNIC
         REG_WR(bp, SRC_REG_KEYSEARCH_0, 0x63285672);
@@ -4110,6 +5127,11 @@ static int bnx2x_init_common(struct bnx2x *bp)
         REG_WR(bp, CFC_REG_DEBUG0, 0x20020000);
 
         bnx2x_init_block(bp, HC_BLOCK, COMMON_STAGE);
+
+        if (CHIP_IS_E2(bp) && BP_NOMCP(bp))
+                REG_WR(bp, IGU_REG_RESET_MEMORIES, 0x36);
+
+        bnx2x_init_block(bp, IGU_BLOCK, COMMON_STAGE);
         bnx2x_init_block(bp, MISC_AEU_BLOCK, COMMON_STAGE);
 
         bnx2x_init_block(bp, PXPCS_BLOCK, COMMON_STAGE);
@@ -4117,15 +5139,34 @@ static int bnx2x_init_common(struct bnx2x *bp)
         REG_WR(bp, 0x2814, 0xffffffff);
         REG_WR(bp, 0x3820, 0xffffffff);
 
+        if (CHIP_IS_E2(bp)) {
+                REG_WR(bp, PCICFG_OFFSET + PXPCS_TL_CONTROL_5,
+                           (PXPCS_TL_CONTROL_5_ERR_UNSPPORT1 |
+                                PXPCS_TL_CONTROL_5_ERR_UNSPPORT));
+                REG_WR(bp, PCICFG_OFFSET + PXPCS_TL_FUNC345_STAT,
+                           (PXPCS_TL_FUNC345_STAT_ERR_UNSPPORT4 |
+                                PXPCS_TL_FUNC345_STAT_ERR_UNSPPORT3 |
+                                PXPCS_TL_FUNC345_STAT_ERR_UNSPPORT2));
+                REG_WR(bp, PCICFG_OFFSET + PXPCS_TL_FUNC678_STAT,
+                           (PXPCS_TL_FUNC678_STAT_ERR_UNSPPORT7 |
+                                PXPCS_TL_FUNC678_STAT_ERR_UNSPPORT6 |
+                                PXPCS_TL_FUNC678_STAT_ERR_UNSPPORT5));
+        }
+
         bnx2x_init_block(bp, EMAC0_BLOCK, COMMON_STAGE);
         bnx2x_init_block(bp, EMAC1_BLOCK, COMMON_STAGE);
         bnx2x_init_block(bp, DBU_BLOCK, COMMON_STAGE);
         bnx2x_init_block(bp, DBG_BLOCK, COMMON_STAGE);
 
         bnx2x_init_block(bp, NIG_BLOCK, COMMON_STAGE);
-        if (CHIP_IS_E1H(bp)) {
-                REG_WR(bp, NIG_REG_LLH_MF_MODE, IS_E1HMF(bp));
-                REG_WR(bp, NIG_REG_LLH_E1HOV_MODE, IS_E1HMF(bp));
+        if (!CHIP_IS_E1(bp)) {
+                REG_WR(bp, NIG_REG_LLH_MF_MODE, IS_MF(bp));
+                REG_WR(bp, NIG_REG_LLH_E1HOV_MODE, IS_MF(bp));
+        }
+        if (CHIP_IS_E2(bp)) {
+                /* Bit-map indicating which L2 hdrs may appear after the
+                   basic Ethernet header */
+                REG_WR(bp, NIG_REG_P0_HDRS_AFTER_BASIC, (IS_MF(bp) ? 7 : 6));
         }
 
         if (CHIP_REV_IS_SLOW(bp))
@@ -4149,15 +5190,17 @@ static int bnx2x_init_common(struct bnx2x *bp)
         }
         REG_WR(bp, CFC_REG_DEBUG0, 0);
 
-        /* read NIG statistic
-           to see if this is our first up since powerup */
-        bnx2x_read_dmae(bp, NIG_REG_STAT2_BRB_OCTET, 2);
-        val = *bnx2x_sp(bp, wb_data[0]);
+        if (CHIP_IS_E1(bp)) {
+                /* read NIG statistic
+                   to see if this is our first up since powerup */
+                bnx2x_read_dmae(bp, NIG_REG_STAT2_BRB_OCTET, 2);
+                val = *bnx2x_sp(bp, wb_data[0]);
 
-        /* do internal memory self test */
-        if ((CHIP_IS_E1(bp)) && (val == 0) && bnx2x_int_mem_test(bp)) {
-                BNX2X_ERR("internal mem self test failed\n");
-                return -EBUSY;
+                /* do internal memory self test */
+                if ((val == 0) && bnx2x_int_mem_test(bp)) {
+                        BNX2X_ERR("internal mem self test failed\n");
+                        return -EBUSY;
+                }
         }
 
         bp->port.need_hw_lock = bnx2x_hw_lock_required(bp,
@@ -4174,17 +5217,30 @@ static int bnx2x_init_common(struct bnx2x *bp)
                 enable_blocks_parity(bp);
 
         if (!BP_NOMCP(bp)) {
-                bnx2x_acquire_phy_lock(bp);
-                bnx2x_common_init_phy(bp, bp->common.shmem_base,
-                                      bp->common.shmem2_base);
-                bnx2x_release_phy_lock(bp);
+                /* In E2 2-PORT mode, same ext phy is used for the two paths */
+                if ((load_code == FW_MSG_CODE_DRV_LOAD_COMMON_CHIP) ||
+                    CHIP_IS_E1x(bp)) {
+                        u32 shmem_base[2], shmem2_base[2];
+                        shmem_base[0] =  bp->common.shmem_base;
+                        shmem2_base[0] = bp->common.shmem2_base;
+                        if (CHIP_IS_E2(bp)) {
+                                shmem_base[1] =
+                                        SHMEM2_RD(bp, other_shmem_base_addr);
+                                shmem2_base[1] =
+                                        SHMEM2_RD(bp, other_shmem2_base_addr);
+                        }
+                        bnx2x_acquire_phy_lock(bp);
+                        bnx2x_common_init_phy(bp, shmem_base, shmem2_base,
+                                              bp->common.chip_id);
+                        bnx2x_release_phy_lock(bp);
+                }
         } else
                 BNX2X_ERR("Bootcode is missing - can not initialize link\n");
 
         return 0;
 }
 
-static int bnx2x_init_port(struct bnx2x *bp)
+static int bnx2x_init_hw_port(struct bnx2x *bp)
 {
         int port = BP_PORT(bp);
         int init_stage = port ? PORT1_STAGE : PORT0_STAGE;
@@ -4198,14 +5254,23 @@ static int bnx2x_init_port(struct bnx2x *bp)
         bnx2x_init_block(bp, PXP_BLOCK, init_stage);
         bnx2x_init_block(bp, PXP2_BLOCK, init_stage);
 
+        /* Timers bug workaround: disables the pf_master bit in pglue at
+         * common phase, we need to enable it here before any dmae access are
+         * attempted. Therefore we manually added the enable-master to the
+         * port phase (it also happens in the function phase)
+         */
+        if (CHIP_IS_E2(bp))
+                REG_WR(bp, PGLUE_B_REG_INTERNAL_PFID_ENABLE_MASTER, 1);
+
         bnx2x_init_block(bp, TCM_BLOCK, init_stage);
         bnx2x_init_block(bp, UCM_BLOCK, init_stage);
         bnx2x_init_block(bp, CCM_BLOCK, init_stage);
         bnx2x_init_block(bp, XCM_BLOCK, init_stage);
 
-#ifdef BCM_CNIC
-        REG_WR(bp, QM_REG_CONNNUM_0 + port*4, 1024/16 - 1);
+        /* QM cid (connection) count */
+        bnx2x_qm_init_cid_count(bp, bp->qm_cid_count, INITOP_SET);
 
+#ifdef BCM_CNIC
         bnx2x_init_block(bp, TIMERS_BLOCK, init_stage);
         REG_WR(bp, TM_REG_LIN0_SCAN_TIME + port*4, 20);
         REG_WR(bp, TM_REG_LIN0_MAX_ACTIVE_CID + port*4, 31);
@@ -4213,29 +5278,41 @@ static int bnx2x_init_port(struct bnx2x *bp)
 
         bnx2x_init_block(bp, DQ_BLOCK, init_stage);
 
-        bnx2x_init_block(bp, BRB1_BLOCK, init_stage);
-        if (CHIP_REV_IS_SLOW(bp) && !CHIP_IS_E1H(bp)) {
-                /* no pause for emulation and FPGA */
-                low = 0;
-                high = 513;
-        } else {
-                if (IS_E1HMF(bp))
-                        low = ((bp->flags & ONE_PORT_FLAG) ? 160 : 246);
-                else if (bp->dev->mtu > 4096) {
-                        if (bp->flags & ONE_PORT_FLAG)
-                                low = 160;
-                        else {
-                                val = bp->dev->mtu;
-                                /* (24*1024 + val*4)/256 */
-                                low = 96 + (val/64) + ((val % 64) ? 1 : 0);
-                        }
-                } else
-                        low = ((bp->flags & ONE_PORT_FLAG) ? 80 : 160);
-                high = low + 56;        /* 14*1024/256 */
+        if (CHIP_MODE_IS_4_PORT(bp))
+                bnx2x_init_block(bp, QM_4PORT_BLOCK, init_stage);
+
+        if (CHIP_IS_E1(bp) || CHIP_IS_E1H(bp)) {
+                bnx2x_init_block(bp, BRB1_BLOCK, init_stage);
+                if (CHIP_REV_IS_SLOW(bp) && CHIP_IS_E1(bp)) {
+                        /* no pause for emulation and FPGA */
+                        low = 0;
+                        high = 513;
+                } else {
+                        if (IS_MF(bp))
+                                low = ((bp->flags & ONE_PORT_FLAG) ? 160 : 246);
+                        else if (bp->dev->mtu > 4096) {
+                                if (bp->flags & ONE_PORT_FLAG)
+                                        low = 160;
+                                else {
+                                        val = bp->dev->mtu;
+                                        /* (24*1024 + val*4)/256 */
+                                        low = 96 + (val/64) +
+                                                        ((val % 64) ? 1 : 0);
+                                }
+                        } else
+                                low = ((bp->flags & ONE_PORT_FLAG) ? 80 : 160);
+                        high = low + 56;        /* 14*1024/256 */
+                }
+                REG_WR(bp, BRB1_REG_PAUSE_LOW_THRESHOLD_0 + port*4, low);
+                REG_WR(bp, BRB1_REG_PAUSE_HIGH_THRESHOLD_0 + port*4, high);
         }
-        REG_WR(bp, BRB1_REG_PAUSE_LOW_THRESHOLD_0 + port*4, low);
-        REG_WR(bp, BRB1_REG_PAUSE_HIGH_THRESHOLD_0 + port*4, high);
 
+        if (CHIP_MODE_IS_4_PORT(bp)) {
+                REG_WR(bp, BRB1_REG_PAUSE_0_XOFF_THRESHOLD_0 + port*8, 248);
+                REG_WR(bp, BRB1_REG_PAUSE_0_XON_THRESHOLD_0 + port*8, 328);
+                REG_WR(bp, (BP_PORT(bp) ? BRB1_REG_MAC_GUARANTIED_1 :
+                                          BRB1_REG_MAC_GUARANTIED_0), 40);
+        }
 
         bnx2x_init_block(bp, PRS_BLOCK, init_stage);
 
@@ -4248,24 +5325,28 @@ static int bnx2x_init_port(struct bnx2x *bp)
         bnx2x_init_block(bp, USEM_BLOCK, init_stage);
         bnx2x_init_block(bp, CSEM_BLOCK, init_stage);
         bnx2x_init_block(bp, XSEM_BLOCK, init_stage);
+        if (CHIP_MODE_IS_4_PORT(bp))
+                bnx2x_init_block(bp, XSEM_4PORT_BLOCK, init_stage);
 
         bnx2x_init_block(bp, UPB_BLOCK, init_stage);
         bnx2x_init_block(bp, XPB_BLOCK, init_stage);
 
         bnx2x_init_block(bp, PBF_BLOCK, init_stage);
 
-        /* configure PBF to work without PAUSE mtu 9000 */
-        REG_WR(bp, PBF_REG_P0_PAUSE_ENABLE + port*4, 0);
+        if (!CHIP_IS_E2(bp)) {
+                /* configure PBF to work without PAUSE mtu 9000 */
+                REG_WR(bp, PBF_REG_P0_PAUSE_ENABLE + port*4, 0);
 
-        /* update threshold */
-        REG_WR(bp, PBF_REG_P0_ARB_THRSH + port*4, (9040/16));
-        /* update init credit */
-        REG_WR(bp, PBF_REG_P0_INIT_CRD + port*4, (9040/16) + 553 - 22);
+                /* update threshold */
+                REG_WR(bp, PBF_REG_P0_ARB_THRSH + port*4, (9040/16));
+                /* update init credit */
+                REG_WR(bp, PBF_REG_P0_INIT_CRD + port*4, (9040/16) + 553 - 22);
 
-        /* probe changes */
-        REG_WR(bp, PBF_REG_INIT_P0 + port*4, 1);
-        msleep(5);
-        REG_WR(bp, PBF_REG_INIT_P0 + port*4, 0);
+                /* probe changes */
+                REG_WR(bp, PBF_REG_INIT_P0 + port*4, 1);
+                udelay(50);
+                REG_WR(bp, PBF_REG_INIT_P0 + port*4, 0);
+        }
 
 #ifdef BCM_CNIC
         bnx2x_init_block(bp, SRCH_BLOCK, init_stage);
@@ -4279,13 +5360,15 @@ static int bnx2x_init_port(struct bnx2x *bp)
         }
         bnx2x_init_block(bp, HC_BLOCK, init_stage);
 
+        bnx2x_init_block(bp, IGU_BLOCK, init_stage);
+
         bnx2x_init_block(bp, MISC_AEU_BLOCK, init_stage);
         /* init aeu_mask_attn_func_0/1:
          *  - SF mode: bits 3-7 are masked. only bits 0-2 are in use
          *  - MF mode: bit 3 is masked. bits 0-2 are in use as in SF
          *             bits 4-7 are used for "per vn group attention" */
         REG_WR(bp, MISC_REG_AEU_MASK_ATTN_FUNC_0 + port*4,
-               (IS_E1HMF(bp) ? 0xF7 : 0x7));
+               (IS_MF(bp) ? 0xF7 : 0x7));
 
         bnx2x_init_block(bp, PXPCS_BLOCK, init_stage);
         bnx2x_init_block(bp, EMAC0_BLOCK, init_stage);
@@ -4297,11 +5380,25 @@ static int bnx2x_init_port(struct bnx2x *bp)
 
         REG_WR(bp, NIG_REG_XGXS_SERDES0_MODE_SEL + port*4, 1);
 
-        if (CHIP_IS_E1H(bp)) {
-                /* 0x2 disable e1hov, 0x1 enable */
+        if (!CHIP_IS_E1(bp)) {
+                /* 0x2 disable mf_ov, 0x1 enable */
                 REG_WR(bp, NIG_REG_LLH0_BRB1_DRV_MASK_MF + port*4,
-                       (IS_E1HMF(bp) ? 0x1 : 0x2));
+                       (IS_MF(bp) ? 0x1 : 0x2));
 
+                if (CHIP_IS_E2(bp)) {
+                        val = 0;
+                        switch (bp->mf_mode) {
+                        case MULTI_FUNCTION_SD:
+                                val = 1;
+                                break;
+                        case MULTI_FUNCTION_SI:
+                                val = 2;
+                                break;
+                        }
+
+                        REG_WR(bp, (BP_PORT(bp) ? NIG_REG_LLH1_CLS_TYPE :
+                                                  NIG_REG_LLH0_CLS_TYPE), val);
+                }
                 {
                         REG_WR(bp, NIG_REG_LLFC_ENABLE_0 + port*4, 0);
                         REG_WR(bp, NIG_REG_LLFC_OUT_EN_0 + port*4, 0);
@@ -4327,140 +5424,323 @@ static int bnx2x_init_port(struct bnx2x *bp)
         return 0;
 }
 
-#define ILT_PER_FUNC            (768/2)
-#define FUNC_ILT_BASE(func)     (func * ILT_PER_FUNC)
-/* the phys address is shifted right 12 bits and has an added
-   1=valid bit added to the 53rd bit
-   then since this is a wide register(TM)
-   we split it into two 32 bit writes
- */
-#define ONCHIP_ADDR1(x)         ((u32)(((u64)x >> 12) & 0xFFFFFFFF))
-#define ONCHIP_ADDR2(x)         ((u32)((1 << 20) | ((u64)x >> 44)))
-#define PXP_ONE_ILT(x)          (((x) << 10) | x)
-#define PXP_ILT_RANGE(f, l)     (((l) << 10) | f)
-
-#ifdef BCM_CNIC
-#define CNIC_ILT_LINES          127
-#define CNIC_CTX_PER_ILT        16
-#else
-#define CNIC_ILT_LINES          0
-#endif
-
 static void bnx2x_ilt_wr(struct bnx2x *bp, u32 index, dma_addr_t addr)
 {
         int reg;
 
-        if (CHIP_IS_E1H(bp))
-                reg = PXP2_REG_RQ_ONCHIP_AT_B0 + index*8;
-        else /* E1 */
+        if (CHIP_IS_E1(bp))
                 reg = PXP2_REG_RQ_ONCHIP_AT + index*8;
+        else
+                reg = PXP2_REG_RQ_ONCHIP_AT_B0 + index*8;
 
         bnx2x_wb_wr(bp, reg, ONCHIP_ADDR1(addr), ONCHIP_ADDR2(addr));
 }
 
-static int bnx2x_init_func(struct bnx2x *bp)
+static inline void bnx2x_igu_clear_sb(struct bnx2x *bp, u8 idu_sb_id)
+{
+        bnx2x_igu_clear_sb_gen(bp, idu_sb_id, true /*PF*/);
+}
+
+static inline void bnx2x_clear_func_ilt(struct bnx2x *bp, u32 func)
+{
+        u32 i, base = FUNC_ILT_BASE(func);
+        for (i = base; i < base + ILT_PER_FUNC; i++)
+                bnx2x_ilt_wr(bp, i, 0);
+}
+
+static int bnx2x_init_hw_func(struct bnx2x *bp)
 {
         int port = BP_PORT(bp);
         int func = BP_FUNC(bp);
+        struct bnx2x_ilt *ilt = BP_ILT(bp);
+        u16 cdu_ilt_start;
         u32 addr, val;
-        int i;
+        u32 main_mem_base, main_mem_size, main_mem_prty_clr;
+        int i, main_mem_width;
 
         DP(BNX2X_MSG_MCP, "starting func init  func %d\n", func);
 
         /* set MSI reconfigure capability */
-        addr = (port ? HC_REG_CONFIG_1 : HC_REG_CONFIG_0);
-        val = REG_RD(bp, addr);
-        val |= HC_CONFIG_0_REG_MSI_ATTN_EN_0;
-        REG_WR(bp, addr, val);
+        if (bp->common.int_block == INT_BLOCK_HC) {
+                addr = (port ? HC_REG_CONFIG_1 : HC_REG_CONFIG_0);
+                val = REG_RD(bp, addr);
+                val |= HC_CONFIG_0_REG_MSI_ATTN_EN_0;
+                REG_WR(bp, addr, val);
+        }
 
-        i = FUNC_ILT_BASE(func);
+        ilt = BP_ILT(bp);
+        cdu_ilt_start = ilt->clients[ILT_CLIENT_CDU].start;
 
-        bnx2x_ilt_wr(bp, i, bnx2x_sp_mapping(bp, context));
-        if (CHIP_IS_E1H(bp)) {
-                REG_WR(bp, PXP2_REG_RQ_CDU_FIRST_ILT, i);
-                REG_WR(bp, PXP2_REG_RQ_CDU_LAST_ILT, i + CNIC_ILT_LINES);
-        } else /* E1 */
-                REG_WR(bp, PXP2_REG_PSWRQ_CDU0_L2P + func*4,
-                       PXP_ILT_RANGE(i, i + CNIC_ILT_LINES));
+        for (i = 0; i < L2_ILT_LINES(bp); i++) {
+                ilt->lines[cdu_ilt_start + i].page =
+                        bp->context.vcxt + (ILT_PAGE_CIDS * i);
+                ilt->lines[cdu_ilt_start + i].page_mapping =
+                        bp->context.cxt_mapping + (CDU_ILT_PAGE_SZ * i);
+                /* cdu ilt pages are allocated manually so there's no need to
+                set the size */
+        }
+        bnx2x_ilt_init_op(bp, INITOP_SET);
 
 #ifdef BCM_CNIC
-        i += 1 + CNIC_ILT_LINES;
-        bnx2x_ilt_wr(bp, i, bp->timers_mapping);
-        if (CHIP_IS_E1(bp))
-                REG_WR(bp, PXP2_REG_PSWRQ_TM0_L2P + func*4, PXP_ONE_ILT(i));
-        else {
-                REG_WR(bp, PXP2_REG_RQ_TM_FIRST_ILT, i);
-                REG_WR(bp, PXP2_REG_RQ_TM_LAST_ILT, i);
-        }
+        bnx2x_src_init_t2(bp, bp->t2, bp->t2_mapping, SRC_CONN_NUM);
 
-        i++;
-        bnx2x_ilt_wr(bp, i, bp->qm_mapping);
-        if (CHIP_IS_E1(bp))
-                REG_WR(bp, PXP2_REG_PSWRQ_QM0_L2P + func*4, PXP_ONE_ILT(i));
-        else {
-                REG_WR(bp, PXP2_REG_RQ_QM_FIRST_ILT, i);
-                REG_WR(bp, PXP2_REG_RQ_QM_LAST_ILT, i);
+        /* T1 hash bits value determines the T1 number of entries */
+        REG_WR(bp, SRC_REG_NUMBER_HASH_BITS0 + port*4, SRC_HASH_BITS);
+#endif
+
+#ifndef BCM_CNIC
+        /* set NIC mode */
+        REG_WR(bp, PRS_REG_NIC_MODE, 1);
+#endif  /* BCM_CNIC */
+
+        if (CHIP_IS_E2(bp)) {
+                u32 pf_conf = IGU_PF_CONF_FUNC_EN;
+
+                /* Turn on a single ISR mode in IGU if driver is going to use
+                 * INT#x or MSI
+                 */
+                if (!(bp->flags & USING_MSIX_FLAG))
+                        pf_conf |= IGU_PF_CONF_SINGLE_ISR_EN;
+                /*
+                 * Timers workaround bug: function init part.
+                 * Need to wait 20msec after initializing ILT,
+                 * needed to make sure there are no requests in
+                 * one of the PXP internal queues with "old" ILT addresses
+                 */
+                msleep(20);
+                /*
+                 * Master enable - Due to WB DMAE writes performed before this
+                 * register is re-initialized as part of the regular function
+                 * init
+                 */
+                REG_WR(bp, PGLUE_B_REG_INTERNAL_PFID_ENABLE_MASTER, 1);
+                /* Enable the function in IGU */
+                REG_WR(bp, IGU_REG_PF_CONFIGURATION, pf_conf);
         }
 
-        i++;
-        bnx2x_ilt_wr(bp, i, bp->t1_mapping);
-        if (CHIP_IS_E1(bp))
-                REG_WR(bp, PXP2_REG_PSWRQ_SRC0_L2P + func*4, PXP_ONE_ILT(i));
-        else {
-                REG_WR(bp, PXP2_REG_RQ_SRC_FIRST_ILT, i);
-                REG_WR(bp, PXP2_REG_RQ_SRC_LAST_ILT, i);
+        bp->dmae_ready = 1;
+
+        bnx2x_init_block(bp, PGLUE_B_BLOCK, FUNC0_STAGE + func);
+
+        if (CHIP_IS_E2(bp))
+                REG_WR(bp, PGLUE_B_REG_WAS_ERROR_PF_7_0_CLR, func);
+
+        bnx2x_init_block(bp, MISC_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, TCM_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, UCM_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, CCM_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, XCM_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, TSEM_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, USEM_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, CSEM_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, XSEM_BLOCK, FUNC0_STAGE + func);
+
+        if (CHIP_IS_E2(bp)) {
+                REG_WR(bp, BAR_XSTRORM_INTMEM + XSTORM_PATH_ID_OFFSET,
+                                                                BP_PATH(bp));
+                REG_WR(bp, BAR_CSTRORM_INTMEM + CSTORM_PATH_ID_OFFSET,
+                                                                BP_PATH(bp));
         }
 
-        /* tell the searcher where the T2 table is */
-        REG_WR(bp, SRC_REG_COUNTFREE0 + port*4, 16*1024/64);
+        if (CHIP_MODE_IS_4_PORT(bp))
+                bnx2x_init_block(bp, XSEM_4PORT_BLOCK, FUNC0_STAGE + func);
 
-        bnx2x_wb_wr(bp, SRC_REG_FIRSTFREE0 + port*16,
-                    U64_LO(bp->t2_mapping), U64_HI(bp->t2_mapping));
+        if (CHIP_IS_E2(bp))
+                REG_WR(bp, QM_REG_PF_EN, 1);
 
-        bnx2x_wb_wr(bp, SRC_REG_LASTFREE0 + port*16,
-                    U64_LO((u64)bp->t2_mapping + 16*1024 - 64),
-                    U64_HI((u64)bp->t2_mapping + 16*1024 - 64));
+        bnx2x_init_block(bp, QM_BLOCK, FUNC0_STAGE + func);
 
-        REG_WR(bp, SRC_REG_NUMBER_HASH_BITS0 + port*4, 10);
-#endif
+        if (CHIP_MODE_IS_4_PORT(bp))
+                bnx2x_init_block(bp, QM_4PORT_BLOCK, FUNC0_STAGE + func);
+
+        bnx2x_init_block(bp, TIMERS_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, DQ_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, BRB1_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, PRS_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, TSDM_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, CSDM_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, USDM_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, XSDM_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, UPB_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, XPB_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, PBF_BLOCK, FUNC0_STAGE + func);
+        if (CHIP_IS_E2(bp))
+                REG_WR(bp, PBF_REG_DISABLE_PF, 0);
 
-        if (CHIP_IS_E1H(bp)) {
-                bnx2x_init_block(bp, MISC_BLOCK, FUNC0_STAGE + func);
-                bnx2x_init_block(bp, TCM_BLOCK, FUNC0_STAGE + func);
-                bnx2x_init_block(bp, UCM_BLOCK, FUNC0_STAGE + func);
-                bnx2x_init_block(bp, CCM_BLOCK, FUNC0_STAGE + func);
-                bnx2x_init_block(bp, XCM_BLOCK, FUNC0_STAGE + func);
-                bnx2x_init_block(bp, TSEM_BLOCK, FUNC0_STAGE + func);
-                bnx2x_init_block(bp, USEM_BLOCK, FUNC0_STAGE + func);
-                bnx2x_init_block(bp, CSEM_BLOCK, FUNC0_STAGE + func);
-                bnx2x_init_block(bp, XSEM_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, CDU_BLOCK, FUNC0_STAGE + func);
 
+        bnx2x_init_block(bp, CFC_BLOCK, FUNC0_STAGE + func);
+
+        if (CHIP_IS_E2(bp))
+                REG_WR(bp, CFC_REG_WEAK_ENABLE_PF, 1);
+
+        if (IS_MF(bp)) {
                 REG_WR(bp, NIG_REG_LLH0_FUNC_EN + port*8, 1);
-                REG_WR(bp, NIG_REG_LLH0_FUNC_VLAN_ID + port*8, bp->e1hov);
+                REG_WR(bp, NIG_REG_LLH0_FUNC_VLAN_ID + port*8, bp->mf_ov);
         }
 
+        bnx2x_init_block(bp, MISC_AEU_BLOCK, FUNC0_STAGE + func);
+
         /* HC init per function */
-        if (CHIP_IS_E1H(bp)) {
+        if (bp->common.int_block == INT_BLOCK_HC) {
+                if (CHIP_IS_E1H(bp)) {
+                        REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_12 + func*4, 0);
+
+                        REG_WR(bp, HC_REG_LEADING_EDGE_0 + port*8, 0);
+                        REG_WR(bp, HC_REG_TRAILING_EDGE_0 + port*8, 0);
+                }
+                bnx2x_init_block(bp, HC_BLOCK, FUNC0_STAGE + func);
+
+        } else {
+                int num_segs, sb_idx, prod_offset;
+
                 REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_12 + func*4, 0);
 
-                REG_WR(bp, HC_REG_LEADING_EDGE_0 + port*8, 0);
-                REG_WR(bp, HC_REG_TRAILING_EDGE_0 + port*8, 0);
+                if (CHIP_IS_E2(bp)) {
+                        REG_WR(bp, IGU_REG_LEADING_EDGE_LATCH, 0);
+                        REG_WR(bp, IGU_REG_TRAILING_EDGE_LATCH, 0);
+                }
+
+                bnx2x_init_block(bp, IGU_BLOCK, FUNC0_STAGE + func);
+
+                if (CHIP_IS_E2(bp)) {
+                        int dsb_idx = 0;
+                        /**
+                         * Producer memory:
+                         * E2 mode: address 0-135 match to the mapping memory;
+                         * 136 - PF0 default prod; 137 - PF1 default prod;
+                         * 138 - PF2 default prod; 139 - PF3 default prod;
+                         * 140 - PF0 attn prod;    141 - PF1 attn prod;
+                         * 142 - PF2 attn prod;    143 - PF3 attn prod;
+                         * 144-147 reserved.
+                         *
+                         * E1.5 mode - In backward compatible mode;
+                         * for non default SB; each even line in the memory
+                         * holds the U producer and each odd line hold
+                         * the C producer. The first 128 producers are for
+                         * NDSB (PF0 - 0-31; PF1 - 32-63 and so on). The last 20
+                         * producers are for the DSB for each PF.
+                         * Each PF has five segments: (the order inside each
+                         * segment is PF0; PF1; PF2; PF3) - 128-131 U prods;
+                         * 132-135 C prods; 136-139 X prods; 140-143 T prods;
+                         * 144-147 attn prods;
+                         */
+                        /* non-default-status-blocks */
+                        num_segs = CHIP_INT_MODE_IS_BC(bp) ?
+                                IGU_BC_NDSB_NUM_SEGS : IGU_NORM_NDSB_NUM_SEGS;
+                        for (sb_idx = 0; sb_idx < bp->igu_sb_cnt; sb_idx++) {
+                                prod_offset = (bp->igu_base_sb + sb_idx) *
+                                        num_segs;
+
+                                for (i = 0; i < num_segs; i++) {
+                                        addr = IGU_REG_PROD_CONS_MEMORY +
+                                                        (prod_offset + i) * 4;
+                                        REG_WR(bp, addr, 0);
+                                }
+                                /* send consumer update with value 0 */
+                                bnx2x_ack_sb(bp, bp->igu_base_sb + sb_idx,
+                                             USTORM_ID, 0, IGU_INT_NOP, 1);
+                                bnx2x_igu_clear_sb(bp,
+                                                   bp->igu_base_sb + sb_idx);
+                        }
+
+                        /* default-status-blocks */
+                        num_segs = CHIP_INT_MODE_IS_BC(bp) ?
+                                IGU_BC_DSB_NUM_SEGS : IGU_NORM_DSB_NUM_SEGS;
+
+                        if (CHIP_MODE_IS_4_PORT(bp))
+                                dsb_idx = BP_FUNC(bp);
+                        else
+                                dsb_idx = BP_E1HVN(bp);
+
+                        prod_offset = (CHIP_INT_MODE_IS_BC(bp) ?
+                                       IGU_BC_BASE_DSB_PROD + dsb_idx :
+                                       IGU_NORM_BASE_DSB_PROD + dsb_idx);
+
+                        for (i = 0; i < (num_segs * E1HVN_MAX);
+                             i += E1HVN_MAX) {
+                                addr = IGU_REG_PROD_CONS_MEMORY +
+                                                        (prod_offset + i)*4;
+                                REG_WR(bp, addr, 0);
+                        }
+                        /* send consumer update with 0 */
+                        if (CHIP_INT_MODE_IS_BC(bp)) {
+                                bnx2x_ack_sb(bp, bp->igu_dsb_id,
+                                             USTORM_ID, 0, IGU_INT_NOP, 1);
+                                bnx2x_ack_sb(bp, bp->igu_dsb_id,
+                                             CSTORM_ID, 0, IGU_INT_NOP, 1);
+                                bnx2x_ack_sb(bp, bp->igu_dsb_id,
+                                             XSTORM_ID, 0, IGU_INT_NOP, 1);
+                                bnx2x_ack_sb(bp, bp->igu_dsb_id,
+                                             TSTORM_ID, 0, IGU_INT_NOP, 1);
+                                bnx2x_ack_sb(bp, bp->igu_dsb_id,
+                                             ATTENTION_ID, 0, IGU_INT_NOP, 1);
+                        } else {
+                                bnx2x_ack_sb(bp, bp->igu_dsb_id,
+                                             USTORM_ID, 0, IGU_INT_NOP, 1);
+                                bnx2x_ack_sb(bp, bp->igu_dsb_id,
+                                             ATTENTION_ID, 0, IGU_INT_NOP, 1);
+                        }
+                        bnx2x_igu_clear_sb(bp, bp->igu_dsb_id);
+
+                        /* !!! these should become driver const once
+                           rf-tool supports split-68 const */
+                        REG_WR(bp, IGU_REG_SB_INT_BEFORE_MASK_LSB, 0);
+                        REG_WR(bp, IGU_REG_SB_INT_BEFORE_MASK_MSB, 0);
+                        REG_WR(bp, IGU_REG_SB_MASK_LSB, 0);
+                        REG_WR(bp, IGU_REG_SB_MASK_MSB, 0);
+                        REG_WR(bp, IGU_REG_PBA_STATUS_LSB, 0);
+                        REG_WR(bp, IGU_REG_PBA_STATUS_MSB, 0);
+                }
         }
-        bnx2x_init_block(bp, HC_BLOCK, FUNC0_STAGE + func);
 
         /* Reset PCIE errors for debug */
         REG_WR(bp, 0x2114, 0xffffffff);
         REG_WR(bp, 0x2120, 0xffffffff);
+
+        bnx2x_init_block(bp, EMAC0_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, EMAC1_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, DBU_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, DBG_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, MCP_BLOCK, FUNC0_STAGE + func);
+        bnx2x_init_block(bp, DMAE_BLOCK, FUNC0_STAGE + func);
+
+        if (CHIP_IS_E1x(bp)) {
+                main_mem_size = HC_REG_MAIN_MEMORY_SIZE / 2; /*dwords*/
+                main_mem_base = HC_REG_MAIN_MEMORY +
+                                BP_PORT(bp) * (main_mem_size * 4);
+                main_mem_prty_clr = HC_REG_HC_PRTY_STS_CLR;
+                main_mem_width = 8;
+
+                val = REG_RD(bp, main_mem_prty_clr);
+                if (val)
+                        DP(BNX2X_MSG_MCP, "Hmmm... Parity errors in HC "
+                                          "block during "
+                                          "function init (0x%x)!\n", val);
+
+                /* Clear "false" parity errors in MSI-X table */
+                for (i = main_mem_base;
+                     i < main_mem_base + main_mem_size * 4;
+                     i += main_mem_width) {
+                        bnx2x_read_dmae(bp, i, main_mem_width / 4);
+                        bnx2x_write_dmae(bp, bnx2x_sp_mapping(bp, wb_data),
+                                         i, main_mem_width / 4);
+                }
+                /* Clear HC parity attention */
+                REG_RD(bp, main_mem_prty_clr);
+        }
+
         bnx2x_phy_probe(&bp->link_params);
+
         return 0;
 }
 
 int bnx2x_init_hw(struct bnx2x *bp, u32 load_code)
 {
-        int i, rc = 0;
+        int rc = 0;
 
         DP(BNX2X_MSG_MCP, "function %d  load_code %x\n",
-           BP_FUNC(bp), load_code);
+           BP_ABS_FUNC(bp), load_code);
 
         bp->dmae_ready = 0;
         mutex_init(&bp->dmae_mutex);
@@ -4470,21 +5750,20 @@ int bnx2x_init_hw(struct bnx2x *bp, u32 load_code)
 
         switch (load_code) {
         case FW_MSG_CODE_DRV_LOAD_COMMON:
-                rc = bnx2x_init_common(bp);
+        case FW_MSG_CODE_DRV_LOAD_COMMON_CHIP:
+                rc = bnx2x_init_hw_common(bp, load_code);
                 if (rc)
                         goto init_hw_err;
                 /* no break */
 
         case FW_MSG_CODE_DRV_LOAD_PORT:
-                bp->dmae_ready = 1;
-                rc = bnx2x_init_port(bp);
+                rc = bnx2x_init_hw_port(bp);
                 if (rc)
                         goto init_hw_err;
                 /* no break */
 
         case FW_MSG_CODE_DRV_LOAD_FUNCTION:
-                bp->dmae_ready = 1;
-                rc = bnx2x_init_func(bp);
+                rc = bnx2x_init_hw_func(bp);
                 if (rc)
                         goto init_hw_err;
                 break;
@@ -4495,22 +5774,14 @@ int bnx2x_init_hw(struct bnx2x *bp, u32 load_code)
         }
 
         if (!BP_NOMCP(bp)) {
-                int func = BP_FUNC(bp);
+                int mb_idx = BP_FW_MB_IDX(bp);
 
                 bp->fw_drv_pulse_wr_seq =
-                                (SHMEM_RD(bp, func_mb[func].drv_pulse_mb) &
+                                (SHMEM_RD(bp, func_mb[mb_idx].drv_pulse_mb) &
                                  DRV_PULSE_SEQ_MASK);
                 DP(BNX2X_MSG_MCP, "drv_pulse 0x%x\n", bp->fw_drv_pulse_wr_seq);
         }
 
-        /* this needs to be done before gunzip end */
-        bnx2x_zero_def_sb(bp);
-        for_each_queue(bp, i)
-                bnx2x_zero_sb(bp, BP_L_ID(bp) + i);
-#ifdef BCM_CNIC
-        bnx2x_zero_sb(bp, BP_L_ID(bp) + i);
-#endif
-
 init_hw_err:
         bnx2x_gunzip_end(bp);
 
@@ -4523,7 +5794,7 @@ void bnx2x_free_mem(struct bnx2x *bp)
 #define BNX2X_PCI_FREE(x, y, size) \
         do { \
                 if (x) { \
-                        dma_free_coherent(&bp->pdev->dev, size, x, y); \
+                        dma_free_coherent(&bp->pdev->dev, size, (void *)x, y); \
                         x = NULL; \
                         y = 0; \
                 } \
@@ -4532,7 +5803,7 @@ void bnx2x_free_mem(struct bnx2x *bp)
 #define BNX2X_FREE(x) \
         do { \
                 if (x) { \
-                        vfree(x); \
+                        kfree((void *)x); \
                         x = NULL; \
                 } \
         } while (0)
@@ -4542,11 +5813,15 @@ void bnx2x_free_mem(struct bnx2x *bp)
         /* fastpath */
         /* Common */
         for_each_queue(bp, i) {
-
                 /* status blocks */
-                BNX2X_PCI_FREE(bnx2x_fp(bp, i, status_blk),
-                               bnx2x_fp(bp, i, status_blk_mapping),
-                               sizeof(struct host_status_block));
+                if (CHIP_IS_E2(bp))
+                        BNX2X_PCI_FREE(bnx2x_fp(bp, i, status_blk.e2_sb),
+                                       bnx2x_fp(bp, i, status_blk_mapping),
+                                       sizeof(struct host_hc_status_block_e2));
+                else
+                        BNX2X_PCI_FREE(bnx2x_fp(bp, i, status_blk.e1x_sb),
+                                       bnx2x_fp(bp, i, status_blk_mapping),
+                                       sizeof(struct host_hc_status_block_e1x));
         }
         /* Rx */
         for_each_queue(bp, i) {
@@ -4580,28 +5855,56 @@ void bnx2x_free_mem(struct bnx2x *bp)
         /* end of fastpath */
 
         BNX2X_PCI_FREE(bp->def_status_blk, bp->def_status_blk_mapping,
-                       sizeof(struct host_def_status_block));
+                       sizeof(struct host_sp_status_block));
 
         BNX2X_PCI_FREE(bp->slowpath, bp->slowpath_mapping,
                        sizeof(struct bnx2x_slowpath));
 
+        BNX2X_PCI_FREE(bp->context.vcxt, bp->context.cxt_mapping,
+                       bp->context.size);
+
+        bnx2x_ilt_mem_op(bp, ILT_MEMOP_FREE);
+
+        BNX2X_FREE(bp->ilt->lines);
+
 #ifdef BCM_CNIC
-        BNX2X_PCI_FREE(bp->t1, bp->t1_mapping, 64*1024);
-        BNX2X_PCI_FREE(bp->t2, bp->t2_mapping, 16*1024);
-        BNX2X_PCI_FREE(bp->timers, bp->timers_mapping, 8*1024);
-        BNX2X_PCI_FREE(bp->qm, bp->qm_mapping, 128*1024);
-        BNX2X_PCI_FREE(bp->cnic_sb, bp->cnic_sb_mapping,
-                       sizeof(struct host_status_block));
+        if (CHIP_IS_E2(bp))
+                BNX2X_PCI_FREE(bp->cnic_sb.e2_sb, bp->cnic_sb_mapping,
+                               sizeof(struct host_hc_status_block_e2));
+        else
+                BNX2X_PCI_FREE(bp->cnic_sb.e1x_sb, bp->cnic_sb_mapping,
+                               sizeof(struct host_hc_status_block_e1x));
+
+        BNX2X_PCI_FREE(bp->t2, bp->t2_mapping, SRC_T2_SZ);
 #endif
+
         BNX2X_PCI_FREE(bp->spq, bp->spq_mapping, BCM_PAGE_SIZE);
 
+        BNX2X_PCI_FREE(bp->eq_ring, bp->eq_mapping,
+                       BCM_PAGE_SIZE * NUM_EQ_PAGES);
+
 #undef BNX2X_PCI_FREE
 #undef BNX2X_KFREE
 }
 
-int bnx2x_alloc_mem(struct bnx2x *bp)
+static inline void set_sb_shortcuts(struct bnx2x *bp, int index)
 {
+        union host_hc_status_block status_blk = bnx2x_fp(bp, index, status_blk);
+        if (CHIP_IS_E2(bp)) {
+                bnx2x_fp(bp, index, sb_index_values) =
+                        (__le16 *)status_blk.e2_sb->sb.index_values;
+                bnx2x_fp(bp, index, sb_running_index) =
+                        (__le16 *)status_blk.e2_sb->sb.running_index;
+        } else {
+                bnx2x_fp(bp, index, sb_index_values) =
+                        (__le16 *)status_blk.e1x_sb->sb.index_values;
+                bnx2x_fp(bp, index, sb_running_index) =
+                        (__le16 *)status_blk.e1x_sb->sb.running_index;
+        }
+}
 
+int bnx2x_alloc_mem(struct bnx2x *bp)
+{
 #define BNX2X_PCI_ALLOC(x, y, size) \
         do { \
                 x = dma_alloc_coherent(&bp->pdev->dev, size, y, GFP_KERNEL); \
@@ -4612,10 +5915,9 @@ int bnx2x_alloc_mem(struct bnx2x *bp)
 
 #define BNX2X_ALLOC(x, size) \
         do { \
-                x = vmalloc(size); \
+                x = kzalloc(size, GFP_KERNEL); \
                 if (x == NULL) \
                         goto alloc_mem_err; \
-                memset(x, 0, size); \
         } while (0)
 
         int i;
@@ -4623,12 +5925,19 @@ int bnx2x_alloc_mem(struct bnx2x *bp)
         /* fastpath */
         /* Common */
         for_each_queue(bp, i) {
+                union host_hc_status_block *sb = &bnx2x_fp(bp, i, status_blk);
                 bnx2x_fp(bp, i, bp) = bp;
-
                 /* status blocks */
-                BNX2X_PCI_ALLOC(bnx2x_fp(bp, i, status_blk),
+                if (CHIP_IS_E2(bp))
+                        BNX2X_PCI_ALLOC(sb->e2_sb,
+                                &bnx2x_fp(bp, i, status_blk_mapping),
+                                sizeof(struct host_hc_status_block_e2));
+                else
+                        BNX2X_PCI_ALLOC(sb->e1x_sb,
                                 &bnx2x_fp(bp, i, status_blk_mapping),
-                                sizeof(struct host_status_block));
+                                sizeof(struct host_hc_status_block_e1x));
+
+                set_sb_shortcuts(bp, i);
         }
         /* Rx */
         for_each_queue(bp, i) {
@@ -4664,37 +5973,41 @@ int bnx2x_alloc_mem(struct bnx2x *bp)
         }
         /* end of fastpath */
 
+#ifdef BCM_CNIC
+        if (CHIP_IS_E2(bp))
+                BNX2X_PCI_ALLOC(bp->cnic_sb.e2_sb, &bp->cnic_sb_mapping,
+                                sizeof(struct host_hc_status_block_e2));
+        else
+                BNX2X_PCI_ALLOC(bp->cnic_sb.e1x_sb, &bp->cnic_sb_mapping,
+                                sizeof(struct host_hc_status_block_e1x));
+
+        /* allocate searcher T2 table */
+        BNX2X_PCI_ALLOC(bp->t2, &bp->t2_mapping, SRC_T2_SZ);
+#endif
+
+
         BNX2X_PCI_ALLOC(bp->def_status_blk, &bp->def_status_blk_mapping,
-                        sizeof(struct host_def_status_block));
+                        sizeof(struct host_sp_status_block));
 
         BNX2X_PCI_ALLOC(bp->slowpath, &bp->slowpath_mapping,
                         sizeof(struct bnx2x_slowpath));
 
-#ifdef BCM_CNIC
-        BNX2X_PCI_ALLOC(bp->t1, &bp->t1_mapping, 64*1024);
-
-        /* allocate searcher T2 table
-           we allocate 1/4 of alloc num for T2
-          (which is not entered into the ILT) */
-        BNX2X_PCI_ALLOC(bp->t2, &bp->t2_mapping, 16*1024);
-
-        /* Initialize T2 (for 1024 connections) */
-        for (i = 0; i < 16*1024; i += 64)
-                *(u64 *)((char *)bp->t2 + i + 56) = bp->t2_mapping + i + 64;
+        bp->context.size = sizeof(union cdu_context) * bp->l2_cid_count;
 
-        /* Timer block array (8*MAX_CONN) phys uncached for now 1024 conns */
-        BNX2X_PCI_ALLOC(bp->timers, &bp->timers_mapping, 8*1024);
+        BNX2X_PCI_ALLOC(bp->context.vcxt, &bp->context.cxt_mapping,
+                        bp->context.size);
 
-        /* QM queues (128*MAX_CONN) */
-        BNX2X_PCI_ALLOC(bp->qm, &bp->qm_mapping, 128*1024);
+        BNX2X_ALLOC(bp->ilt->lines, sizeof(struct ilt_line) * ILT_MAX_LINES);
 
-        BNX2X_PCI_ALLOC(bp->cnic_sb, &bp->cnic_sb_mapping,
-                        sizeof(struct host_status_block));
-#endif
+        if (bnx2x_ilt_mem_op(bp, ILT_MEMOP_ALLOC))
+                goto alloc_mem_err;
 
         /* Slow path ring */
         BNX2X_PCI_ALLOC(bp->spq, &bp->spq_mapping, BCM_PAGE_SIZE);
 
+        /* EQ */
+        BNX2X_PCI_ALLOC(bp->eq_ring, &bp->eq_mapping,
+                        BCM_PAGE_SIZE * NUM_EQ_PAGES);
         return 0;
 
 alloc_mem_err:
@@ -4705,97 +6018,47 @@ alloc_mem_err:
 #undef BNX2X_ALLOC
 }
 
-
 /*
  * Init service functions
  */
-
-/**
- * Sets a MAC in a CAM for a few L2 Clients for E1 chip
- *
- * @param bp driver descriptor
- * @param set set or clear an entry (1 or 0)
- * @param mac pointer to a buffer containing a MAC
- * @param cl_bit_vec bit vector of clients to register a MAC for
- * @param cam_offset offset in a CAM to use
- * @param with_bcast set broadcast MAC as well
- */
-static void bnx2x_set_mac_addr_e1_gen(struct bnx2x *bp, int set, u8 *mac,
-                                      u32 cl_bit_vec, u8 cam_offset,
-                                      u8 with_bcast)
+int bnx2x_func_start(struct bnx2x *bp)
 {
-        struct mac_configuration_cmd *config = bnx2x_sp(bp, mac_config);
-        int port = BP_PORT(bp);
+        bnx2x_sp_post(bp, RAMROD_CMD_ID_COMMON_FUNCTION_START, 0, 0, 0, 1);
 
-        /* CAM allocation
-         * unicasts 0-31:port0 32-63:port1
-         * multicast 64-127:port0 128-191:port1
-         */
-        config->hdr.length = 1 + (with_bcast ? 1 : 0);
-        config->hdr.offset = cam_offset;
-        config->hdr.client_id = 0xff;
-        config->hdr.reserved1 = 0;
-
-        /* primary MAC */
-        config->config_table[0].cam_entry.msb_mac_addr =
-                                        swab16(*(u16 *)&mac[0]);
-        config->config_table[0].cam_entry.middle_mac_addr =
-                                        swab16(*(u16 *)&mac[2]);
-        config->config_table[0].cam_entry.lsb_mac_addr =
-                                        swab16(*(u16 *)&mac[4]);
-        config->config_table[0].cam_entry.flags = cpu_to_le16(port);
-        if (set)
-                config->config_table[0].target_table_entry.flags = 0;
-        else
-                CAM_INVALIDATE(config->config_table[0]);
-        config->config_table[0].target_table_entry.clients_bit_vector =
-                                                cpu_to_le32(cl_bit_vec);
-        config->config_table[0].target_table_entry.vlan_id = 0;
+        /* Wait for completion */
+        return bnx2x_wait_ramrod(bp, BNX2X_STATE_FUNC_STARTED, 0, &(bp->state),
+                                 WAIT_RAMROD_COMMON);
+}
 
-        DP(NETIF_MSG_IFUP, "%s MAC (%04x:%04x:%04x)\n",
-           (set ? "setting" : "clearing"),
-           config->config_table[0].cam_entry.msb_mac_addr,
-           config->config_table[0].cam_entry.middle_mac_addr,
-           config->config_table[0].cam_entry.lsb_mac_addr);
-
-        /* broadcast */
-        if (with_bcast) {
-                config->config_table[1].cam_entry.msb_mac_addr =
-                        cpu_to_le16(0xffff);
-                config->config_table[1].cam_entry.middle_mac_addr =
-                        cpu_to_le16(0xffff);
-                config->config_table[1].cam_entry.lsb_mac_addr =
-                        cpu_to_le16(0xffff);
-                config->config_table[1].cam_entry.flags = cpu_to_le16(port);
-                if (set)
-                        config->config_table[1].target_table_entry.flags =
-                                        TSTORM_CAM_TARGET_TABLE_ENTRY_BROADCAST;
-                else
-                        CAM_INVALIDATE(config->config_table[1]);
-                config->config_table[1].target_table_entry.clients_bit_vector =
-                                                        cpu_to_le32(cl_bit_vec);
-                config->config_table[1].target_table_entry.vlan_id = 0;
-        }
+int bnx2x_func_stop(struct bnx2x *bp)
+{
+        bnx2x_sp_post(bp, RAMROD_CMD_ID_COMMON_FUNCTION_STOP, 0, 0, 0, 1);
 
-        bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_SET_MAC, 0,
-                      U64_HI(bnx2x_sp_mapping(bp, mac_config)),
-                      U64_LO(bnx2x_sp_mapping(bp, mac_config)), 0);
+        /* Wait for completion */
+        return bnx2x_wait_ramrod(bp, BNX2X_STATE_CLOSING_WAIT4_UNLOAD,
+                                      0, &(bp->state), WAIT_RAMROD_COMMON);
 }
 
 /**
- * Sets a MAC in a CAM for a few L2 Clients for E1H chip
+ * Sets a MAC in a CAM for a few L2 Clients for E1x chips
  *
  * @param bp driver descriptor
  * @param set set or clear an entry (1 or 0)
  * @param mac pointer to a buffer containing a MAC
  * @param cl_bit_vec bit vector of clients to register a MAC for
  * @param cam_offset offset in a CAM to use
+ * @param is_bcast is the set MAC a broadcast address (for E1 only)
  */
-static void bnx2x_set_mac_addr_e1h_gen(struct bnx2x *bp, int set, u8 *mac,
-                                       u32 cl_bit_vec, u8 cam_offset)
+static void bnx2x_set_mac_addr_gen(struct bnx2x *bp, int set, u8 *mac,
+                                   u32 cl_bit_vec, u8 cam_offset,
+                                   u8 is_bcast)
 {
-        struct mac_configuration_cmd_e1h *config =
-                (struct mac_configuration_cmd_e1h *)bnx2x_sp(bp, mac_config);
+        struct mac_configuration_cmd *config =
+                (struct mac_configuration_cmd *)bnx2x_sp(bp, mac_config);
+        int ramrod_flags = WAIT_RAMROD_COMMON;
+
+        bp->set_mac_pending = 1;
+        smp_wmb();
 
         config->hdr.length = 1;
         config->hdr.offset = cam_offset;
@@ -4812,29 +6075,41 @@ static void bnx2x_set_mac_addr_e1h_gen(struct bnx2x *bp, int set, u8 *mac,
         config->config_table[0].clients_bit_vector =
                                         cpu_to_le32(cl_bit_vec);
         config->config_table[0].vlan_id = 0;
-        config->config_table[0].e1hov_id = cpu_to_le16(bp->e1hov);
+        config->config_table[0].pf_id = BP_FUNC(bp);
         if (set)
-                config->config_table[0].flags = BP_PORT(bp);
+                SET_FLAG(config->config_table[0].flags,
+                        MAC_CONFIGURATION_ENTRY_ACTION_TYPE,
+                        T_ETH_MAC_COMMAND_SET);
         else
-                config->config_table[0].flags =
-                                MAC_CONFIGURATION_ENTRY_E1H_ACTION_TYPE;
+                SET_FLAG(config->config_table[0].flags,
+                        MAC_CONFIGURATION_ENTRY_ACTION_TYPE,
+                        T_ETH_MAC_COMMAND_INVALIDATE);
 
-        DP(NETIF_MSG_IFUP, "%s MAC (%04x:%04x:%04x)  E1HOV %d  CLID mask %d\n",
+        if (is_bcast)
+                SET_FLAG(config->config_table[0].flags,
+                        MAC_CONFIGURATION_ENTRY_BROADCAST, 1);
+
+        DP(NETIF_MSG_IFUP, "%s MAC (%04x:%04x:%04x)  PF_ID %d  CLID mask %d\n",
            (set ? "setting" : "clearing"),
            config->config_table[0].msb_mac_addr,
            config->config_table[0].middle_mac_addr,
-           config->config_table[0].lsb_mac_addr, bp->e1hov, cl_bit_vec);
+           config->config_table[0].lsb_mac_addr, BP_FUNC(bp), cl_bit_vec);
 
-        bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_SET_MAC, 0,
+        bnx2x_sp_post(bp, RAMROD_CMD_ID_COMMON_SET_MAC, 0,
                       U64_HI(bnx2x_sp_mapping(bp, mac_config)),
-                      U64_LO(bnx2x_sp_mapping(bp, mac_config)), 0);
+                      U64_LO(bnx2x_sp_mapping(bp, mac_config)), 1);
+
+        /* Wait for a completion */
+        bnx2x_wait_ramrod(bp, 0, 0, &bp->set_mac_pending, ramrod_flags);
 }
 
-static int bnx2x_wait_ramrod(struct bnx2x *bp, int state, int idx,
-                             int *state_p, int poll)
+int bnx2x_wait_ramrod(struct bnx2x *bp, int state, int idx,
+                      int *state_p, int flags)
 {
         /* can take a while if any port is running */
         int cnt = 5000;
+        u8 poll = flags & WAIT_RAMROD_POLL;
+        u8 common = flags & WAIT_RAMROD_COMMON;
 
         DP(NETIF_MSG_IFUP, "%s for state to become %x on IDX [%d]\n",
            poll ? "polling" : "waiting", state, idx);
@@ -4842,13 +6117,17 @@ static int bnx2x_wait_ramrod(struct bnx2x *bp, int state, int idx,
         might_sleep();
         while (cnt--) {
                 if (poll) {
-                        bnx2x_rx_int(bp->fp, 10);
-                        /* if index is different from 0
-                         * the reply for some commands will
-                         * be on the non default queue
-                         */
-                        if (idx)
-                                bnx2x_rx_int(&bp->fp[idx], 10);
+                        if (common)
+                                bnx2x_eq_int(bp);
+                        else {
+                                bnx2x_rx_int(bp->fp, 10);
+                                /* if index is different from 0
+                                 * the reply for some commands will
+                                 * be on the non default queue
+                                 */
+                                if (idx)
+                                        bnx2x_rx_int(&bp->fp[idx], 10);
+                        }
                 }
 
                 mb(); /* state is changed by bnx2x_sp_event() */
@@ -4875,29 +6154,112 @@ static int bnx2x_wait_ramrod(struct bnx2x *bp, int state, int idx,
         return -EBUSY;
 }
 
-void bnx2x_set_eth_mac_addr_e1h(struct bnx2x *bp, int set)
+u8 bnx2x_e1h_cam_offset(struct bnx2x *bp, u8 rel_offset)
 {
-        bp->set_mac_pending++;
-        smp_wmb();
+        if (CHIP_IS_E1H(bp))
+                return E1H_FUNC_MAX * rel_offset + BP_FUNC(bp);
+        else if (CHIP_MODE_IS_4_PORT(bp))
+                return BP_FUNC(bp) * 32  + rel_offset;
+        else
+                return BP_VN(bp) * 32  + rel_offset;
+}
+
+void bnx2x_set_eth_mac(struct bnx2x *bp, int set)
+{
+        u8 cam_offset = (CHIP_IS_E1(bp) ? (BP_PORT(bp) ? 32 : 0) :
+                         bnx2x_e1h_cam_offset(bp, CAM_ETH_LINE));
 
-        bnx2x_set_mac_addr_e1h_gen(bp, set, bp->dev->dev_addr,
-                                   (1 << bp->fp->cl_id), BP_FUNC(bp));
+        /* networking  MAC */
+        bnx2x_set_mac_addr_gen(bp, set, bp->dev->dev_addr,
+                               (1 << bp->fp->cl_id), cam_offset , 0);
 
-        /* Wait for a completion */
-        bnx2x_wait_ramrod(bp, 0, 0, &bp->set_mac_pending, set ? 0 : 1);
+        if (CHIP_IS_E1(bp)) {
+                /* broadcast MAC */
+                u8 bcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+                bnx2x_set_mac_addr_gen(bp, set, bcast, 0, cam_offset + 1, 1);
+        }
 }
+static void bnx2x_set_e1_mc_list(struct bnx2x *bp, u8 offset)
+{
+        int i = 0, old;
+        struct net_device *dev = bp->dev;
+        struct netdev_hw_addr *ha;
+        struct mac_configuration_cmd *config_cmd = bnx2x_sp(bp, mcast_config);
+        dma_addr_t config_cmd_map = bnx2x_sp_mapping(bp, mcast_config);
+
+        netdev_for_each_mc_addr(ha, dev) {
+                /* copy mac */
+                config_cmd->config_table[i].msb_mac_addr =
+                        swab16(*(u16 *)&bnx2x_mc_addr(ha)[0]);
+                config_cmd->config_table[i].middle_mac_addr =
+                        swab16(*(u16 *)&bnx2x_mc_addr(ha)[2]);
+                config_cmd->config_table[i].lsb_mac_addr =
+                        swab16(*(u16 *)&bnx2x_mc_addr(ha)[4]);
+
+                config_cmd->config_table[i].vlan_id = 0;
+                config_cmd->config_table[i].pf_id = BP_FUNC(bp);
+                config_cmd->config_table[i].clients_bit_vector =
+                        cpu_to_le32(1 << BP_L_ID(bp));
+
+                SET_FLAG(config_cmd->config_table[i].flags,
+                        MAC_CONFIGURATION_ENTRY_ACTION_TYPE,
+                        T_ETH_MAC_COMMAND_SET);
 
-void bnx2x_set_eth_mac_addr_e1(struct bnx2x *bp, int set)
+                DP(NETIF_MSG_IFUP,
+                   "setting MCAST[%d] (%04x:%04x:%04x)\n", i,
+                   config_cmd->config_table[i].msb_mac_addr,
+                   config_cmd->config_table[i].middle_mac_addr,
+                   config_cmd->config_table[i].lsb_mac_addr);
+                i++;
+        }
+        old = config_cmd->hdr.length;
+        if (old > i) {
+                for (; i < old; i++) {
+                        if (CAM_IS_INVALID(config_cmd->
+                                           config_table[i])) {
+                                /* already invalidated */
+                                break;
+                        }
+                        /* invalidate */
+                        SET_FLAG(config_cmd->config_table[i].flags,
+                                MAC_CONFIGURATION_ENTRY_ACTION_TYPE,
+                                T_ETH_MAC_COMMAND_INVALIDATE);
+                }
+        }
+
+        config_cmd->hdr.length = i;
+        config_cmd->hdr.offset = offset;
+        config_cmd->hdr.client_id = 0xff;
+        config_cmd->hdr.reserved1 = 0;
+
+        bp->set_mac_pending = 1;
+        smp_wmb();
+
+        bnx2x_sp_post(bp, RAMROD_CMD_ID_COMMON_SET_MAC, 0,
+                   U64_HI(config_cmd_map), U64_LO(config_cmd_map), 1);
+}
+static void bnx2x_invlidate_e1_mc_list(struct bnx2x *bp)
 {
-        bp->set_mac_pending++;
+        int i;
+        struct mac_configuration_cmd *config_cmd = bnx2x_sp(bp, mcast_config);
+        dma_addr_t config_cmd_map = bnx2x_sp_mapping(bp, mcast_config);
+        int ramrod_flags = WAIT_RAMROD_COMMON;
+
+        bp->set_mac_pending = 1;
         smp_wmb();
 
-        bnx2x_set_mac_addr_e1_gen(bp, set, bp->dev->dev_addr,
-                                  (1 << bp->fp->cl_id), (BP_PORT(bp) ? 32 : 0),
-                                  1);
+        for (i = 0; i < config_cmd->hdr.length; i++)
+                SET_FLAG(config_cmd->config_table[i].flags,
+                        MAC_CONFIGURATION_ENTRY_ACTION_TYPE,
+                        T_ETH_MAC_COMMAND_INVALIDATE);
+
+        bnx2x_sp_post(bp, RAMROD_CMD_ID_COMMON_SET_MAC, 0,
+                      U64_HI(config_cmd_map), U64_LO(config_cmd_map), 1);
 
         /* Wait for a completion */
-        bnx2x_wait_ramrod(bp, 0, 0, &bp->set_mac_pending, set ? 0 : 1);
+        bnx2x_wait_ramrod(bp, 0, 0, &bp->set_mac_pending,
+                                ramrod_flags);
+
 }
 
 #ifdef BCM_CNIC
@@ -4913,174 +6275,463 @@ void bnx2x_set_eth_mac_addr_e1(struct bnx2x *bp, int set)
  */
 int bnx2x_set_iscsi_eth_mac_addr(struct bnx2x *bp, int set)
 {
-        u32 cl_bit_vec = (1 << BCM_ISCSI_ETH_CL_ID);
-
-        bp->set_mac_pending++;
-        smp_wmb();
+        u8 cam_offset = (CHIP_IS_E1(bp) ? ((BP_PORT(bp) ? 32 : 0) + 2) :
+                         bnx2x_e1h_cam_offset(bp, CAM_ISCSI_ETH_LINE));
+        u32 iscsi_l2_cl_id = BNX2X_ISCSI_ETH_CL_ID;
+        u32 cl_bit_vec = (1 << iscsi_l2_cl_id);
 
         /* Send a SET_MAC ramrod */
-        if (CHIP_IS_E1(bp))
-                bnx2x_set_mac_addr_e1_gen(bp, set, bp->iscsi_mac,
-                                  cl_bit_vec, (BP_PORT(bp) ? 32 : 0) + 2,
-                                  1);
-        else
-                /* CAM allocation for E1H
-                * unicasts: by func number
-                * multicast: 20+FUNC*20, 20 each
-                */
-                bnx2x_set_mac_addr_e1h_gen(bp, set, bp->iscsi_mac,
-                                   cl_bit_vec, E1H_FUNC_MAX + BP_FUNC(bp));
-
-        /* Wait for a completion when setting */
-        bnx2x_wait_ramrod(bp, 0, 0, &bp->set_mac_pending, set ? 0 : 1);
-
+        bnx2x_set_mac_addr_gen(bp, set, bp->iscsi_mac, cl_bit_vec,
+                               cam_offset, 0);
         return 0;
 }
 #endif
 
-int bnx2x_setup_leading(struct bnx2x *bp)
-{
-        int rc;
+static void bnx2x_fill_cl_init_data(struct bnx2x *bp,
+                                    struct bnx2x_client_init_params *params,
+                                    u8 activate,
+                                    struct client_init_ramrod_data *data)
+{
+        /* Clear the buffer */
+        memset(data, 0, sizeof(*data));
+
+        /* general */
+        data->general.client_id = params->rxq_params.cl_id;
+        data->general.statistics_counter_id = params->rxq_params.stat_id;
+        data->general.statistics_en_flg =
+                (params->rxq_params.flags & QUEUE_FLG_STATS) ? 1 : 0;
+        data->general.activate_flg = activate;
+        data->general.sp_client_id = params->rxq_params.spcl_id;
+
+        /* Rx data */
+        data->rx.tpa_en_flg =
+                (params->rxq_params.flags & QUEUE_FLG_TPA) ? 1 : 0;
+        data->rx.vmqueue_mode_en_flg = 0;
+        data->rx.cache_line_alignment_log_size =
+                params->rxq_params.cache_line_log;
+        data->rx.enable_dynamic_hc =
+                (params->rxq_params.flags & QUEUE_FLG_DHC) ? 1 : 0;
+        data->rx.max_sges_for_packet = params->rxq_params.max_sges_pkt;
+        data->rx.client_qzone_id = params->rxq_params.cl_qzone_id;
+        data->rx.max_agg_size = params->rxq_params.tpa_agg_sz;
+
+        /* We don't set drop flags */
+        data->rx.drop_ip_cs_err_flg = 0;
+        data->rx.drop_tcp_cs_err_flg = 0;
+        data->rx.drop_ttl0_flg = 0;
+        data->rx.drop_udp_cs_err_flg = 0;
+
+        data->rx.inner_vlan_removal_enable_flg =
+                (params->rxq_params.flags & QUEUE_FLG_VLAN) ? 1 : 0;
+        data->rx.outer_vlan_removal_enable_flg =
+                (params->rxq_params.flags & QUEUE_FLG_OV) ? 1 : 0;
+        data->rx.status_block_id = params->rxq_params.fw_sb_id;
+        data->rx.rx_sb_index_number = params->rxq_params.sb_cq_index;
+        data->rx.bd_buff_size = cpu_to_le16(params->rxq_params.buf_sz);
+        data->rx.sge_buff_size = cpu_to_le16(params->rxq_params.sge_buf_sz);
+        data->rx.mtu = cpu_to_le16(params->rxq_params.mtu);
+        data->rx.bd_page_base.lo =
+                cpu_to_le32(U64_LO(params->rxq_params.dscr_map));
+        data->rx.bd_page_base.hi =
+                cpu_to_le32(U64_HI(params->rxq_params.dscr_map));
+        data->rx.sge_page_base.lo =
+                cpu_to_le32(U64_LO(params->rxq_params.sge_map));
+        data->rx.sge_page_base.hi =
+                cpu_to_le32(U64_HI(params->rxq_params.sge_map));
+        data->rx.cqe_page_base.lo =
+                cpu_to_le32(U64_LO(params->rxq_params.rcq_map));
+        data->rx.cqe_page_base.hi =
+                cpu_to_le32(U64_HI(params->rxq_params.rcq_map));
+        data->rx.is_leading_rss =
+                (params->ramrod_params.flags & CLIENT_IS_LEADING_RSS) ? 1 : 0;
+        data->rx.is_approx_mcast = data->rx.is_leading_rss;
+
+        /* Tx data */
+        data->tx.enforce_security_flg = 0; /* VF specific */
+        data->tx.tx_status_block_id = params->txq_params.fw_sb_id;
+        data->tx.tx_sb_index_number = params->txq_params.sb_cq_index;
+        data->tx.mtu = 0; /* VF specific */
+        data->tx.tx_bd_page_base.lo =
+                cpu_to_le32(U64_LO(params->txq_params.dscr_map));
+        data->tx.tx_bd_page_base.hi =
+                cpu_to_le32(U64_HI(params->txq_params.dscr_map));
+
+        /* flow control data */
+        data->fc.cqe_pause_thr_low = cpu_to_le16(params->pause.rcq_th_lo);
+        data->fc.cqe_pause_thr_high = cpu_to_le16(params->pause.rcq_th_hi);
+        data->fc.bd_pause_thr_low = cpu_to_le16(params->pause.bd_th_lo);
+        data->fc.bd_pause_thr_high = cpu_to_le16(params->pause.bd_th_hi);
+        data->fc.sge_pause_thr_low = cpu_to_le16(params->pause.sge_th_lo);
+        data->fc.sge_pause_thr_high = cpu_to_le16(params->pause.sge_th_hi);
+        data->fc.rx_cos_mask = cpu_to_le16(params->pause.pri_map);
+
+        data->fc.safc_group_num = params->txq_params.cos;
+        data->fc.safc_group_en_flg =
+                (params->txq_params.flags & QUEUE_FLG_COS) ? 1 : 0;
+        data->fc.traffic_type = LLFC_TRAFFIC_TYPE_NW;
+}
+
+static inline void bnx2x_set_ctx_validation(struct eth_context *cxt, u32 cid)
+{
+        /* ustorm cxt validation */
+        cxt->ustorm_ag_context.cdu_usage =
+                CDU_RSRVD_VALUE_TYPE_A(cid, CDU_REGION_NUMBER_UCM_AG,
+                                       ETH_CONNECTION_TYPE);
+        /* xcontext validation */
+        cxt->xstorm_ag_context.cdu_reserved =
+                CDU_RSRVD_VALUE_TYPE_A(cid, CDU_REGION_NUMBER_XCM_AG,
+                                       ETH_CONNECTION_TYPE);
+}
+
+int bnx2x_setup_fw_client(struct bnx2x *bp,
+                          struct bnx2x_client_init_params *params,
+                          u8 activate,
+                          struct client_init_ramrod_data *data,
+                          dma_addr_t data_mapping)
+{
+        u16 hc_usec;
+        int ramrod = RAMROD_CMD_ID_ETH_CLIENT_SETUP;
+        int ramrod_flags = 0, rc;
+
+        /* HC and context validation values */
+        hc_usec = params->txq_params.hc_rate ?
+                1000000 / params->txq_params.hc_rate : 0;
+        bnx2x_update_coalesce_sb_index(bp,
+                        params->txq_params.fw_sb_id,
+                        params->txq_params.sb_cq_index,
+                        !(params->txq_params.flags & QUEUE_FLG_HC),
+                        hc_usec);
+
+        *(params->ramrod_params.pstate) = BNX2X_FP_STATE_OPENING;
+
+        hc_usec = params->rxq_params.hc_rate ?
+                1000000 / params->rxq_params.hc_rate : 0;
+        bnx2x_update_coalesce_sb_index(bp,
+                        params->rxq_params.fw_sb_id,
+                        params->rxq_params.sb_cq_index,
+                        !(params->rxq_params.flags & QUEUE_FLG_HC),
+                        hc_usec);
+
+        bnx2x_set_ctx_validation(params->rxq_params.cxt,
+                                 params->rxq_params.cid);
+
+        /* zero stats */
+        if (params->txq_params.flags & QUEUE_FLG_STATS)
+                storm_memset_xstats_zero(bp, BP_PORT(bp),
+                                         params->txq_params.stat_id);
+
+        if (params->rxq_params.flags & QUEUE_FLG_STATS) {
+                storm_memset_ustats_zero(bp, BP_PORT(bp),
+                                         params->rxq_params.stat_id);
+                storm_memset_tstats_zero(bp, BP_PORT(bp),
+                                         params->rxq_params.stat_id);
+        }
+
+        /* Fill the ramrod data */
+        bnx2x_fill_cl_init_data(bp, params, activate, data);
+
+        /* SETUP ramrod.
+         *
+         * bnx2x_sp_post() takes a spin_lock thus no other explict memory
+         * barrier except from mmiowb() is needed to impose a
+         * proper ordering of memory operations.
+         */
+        mmiowb();
 
-        /* reset IGU state */
-        bnx2x_ack_sb(bp, bp->fp[0].sb_id, CSTORM_ID, 0, IGU_INT_ENABLE, 0);
 
-        /* SETUP ramrod */
-        bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_PORT_SETUP, 0, 0, 0, 0);
+        bnx2x_sp_post(bp, ramrod, params->ramrod_params.cid,
+                      U64_HI(data_mapping), U64_LO(data_mapping), 0);
 
         /* Wait for completion */
-        rc = bnx2x_wait_ramrod(bp, BNX2X_STATE_OPEN, 0, &(bp->state), 0);
-
+        rc = bnx2x_wait_ramrod(bp, params->ramrod_params.state,
+                                 params->ramrod_params.index,
+                                 params->ramrod_params.pstate,
+                                 ramrod_flags);
         return rc;
 }
 
-int bnx2x_setup_multi(struct bnx2x *bp, int index)
+/**
+ * Configure interrupt mode according to current configuration.
+ * In case of MSI-X it will also try to enable MSI-X.
+ *
+ * @param bp
+ *
+ * @return int
+ */
+static int __devinit bnx2x_set_int_mode(struct bnx2x *bp)
 {
-        struct bnx2x_fastpath *fp = &bp->fp[index];
+        int rc = 0;
 
-        /* reset IGU state */
-        bnx2x_ack_sb(bp, fp->sb_id, CSTORM_ID, 0, IGU_INT_ENABLE, 0);
+        switch (bp->int_mode) {
+        case INT_MODE_MSI:
+                bnx2x_enable_msi(bp);
+                /* falling through... */
+        case INT_MODE_INTx:
+                bp->num_queues = 1;
+                DP(NETIF_MSG_IFUP, "set number of queues to 1\n");
+                break;
+        default:
+                /* Set number of queues according to bp->multi_mode value */
+                bnx2x_set_num_queues(bp);
 
-        /* SETUP ramrod */
-        fp->state = BNX2X_FP_STATE_OPENING;
-        bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_CLIENT_SETUP, index, 0,
-                      fp->cl_id, 0);
+                DP(NETIF_MSG_IFUP, "set number of queues to %d\n",
+                   bp->num_queues);
 
-        /* Wait for completion */
-        return bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_OPEN, index,
-                                 &(fp->state), 0);
-}
+                /* if we can't use MSI-X we only need one fp,
+                 * so try to enable MSI-X with the requested number of fp's
+                 * and fallback to MSI or legacy INTx with one fp
+                 */
+                rc = bnx2x_enable_msix(bp);
+                if (rc) {
+                        /* failed to enable MSI-X */
+                        if (bp->multi_mode)
+                                DP(NETIF_MSG_IFUP,
+                                          "Multi requested but failed to "
+                                          "enable MSI-X (%d), "
+                                          "set number of queues to %d\n",
+                                   bp->num_queues,
+                                   1);
+                        bp->num_queues = 1;
+
+                        if (!(bp->flags & DISABLE_MSI_FLAG))
+                                bnx2x_enable_msi(bp);
+                }
 
+                break;
+        }
 
-void bnx2x_set_num_queues_msix(struct bnx2x *bp)
+        return rc;
+}
+
+/* must be called prioir to any HW initializations */
+static inline u16 bnx2x_cid_ilt_lines(struct bnx2x *bp)
 {
+        return L2_ILT_LINES(bp);
+}
 
-        switch (bp->multi_mode) {
-        case ETH_RSS_MODE_DISABLED:
-                bp->num_queues = 1;
-                break;
+void bnx2x_ilt_set_info(struct bnx2x *bp)
+{
+        struct ilt_client_info *ilt_client;
+        struct bnx2x_ilt *ilt = BP_ILT(bp);
+        u16 line = 0;
 
-        case ETH_RSS_MODE_REGULAR:
-                if (num_queues)
-                        bp->num_queues = min_t(u32, num_queues,
-                                                  BNX2X_MAX_QUEUES(bp));
-                else
-                        bp->num_queues = min_t(u32, num_online_cpus(),
-                                                  BNX2X_MAX_QUEUES(bp));
-                break;
+        ilt->start_line = FUNC_ILT_BASE(BP_FUNC(bp));
+        DP(BNX2X_MSG_SP, "ilt starts at line %d\n", ilt->start_line);
 
+        /* CDU */
+        ilt_client = &ilt->clients[ILT_CLIENT_CDU];
+        ilt_client->client_num = ILT_CLIENT_CDU;
+        ilt_client->page_size = CDU_ILT_PAGE_SZ;
+        ilt_client->flags = ILT_CLIENT_SKIP_MEM;
+        ilt_client->start = line;
+        line += L2_ILT_LINES(bp);
+#ifdef BCM_CNIC
+        line += CNIC_ILT_LINES;
+#endif
+        ilt_client->end = line - 1;
+
+        DP(BNX2X_MSG_SP, "ilt client[CDU]: start %d, end %d, psz 0x%x, "
+                                         "flags 0x%x, hw psz %d\n",
+           ilt_client->start,
+           ilt_client->end,
+           ilt_client->page_size,
+           ilt_client->flags,
+           ilog2(ilt_client->page_size >> 12));
+
+        /* QM */
+        if (QM_INIT(bp->qm_cid_count)) {
+                ilt_client = &ilt->clients[ILT_CLIENT_QM];
+                ilt_client->client_num = ILT_CLIENT_QM;
+                ilt_client->page_size = QM_ILT_PAGE_SZ;
+                ilt_client->flags = 0;
+                ilt_client->start = line;
+
+                /* 4 bytes for each cid */
+                line += DIV_ROUND_UP(bp->qm_cid_count * QM_QUEUES_PER_FUNC * 4,
+                                                         QM_ILT_PAGE_SZ);
+
+                ilt_client->end = line - 1;
+
+                DP(BNX2X_MSG_SP, "ilt client[QM]: start %d, end %d, psz 0x%x, "
+                                                 "flags 0x%x, hw psz %d\n",
+                   ilt_client->start,
+                   ilt_client->end,
+                   ilt_client->page_size,
+                   ilt_client->flags,
+                   ilog2(ilt_client->page_size >> 12));
+
+        }
+        /* SRC */
+        ilt_client = &ilt->clients[ILT_CLIENT_SRC];
+#ifdef BCM_CNIC
+        ilt_client->client_num = ILT_CLIENT_SRC;
+        ilt_client->page_size = SRC_ILT_PAGE_SZ;
+        ilt_client->flags = 0;
+        ilt_client->start = line;
+        line += SRC_ILT_LINES;
+        ilt_client->end = line - 1;
+
+        DP(BNX2X_MSG_SP, "ilt client[SRC]: start %d, end %d, psz 0x%x, "
+                                         "flags 0x%x, hw psz %d\n",
+           ilt_client->start,
+           ilt_client->end,
+           ilt_client->page_size,
+           ilt_client->flags,
+           ilog2(ilt_client->page_size >> 12));
 
-        default:
-                bp->num_queues = 1;
-                break;
-        }
-}
+#else
+        ilt_client->flags = (ILT_CLIENT_SKIP_INIT | ILT_CLIENT_SKIP_MEM);
+#endif
 
+        /* TM */
+        ilt_client = &ilt->clients[ILT_CLIENT_TM];
+#ifdef BCM_CNIC
+        ilt_client->client_num = ILT_CLIENT_TM;
+        ilt_client->page_size = TM_ILT_PAGE_SZ;
+        ilt_client->flags = 0;
+        ilt_client->start = line;
+        line += TM_ILT_LINES;
+        ilt_client->end = line - 1;
+
+        DP(BNX2X_MSG_SP, "ilt client[TM]: start %d, end %d, psz 0x%x, "
+                                         "flags 0x%x, hw psz %d\n",
+           ilt_client->start,
+           ilt_client->end,
+           ilt_client->page_size,
+           ilt_client->flags,
+           ilog2(ilt_client->page_size >> 12));
 
+#else
+        ilt_client->flags = (ILT_CLIENT_SKIP_INIT | ILT_CLIENT_SKIP_MEM);
+#endif
+}
 
-static int bnx2x_stop_multi(struct bnx2x *bp, int index)
+int bnx2x_setup_client(struct bnx2x *bp, struct bnx2x_fastpath *fp,
+                       int is_leading)
 {
-        struct bnx2x_fastpath *fp = &bp->fp[index];
+        struct bnx2x_client_init_params params = { {0} };
         int rc;
 
-        /* halt the connection */
-        fp->state = BNX2X_FP_STATE_HALTING;
-        bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_HALT, index, 0, fp->cl_id, 0);
+        bnx2x_ack_sb(bp, fp->igu_sb_id, USTORM_ID, 0,
+                             IGU_INT_ENABLE, 0);
 
-        /* Wait for completion */
-        rc = bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_HALTED, index,
-                               &(fp->state), 1);
-        if (rc) /* timeout */
-                return rc;
+        params.ramrod_params.pstate = &fp->state;
+        params.ramrod_params.state = BNX2X_FP_STATE_OPEN;
+        params.ramrod_params.index = fp->index;
+        params.ramrod_params.cid = fp->cid;
 
-        /* delete cfc entry */
-        bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_CFC_DEL, index, 0, 0, 1);
+        if (is_leading)
+                params.ramrod_params.flags |= CLIENT_IS_LEADING_RSS;
 
-        /* Wait for completion */
-        rc = bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_CLOSED, index,
-                               &(fp->state), 1);
+        bnx2x_pf_rx_cl_prep(bp, fp, &params.pause, &params.rxq_params);
+
+        bnx2x_pf_tx_cl_prep(bp, fp, &params.txq_params);
+
+        rc = bnx2x_setup_fw_client(bp, &params, 1,
+                                     bnx2x_sp(bp, client_init_data),
+                                     bnx2x_sp_mapping(bp, client_init_data));
         return rc;
 }
 
-static int bnx2x_stop_leading(struct bnx2x *bp)
+int bnx2x_stop_fw_client(struct bnx2x *bp, struct bnx2x_client_ramrod_params *p)
 {
-        __le16 dsb_sp_prod_idx;
-        /* if the other port is handling traffic,
-           this can take a lot of time */
-        int cnt = 500;
         int rc;
 
-        might_sleep();
+        int poll_flag = p->poll ? WAIT_RAMROD_POLL : 0;
 
-        /* Send HALT ramrod */
-        bp->fp[0].state = BNX2X_FP_STATE_HALTING;
-        bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_HALT, 0, 0, bp->fp->cl_id, 0);
+        /* halt the connection */
+        *p->pstate = BNX2X_FP_STATE_HALTING;
+        bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_HALT, p->cid, 0,
+                                                  p->cl_id, 0);
 
         /* Wait for completion */
-        rc = bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_HALTED, 0,
-                               &(bp->fp[0].state), 1);
+        rc = bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_HALTED, p->index,
+                               p->pstate, poll_flag);
         if (rc) /* timeout */
                 return rc;
 
-        dsb_sp_prod_idx = *bp->dsb_sp_prod;
+        *p->pstate = BNX2X_FP_STATE_TERMINATING;
+        bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_TERMINATE, p->cid, 0,
+                                                       p->cl_id, 0);
+        /* Wait for completion */
+        rc = bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_TERMINATED, p->index,
+                               p->pstate, poll_flag);
+        if (rc) /* timeout */
+                return rc;
 
-        /* Send PORT_DELETE ramrod */
-        bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_PORT_DEL, 0, 0, 0, 1);
 
-        /* Wait for completion to arrive on default status block
-           we are going to reset the chip anyway
-           so there is not much to do if this times out
-         */
-        while (dsb_sp_prod_idx == *bp->dsb_sp_prod) {
-                if (!cnt) {
-                        DP(NETIF_MSG_IFDOWN, "timeout waiting for port del "
-                           "dsb_sp_prod 0x%x != dsb_sp_prod_idx 0x%x\n",
-                           *bp->dsb_sp_prod, dsb_sp_prod_idx);
-#ifdef BNX2X_STOP_ON_ERROR
-                        bnx2x_panic();
-#endif
-                        rc = -EBUSY;
-                        break;
-                }
-                cnt--;
-                msleep(1);
-                rmb(); /* Refresh the dsb_sp_prod */
-        }
-        bp->state = BNX2X_STATE_CLOSING_WAIT4_UNLOAD;
-        bp->fp[0].state = BNX2X_FP_STATE_CLOSED;
+        /* delete cfc entry */
+        bnx2x_sp_post(bp, RAMROD_CMD_ID_COMMON_CFC_DEL, p->cid, 0, 0, 1);
 
+        /* Wait for completion */
+        rc = bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_CLOSED, p->index,
+                               p->pstate, WAIT_RAMROD_COMMON);
         return rc;
 }
 
+static int bnx2x_stop_client(struct bnx2x *bp, int index)
+{
+        struct bnx2x_client_ramrod_params client_stop = {0};
+        struct bnx2x_fastpath *fp = &bp->fp[index];
+
+        client_stop.index = index;
+        client_stop.cid = fp->cid;
+        client_stop.cl_id = fp->cl_id;
+        client_stop.pstate = &(fp->state);
+        client_stop.poll = 0;
+
+        return bnx2x_stop_fw_client(bp, &client_stop);
+}
+
+
 static void bnx2x_reset_func(struct bnx2x *bp)
 {
         int port = BP_PORT(bp);
         int func = BP_FUNC(bp);
-        int base, i;
+        int i;
+        int pfunc_offset_fp = offsetof(struct hc_sb_data, p_func) +
+                        (CHIP_IS_E2(bp) ?
+                         offsetof(struct hc_status_block_data_e2, common) :
+                         offsetof(struct hc_status_block_data_e1x, common));
+        int pfunc_offset_sp = offsetof(struct hc_sp_status_block_data, p_func);
+        int pfid_offset = offsetof(struct pci_entity, pf_id);
+
+        /* Disable the function in the FW */
+        REG_WR8(bp, BAR_XSTRORM_INTMEM + XSTORM_FUNC_EN_OFFSET(func), 0);
+        REG_WR8(bp, BAR_CSTRORM_INTMEM + CSTORM_FUNC_EN_OFFSET(func), 0);
+        REG_WR8(bp, BAR_TSTRORM_INTMEM + TSTORM_FUNC_EN_OFFSET(func), 0);
+        REG_WR8(bp, BAR_USTRORM_INTMEM + USTORM_FUNC_EN_OFFSET(func), 0);
+
+        /* FP SBs */
+        for_each_queue(bp, i) {
+                struct bnx2x_fastpath *fp = &bp->fp[i];
+                REG_WR8(bp,
+                        BAR_CSTRORM_INTMEM +
+                        CSTORM_STATUS_BLOCK_DATA_OFFSET(fp->fw_sb_id)
+                        + pfunc_offset_fp + pfid_offset,
+                        HC_FUNCTION_DISABLED);
+        }
+
+        /* SP SB */
+        REG_WR8(bp,
+                BAR_CSTRORM_INTMEM +
+                CSTORM_SP_STATUS_BLOCK_DATA_OFFSET(func) +
+                pfunc_offset_sp + pfid_offset,
+                HC_FUNCTION_DISABLED);
+
+
+        for (i = 0; i < XSTORM_SPQ_DATA_SIZE / 4; i++)
+                REG_WR(bp, BAR_XSTRORM_INTMEM + XSTORM_SPQ_DATA_OFFSET(func),
+                       0);
 
         /* Configure IGU */
-        REG_WR(bp, HC_REG_LEADING_EDGE_0 + port*8, 0);
-        REG_WR(bp, HC_REG_TRAILING_EDGE_0 + port*8, 0);
+        if (bp->common.int_block == INT_BLOCK_HC) {
+                REG_WR(bp, HC_REG_LEADING_EDGE_0 + port*8, 0);
+                REG_WR(bp, HC_REG_TRAILING_EDGE_0 + port*8, 0);
+        } else {
+                REG_WR(bp, IGU_REG_LEADING_EDGE_LATCH, 0);
+                REG_WR(bp, IGU_REG_TRAILING_EDGE_LATCH, 0);
+        }
 
 #ifdef BCM_CNIC
         /* Disable Timer scan */
@@ -5096,9 +6747,27 @@ static void bnx2x_reset_func(struct bnx2x *bp)
         }
 #endif
         /* Clear ILT */
-        base = FUNC_ILT_BASE(func);
-        for (i = base; i < base + ILT_PER_FUNC; i++)
-                bnx2x_ilt_wr(bp, i, 0);
+        bnx2x_clear_func_ilt(bp, func);
+
+        /* Timers workaround bug for E2: if this is vnic-3,
+         * we need to set the entire ilt range for this timers.
+         */
+        if (CHIP_IS_E2(bp) && BP_VN(bp) == 3) {
+                struct ilt_client_info ilt_cli;
+                /* use dummy TM client */
+                memset(&ilt_cli, 0, sizeof(struct ilt_client_info));
+                ilt_cli.start = 0;
+                ilt_cli.end = ILT_NUM_PAGE_ENTRIES - 1;
+                ilt_cli.client_num = ILT_CLIENT_TM;
+
+                bnx2x_ilt_boundry_init_op(bp, &ilt_cli, 0, INITOP_CLEAR);
+        }
+
+        /* this assumes that reset_port() called before reset_func()*/
+        if (CHIP_IS_E2(bp))
+                bnx2x_pf_disable(bp);
+
+        bp->dmae_ready = 0;
 }
 
 static void bnx2x_reset_port(struct bnx2x *bp)
@@ -5130,7 +6799,7 @@ static void bnx2x_reset_port(struct bnx2x *bp)
 static void bnx2x_reset_chip(struct bnx2x *bp, u32 reset_code)
 {
         DP(BNX2X_MSG_MCP, "function %d  reset_code %x\n",
-           BP_FUNC(bp), reset_code);
+           BP_ABS_FUNC(bp), reset_code);
 
         switch (reset_code) {
         case FW_MSG_CODE_DRV_UNLOAD_COMMON:
@@ -5167,7 +6836,6 @@ void bnx2x_chip_cleanup(struct bnx2x *bp, int unload_mode)
                 cnt = 1000;
                 while (bnx2x_has_tx_work_unload(fp)) {
 
-                        bnx2x_tx_int(fp);
                         if (!cnt) {
                                 BNX2X_ERR("timeout waiting for queue[%d]\n",
                                           i);
@@ -5186,39 +6854,21 @@ void bnx2x_chip_cleanup(struct bnx2x *bp, int unload_mode)
         msleep(1);
 
         if (CHIP_IS_E1(bp)) {
-                struct mac_configuration_cmd *config =
-                                                bnx2x_sp(bp, mcast_config);
-
-                bnx2x_set_eth_mac_addr_e1(bp, 0);
-
-                for (i = 0; i < config->hdr.length; i++)
-                        CAM_INVALIDATE(config->config_table[i]);
-
-                config->hdr.length = i;
-                if (CHIP_REV_IS_SLOW(bp))
-                        config->hdr.offset = BNX2X_MAX_EMUL_MULTI*(1 + port);
-                else
-                        config->hdr.offset = BNX2X_MAX_MULTICAST*(1 + port);
-                config->hdr.client_id = bp->fp->cl_id;
-                config->hdr.reserved1 = 0;
-
-                bp->set_mac_pending++;
-                smp_wmb();
-
-                bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_SET_MAC, 0,
-                              U64_HI(bnx2x_sp_mapping(bp, mcast_config)),
-                              U64_LO(bnx2x_sp_mapping(bp, mcast_config)), 0);
+                /* invalidate mc list,
+                 * wait and poll (interrupts are off)
+                 */
+                bnx2x_invlidate_e1_mc_list(bp);
+                bnx2x_set_eth_mac(bp, 0);
 
-        } else { /* E1H */
+        } else {
                 REG_WR(bp, NIG_REG_LLH0_FUNC_EN + port*8, 0);
 
-                bnx2x_set_eth_mac_addr_e1h(bp, 0);
+                bnx2x_set_eth_mac(bp, 0);
 
                 for (i = 0; i < MC_HASH_SIZE; i++)
                         REG_WR(bp, MC_HASH_OFFSET(bp, i), 0);
-
-                REG_WR(bp, MISC_REG_E1HMF_MODE, 0);
         }
+
 #ifdef BCM_CNIC
         /* Clear iSCSI L2 MAC */
         mutex_lock(&bp->cnic_mutex);
@@ -5257,33 +6907,44 @@ void bnx2x_chip_cleanup(struct bnx2x *bp, int unload_mode)
 
         /* Close multi and leading connections
            Completions for ramrods are collected in a synchronous way */
-        for_each_nondefault_queue(bp, i)
-                if (bnx2x_stop_multi(bp, i))
+        for_each_queue(bp, i)
+
+                if (bnx2x_stop_client(bp, i))
+#ifdef BNX2X_STOP_ON_ERROR
+                        return;
+#else
                         goto unload_error;
+#endif
 
-        rc = bnx2x_stop_leading(bp);
+        rc = bnx2x_func_stop(bp);
         if (rc) {
-                BNX2X_ERR("Stop leading failed!\n");
+                BNX2X_ERR("Function stop failed!\n");
 #ifdef BNX2X_STOP_ON_ERROR
-                return -EBUSY;
+                return;
 #else
                 goto unload_error;
 #endif
         }
-
+#ifndef BNX2X_STOP_ON_ERROR
 unload_error:
+#endif
         if (!BP_NOMCP(bp))
                 reset_code = bnx2x_fw_command(bp, reset_code, 0);
         else {
-                DP(NETIF_MSG_IFDOWN, "NO MCP - load counts      %d, %d, %d\n",
-                   load_count[0], load_count[1], load_count[2]);
-                load_count[0]--;
-                load_count[1 + port]--;
-                DP(NETIF_MSG_IFDOWN, "NO MCP - new load counts  %d, %d, %d\n",
-                   load_count[0], load_count[1], load_count[2]);
-                if (load_count[0] == 0)
+                DP(NETIF_MSG_IFDOWN, "NO MCP - load counts[%d]      "
+                                     "%d, %d, %d\n", BP_PATH(bp),
+                   load_count[BP_PATH(bp)][0],
+                   load_count[BP_PATH(bp)][1],
+                   load_count[BP_PATH(bp)][2]);
+                load_count[BP_PATH(bp)][0]--;
+                load_count[BP_PATH(bp)][1 + port]--;
+                DP(NETIF_MSG_IFDOWN, "NO MCP - new load counts[%d]  "
+                                     "%d, %d, %d\n", BP_PATH(bp),
+                   load_count[BP_PATH(bp)][0], load_count[BP_PATH(bp)][1],
+                   load_count[BP_PATH(bp)][2]);
+                if (load_count[BP_PATH(bp)][0] == 0)
                         reset_code = FW_MSG_CODE_DRV_UNLOAD_COMMON;
-                else if (load_count[1 + port] == 0)
+                else if (load_count[BP_PATH(bp)][1 + port] == 0)
                         reset_code = FW_MSG_CODE_DRV_UNLOAD_PORT;
                 else
                         reset_code = FW_MSG_CODE_DRV_UNLOAD_FUNCTION;
@@ -5293,6 +6954,12 @@ unload_error:
             (reset_code == FW_MSG_CODE_DRV_UNLOAD_PORT))
                 bnx2x__link_reset(bp);
 
+        /* Disable HW interrupts, NAPI */
+        bnx2x_netif_stop(bp, 1);
+
+        /* Release IRQs */
+        bnx2x_free_irq(bp);
+
         /* Reset the chip */
         bnx2x_reset_chip(bp, reset_code);
 
@@ -5324,7 +6991,6 @@ void bnx2x_disable_close_the_gate(struct bnx2x *bp)
         }
 }
 
-
 /* Close gates #2, #3 and #4: */
 static void bnx2x_set_234_gates(struct bnx2x *bp, bool close)
 {
@@ -5370,15 +7036,13 @@ static void bnx2x_clp_reset_prep(struct bnx2x *bp, u32 *magic_val)
 static void bnx2x_clp_reset_done(struct bnx2x *bp, u32 magic_val)
 {
         /* Restore the `magic' bit value... */
-        /* u32 val = SHMEM_RD(bp, mf_cfg.shared_mf_config.clp_mb);
-        SHMEM_WR(bp, mf_cfg.shared_mf_config.clp_mb,
-                (val & (~SHARED_MF_CLP_MAGIC)) | magic_val); */
         u32 val = MF_CFG_RD(bp, shared_mf_config.clp_mb);
         MF_CFG_WR(bp, shared_mf_config.clp_mb,
                 (val & (~SHARED_MF_CLP_MAGIC)) | magic_val);
 }
 
-/* Prepares for MCP reset: takes care of CLP configurations.
+/**
+ * Prepares for MCP reset: takes care of CLP configurations.
  *
  * @param bp
  * @param magic_val Old value of 'magic' bit.
@@ -5776,39 +7440,23 @@ reset_task_exit:
  * Init service functions
  */
 
-static inline u32 bnx2x_get_pretend_reg(struct bnx2x *bp, int func)
-{
-        switch (func) {
-        case 0: return PXP2_REG_PGL_PRETEND_FUNC_F0;
-        case 1: return PXP2_REG_PGL_PRETEND_FUNC_F1;
-        case 2: return PXP2_REG_PGL_PRETEND_FUNC_F2;
-        case 3: return PXP2_REG_PGL_PRETEND_FUNC_F3;
-        case 4: return PXP2_REG_PGL_PRETEND_FUNC_F4;
-        case 5: return PXP2_REG_PGL_PRETEND_FUNC_F5;
-        case 6: return PXP2_REG_PGL_PRETEND_FUNC_F6;
-        case 7: return PXP2_REG_PGL_PRETEND_FUNC_F7;
-        default:
-                BNX2X_ERR("Unsupported function index: %d\n", func);
-                return (u32)(-1);
-        }
+u32 bnx2x_get_pretend_reg(struct bnx2x *bp)
+{
+        u32 base = PXP2_REG_PGL_PRETEND_FUNC_F0;
+        u32 stride = PXP2_REG_PGL_PRETEND_FUNC_F1 - base;
+        return base + (BP_ABS_FUNC(bp)) * stride;
 }
 
-static void bnx2x_undi_int_disable_e1h(struct bnx2x *bp, int orig_func)
+static void bnx2x_undi_int_disable_e1h(struct bnx2x *bp)
 {
-        u32 reg = bnx2x_get_pretend_reg(bp, orig_func), new_val;
+        u32 reg = bnx2x_get_pretend_reg(bp);
 
         /* Flush all outstanding writes */
         mmiowb();
 
         /* Pretend to be function 0 */
         REG_WR(bp, reg, 0);
-        /* Flush the GRC transaction (in the chip) */
-        new_val = REG_RD(bp, reg);
-        if (new_val != 0) {
-                BNX2X_ERR("Hmmm... Pretend register wasn't updated: (0,%d)!\n",
-                          new_val);
-                BUG();
-        }
+        REG_RD(bp, reg);        /* Flush the GRC transaction (in the chip) */
 
         /* From now we are in the "like-E1" mode */
         bnx2x_int_disable(bp);
@@ -5816,22 +7464,17 @@ static void bnx2x_undi_int_disable_e1h(struct bnx2x *bp, int orig_func)
         /* Flush all outstanding writes */
         mmiowb();
 
-        /* Restore the original funtion settings */
-        REG_WR(bp, reg, orig_func);
-        new_val = REG_RD(bp, reg);
-        if (new_val != orig_func) {
-                BNX2X_ERR("Hmmm... Pretend register wasn't updated: (%d,%d)!\n",
-                          orig_func, new_val);
-                BUG();
-        }
+        /* Restore the original function */
+        REG_WR(bp, reg, BP_ABS_FUNC(bp));
+        REG_RD(bp, reg);
 }
 
-static inline void bnx2x_undi_int_disable(struct bnx2x *bp, int func)
+static inline void bnx2x_undi_int_disable(struct bnx2x *bp)
 {
-        if (CHIP_IS_E1H(bp))
-                bnx2x_undi_int_disable_e1h(bp, func);
-        else
+        if (CHIP_IS_E1(bp))
                 bnx2x_int_disable(bp);
+        else
+                bnx2x_undi_int_disable_e1h(bp);
 }
 
 static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
@@ -5848,8 +7491,8 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                 val = REG_RD(bp, DORQ_REG_NORM_CID_OFST);
                 if (val == 0x7) {
                         u32 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
-                        /* save our func */
-                        int func = BP_FUNC(bp);
+                        /* save our pf_num */
+                        int orig_pf_num = bp->pf_num;
                         u32 swap_en;
                         u32 swap_val;
 
@@ -5859,9 +7502,9 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                         BNX2X_DEV_INFO("UNDI is active! reset device\n");
 
                         /* try unload UNDI on port 0 */
-                        bp->func = 0;
+                        bp->pf_num = 0;
                         bp->fw_seq =
-                               (SHMEM_RD(bp, func_mb[bp->func].drv_mb_header) &
+                              (SHMEM_RD(bp, func_mb[bp->pf_num].drv_mb_header) &
                                 DRV_MSG_SEQ_NUMBER_MASK);
                         reset_code = bnx2x_fw_command(bp, reset_code, 0);
 
@@ -5873,9 +7516,9 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                                                  DRV_MSG_CODE_UNLOAD_DONE, 0);
 
                                 /* unload UNDI on port 1 */
-                                bp->func = 1;
+                                bp->pf_num = 1;
                                 bp->fw_seq =
-                               (SHMEM_RD(bp, func_mb[bp->func].drv_mb_header) &
+                              (SHMEM_RD(bp, func_mb[bp->pf_num].drv_mb_header) &
                                         DRV_MSG_SEQ_NUMBER_MASK);
                                 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
 
@@ -5885,7 +7528,7 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                         /* now it's safe to release the lock */
                         bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
 
-                        bnx2x_undi_int_disable(bp, func);
+                        bnx2x_undi_int_disable(bp);
 
                         /* close input traffic and wait for it */
                         /* Do not rcv packets to BRB */
@@ -5924,11 +7567,10 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                         bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE, 0);
 
                         /* restore our func and fw_seq */
-                        bp->func = func;
+                        bp->pf_num = orig_pf_num;
                         bp->fw_seq =
-                               (SHMEM_RD(bp, func_mb[bp->func].drv_mb_header) &
+                              (SHMEM_RD(bp, func_mb[bp->pf_num].drv_mb_header) &
                                 DRV_MSG_SEQ_NUMBER_MASK);
-
                 } else
                         bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
         }
@@ -5950,6 +7592,40 @@ static void __devinit bnx2x_get_common_hwinfo(struct bnx2x *bp)
         val = REG_RD(bp, MISC_REG_BOND_ID);
         id |= (val & 0xf);
         bp->common.chip_id = id;
+
+        /* Set doorbell size */
+        bp->db_size = (1 << BNX2X_DB_SHIFT);
+
+        if (CHIP_IS_E2(bp)) {
+                val = REG_RD(bp, MISC_REG_PORT4MODE_EN_OVWR);
+                if ((val & 1) == 0)
+                        val = REG_RD(bp, MISC_REG_PORT4MODE_EN);
+                else
+                        val = (val >> 1) & 1;
+                BNX2X_DEV_INFO("chip is in %s\n", val ? "4_PORT_MODE" :
+                                                       "2_PORT_MODE");
+                bp->common.chip_port_mode = val ? CHIP_4_PORT_MODE :
+                                                 CHIP_2_PORT_MODE;
+
+                if (CHIP_MODE_IS_4_PORT(bp))
+                        bp->pfid = (bp->pf_num >> 1);   /* 0..3 */
+                else
+                        bp->pfid = (bp->pf_num & 0x6);  /* 0, 2, 4, 6 */
+        } else {
+                bp->common.chip_port_mode = CHIP_PORT_MODE_NONE; /* N/A */
+                bp->pfid = bp->pf_num;                  /* 0..7 */
+        }
+
+        /*
+         * set base FW non-default (fast path) status block id, this value is
+         * used to initialize the fw_sb_id saved on the fp/queue structure to
+         * determine the id used by the FW.
+         */
+        if (CHIP_IS_E1x(bp))
+                bp->base_fw_ndsb = BP_PORT(bp) * FP_SB_MAX_E1x;
+        else /* E2 */
+                bp->base_fw_ndsb = BP_PORT(bp) * FP_SB_MAX_E2;
+
         bp->link_params.chip_id = bp->common.chip_id;
         BNX2X_DEV_INFO("chip ID is 0x%x\n", id);
 
@@ -5967,15 +7643,15 @@ static void __devinit bnx2x_get_common_hwinfo(struct bnx2x *bp)
                        bp->common.flash_size, bp->common.flash_size);
 
         bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR);
-        bp->common.shmem2_base = REG_RD(bp, MISC_REG_GENERIC_CR_0);
+        bp->common.shmem2_base = REG_RD(bp, (BP_PATH(bp) ?
+                                        MISC_REG_GENERIC_CR_1 :
+                                        MISC_REG_GENERIC_CR_0));
         bp->link_params.shmem_base = bp->common.shmem_base;
         bp->link_params.shmem2_base = bp->common.shmem2_base;
         BNX2X_DEV_INFO("shmem offset 0x%x  shmem2 offset 0x%x\n",
                        bp->common.shmem_base, bp->common.shmem2_base);
 
-        if (!bp->common.shmem_base ||
-            (bp->common.shmem_base < 0xA0000) ||
-            (bp->common.shmem_base >= 0xC0000)) {
+        if (!bp->common.shmem_base) {
                 BNX2X_DEV_INFO("MCP not active\n");
                 bp->flags |= NO_MCP_FLAG;
                 return;
@@ -5984,7 +7660,7 @@ static void __devinit bnx2x_get_common_hwinfo(struct bnx2x *bp)
         val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]);
         if ((val & (SHR_MEM_VALIDITY_DEV_INFO | SHR_MEM_VALIDITY_MB))
                 != (SHR_MEM_VALIDITY_DEV_INFO | SHR_MEM_VALIDITY_MB))
-                BNX2X_ERROR("BAD MCP validity signature\n");
+                BNX2X_ERR("BAD MCP validity signature\n");
 
         bp->common.hw_config = SHMEM_RD(bp, dev_info.shared_hw_config.config);
         BNX2X_DEV_INFO("hw_config 0x%08x\n", bp->common.hw_config);
@@ -6008,12 +7684,13 @@ static void __devinit bnx2x_get_common_hwinfo(struct bnx2x *bp)
         if (val < BNX2X_BC_VER) {
                 /* for now only warn
                  * later we might need to enforce this */
-                BNX2X_ERROR("This driver needs bc_ver %X but found %X, "
-                            "please upgrade BC\n", BNX2X_BC_VER, val);
+                BNX2X_ERR("This driver needs bc_ver %X but found %X, "
+                          "please upgrade BC\n", BNX2X_BC_VER, val);
         }
         bp->link_params.feature_config_flags |=
                                 (val >= REQ_BC_VER_4_VRFY_FIRST_PHY_OPT_MDL) ?
-                FEATURE_CONFIG_BC_SUPPORTS_OPT_MDL_VRFY : 0;
+                                FEATURE_CONFIG_BC_SUPPORTS_OPT_MDL_VRFY : 0;
+
         bp->link_params.feature_config_flags |=
                 (val >= REQ_BC_VER_4_VRFY_SPECIFIC_PHY_OPT_MDL) ?
                 FEATURE_CONFIG_BC_SUPPORTS_DUAL_PHY_OPT_MDL_VRFY : 0;
@@ -6037,6 +7714,57 @@ static void __devinit bnx2x_get_common_hwinfo(struct bnx2x *bp)
                  val, val2, val3, val4);
 }
 
+#define IGU_FID(val)    GET_FIELD((val), IGU_REG_MAPPING_MEMORY_FID)
+#define IGU_VEC(val)    GET_FIELD((val), IGU_REG_MAPPING_MEMORY_VECTOR)
+
+static void __devinit bnx2x_get_igu_cam_info(struct bnx2x *bp)
+{
+        int pfid = BP_FUNC(bp);
+        int vn = BP_E1HVN(bp);
+        int igu_sb_id;
+        u32 val;
+        u8 fid;
+
+        bp->igu_base_sb = 0xff;
+        bp->igu_sb_cnt = 0;
+        if (CHIP_INT_MODE_IS_BC(bp)) {
+                bp->igu_sb_cnt = min_t(u8, FP_SB_MAX_E1x,
+                                       bp->l2_cid_count);
+
+                bp->igu_base_sb = (CHIP_MODE_IS_4_PORT(bp) ? pfid : vn) *
+                        FP_SB_MAX_E1x;
+
+                bp->igu_dsb_id =  E1HVN_MAX * FP_SB_MAX_E1x +
+                        (CHIP_MODE_IS_4_PORT(bp) ? pfid : vn);
+
+                return;
+        }
+
+        /* IGU in normal mode - read CAM */
+        for (igu_sb_id = 0; igu_sb_id < IGU_REG_MAPPING_MEMORY_SIZE;
+             igu_sb_id++) {
+                val = REG_RD(bp, IGU_REG_MAPPING_MEMORY + igu_sb_id * 4);
+                if (!(val & IGU_REG_MAPPING_MEMORY_VALID))
+                        continue;
+                fid = IGU_FID(val);
+                if ((fid & IGU_FID_ENCODE_IS_PF)) {
+                        if ((fid & IGU_FID_PF_NUM_MASK) != pfid)
+                                continue;
+                        if (IGU_VEC(val) == 0)
+                                /* default status block */
+                                bp->igu_dsb_id = igu_sb_id;
+                        else {
+                                if (bp->igu_base_sb == 0xff)
+                                        bp->igu_base_sb = igu_sb_id;
+                                bp->igu_sb_cnt++;
+                        }
+                }
+        }
+        bp->igu_sb_cnt = min_t(u8, bp->igu_sb_cnt, bp->l2_cid_count);
+        if (bp->igu_sb_cnt == 0)
+                BNX2X_ERR("CAM configuration error\n");
+}
+
 static void __devinit bnx2x_link_settings_supported(struct bnx2x *bp,
                                                     u32 switch_cfg)
 {
@@ -6079,7 +7807,7 @@ static void __devinit bnx2x_link_settings_supported(struct bnx2x *bp,
                            SHMEM_RD(bp,
                            dev_info.port_hw_config[port].external_phy_config2));
                         return;
-                }
+        }
 
         switch (switch_cfg) {
         case SWITCH_CFG_1G:
@@ -6092,7 +7820,6 @@ static void __devinit bnx2x_link_settings_supported(struct bnx2x *bp,
                 bp->port.phy_addr = REG_RD(bp, NIG_REG_XGXS0_CTRL_PHY_ADDR +
                                            port*0x18);
                 BNX2X_DEV_INFO("phy_addr 0x%x\n", bp->port.phy_addr);
-
                 break;
 
         default:
@@ -6121,7 +7848,7 @@ static void __devinit bnx2x_link_settings_supported(struct bnx2x *bp,
                 if (!(bp->link_params.speed_cap_mask[idx] &
                                         PORT_HW_CFG_SPEED_CAPABILITY_D0_1G))
                         bp->port.supported[idx] &= ~(SUPPORTED_1000baseT_Half |
-                                        SUPPORTED_1000baseT_Full);
+                                                     SUPPORTED_1000baseT_Full);
 
                 if (!(bp->link_params.speed_cap_mask[idx] &
                                         PORT_HW_CFG_SPEED_CAPABILITY_D0_2_5G))
@@ -6155,41 +7882,41 @@ static void __devinit bnx2x_link_settings_requested(struct bnx2x *bp)
                 bp->link_params.req_duplex[idx] = DUPLEX_FULL;
                 link_config = bp->port.link_config[idx];
                 switch (link_config & PORT_FEATURE_LINK_SPEED_MASK) {
-        case PORT_FEATURE_LINK_SPEED_AUTO:
+                case PORT_FEATURE_LINK_SPEED_AUTO:
                         if (bp->port.supported[idx] & SUPPORTED_Autoneg) {
                                 bp->link_params.req_line_speed[idx] =
                                         SPEED_AUTO_NEG;
                                 bp->port.advertising[idx] |=
                                         bp->port.supported[idx];
-                } else {
-                        /* force 10G, no AN */
+                        } else {
+                                /* force 10G, no AN */
                                 bp->link_params.req_line_speed[idx] =
                                         SPEED_10000;
                                 bp->port.advertising[idx] |=
                                         (ADVERTISED_10000baseT_Full |
-                                                 ADVERTISED_FIBRE);
+                                         ADVERTISED_FIBRE);
                                 continue;
-                }
-                break;
+                        }
+                        break;
 
-        case PORT_FEATURE_LINK_SPEED_10M_FULL:
+                case PORT_FEATURE_LINK_SPEED_10M_FULL:
                         if (bp->port.supported[idx] & SUPPORTED_10baseT_Full) {
                                 bp->link_params.req_line_speed[idx] =
                                         SPEED_10;
                                 bp->port.advertising[idx] |=
                                         (ADVERTISED_10baseT_Full |
-                                                ADVERTISED_TP);
-                } else {
-                        BNX2X_ERROR("NVRAM config error. "
-                                    "Invalid link_config 0x%x"
-                                    "  speed_cap_mask 0x%x\n",
-                                    link_config,
+                                         ADVERTISED_TP);
+                        } else {
+                                BNX2X_ERROR("NVRAM config error. "
+                                            "Invalid link_config 0x%x"
+                                            "  speed_cap_mask 0x%x\n",
+                                            link_config,
                                     bp->link_params.speed_cap_mask[idx]);
-                        return;
-                }
-                break;
+                                return;
+                        }
+                        break;
 
-        case PORT_FEATURE_LINK_SPEED_10M_HALF:
+                case PORT_FEATURE_LINK_SPEED_10M_HALF:
                         if (bp->port.supported[idx] & SUPPORTED_10baseT_Half) {
                                 bp->link_params.req_line_speed[idx] =
                                         SPEED_10;
@@ -6197,70 +7924,74 @@ static void __devinit bnx2x_link_settings_requested(struct bnx2x *bp)
                                         DUPLEX_HALF;
                                 bp->port.advertising[idx] |=
                                         (ADVERTISED_10baseT_Half |
-                                                ADVERTISED_TP);
-                } else {
-                        BNX2X_ERROR("NVRAM config error. "
-                                    "Invalid link_config 0x%x"
-                                    "  speed_cap_mask 0x%x\n",
-                                    link_config,
-                                    bp->link_params.speed_cap_mask[idx]);
-                        return;
-                }
-                break;
+                                         ADVERTISED_TP);
+                        } else {
+                                BNX2X_ERROR("NVRAM config error. "
+                                            "Invalid link_config 0x%x"
+                                            "  speed_cap_mask 0x%x\n",
+                                            link_config,
+                                          bp->link_params.speed_cap_mask[idx]);
+                                return;
+                        }
+                        break;
 
-        case PORT_FEATURE_LINK_SPEED_100M_FULL:
-                        if (bp->port.supported[idx] & SUPPORTED_100baseT_Full) {
+                case PORT_FEATURE_LINK_SPEED_100M_FULL:
+                        if (bp->port.supported[idx] &
+                            SUPPORTED_100baseT_Full) {
                                 bp->link_params.req_line_speed[idx] =
                                         SPEED_100;
                                 bp->port.advertising[idx] |=
                                         (ADVERTISED_100baseT_Full |
-                                                ADVERTISED_TP);
-                } else {
-                        BNX2X_ERROR("NVRAM config error. "
-                                    "Invalid link_config 0x%x"
-                                    "  speed_cap_mask 0x%x\n",
-                                    link_config,
-                                    bp->link_params.speed_cap_mask[idx]);
-                        return;
-                }
-                break;
+                                         ADVERTISED_TP);
+                        } else {
+                                BNX2X_ERROR("NVRAM config error. "
+                                            "Invalid link_config 0x%x"
+                                            "  speed_cap_mask 0x%x\n",
+                                            link_config,
+                                          bp->link_params.speed_cap_mask[idx]);
+                                return;
+                        }
+                        break;
 
-        case PORT_FEATURE_LINK_SPEED_100M_HALF:
-                        if (bp->port.supported[idx] & SUPPORTED_100baseT_Half) {
-                                bp->link_params.req_line_speed[idx] = SPEED_100;
-                                bp->link_params.req_duplex[idx] = DUPLEX_HALF;
+                case PORT_FEATURE_LINK_SPEED_100M_HALF:
+                        if (bp->port.supported[idx] &
+                            SUPPORTED_100baseT_Half) {
+                                bp->link_params.req_line_speed[idx] =
+                                                                SPEED_100;
+                                bp->link_params.req_duplex[idx] =
+                                                                DUPLEX_HALF;
                                 bp->port.advertising[idx] |=
                                         (ADVERTISED_100baseT_Half |
-                                                ADVERTISED_TP);
-                } else {
-                        BNX2X_ERROR("NVRAM config error. "
+                                         ADVERTISED_TP);
+                        } else {
+                                BNX2X_ERROR("NVRAM config error. "
                                     "Invalid link_config 0x%x"
                                     "  speed_cap_mask 0x%x\n",
                                     link_config,
                                     bp->link_params.speed_cap_mask[idx]);
-                        return;
-                }
-                break;
+                                return;
+                        }
+                        break;
 
-        case PORT_FEATURE_LINK_SPEED_1G:
+                case PORT_FEATURE_LINK_SPEED_1G:
                         if (bp->port.supported[idx] &
                             SUPPORTED_1000baseT_Full) {
                                 bp->link_params.req_line_speed[idx] =
                                         SPEED_1000;
                                 bp->port.advertising[idx] |=
                                         (ADVERTISED_1000baseT_Full |
-                                                ADVERTISED_TP);
-                } else {
-                        BNX2X_ERROR("NVRAM config error. "
+                                         ADVERTISED_TP);
+                        } else {
+                                BNX2X_ERROR("NVRAM config error. "
                                     "Invalid link_config 0x%x"
                                     "  speed_cap_mask 0x%x\n",
                                     link_config,
                                     bp->link_params.speed_cap_mask[idx]);
-                        return;
-                }
-                break;
+                                return;
+                        }
+                        break;
 
-        case PORT_FEATURE_LINK_SPEED_2_5G:
+                case PORT_FEATURE_LINK_SPEED_2_5G:
                         if (bp->port.supported[idx] &
                             SUPPORTED_2500baseX_Full) {
                                 bp->link_params.req_line_speed[idx] =
@@ -6268,19 +7999,19 @@ static void __devinit bnx2x_link_settings_requested(struct bnx2x *bp)
                                 bp->port.advertising[idx] |=
                                         (ADVERTISED_2500baseX_Full |
                                                 ADVERTISED_TP);
-                } else {
-                        BNX2X_ERROR("NVRAM config error. "
+                        } else {
+                                BNX2X_ERROR("NVRAM config error. "
                                     "Invalid link_config 0x%x"
                                     "  speed_cap_mask 0x%x\n",
                                     link_config,
-                                     bp->link_params.speed_cap_mask[idx]);
-                        return;
-                }
-                break;
+                                    bp->link_params.speed_cap_mask[idx]);
+                                return;
+                        }
+                        break;
 
-        case PORT_FEATURE_LINK_SPEED_10G_CX4:
-        case PORT_FEATURE_LINK_SPEED_10G_KX4:
-        case PORT_FEATURE_LINK_SPEED_10G_KR:
+                case PORT_FEATURE_LINK_SPEED_10G_CX4:
+                case PORT_FEATURE_LINK_SPEED_10G_KX4:
+                case PORT_FEATURE_LINK_SPEED_10G_KR:
                         if (bp->port.supported[idx] &
                             SUPPORTED_10000baseT_Full) {
                                 bp->link_params.req_line_speed[idx] =
@@ -6288,24 +8019,26 @@ static void __devinit bnx2x_link_settings_requested(struct bnx2x *bp)
                                 bp->port.advertising[idx] |=
                                         (ADVERTISED_10000baseT_Full |
                                                 ADVERTISED_FIBRE);
-                } else {
-                        BNX2X_ERROR("NVRAM config error. "
+                        } else {
+                                BNX2X_ERROR("NVRAM config error. "
                                     "Invalid link_config 0x%x"
                                     "  speed_cap_mask 0x%x\n",
                                     link_config,
-                                     bp->link_params.speed_cap_mask[idx]);
-                        return;
-                }
-                break;
+                                    bp->link_params.speed_cap_mask[idx]);
+                                return;
+                        }
+                        break;
 
-        default:
-                BNX2X_ERROR("NVRAM config error. "
-                            "BAD link speed link_config 0x%x\n",
-                                  link_config);
-                        bp->link_params.req_line_speed[idx] = SPEED_AUTO_NEG;
-                        bp->port.advertising[idx] = bp->port.supported[idx];
-                break;
-        }
+                default:
+                        BNX2X_ERROR("NVRAM config error. "
+                                    "BAD link speed link_config 0x%x\n",
+                                          link_config);
+                                bp->link_params.req_line_speed[idx] =
+                                                        SPEED_AUTO_NEG;
+                                bp->port.advertising[idx] =
+                                                bp->port.supported[idx];
+                        break;
+                }
 
                 bp->link_params.req_flow_ctrl[idx] = (link_config &
                                          PORT_FEATURE_FLOW_CONTROL_MASK);
@@ -6367,14 +8100,14 @@ static void __devinit bnx2x_get_port_hwinfo(struct bnx2x *bp)
         bp->wol = (!(bp->flags & NO_WOL_FLAG) &&
                    (config & PORT_FEATURE_WOL_ENABLED));
 
-        BNX2X_DEV_INFO("lane_config 0x%08x"
+        BNX2X_DEV_INFO("lane_config 0x%08x  "
                        "speed_cap_mask0 0x%08x  link_config0 0x%08x\n",
                        bp->link_params.lane_config,
                        bp->link_params.speed_cap_mask[0],
                        bp->port.link_config[0]);
 
         bp->link_params.switch_cfg = (bp->port.link_config[0] &
-                                       PORT_FEATURE_CONNECTED_SWITCH_MASK);
+                                      PORT_FEATURE_CONNECTED_SWITCH_MASK);
         bnx2x_phy_probe(&bp->link_params);
         bnx2x_link_settings_supported(bp, bp->link_params.switch_cfg);
 
@@ -6411,41 +8144,74 @@ static void __devinit bnx2x_get_port_hwinfo(struct bnx2x *bp)
 
 static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
 {
-        int func = BP_FUNC(bp);
+        int func = BP_ABS_FUNC(bp);
+        int vn;
         u32 val, val2;
         int rc = 0;
 
         bnx2x_get_common_hwinfo(bp);
 
-        bp->e1hov = 0;
-        bp->e1hmf = 0;
-        if (CHIP_IS_E1H(bp) && !BP_NOMCP(bp)) {
-                bp->mf_config =
-                        SHMEM_RD(bp, mf_cfg.func_mf_config[func].config);
+        if (CHIP_IS_E1x(bp)) {
+                bp->common.int_block = INT_BLOCK_HC;
+
+                bp->igu_dsb_id = DEF_SB_IGU_ID;
+                bp->igu_base_sb = 0;
+                bp->igu_sb_cnt = min_t(u8, FP_SB_MAX_E1x, bp->l2_cid_count);
+        } else {
+                bp->common.int_block = INT_BLOCK_IGU;
+                val = REG_RD(bp, IGU_REG_BLOCK_CONFIGURATION);
+                if (val & IGU_BLOCK_CONFIGURATION_REG_BACKWARD_COMP_EN) {
+                        DP(NETIF_MSG_PROBE, "IGU Backward Compatible Mode\n");
+                        bp->common.int_block |= INT_BLOCK_MODE_BW_COMP;
+                } else
+                        DP(NETIF_MSG_PROBE, "IGU Normal Mode\n");
+
+                bnx2x_get_igu_cam_info(bp);
+
+        }
+        DP(NETIF_MSG_PROBE, "igu_dsb_id %d  igu_base_sb %d  igu_sb_cnt %d\n",
+                             bp->igu_dsb_id, bp->igu_base_sb, bp->igu_sb_cnt);
+
+        /*
+         * Initialize MF configuration
+         */
 
-                val = (SHMEM_RD(bp, mf_cfg.func_mf_config[FUNC_0].e1hov_tag) &
+        bp->mf_ov = 0;
+        bp->mf_mode = 0;
+        vn = BP_E1HVN(bp);
+        if (!CHIP_IS_E1(bp) && !BP_NOMCP(bp)) {
+                if (SHMEM2_HAS(bp, mf_cfg_addr))
+                        bp->common.mf_cfg_base = SHMEM2_RD(bp, mf_cfg_addr);
+                else
+                        bp->common.mf_cfg_base = bp->common.shmem_base +
+                                offsetof(struct shmem_region, func_mb) +
+                                E1H_FUNC_MAX * sizeof(struct drv_func_mb);
+                bp->mf_config[vn] =
+                        MF_CFG_RD(bp, func_mf_config[func].config);
+
+                val = (MF_CFG_RD(bp, func_mf_config[FUNC_0].e1hov_tag) &
                        FUNC_MF_CFG_E1HOV_TAG_MASK);
                 if (val != FUNC_MF_CFG_E1HOV_TAG_DEFAULT)
-                        bp->e1hmf = 1;
+                        bp->mf_mode = 1;
                 BNX2X_DEV_INFO("%s function mode\n",
-                               IS_E1HMF(bp) ? "multi" : "single");
+                               IS_MF(bp) ? "multi" : "single");
 
-                if (IS_E1HMF(bp)) {
-                        val = (SHMEM_RD(bp, mf_cfg.func_mf_config[func].
+                if (IS_MF(bp)) {
+                        val = (MF_CFG_RD(bp, func_mf_config[func].
                                                                 e1hov_tag) &
                                FUNC_MF_CFG_E1HOV_TAG_MASK);
                         if (val != FUNC_MF_CFG_E1HOV_TAG_DEFAULT) {
-                                bp->e1hov = val;
-                                BNX2X_DEV_INFO("E1HOV for func %d is %d "
+                                bp->mf_ov = val;
+                                BNX2X_DEV_INFO("MF OV for func %d is %d "
                                                "(0x%04x)\n",
-                                               func, bp->e1hov, bp->e1hov);
+                                               func, bp->mf_ov, bp->mf_ov);
                         } else {
-                                BNX2X_ERROR("No valid E1HOV for func %d,"
+                                BNX2X_ERROR("No valid MF OV for func %d,"
                                             "  aborting\n", func);
                                 rc = -EPERM;
                         }
                 } else {
-                        if (BP_E1HVN(bp)) {
+                        if (BP_VN(bp)) {
                                 BNX2X_ERROR("VN %d in single function mode,"
                                             "  aborting\n", BP_E1HVN(bp));
                                 rc = -EPERM;
@@ -6453,17 +8219,31 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
                 }
         }
 
+        /* adjust igu_sb_cnt to MF for E1x */
+        if (CHIP_IS_E1x(bp) && IS_MF(bp))
+                bp->igu_sb_cnt /= E1HVN_MAX;
+
+        /*
+         * adjust E2 sb count: to be removed when FW will support
+         * more then 16 L2 clients
+         */
+#define MAX_L2_CLIENTS                          16
+        if (CHIP_IS_E2(bp))
+                bp->igu_sb_cnt = min_t(u8, bp->igu_sb_cnt,
+                                       MAX_L2_CLIENTS / (IS_MF(bp) ? 4 : 1));
+
         if (!BP_NOMCP(bp)) {
                 bnx2x_get_port_hwinfo(bp);
 
-                bp->fw_seq = (SHMEM_RD(bp, func_mb[func].drv_mb_header) &
-                              DRV_MSG_SEQ_NUMBER_MASK);
+                bp->fw_seq =
+                        (SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) &
+                         DRV_MSG_SEQ_NUMBER_MASK);
                 BNX2X_DEV_INFO("fw_seq 0x%08x\n", bp->fw_seq);
         }
 
-        if (IS_E1HMF(bp)) {
-                val2 = SHMEM_RD(bp, mf_cfg.func_mf_config[func].mac_upper);
-                val = SHMEM_RD(bp,  mf_cfg.func_mf_config[func].mac_lower);
+        if (IS_MF(bp)) {
+                val2 = MF_CFG_RD(bp, func_mf_config[func].mac_upper);
+                val = MF_CFG_RD(bp,  func_mf_config[func].mac_lower);
                 if ((val2 != FUNC_MF_CFG_UPPERMAC_DEFAULT) &&
                     (val != FUNC_MF_CFG_LOWERMAC_DEFAULT)) {
                         bp->dev->dev_addr[0] = (u8)(val2 >> 8 & 0xff);
@@ -6557,7 +8337,7 @@ out_not_found:
 
 static int __devinit bnx2x_init_bp(struct bnx2x *bp)
 {
-        int func = BP_FUNC(bp);
+        int func;
         int timer_interval;
         int rc;
 
@@ -6577,7 +8357,13 @@ static int __devinit bnx2x_init_bp(struct bnx2x *bp)
 
         rc = bnx2x_get_hwinfo(bp);
 
+        if (!rc)
+                rc = bnx2x_alloc_mem_bp(bp);
+
         bnx2x_read_fwinfo(bp);
+
+        func = BP_FUNC(bp);
+
         /* need to reset chip if undi was active */
         if (!BP_NOMCP(bp))
                 bnx2x_undi_unload(bp);
@@ -6623,8 +8409,8 @@ static int __devinit bnx2x_init_bp(struct bnx2x *bp)
         bp->rx_csum = 1;
 
         /* make sure that the numbers are in the right granularity */
-        bp->tx_ticks = (50 / (4 * BNX2X_BTR)) * (4 * BNX2X_BTR);
-        bp->rx_ticks = (25 / (4 * BNX2X_BTR)) * (4 * BNX2X_BTR);
+        bp->tx_ticks = (50 / BNX2X_BTR) * BNX2X_BTR;
+        bp->rx_ticks = (25 / BNX2X_BTR) * BNX2X_BTR;
 
         timer_interval = (CHIP_REV_IS_SLOW(bp) ? 5*HZ : HZ);
         bp->current_interval = (poll ? poll : timer_interval);
@@ -6716,81 +8502,22 @@ void bnx2x_set_rx_mode(struct net_device *dev)
 
         if (dev->flags & IFF_PROMISC)
                 rx_mode = BNX2X_RX_MODE_PROMISC;
-
         else if ((dev->flags & IFF_ALLMULTI) ||
                  ((netdev_mc_count(dev) > BNX2X_MAX_MULTICAST) &&
                   CHIP_IS_E1(bp)))
                 rx_mode = BNX2X_RX_MODE_ALLMULTI;
-
         else { /* some multicasts */
                 if (CHIP_IS_E1(bp)) {
-                        int i, old, offset;
-                        struct netdev_hw_addr *ha;
-                        struct mac_configuration_cmd *config =
-                                                bnx2x_sp(bp, mcast_config);
-
-                        i = 0;
-                        netdev_for_each_mc_addr(ha, dev) {
-                                config->config_table[i].
-                                        cam_entry.msb_mac_addr =
-                                        swab16(*(u16 *)&ha->addr[0]);
-                                config->config_table[i].
-                                        cam_entry.middle_mac_addr =
-                                        swab16(*(u16 *)&ha->addr[2]);
-                                config->config_table[i].
-                                        cam_entry.lsb_mac_addr =
-                                        swab16(*(u16 *)&ha->addr[4]);
-                                config->config_table[i].cam_entry.flags =
-                                                        cpu_to_le16(port);
-                                config->config_table[i].
-                                        target_table_entry.flags = 0;
-                                config->config_table[i].target_table_entry.
-                                        clients_bit_vector =
-                                                cpu_to_le32(1 << BP_L_ID(bp));
-                                config->config_table[i].
-                                        target_table_entry.vlan_id = 0;
-
-                                DP(NETIF_MSG_IFUP,
-                                   "setting MCAST[%d] (%04x:%04x:%04x)\n", i,
-                                   config->config_table[i].
-                                                cam_entry.msb_mac_addr,
-                                   config->config_table[i].
-                                                cam_entry.middle_mac_addr,
-                                   config->config_table[i].
-                                                cam_entry.lsb_mac_addr);
-                                i++;
-                        }
-                        old = config->hdr.length;
-                        if (old > i) {
-                                for (; i < old; i++) {
-                                        if (CAM_IS_INVALID(config->
-                                                           config_table[i])) {
-                                                /* already invalidated */
-                                                break;
-                                        }
-                                        /* invalidate */
-                                        CAM_INVALIDATE(config->
-                                                       config_table[i]);
-                                }
-                        }
-
-                        if (CHIP_REV_IS_SLOW(bp))
-                                offset = BNX2X_MAX_EMUL_MULTI*(1 + port);
-                        else
-                                offset = BNX2X_MAX_MULTICAST*(1 + port);
-
-                        config->hdr.length = i;
-                        config->hdr.offset = offset;
-                        config->hdr.client_id = bp->fp->cl_id;
-                        config->hdr.reserved1 = 0;
-
-                        bp->set_mac_pending++;
-                        smp_wmb();
+                        /*
+                         * set mc list, do not wait as wait implies sleep
+                         * and set_rx_mode can be invoked from non-sleepable
+                         * context
+                         */
+                        u8 offset = (CHIP_REV_IS_SLOW(bp) ?
+                                     BNX2X_MAX_EMUL_MULTI*(1 + port) :
+                                     BNX2X_MAX_MULTICAST*(1 + port));
 
-                        bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_SET_MAC, 0,
-                                   U64_HI(bnx2x_sp_mapping(bp, mcast_config)),
-                                   U64_LO(bnx2x_sp_mapping(bp, mcast_config)),
-                                      0);
+                        bnx2x_set_e1_mc_list(bp, offset);
                 } else { /* E1H */
                         /* Accept one or more multicasts */
                         struct netdev_hw_addr *ha;
@@ -6802,9 +8529,10 @@ void bnx2x_set_rx_mode(struct net_device *dev)
 
                         netdev_for_each_mc_addr(ha, dev) {
                                 DP(NETIF_MSG_IFUP, "Adding mcast MAC: %pM\n",
-                                   ha->addr);
+                                   bnx2x_mc_addr(ha));
 
-                                crc = crc32c_le(0, ha->addr, ETH_ALEN);
+                                crc = crc32c_le(0, bnx2x_mc_addr(ha),
+                                                ETH_ALEN);
                                 bit = (crc >> 24) & 0xff;
                                 regidx = bit >> 5;
                                 bit &= 0x1f;
@@ -6821,7 +8549,6 @@ void bnx2x_set_rx_mode(struct net_device *dev)
         bnx2x_set_storm_rx_mode(bp);
 }
 
-
 /* called with rtnl_lock */
 static int bnx2x_mdio_read(struct net_device *netdev, int prtad,
                            int devad, u16 addr)
@@ -6901,9 +8628,6 @@ static const struct net_device_ops bnx2x_netdev_ops = {
         .ndo_do_ioctl           = bnx2x_ioctl,
         .ndo_change_mtu         = bnx2x_change_mtu,
         .ndo_tx_timeout         = bnx2x_tx_timeout,
-#ifdef BCM_VLAN
-        .ndo_vlan_rx_register   = bnx2x_vlan_rx_register,
-#endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = poll_bnx2x,
 #endif
@@ -6921,7 +8645,7 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
         bp->dev = dev;
         bp->pdev = pdev;
         bp->flags = 0;
-        bp->func = PCI_FUNC(pdev->devfn);
+        bp->pf_num = PCI_FUNC(pdev->devfn);
 
         rc = pci_enable_device(pdev);
         if (rc) {
@@ -7003,7 +8727,7 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
         }
 
         bp->doorbells = ioremap_nocache(pci_resource_start(pdev, 2),
-                                        min_t(u64, BNX2X_DB_SIZE,
+                                        min_t(u64, BNX2X_DB_SIZE(bp),
                                               pci_resource_len(pdev, 2)));
         if (!bp->doorbells) {
                 dev_err(&bp->pdev->dev,
@@ -7035,9 +8759,7 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
                 dev->features |= NETIF_F_HIGHDMA;
         dev->features |= (NETIF_F_TSO | NETIF_F_TSO_ECN);
         dev->features |= NETIF_F_TSO6;
-#ifdef BCM_VLAN
         dev->features |= (NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX);
-        bp->flags |= (HW_VLAN_RX_FLAG | HW_VLAN_TX_FLAG);
 
         dev->vlan_features |= NETIF_F_SG;
         dev->vlan_features |= NETIF_F_HW_CSUM;
@@ -7045,7 +8767,6 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
                 dev->vlan_features |= NETIF_F_HIGHDMA;
         dev->vlan_features |= (NETIF_F_TSO | NETIF_F_TSO_ECN);
         dev->vlan_features |= NETIF_F_TSO6;
-#endif
 
         /* get_port_hwinfo() will set prtad and mmds properly */
         bp->mdio.prtad = MDIO_PRTAD_NONE;
@@ -7179,6 +8900,30 @@ static inline void bnx2x_prep_ops(const u8 *_source, u8 *_target, u32 n)
         }
 }
 
+/**
+ * IRO array is stored in the following format:
+ * {base(24bit), m1(16bit), m2(16bit), m3(16bit), size(16bit) }
+ */
+static inline void bnx2x_prep_iro(const u8 *_source, u8 *_target, u32 n)
+{
+        const __be32 *source = (const __be32 *)_source;
+        struct iro *target = (struct iro *)_target;
+        u32 i, j, tmp;
+
+        for (i = 0, j = 0; i < n/sizeof(struct iro); i++) {
+                target[i].base = be32_to_cpu(source[j]);
+                j++;
+                tmp = be32_to_cpu(source[j]);
+                target[i].m1 = (tmp >> 16) & 0xffff;
+                target[i].m2 = tmp & 0xffff;
+                j++;
+                tmp = be32_to_cpu(source[j]);
+                target[i].m3 = (tmp >> 16) & 0xffff;
+                target[i].size = tmp & 0xffff;
+                j++;
+        }
+}
+
 static inline void be16_to_cpu_n(const u8 *_source, u8 *_target, u32 n)
 {
         const __be16 *source = (const __be16 *)_source;
@@ -7211,6 +8956,8 @@ int bnx2x_init_firmware(struct bnx2x *bp)
                 fw_file_name = FW_FILE_NAME_E1;
         else if (CHIP_IS_E1H(bp))
                 fw_file_name = FW_FILE_NAME_E1H;
+        else if (CHIP_IS_E2(bp))
+                fw_file_name = FW_FILE_NAME_E2;
         else {
                 BNX2X_ERR("Unsupported chip revision\n");
                 return -EINVAL;
@@ -7260,9 +9007,13 @@ int bnx2x_init_firmware(struct bnx2x *bp)
                         be32_to_cpu(fw_hdr->csem_int_table_data.offset);
         INIT_CSEM_PRAM_DATA(bp)      = bp->firmware->data +
                         be32_to_cpu(fw_hdr->csem_pram_data.offset);
+        /* IRO */
+        BNX2X_ALLOC_AND_SET(iro_arr, iro_alloc_err, bnx2x_prep_iro);
 
         return 0;
 
+iro_alloc_err:
+        kfree(bp->init_ops_offsets);
 init_offsets_alloc_err:
         kfree(bp->init_ops);
 init_ops_alloc_err:
@@ -7273,6 +9024,15 @@ request_firmware_exit:
         return rc;
 }
 
+static inline int bnx2x_set_qm_cid_count(struct bnx2x *bp, int l2_cid_count)
+{
+        int cid_count = L2_FP_COUNT(l2_cid_count);
+
+#ifdef BCM_CNIC
+        cid_count += CNIC_CID_MAX;
+#endif
+        return roundup(cid_count, QM_CID_ROUND);
+}
 
 static int __devinit bnx2x_init_one(struct pci_dev *pdev,
                                     const struct pci_device_id *ent)
@@ -7280,10 +9040,30 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
         struct net_device *dev = NULL;
         struct bnx2x *bp;
         int pcie_width, pcie_speed;
-        int rc;
+        int rc, cid_count;
+
+        switch (ent->driver_data) {
+        case BCM57710:
+        case BCM57711:
+        case BCM57711E:
+                cid_count = FP_SB_MAX_E1x;
+                break;
+
+        case BCM57712:
+        case BCM57712E:
+                cid_count = FP_SB_MAX_E2;
+                break;
+
+        default:
+                pr_err("Unknown board_type (%ld), aborting\n",
+                           ent->driver_data);
+                return ENODEV;
+        }
+
+        cid_count += CNIC_CONTEXT_USE;
 
         /* dev zeroed in init_etherdev */
-        dev = alloc_etherdev_mq(sizeof(*bp), MAX_CONTEXT);
+        dev = alloc_etherdev_mq(sizeof(*bp), cid_count);
         if (!dev) {
                 dev_err(&pdev->dev, "Cannot allocate net device\n");
                 return -ENOMEM;
@@ -7294,6 +9074,8 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
 
         pci_set_drvdata(pdev, dev);
 
+        bp->l2_cid_count = cid_count;
+
         rc = bnx2x_init_dev(pdev, dev);
         if (rc < 0) {
                 free_netdev(dev);
@@ -7304,17 +9086,32 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
         if (rc)
                 goto init_one_exit;
 
+        /* calc qm_cid_count */
+        bp->qm_cid_count = bnx2x_set_qm_cid_count(bp, cid_count);
+
         rc = register_netdev(dev);
         if (rc) {
                 dev_err(&pdev->dev, "Cannot register net device\n");
                 goto init_one_exit;
         }
 
+        /* Configure interupt mode: try to enable MSI-X/MSI if
+         * needed, set bp->num_queues appropriately.
+         */
+        bnx2x_set_int_mode(bp);
+
+        /* Add all NAPI objects */
+        bnx2x_add_all_napi(bp);
+
         bnx2x_get_pcie_width_speed(bp, &pcie_width, &pcie_speed);
+
         netdev_info(dev, "%s (%c%d) PCI-E x%d %s found at mem %lx,"
                " IRQ %d, ", board_info[ent->driver_data].name,
                (CHIP_REV(bp) >> 12) + 'A', (CHIP_METAL(bp) >> 4),
-               pcie_width, (pcie_speed == 2) ? "5GHz (Gen2)" : "2.5GHz",
+               pcie_width,
+               ((!CHIP_IS_E2(bp) && pcie_speed == 2) ||
+                 (CHIP_IS_E2(bp) && pcie_speed == 1)) ?
+                                                "5GHz (Gen2)" : "2.5GHz",
                dev->base_addr, bp->pdev->irq);
         pr_cont("node addr %pM\n", dev->dev_addr);
 
@@ -7351,6 +9148,12 @@ static void __devexit bnx2x_remove_one(struct pci_dev *pdev)
 
         unregister_netdev(dev);
 
+        /* Delete all NAPI objects */
+        bnx2x_del_all_napi(bp);
+
+        /* Disable MSI/MSI-X */
+        bnx2x_disable_msi(bp);
+
         /* Make sure RESET task is not scheduled before continuing */
         cancel_delayed_work_sync(&bp->reset_task);
 
@@ -7360,6 +9163,8 @@ static void __devexit bnx2x_remove_one(struct pci_dev *pdev)
         if (bp->doorbells)
                 iounmap(bp->doorbells);
 
+        bnx2x_free_mem_bp(bp);
+
         free_netdev(dev);
 
         if (atomic_read(&pdev->enable_cnt) == 1)
@@ -7385,22 +9190,14 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
         DP(BNX2X_MSG_STATS, "stats_state - DISABLED\n");
 
         /* Release IRQs */
-        bnx2x_free_irq(bp, false);
-
-        if (CHIP_IS_E1(bp)) {
-                struct mac_configuration_cmd *config =
-                                                bnx2x_sp(bp, mcast_config);
-
-                for (i = 0; i < config->hdr.length; i++)
-                        CAM_INVALIDATE(config->config_table[i]);
-        }
+        bnx2x_free_irq(bp);
 
         /* Free SKBs, SGEs, TPA pool and driver internals */
         bnx2x_free_skbs(bp);
+
         for_each_queue(bp, i)
                 bnx2x_free_rx_sge_range(bp, bp->fp + i, NUM_RX_SGE);
-        for_each_queue(bp, i)
-                netif_napi_del(&bnx2x_fp(bp, i, napi));
+
         bnx2x_free_mem(bp);
 
         bp->state = BNX2X_STATE_CLOSED;
@@ -7432,8 +9229,9 @@ static void bnx2x_eeh_recover(struct bnx2x *bp)
                 BNX2X_ERR("BAD MCP validity signature\n");
 
         if (!BP_NOMCP(bp)) {
-                bp->fw_seq = (SHMEM_RD(bp, func_mb[BP_FUNC(bp)].drv_mb_header)
-                              & DRV_MSG_SEQ_NUMBER_MASK);
+                bp->fw_seq =
+                    (SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) &
+                    DRV_MSG_SEQ_NUMBER_MASK);
                 BNX2X_DEV_INFO("fw_seq 0x%08x\n", bp->fw_seq);
         }
 }
@@ -7516,7 +9314,8 @@ static void bnx2x_io_resume(struct pci_dev *pdev)
         struct bnx2x *bp = netdev_priv(dev);
 
         if (bp->recovery_state != BNX2X_RECOVERY_DONE) {
-                printk(KERN_ERR "Handling parity error recovery. Try again later\n");
+                printk(KERN_ERR "Handling parity error recovery. "
+                                "Try again later\n");
                 return;
         }
 
@@ -7591,19 +9390,53 @@ static void bnx2x_cnic_sp_post(struct bnx2x *bp, int count)
 #endif
 
         spin_lock_bh(&bp->spq_lock);
+        BUG_ON(bp->cnic_spq_pending < count);
         bp->cnic_spq_pending -= count;
 
-        for (; bp->cnic_spq_pending < bp->cnic_eth_dev.max_kwqe_pending;
-             bp->cnic_spq_pending++) {
 
-                if (!bp->cnic_kwq_pending)
+        for (; bp->cnic_kwq_pending; bp->cnic_kwq_pending--) {
+                u16 type =  (le16_to_cpu(bp->cnic_kwq_cons->hdr.type)
+                                & SPE_HDR_CONN_TYPE) >>
+                                SPE_HDR_CONN_TYPE_SHIFT;
+
+                /* Set validation for iSCSI L2 client before sending SETUP
+                 *  ramrod
+                 */
+                if (type == ETH_CONNECTION_TYPE) {
+                        u8 cmd = (le32_to_cpu(bp->cnic_kwq_cons->
+                                             hdr.conn_and_cmd_data) >>
+                                SPE_HDR_CMD_ID_SHIFT) & 0xff;
+
+                        if (cmd == RAMROD_CMD_ID_ETH_CLIENT_SETUP)
+                                bnx2x_set_ctx_validation(&bp->context.
+                                                vcxt[BNX2X_ISCSI_ETH_CID].eth,
+                                        HW_CID(bp, BNX2X_ISCSI_ETH_CID));
+                }
+
+                /* There may be not more than 8 L2 and COMMON SPEs and not more
+                 * than 8 L5 SPEs in the air.
+                 */
+                if ((type == NONE_CONNECTION_TYPE) ||
+                    (type == ETH_CONNECTION_TYPE)) {
+                        if (!atomic_read(&bp->spq_left))
+                                break;
+                        else
+                                atomic_dec(&bp->spq_left);
+                } else if (type == ISCSI_CONNECTION_TYPE) {
+                        if (bp->cnic_spq_pending >=
+                            bp->cnic_eth_dev.max_kwqe_pending)
+                                break;
+                        else
+                                bp->cnic_spq_pending++;
+                } else {
+                        BNX2X_ERR("Unknown SPE type: %d\n", type);
+                        bnx2x_panic();
                         break;
+                }
 
                 spe = bnx2x_sp_get_next(bp);
                 *spe = *bp->cnic_kwq_cons;
 
-                bp->cnic_kwq_pending--;
-
                 DP(NETIF_MSG_TIMER, "pending on SPQ %d, on KWQ %d count %d\n",
                    bp->cnic_spq_pending, bp->cnic_kwq_pending, count);
 
@@ -7641,8 +9474,8 @@ static int bnx2x_cnic_sp_queue(struct net_device *dev,
 
                 DP(NETIF_MSG_TIMER, "L5 SPQE %x %x %x:%x pos %d\n",
                    spe->hdr.conn_and_cmd_data, spe->hdr.type,
-                   spe->data.mac_config_addr.hi,
-                   spe->data.mac_config_addr.lo,
+                   spe->data.update_data_addr.hi,
+                   spe->data.update_data_addr.lo,
                    bp->cnic_kwq_pending);
 
                 if (bp->cnic_kwq_prod == bp->cnic_kwq_last)
@@ -7708,7 +9541,7 @@ static void bnx2x_cnic_cfc_comp(struct bnx2x *bp, int cid)
         ctl.data.comp.cid = cid;
 
         bnx2x_cnic_ctl_send_bh(bp, &ctl);
-        bnx2x_cnic_sp_post(bp, 1);
+        bnx2x_cnic_sp_post(bp, 0);
 }
 
 static int bnx2x_drv_ctl(struct net_device *dev, struct drv_ctl_info *ctl)
@@ -7725,8 +9558,8 @@ static int bnx2x_drv_ctl(struct net_device *dev, struct drv_ctl_info *ctl)
                 break;
         }
 
-        case DRV_CTL_COMPLETION_CMD: {
-                int count = ctl->data.comp.comp_count;
+        case DRV_CTL_RET_L5_SPQ_CREDIT_CMD: {
+                int count = ctl->data.credit.credit_count;
 
                 bnx2x_cnic_sp_post(bp, count);
                 break;
@@ -7736,8 +9569,24 @@ static int bnx2x_drv_ctl(struct net_device *dev, struct drv_ctl_info *ctl)
         case DRV_CTL_START_L2_CMD: {
                 u32 cli = ctl->data.ring.client_id;
 
-                bp->rx_mode_cl_mask |= (1 << cli);
-                bnx2x_set_storm_rx_mode(bp);
+                /* Set iSCSI MAC address */
+                bnx2x_set_iscsi_eth_mac_addr(bp, 1);
+
+                mmiowb();
+                barrier();
+
+                /* Start accepting on iSCSI L2 ring. Accept all multicasts
+                 * because it's the only way for UIO Client to accept
+                 * multicasts (in non-promiscuous mode only one Client per
+                 * function will receive multicast packets (leading in our
+                 * case).
+                 */
+                bnx2x_rxq_set_mac_filters(bp, cli,
+                        BNX2X_ACCEPT_UNICAST |
+                        BNX2X_ACCEPT_BROADCAST |
+                        BNX2X_ACCEPT_ALL_MULTICAST);
+                storm_memset_mac_filters(bp, &bp->mac_filters, BP_FUNC(bp));
+
                 break;
         }
 
@@ -7745,8 +9594,23 @@ static int bnx2x_drv_ctl(struct net_device *dev, struct drv_ctl_info *ctl)
         case DRV_CTL_STOP_L2_CMD: {
                 u32 cli = ctl->data.ring.client_id;
 
-                bp->rx_mode_cl_mask &= ~(1 << cli);
-                bnx2x_set_storm_rx_mode(bp);
+                /* Stop accepting on iSCSI L2 ring */
+                bnx2x_rxq_set_mac_filters(bp, cli, BNX2X_ACCEPT_NONE);
+                storm_memset_mac_filters(bp, &bp->mac_filters, BP_FUNC(bp));
+
+                mmiowb();
+                barrier();
+
+                /* Unset iSCSI L2 MAC */
+                bnx2x_set_iscsi_eth_mac_addr(bp, 0);
+                break;
+        }
+        case DRV_CTL_RET_L2_SPQ_CREDIT_CMD: {
+                int count = ctl->data.credit.credit_count;
+
+                smp_mb__before_atomic_inc();
+                atomic_add(count, &bp->spq_left);
+                smp_mb__after_atomic_inc();
                 break;
         }
 
@@ -7770,10 +9634,16 @@ void bnx2x_setup_cnic_irq_info(struct bnx2x *bp)
                 cp->drv_state &= ~CNIC_DRV_STATE_USING_MSIX;
                 cp->irq_arr[0].irq_flags &= ~CNIC_IRQ_FL_MSIX;
         }
-        cp->irq_arr[0].status_blk = bp->cnic_sb;
+        if (CHIP_IS_E2(bp))
+                cp->irq_arr[0].status_blk = (void *)bp->cnic_sb.e2_sb;
+        else
+                cp->irq_arr[0].status_blk = (void *)bp->cnic_sb.e1x_sb;
+
         cp->irq_arr[0].status_blk_num = CNIC_SB_ID(bp);
+        cp->irq_arr[0].status_blk_num2 = CNIC_IGU_SB_ID(bp);
         cp->irq_arr[1].status_blk = bp->def_status_blk;
         cp->irq_arr[1].status_blk_num = DEF_SB_ID;
+        cp->irq_arr[1].status_blk_num2 = DEF_SB_IGU_ID;
 
         cp->num_irq = 2;
 }
@@ -7805,12 +9675,10 @@ static int bnx2x_register_cnic(struct net_device *dev, struct cnic_ops *ops,
 
         cp->num_irq = 0;
         cp->drv_state = CNIC_DRV_STATE_REGD;
-
-        bnx2x_init_sb(bp, bp->cnic_sb, bp->cnic_sb_mapping, CNIC_SB_ID(bp));
+        cp->iro_arr = bp->iro_arr;
 
         bnx2x_setup_cnic_irq_info(bp);
-        bnx2x_set_iscsi_eth_mac_addr(bp, 1);
-        bp->cnic_flags |= BNX2X_CNIC_FLAG_MAC_SET;
+
         rcu_assign_pointer(bp->cnic_ops, ops);
 
         return 0;
@@ -7847,15 +9715,24 @@ struct cnic_eth_dev *bnx2x_cnic_probe(struct net_device *dev)
         cp->io_base = bp->regview;
         cp->io_base2 = bp->doorbells;
         cp->max_kwqe_pending = 8;
-        cp->ctx_blk_size = CNIC_CTX_PER_ILT * sizeof(union cdu_context);
-        cp->ctx_tbl_offset = FUNC_ILT_BASE(BP_FUNC(bp)) + 1;
+        cp->ctx_blk_size = CDU_ILT_PAGE_SZ;
+        cp->ctx_tbl_offset = FUNC_ILT_BASE(BP_FUNC(bp)) +
+                             bnx2x_cid_ilt_lines(bp);
         cp->ctx_tbl_len = CNIC_ILT_LINES;
-        cp->starting_cid = BCM_CNIC_CID_START;
+        cp->starting_cid = bnx2x_cid_ilt_lines(bp) * ILT_PAGE_CIDS;
         cp->drv_submit_kwqes_16 = bnx2x_cnic_sp_queue;
         cp->drv_ctl = bnx2x_drv_ctl;
         cp->drv_register_cnic = bnx2x_register_cnic;
         cp->drv_unregister_cnic = bnx2x_unregister_cnic;
-
+        cp->iscsi_l2_client_id = BNX2X_ISCSI_ETH_CL_ID;
+        cp->iscsi_l2_cid = BNX2X_ISCSI_ETH_CID;
+
+        DP(BNX2X_MSG_SP, "page_size %d, tbl_offset %d, tbl_lines %d, "
+                         "starting cid %d\n",
+           cp->ctx_blk_size,
+           cp->ctx_tbl_offset,
+           cp->ctx_tbl_len,
+           cp->starting_cid);
         return cp;
 }
 EXPORT_SYMBOL(bnx2x_cnic_probe);
diff --git a/drivers/net/bnx2x/bnx2x_reg.h b/drivers/net/bnx2x/bnx2x_reg.h
index 6be0d09ad3fd..1cefe489a955 100644
--- a/drivers/net/bnx2x/bnx2x_reg.h
+++ b/drivers/net/bnx2x/bnx2x_reg.h
@@ -1,6 +1,6 @@
 /* bnx2x_reg.h: Broadcom Everest network driver.
  *
- * Copyright (c) 2007-2009 Broadcom Corporation
+ * Copyright (c) 2007-2010 Broadcom Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -19,7 +19,20 @@
  *
  */
 
-
+#define ATC_ATC_INT_STS_REG_ADDRESS_ERROR                        (0x1<<0)
+#define ATC_ATC_INT_STS_REG_ATC_GPA_MULTIPLE_HITS                (0x1<<2)
+#define ATC_ATC_INT_STS_REG_ATC_IREQ_LESS_THAN_STU               (0x1<<5)
+#define ATC_ATC_INT_STS_REG_ATC_RCPL_TO_EMPTY_CNT                (0x1<<3)
+#define ATC_ATC_INT_STS_REG_ATC_TCPL_ERROR                       (0x1<<4)
+#define ATC_ATC_INT_STS_REG_ATC_TCPL_TO_NOT_PEND                 (0x1<<1)
+/* [RW 1] Initiate the ATC array - reset all the valid bits */
+#define ATC_REG_ATC_INIT_ARRAY                                   0x1100b8
+/* [R 1] ATC initalization done */
+#define ATC_REG_ATC_INIT_DONE                                    0x1100bc
+/* [RC 6] Interrupt register #0 read clear */
+#define ATC_REG_ATC_INT_STS_CLR                          0x1101c0
+/* [RW 19] Interrupt mask register #0 read/write */
+#define BRB1_REG_BRB1_INT_MASK                                   0x60128
 /* [R 19] Interrupt register #0 read */
 #define BRB1_REG_BRB1_INT_STS                                    0x6011c
 /* [RW 4] Parity mask register #0 read/write */
@@ -27,9 +40,31 @@
 /* [R 4] Parity register #0 read */
 #define BRB1_REG_BRB1_PRTY_STS                                   0x6012c
 /* [RW 10] At address BRB1_IND_FREE_LIST_PRS_CRDT initialize free head. At
-   address BRB1_IND_FREE_LIST_PRS_CRDT+1 initialize free tail. At address
-   BRB1_IND_FREE_LIST_PRS_CRDT+2 initialize parser initial credit. */
+ * address BRB1_IND_FREE_LIST_PRS_CRDT+1 initialize free tail. At address
+ * BRB1_IND_FREE_LIST_PRS_CRDT+2 initialize parser initial credit. Warning -
+ * following reset the first rbc access to this reg must be write; there can
+ * be no more rbc writes after the first one; there can be any number of rbc
+ * read following the first write; rbc access not following these rules will
+ * result in hang condition. */
 #define BRB1_REG_FREE_LIST_PRS_CRDT                              0x60200
+/* [RW 10] The number of free blocks below which the full signal to class 0
+ * is asserted */
+#define BRB1_REG_FULL_0_XOFF_THRESHOLD_0                         0x601d0
+/* [RW 10] The number of free blocks above which the full signal to class 0
+ * is de-asserted */
+#define BRB1_REG_FULL_0_XON_THRESHOLD_0                          0x601d4
+/* [RW 10] The number of free blocks below which the full signal to class 1
+ * is asserted */
+#define BRB1_REG_FULL_1_XOFF_THRESHOLD_0                         0x601d8
+/* [RW 10] The number of free blocks above which the full signal to class 1
+ * is de-asserted */
+#define BRB1_REG_FULL_1_XON_THRESHOLD_0                          0x601dc
+/* [RW 10] The number of free blocks below which the full signal to the LB
+ * port is asserted */
+#define BRB1_REG_FULL_LB_XOFF_THRESHOLD                          0x601e0
+/* [RW 10] The number of free blocks above which the full signal to the LB
+ * port is de-asserted */
+#define BRB1_REG_FULL_LB_XON_THRESHOLD                           0x601e4
 /* [RW 10] The number of free blocks above which the High_llfc signal to
    interface #n is de-asserted. */
 #define BRB1_REG_HIGH_LLFC_HIGH_THRESHOLD_0                      0x6014c
@@ -44,6 +79,9 @@
 /* [RW 10] The number of free blocks below which the Low_llfc signal to
    interface #n is asserted. */
 #define BRB1_REG_LOW_LLFC_LOW_THRESHOLD_0                        0x6015c
+/* [RW 10] The number of blocks guarantied for the MAC port */
+#define BRB1_REG_MAC_GUARANTIED_0                                0x601e8
+#define BRB1_REG_MAC_GUARANTIED_1                                0x60240
 /* [R 24] The number of full blocks. */
 #define BRB1_REG_NUM_OF_FULL_BLOCKS                              0x60090
 /* [ST 32] The number of cycles that the write_full signal towards MAC #0
@@ -55,7 +93,19 @@
    asserted. */
 #define BRB1_REG_NUM_OF_PAUSE_CYCLES_0                           0x600b8
 #define BRB1_REG_NUM_OF_PAUSE_CYCLES_1                           0x600bc
-/* [RW 10] Write client 0: De-assert pause threshold. */
+/* [RW 10] The number of free blocks below which the pause signal to class 0
+ * is asserted */
+#define BRB1_REG_PAUSE_0_XOFF_THRESHOLD_0                        0x601c0
+/* [RW 10] The number of free blocks above which the pause signal to class 0
+ * is de-asserted */
+#define BRB1_REG_PAUSE_0_XON_THRESHOLD_0                         0x601c4
+/* [RW 10] The number of free blocks below which the pause signal to class 1
+ * is asserted */
+#define BRB1_REG_PAUSE_1_XOFF_THRESHOLD_0                        0x601c8
+/* [RW 10] The number of free blocks above which the pause signal to class 1
+ * is de-asserted */
+#define BRB1_REG_PAUSE_1_XON_THRESHOLD_0                         0x601cc
+/* [RW 10] Write client 0: De-assert pause threshold. Not Functional */
 #define BRB1_REG_PAUSE_HIGH_THRESHOLD_0                          0x60078
 #define BRB1_REG_PAUSE_HIGH_THRESHOLD_1                          0x6007c
 /* [RW 10] Write client 0: Assert pause threshold. */
@@ -362,6 +412,7 @@
 #define CFC_REG_NUM_LCIDS_ARRIVING                               0x104004
 /* [R 9] Number of Leaving LCIDs in Link List Block */
 #define CFC_REG_NUM_LCIDS_LEAVING                                0x104018
+#define CFC_REG_WEAK_ENABLE_PF                                   0x104124
 /* [RW 8] The event id for aggregated interrupt 0 */
 #define CSDM_REG_AGG_INT_EVENT_0                                 0xc2038
 #define CSDM_REG_AGG_INT_EVENT_10                                0xc2060
@@ -590,10 +641,17 @@
 #define CSEM_REG_TS_8_AS                                         0x200058
 /* [RW 3] The arbitration scheme of time_slot 9 */
 #define CSEM_REG_TS_9_AS                                         0x20005c
+/* [W 7] VF or PF ID for reset error bit. Values 0-63 reset error bit for 64
+ * VF; values 64-67 reset error for 4 PF; values 68-127 are not valid. */
+#define CSEM_REG_VFPF_ERR_NUM                                    0x200380
 /* [RW 1] Parity mask register #0 read/write */
 #define DBG_REG_DBG_PRTY_MASK                                    0xc0a8
 /* [R 1] Parity register #0 read */
 #define DBG_REG_DBG_PRTY_STS                                     0xc09c
+/* [RW 1] When set the DMAE will process the commands as in E1.5. 1.The
+ * function that is used is always SRC-PCI; 2.VF_Valid = 0; 3.VFID=0;
+ * 4.Completion function=0; 5.Error handling=0 */
+#define DMAE_REG_BACKWARD_COMP_EN                                0x10207c
 /* [RW 32] Commands memory. The address to command X; row Y is to calculated
    as 14*X+Y. */
 #define DMAE_REG_CMD_MEM                                         0x102400
@@ -742,9 +800,13 @@
 #define HC_REG_HC_PRTY_MASK                                      0x1080a0
 /* [R 3] Parity register #0 read */
 #define HC_REG_HC_PRTY_STS                                       0x108094
-#define HC_REG_INT_MASK                                          0x108108
+/* [RC 3] Parity register #0 read clear */
+#define HC_REG_HC_PRTY_STS_CLR                                   0x108098
+#define HC_REG_INT_MASK                                          0x108108
 #define HC_REG_LEADING_EDGE_0                                    0x108040
 #define HC_REG_LEADING_EDGE_1                                    0x108048
+#define HC_REG_MAIN_MEMORY                                       0x108800
+#define HC_REG_MAIN_MEMORY_SIZE                                  152
 #define HC_REG_P0_PROD_CONS                                      0x108200
 #define HC_REG_P1_PROD_CONS                                      0x108400
 #define HC_REG_PBA_COMMAND                                       0x108140
@@ -758,6 +820,92 @@
 #define HC_REG_USTORM_ADDR_FOR_COALESCE                          0x108068
 #define HC_REG_VQID_0                                            0x108008
 #define HC_REG_VQID_1                                            0x10800c
+#define IGU_BLOCK_CONFIGURATION_REG_BACKWARD_COMP_EN             (0x1<<1)
+#define IGU_REG_ATTENTION_ACK_BITS                               0x130108
+/* [R 4] Debug: attn_fsm */
+#define IGU_REG_ATTN_FSM                                         0x130054
+#define IGU_REG_ATTN_MSG_ADDR_H                          0x13011c
+#define IGU_REG_ATTN_MSG_ADDR_L                          0x130120
+/* [R 4] Debug: [3] - attention write done message is pending (0-no pending;
+ * 1-pending). [2:0] = PFID. Pending means attention message was sent; but
+ * write done didnt receive. */
+#define IGU_REG_ATTN_WRITE_DONE_PENDING                  0x130030
+#define IGU_REG_BLOCK_CONFIGURATION                              0x130000
+#define IGU_REG_COMMAND_REG_32LSB_DATA                           0x130124
+#define IGU_REG_COMMAND_REG_CTRL                                 0x13012c
+/* [WB_R 32] Cleanup bit status per SB. 1 = cleanup is set. 0 = cleanup bit
+ * is clear. The bits in this registers are set and clear via the producer
+ * command. Data valid only in addresses 0-4. all the rest are zero. */
+#define IGU_REG_CSTORM_TYPE_0_SB_CLEANUP                         0x130200
+/* [R 5] Debug: ctrl_fsm */
+#define IGU_REG_CTRL_FSM                                         0x130064
+/* [R 1] data availble for error memory. If this bit is clear do not red
+ * from error_handling_memory. */
+#define IGU_REG_ERROR_HANDLING_DATA_VALID                        0x130130
+/* [R 11] Parity register #0 read */
+#define IGU_REG_IGU_PRTY_STS                                     0x13009c
+/* [R 4] Debug: int_handle_fsm */
+#define IGU_REG_INT_HANDLE_FSM                                   0x130050
+#define IGU_REG_LEADING_EDGE_LATCH                               0x130134
+/* [RW 14] mapping CAM; relevant for E2 operating mode only. [0] - valid.
+ * [6:1] - vector number; [13:7] - FID (if VF - [13] = 0; [12:7] = VF
+ * number; if PF - [13] = 1; [12:10] = 0; [9:7] = PF number); */
+#define IGU_REG_MAPPING_MEMORY                                   0x131000
+#define IGU_REG_MAPPING_MEMORY_SIZE                              136
+#define IGU_REG_PBA_STATUS_LSB                                   0x130138
+#define IGU_REG_PBA_STATUS_MSB                                   0x13013c
+#define IGU_REG_PCI_PF_MSI_EN                                    0x130140
+#define IGU_REG_PCI_PF_MSIX_EN                                   0x130144
+#define IGU_REG_PCI_PF_MSIX_FUNC_MASK                            0x130148
+/* [WB_R 32] Each bit represent the pending bits status for that SB. 0 = no
+ * pending; 1 = pending. Pendings means interrupt was asserted; and write
+ * done was not received. Data valid only in addresses 0-4. all the rest are
+ * zero. */
+#define IGU_REG_PENDING_BITS_STATUS                              0x130300
+#define IGU_REG_PF_CONFIGURATION                                 0x130154
+/* [RW 20] producers only. E2 mode: address 0-135 match to the mapping
+ * memory; 136 - PF0 default prod; 137 PF1 default prod; 138 - PF2 default
+ * prod; 139 PF3 default prod; 140 - PF0 - ATTN prod; 141 - PF1 - ATTN prod;
+ * 142 - PF2 - ATTN prod; 143 - PF3 - ATTN prod; 144-147 reserved. E1.5 mode
+ * - In backward compatible mode; for non default SB; each even line in the
+ * memory holds the U producer and each odd line hold the C producer. The
+ * first 128 producer are for NDSB (PF0 - 0-31; PF1 - 32-63 and so on). The
+ * last 20 producers are for the DSB for each PF. each PF has five segments
+ * (the order inside each segment is PF0; PF1; PF2; PF3) - 128-131 U prods;
+ * 132-135 C prods; 136-139 X prods; 140-143 T prods; 144-147 ATTN prods; */
+#define IGU_REG_PROD_CONS_MEMORY                                 0x132000
+/* [R 3] Debug: pxp_arb_fsm */
+#define IGU_REG_PXP_ARB_FSM                                      0x130068
+/* [RW 6] Write one for each bit will reset the appropriate memory. When the
+ * memory reset finished the appropriate bit will be clear. Bit 0 - mapping
+ * memory; Bit 1 - SB memory; Bit 2 - SB interrupt and mask register; Bit 3
+ * - MSIX memory; Bit 4 - PBA memory; Bit 5 - statistics; */
+#define IGU_REG_RESET_MEMORIES                                   0x130158
+/* [R 4] Debug: sb_ctrl_fsm */
+#define IGU_REG_SB_CTRL_FSM                                      0x13004c
+#define IGU_REG_SB_INT_BEFORE_MASK_LSB                           0x13015c
+#define IGU_REG_SB_INT_BEFORE_MASK_MSB                           0x130160
+#define IGU_REG_SB_MASK_LSB                                      0x130164
+#define IGU_REG_SB_MASK_MSB                                      0x130168
+/* [RW 16] Number of command that were dropped without causing an interrupt
+ * due to: read access for WO BAR address; or write access for RO BAR
+ * address or any access for reserved address or PCI function error is set
+ * and address is not MSIX; PBA or cleanup */
+#define IGU_REG_SILENT_DROP                                      0x13016c
+/* [RW 10] Number of MSI/MSIX/ATTN messages sent for the function: 0-63 -
+ * number of MSIX messages per VF; 64-67 - number of MSI/MSIX messages per
+ * PF; 68-71 number of ATTN messages per PF */
+#define IGU_REG_STATISTIC_NUM_MESSAGE_SENT                       0x130800
+/* [RW 32] Number of cycles the timer mask masking the IGU interrupt when a
+ * timer mask command arrives. Value must be bigger than 100. */
+#define IGU_REG_TIMER_MASKING_VALUE                              0x13003c
+#define IGU_REG_TRAILING_EDGE_LATCH                              0x130104
+#define IGU_REG_VF_CONFIGURATION                                 0x130170
+/* [WB_R 32] Each bit represent write done pending bits status for that SB
+ * (MSI/MSIX message was sent and write done was not received yet). 0 =
+ * clear; 1 = set. Data valid only in addresses 0-4. all the rest are zero. */
+#define IGU_REG_WRITE_DONE_PENDING                               0x130480
+#define MCP_A_REG_MCPR_SCRATCH                                   0x3a0000
 #define MCP_REG_MCPR_NVM_ACCESS_ENABLE                           0x86424
 #define MCP_REG_MCPR_NVM_ADDR                                    0x8640c
 #define MCP_REG_MCPR_NVM_CFG4                                    0x8642c
@@ -880,6 +1028,11 @@
    rom_parity; [29] MCP Latched ump_rx_parity; [30] MCP Latched
    ump_tx_parity; [31] MCP Latched scpad_parity; */
 #define MISC_REG_AEU_AFTER_INVERT_4_MCP                          0xa458
+/* [R 32] Read fifth 32 bit after inversion of function 0. Mapped as
+ * follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
+ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
+ * CNIG attention (reserved); [7] CNIG parity (reserved); [31-8] Reserved; */
+#define MISC_REG_AEU_AFTER_INVERT_5_FUNC_0                       0xa700
 /* [W 14] write to this register results with the clear of the latched
    signals; one in d0 clears RBCR latch; one in d1 clears RBCT latch; one in
    d2 clears RBCN latch; one in d3 clears RBCU latch; one in d4 clears RBCP
@@ -1251,6 +1404,7 @@
 #define MISC_REG_E1HMF_MODE                                      0xa5f8
 /* [RW 32] Debug only: spare RW register reset by core reset */
 #define MISC_REG_GENERIC_CR_0                                    0xa460
+#define MISC_REG_GENERIC_CR_1                                    0xa464
 /* [RW 32] Debug only: spare RW register reset by por reset */
 #define MISC_REG_GENERIC_POR_1                                   0xa474
 /* [RW 32] GPIO. [31-28] FLOAT port 0; [27-24] FLOAT port 0; When any of
@@ -1373,6 +1527,14 @@
 #define MISC_REG_PLL_STORM_CTRL_2                                0xa298
 #define MISC_REG_PLL_STORM_CTRL_3                                0xa29c
 #define MISC_REG_PLL_STORM_CTRL_4                                0xa2a0
+/* [R 1] Status of 4 port mode enable input pin. */
+#define MISC_REG_PORT4MODE_EN                                    0xa750
+/* [RW 2] 4 port mode enable overwrite.[0] - Overwrite control; if it is 0 -
+ * the port4mode_en output is equal to 4 port mode input pin; if it is 1 -
+ * the port4mode_en output is equal to bit[1] of this register; [1] -
+ * Overwrite value. If bit[0] of this register is 1 this is the value that
+ * receives the port4mode_en output . */
+#define MISC_REG_PORT4MODE_EN_OVWR                               0xa720
 /* [RW 32] reset reg#2; rite/read one = the specific block is out of reset;
    write/read zero = the specific block is in reset; addr 0-wr- the write
    value will be written to the register; addr 1-set - one will be written
@@ -1656,8 +1818,91 @@
 /* [R 32] Interrupt register #0 read */
 #define NIG_REG_NIG_INT_STS_0                                    0x103b0
 #define NIG_REG_NIG_INT_STS_1                                    0x103c0
-/* [R 32] Parity register #0 read */
+/* [R 32] Legacy E1 and E1H location for parity error status register. */
 #define NIG_REG_NIG_PRTY_STS                                     0x103d0
+/* [R 32] Parity register #0 read */
+#define NIG_REG_NIG_PRTY_STS_0                                   0x183bc
+#define NIG_REG_NIG_PRTY_STS_1                                   0x183cc
+/* [RW 6] Bit-map indicating which L2 hdrs may appear after the basic
+ * Ethernet header. */
+#define NIG_REG_P0_HDRS_AFTER_BASIC                              0x18038
+/* [RW 1] HW PFC enable bit. Set this bit to enable the PFC functionality in
+ * the NIG. Other flow control modes such as PAUSE and SAFC/LLFC should be
+ * disabled when this bit is set. */
+#define NIG_REG_P0_HWPFC_ENABLE                          0x18078
+#define NIG_REG_P0_LLH_FUNC_MEM2                                 0x18480
+#define NIG_REG_P0_LLH_FUNC_MEM2_ENABLE                  0x18440
+/* [RW 32] Eight 4-bit configurations for specifying which COS (0-15 for
+ * future expansion) each priorty is to be mapped to. Bits 3:0 specify the
+ * COS for priority 0. Bits 31:28 specify the COS for priority 7. The 3-bit
+ * priority field is extracted from the outer-most VLAN in receive packet.
+ * Only COS 0 and COS 1 are supported in E2. */
+#define NIG_REG_P0_PKT_PRIORITY_TO_COS                           0x18054
+/* [RW 16] Bit-map indicating which SAFC/PFC priorities to map to COS 0. A
+ * priority is mapped to COS 0 when the corresponding mask bit is 1. More
+ * than one bit may be set; allowing multiple priorities to be mapped to one
+ * COS. */
+#define NIG_REG_P0_RX_COS0_PRIORITY_MASK                         0x18058
+/* [RW 16] Bit-map indicating which SAFC/PFC priorities to map to COS 1. A
+ * priority is mapped to COS 1 when the corresponding mask bit is 1. More
+ * than one bit may be set; allowing multiple priorities to be mapped to one
+ * COS. */
+#define NIG_REG_P0_RX_COS1_PRIORITY_MASK                         0x1805c
+/* [RW 15] Specify which of the credit registers the client is to be mapped
+ * to. Bits[2:0] are for client 0; bits [14:12] are for client 4. For
+ * clients that are not subject to WFQ credit blocking - their
+ * specifications here are not used. */
+#define NIG_REG_P0_TX_ARB_CLIENT_CREDIT_MAP                      0x180f0
+/* [RW 5] Specify whether the client competes directly in the strict
+ * priority arbiter. The bits are mapped according to client ID (client IDs
+ * are defined in tx_arb_priority_client). Default value is set to enable
+ * strict priorities for clients 0-2 -- management and debug traffic. */
+#define NIG_REG_P0_TX_ARB_CLIENT_IS_STRICT                       0x180e8
+/* [RW 5] Specify whether the client is subject to WFQ credit blocking. The
+ * bits are mapped according to client ID (client IDs are defined in
+ * tx_arb_priority_client). Default value is 0 for not using WFQ credit
+ * blocking. */
+#define NIG_REG_P0_TX_ARB_CLIENT_IS_SUBJECT2WFQ          0x180ec
+/* [RW 32] Specify the upper bound that credit register 0 is allowed to
+ * reach. */
+#define NIG_REG_P0_TX_ARB_CREDIT_UPPER_BOUND_0                   0x1810c
+#define NIG_REG_P0_TX_ARB_CREDIT_UPPER_BOUND_1                   0x18110
+/* [RW 32] Specify the weight (in bytes) to be added to credit register 0
+ * when it is time to increment. */
+#define NIG_REG_P0_TX_ARB_CREDIT_WEIGHT_0                        0x180f8
+#define NIG_REG_P0_TX_ARB_CREDIT_WEIGHT_1                        0x180fc
+/* [RW 12] Specify the number of strict priority arbitration slots between
+ * two round-robin arbitration slots to avoid starvation. A value of 0 means
+ * no strict priority cycles - the strict priority with anti-starvation
+ * arbiter becomes a round-robin arbiter. */
+#define NIG_REG_P0_TX_ARB_NUM_STRICT_ARB_SLOTS                   0x180f4
+/* [RW 15] Specify the client number to be assigned to each priority of the
+ * strict priority arbiter. Priority 0 is the highest priority. Bits [2:0]
+ * are for priority 0 client; bits [14:12] are for priority 4 client. The
+ * clients are assigned the following IDs: 0-management; 1-debug traffic
+ * from this port; 2-debug traffic from other port; 3-COS0 traffic; 4-COS1
+ * traffic. The reset value[14:0] is set to 0x4688 (15'b100_011_010_001_000)
+ * for management at priority 0; debug traffic at priorities 1 and 2; COS0
+ * traffic at priority 3; and COS1 traffic at priority 4. */
+#define NIG_REG_P0_TX_ARB_PRIORITY_CLIENT                        0x180e4
+#define NIG_REG_P1_LLH_FUNC_MEM2                                 0x184c0
+#define NIG_REG_P1_LLH_FUNC_MEM2_ENABLE                  0x18460
+/* [RW 32] Eight 4-bit configurations for specifying which COS (0-15 for
+ * future expansion) each priorty is to be mapped to. Bits 3:0 specify the
+ * COS for priority 0. Bits 31:28 specify the COS for priority 7. The 3-bit
+ * priority field is extracted from the outer-most VLAN in receive packet.
+ * Only COS 0 and COS 1 are supported in E2. */
+#define NIG_REG_P1_PKT_PRIORITY_TO_COS                           0x181a8
+/* [RW 16] Bit-map indicating which SAFC/PFC priorities to map to COS 0. A
+ * priority is mapped to COS 0 when the corresponding mask bit is 1. More
+ * than one bit may be set; allowing multiple priorities to be mapped to one
+ * COS. */
+#define NIG_REG_P1_RX_COS0_PRIORITY_MASK                         0x181ac
+/* [RW 16] Bit-map indicating which SAFC/PFC priorities to map to COS 1. A
+ * priority is mapped to COS 1 when the corresponding mask bit is 1. More
+ * than one bit may be set; allowing multiple priorities to be mapped to one
+ * COS. */
+#define NIG_REG_P1_RX_COS1_PRIORITY_MASK                         0x181b0
 /* [RW 1] Pause enable for port0. This register may get 1 only when
    ~safc_enable.safc_enable = 0 and ppp_enable.ppp_enable =0 for the same
    port */
@@ -1742,6 +1987,10 @@
 /* [RW 1] Disable processing further tasks from port 4 (after ending the
    current task in process). */
 #define PBF_REG_DISABLE_NEW_TASK_PROC_P4                         0x14006c
+#define PBF_REG_DISABLE_PF                                       0x1402e8
+/* [RW 6] Bit-map indicating which L2 hdrs may appear after the basic
+ * Ethernet header. */
+#define PBF_REG_HDRS_AFTER_BASIC                                 0x15c0a8
 #define PBF_REG_IF_ENABLE_REG                                    0x140044
 /* [RW 1] Init bit. When set the initial credits are copied to the credit
    registers (except the port credits). Should be set and then reset after
@@ -1765,6 +2014,8 @@
 #define PBF_REG_MAC_IF1_ENABLE                                   0x140034
 /* [RW 1] Enable for the loopback interface. */
 #define PBF_REG_MAC_LB_ENABLE                                    0x140040
+/* [RW 6] Bit-map indicating which headers must appear in the packet */
+#define PBF_REG_MUST_HAVE_HDRS                                   0x15c0c4
 /* [RW 10] Port 0 threshold used by arbiter in 16 byte lines used when pause
    not suppoterd. */
 #define PBF_REG_P0_ARB_THRSH                                     0x1400e4
@@ -1804,6 +2055,259 @@
 #define PB_REG_PB_PRTY_MASK                                      0x38
 /* [R 4] Parity register #0 read */
 #define PB_REG_PB_PRTY_STS                                       0x2c
+#define PGLUE_B_PGLUE_B_INT_STS_REG_ADDRESS_ERROR                (0x1<<0)
+#define PGLUE_B_PGLUE_B_INT_STS_REG_CSSNOOP_FIFO_OVERFLOW        (0x1<<8)
+#define PGLUE_B_PGLUE_B_INT_STS_REG_INCORRECT_RCV_BEHAVIOR       (0x1<<1)
+#define PGLUE_B_PGLUE_B_INT_STS_REG_TCPL_ERROR_ATTN              (0x1<<6)
+#define PGLUE_B_PGLUE_B_INT_STS_REG_TCPL_IN_TWO_RCBS_ATTN        (0x1<<7)
+#define PGLUE_B_PGLUE_B_INT_STS_REG_VF_GRC_SPACE_VIOLATION_ATTN  (0x1<<4)
+#define PGLUE_B_PGLUE_B_INT_STS_REG_VF_LENGTH_VIOLATION_ATTN     (0x1<<3)
+#define PGLUE_B_PGLUE_B_INT_STS_REG_VF_MSIX_BAR_VIOLATION_ATTN   (0x1<<5)
+#define PGLUE_B_PGLUE_B_INT_STS_REG_WAS_ERROR_ATTN               (0x1<<2)
+/* [R 8] Config space A attention dirty bits. Each bit indicates that the
+ * corresponding PF generates config space A attention. Set by PXP. Reset by
+ * MCP writing 1 to icfg_space_a_request_clr. Note: register contains bits
+ * from both paths. */
+#define PGLUE_B_REG_CFG_SPACE_A_REQUEST                  0x9010
+/* [R 8] Config space B attention dirty bits. Each bit indicates that the
+ * corresponding PF generates config space B attention. Set by PXP. Reset by
+ * MCP writing 1 to icfg_space_b_request_clr. Note: register contains bits
+ * from both paths. */
+#define PGLUE_B_REG_CFG_SPACE_B_REQUEST                  0x9014
+/* [RW 1] Type A PF enable inbound interrupt table for CSDM. 0 - disable; 1
+ * - enable. */
+#define PGLUE_B_REG_CSDM_INB_INT_A_PF_ENABLE                     0x9194
+/* [RW 18] Type B VF inbound interrupt table for CSDM: bits[17:9]-mask;
+ * its[8:0]-address. Bits [1:0] must be zero (DW resolution address). */
+#define PGLUE_B_REG_CSDM_INB_INT_B_VF                            0x916c
+/* [RW 1] Type B VF enable inbound interrupt table for CSDM. 0 - disable; 1
+ * - enable. */
+#define PGLUE_B_REG_CSDM_INB_INT_B_VF_ENABLE                     0x919c
+/* [RW 16] Start offset of CSDM zone A (queue zone) in the internal RAM */
+#define PGLUE_B_REG_CSDM_START_OFFSET_A                  0x9100
+/* [RW 16] Start offset of CSDM zone B (legacy zone) in the internal RAM */
+#define PGLUE_B_REG_CSDM_START_OFFSET_B                  0x9108
+/* [RW 5] VF Shift of CSDM zone B (legacy zone) in the internal RAM */
+#define PGLUE_B_REG_CSDM_VF_SHIFT_B                              0x9110
+/* [RW 1] 0 - Zone A size is 136x32B; 1 - Zone A size is 152x32B. */
+#define PGLUE_B_REG_CSDM_ZONE_A_SIZE_PF                  0x91ac
+/* [R 8] FLR request attention dirty bits for PFs 0 to 7. Each bit indicates
+ * that the FLR register of the corresponding PF was set. Set by PXP. Reset
+ * by MCP writing 1 to flr_request_pf_7_0_clr. Note: register contains bits
+ * from both paths. */
+#define PGLUE_B_REG_FLR_REQUEST_PF_7_0                           0x9028
+/* [W 8] FLR request attention dirty bits clear for PFs 0 to 7. MCP writes 1
+ * to a bit in this register in order to clear the corresponding bit in
+ * flr_request_pf_7_0 register. Note: register contains bits from both
+ * paths. */
+#define PGLUE_B_REG_FLR_REQUEST_PF_7_0_CLR                       0x9418
+/* [R 32] FLR request attention dirty bits for VFs 96 to 127. Each bit
+ * indicates that the FLR register of the corresponding VF was set. Set by
+ * PXP. Reset by MCP writing 1 to flr_request_vf_127_96_clr. */
+#define PGLUE_B_REG_FLR_REQUEST_VF_127_96                        0x9024
+/* [R 32] FLR request attention dirty bits for VFs 0 to 31. Each bit
+ * indicates that the FLR register of the corresponding VF was set. Set by
+ * PXP. Reset by MCP writing 1 to flr_request_vf_31_0_clr. */
+#define PGLUE_B_REG_FLR_REQUEST_VF_31_0                  0x9018
+/* [R 32] FLR request attention dirty bits for VFs 32 to 63. Each bit
+ * indicates that the FLR register of the corresponding VF was set. Set by
+ * PXP. Reset by MCP writing 1 to flr_request_vf_63_32_clr. */
+#define PGLUE_B_REG_FLR_REQUEST_VF_63_32                         0x901c
+/* [R 32] FLR request attention dirty bits for VFs 64 to 95. Each bit
+ * indicates that the FLR register of the corresponding VF was set. Set by
+ * PXP. Reset by MCP writing 1 to flr_request_vf_95_64_clr. */
+#define PGLUE_B_REG_FLR_REQUEST_VF_95_64                         0x9020
+/* [R 8] Each bit indicates an incorrect behavior in user RX interface. Bit
+ * 0 - Target memory read arrived with a correctable error. Bit 1 - Target
+ * memory read arrived with an uncorrectable error. Bit 2 - Configuration RW
+ * arrived with a correctable error. Bit 3 - Configuration RW arrived with
+ * an uncorrectable error. Bit 4 - Completion with Configuration Request
+ * Retry Status. Bit 5 - Expansion ROM access received with a write request.
+ * Bit 6 - Completion with pcie_rx_err of 0000; CMPL_STATUS of non-zero; and
+ * pcie_rx_last not asserted. Bit 7 - Completion with pcie_rx_err of 1010;
+ * and pcie_rx_last not asserted. */
+#define PGLUE_B_REG_INCORRECT_RCV_DETAILS                        0x9068
+#define PGLUE_B_REG_INTERNAL_PFID_ENABLE_MASTER          0x942c
+#define PGLUE_B_REG_INTERNAL_PFID_ENABLE_TARGET_READ             0x9430
+#define PGLUE_B_REG_INTERNAL_PFID_ENABLE_TARGET_WRITE            0x9434
+#define PGLUE_B_REG_INTERNAL_VFID_ENABLE                         0x9438
+/* [R 9] Interrupt register #0 read */
+#define PGLUE_B_REG_PGLUE_B_INT_STS                              0x9298
+/* [RC 9] Interrupt register #0 read clear */
+#define PGLUE_B_REG_PGLUE_B_INT_STS_CLR                  0x929c
+/* [R 2] Parity register #0 read */
+#define PGLUE_B_REG_PGLUE_B_PRTY_STS                             0x92a8
+/* [R 13] Details of first request received with error. [2:0] - PFID. [3] -
+ * VF_VALID. [9:4] - VFID. [11:10] - Error Code - 0 - Indicates Completion
+ * Timeout of a User Tx non-posted request. 1 - unsupported request. 2 -
+ * completer abort. 3 - Illegal value for this field. [12] valid - indicates
+ * if there was a completion error since the last time this register was
+ * cleared. */
+#define PGLUE_B_REG_RX_ERR_DETAILS                               0x9080
+/* [R 18] Details of first ATS Translation Completion request received with
+ * error. [2:0] - PFID. [3] - VF_VALID. [9:4] - VFID. [11:10] - Error Code -
+ * 0 - Indicates Completion Timeout of a User Tx non-posted request. 1 -
+ * unsupported request. 2 - completer abort. 3 - Illegal value for this
+ * field. [16:12] - ATC OTB EntryID. [17] valid - indicates if there was a
+ * completion error since the last time this register was cleared. */
+#define PGLUE_B_REG_RX_TCPL_ERR_DETAILS                  0x9084
+/* [W 8] Debug only - Shadow BME bits clear for PFs 0 to 7. MCP writes 1 to
+ * a bit in this register in order to clear the corresponding bit in
+ * shadow_bme_pf_7_0 register. MCP should never use this unless a
+ * work-around is needed. Note: register contains bits from both paths. */
+#define PGLUE_B_REG_SHADOW_BME_PF_7_0_CLR                        0x9458
+/* [R 8] SR IOV disabled attention dirty bits. Each bit indicates that the
+ * VF enable register of the corresponding PF is written to 0 and was
+ * previously 1. Set by PXP. Reset by MCP writing 1 to
+ * sr_iov_disabled_request_clr. Note: register contains bits from both
+ * paths. */
+#define PGLUE_B_REG_SR_IOV_DISABLED_REQUEST                      0x9030
+/* [R 32] Indicates the status of tags 32-63. 0 - tags is used - read
+ * completion did not return yet. 1 - tag is unused. Same functionality as
+ * pxp2_registers_pgl_exp_rom_data2 for tags 0-31. */
+#define PGLUE_B_REG_TAGS_63_32                                   0x9244
+/* [RW 1] Type A PF enable inbound interrupt table for TSDM. 0 - disable; 1
+ * - enable. */
+#define PGLUE_B_REG_TSDM_INB_INT_A_PF_ENABLE                     0x9170
+/* [RW 16] Start offset of TSDM zone A (queue zone) in the internal RAM */
+#define PGLUE_B_REG_TSDM_START_OFFSET_A                  0x90c4
+/* [RW 16] Start offset of TSDM zone B (legacy zone) in the internal RAM */
+#define PGLUE_B_REG_TSDM_START_OFFSET_B                  0x90cc
+/* [RW 5] VF Shift of TSDM zone B (legacy zone) in the internal RAM */
+#define PGLUE_B_REG_TSDM_VF_SHIFT_B                              0x90d4
+/* [RW 1] 0 - Zone A size is 136x32B; 1 - Zone A size is 152x32B. */
+#define PGLUE_B_REG_TSDM_ZONE_A_SIZE_PF                  0x91a0
+/* [R 32] Address [31:0] of first read request not submitted due to error */
+#define PGLUE_B_REG_TX_ERR_RD_ADD_31_0                           0x9098
+/* [R 32] Address [63:32] of first read request not submitted due to error */
+#define PGLUE_B_REG_TX_ERR_RD_ADD_63_32                  0x909c
+/* [R 31] Details of first read request not submitted due to error. [4:0]
+ * VQID. [5] TREQ. 1 - Indicates the request is a Translation Request.
+ * [20:8] - Length in bytes. [23:21] - PFID. [24] - VF_VALID. [30:25] -
+ * VFID. */
+#define PGLUE_B_REG_TX_ERR_RD_DETAILS                            0x90a0
+/* [R 26] Details of first read request not submitted due to error. [15:0]
+ * Request ID. [19:16] client ID. [20] - last SR. [24:21] - Error type -
+ * [21] - Indicates was_error was set; [22] - Indicates BME was cleared;
+ * [23] - Indicates FID_enable was cleared; [24] - Indicates VF with parent
+ * PF FLR_request or IOV_disable_request dirty bit is set. [25] valid -
+ * indicates if there was a request not submitted due to error since the
+ * last time this register was cleared. */
+#define PGLUE_B_REG_TX_ERR_RD_DETAILS2                           0x90a4
+/* [R 32] Address [31:0] of first write request not submitted due to error */
+#define PGLUE_B_REG_TX_ERR_WR_ADD_31_0                           0x9088
+/* [R 32] Address [63:32] of first write request not submitted due to error */
+#define PGLUE_B_REG_TX_ERR_WR_ADD_63_32                  0x908c
+/* [R 31] Details of first write request not submitted due to error. [4:0]
+ * VQID. [20:8] - Length in bytes. [23:21] - PFID. [24] - VF_VALID. [30:25]
+ * - VFID. */
+#define PGLUE_B_REG_TX_ERR_WR_DETAILS                            0x9090
+/* [R 26] Details of first write request not submitted due to error. [15:0]
+ * Request ID. [19:16] client ID. [20] - last SR. [24:21] - Error type -
+ * [21] - Indicates was_error was set; [22] - Indicates BME was cleared;
+ * [23] - Indicates FID_enable was cleared; [24] - Indicates VF with parent
+ * PF FLR_request or IOV_disable_request dirty bit is set. [25] valid -
+ * indicates if there was a request not submitted due to error since the
+ * last time this register was cleared. */
+#define PGLUE_B_REG_TX_ERR_WR_DETAILS2                           0x9094
+/* [RW 10] Type A PF/VF inbound interrupt table for USDM: bits[9:5]-mask;
+ * its[4:0]-address relative to start_offset_a. Bits [1:0] can have any
+ * value (Byte resolution address). */
+#define PGLUE_B_REG_USDM_INB_INT_A_0                             0x9128
+#define PGLUE_B_REG_USDM_INB_INT_A_1                             0x912c
+#define PGLUE_B_REG_USDM_INB_INT_A_2                             0x9130
+#define PGLUE_B_REG_USDM_INB_INT_A_3                             0x9134
+#define PGLUE_B_REG_USDM_INB_INT_A_4                             0x9138
+#define PGLUE_B_REG_USDM_INB_INT_A_5                             0x913c
+#define PGLUE_B_REG_USDM_INB_INT_A_6                             0x9140
+/* [RW 1] Type A PF enable inbound interrupt table for USDM. 0 - disable; 1
+ * - enable. */
+#define PGLUE_B_REG_USDM_INB_INT_A_PF_ENABLE                     0x917c
+/* [RW 1] Type A VF enable inbound interrupt table for USDM. 0 - disable; 1
+ * - enable. */
+#define PGLUE_B_REG_USDM_INB_INT_A_VF_ENABLE                     0x9180
+/* [RW 1] Type B VF enable inbound interrupt table for USDM. 0 - disable; 1
+ * - enable. */
+#define PGLUE_B_REG_USDM_INB_INT_B_VF_ENABLE                     0x9184
+/* [RW 16] Start offset of USDM zone A (queue zone) in the internal RAM */
+#define PGLUE_B_REG_USDM_START_OFFSET_A                  0x90d8
+/* [RW 16] Start offset of USDM zone B (legacy zone) in the internal RAM */
+#define PGLUE_B_REG_USDM_START_OFFSET_B                  0x90e0
+/* [RW 5] VF Shift of USDM zone B (legacy zone) in the internal RAM */
+#define PGLUE_B_REG_USDM_VF_SHIFT_B                              0x90e8
+/* [RW 1] 0 - Zone A size is 136x32B; 1 - Zone A size is 152x32B. */
+#define PGLUE_B_REG_USDM_ZONE_A_SIZE_PF                  0x91a4
+/* [R 26] Details of first target VF request accessing VF GRC space that
+ * failed permission check. [14:0] Address. [15] w_nr: 0 - Read; 1 - Write.
+ * [21:16] VFID. [24:22] - PFID. [25] valid - indicates if there was a
+ * request accessing VF GRC space that failed permission check since the
+ * last time this register was cleared. Permission checks are: function
+ * permission; R/W permission; address range permission. */
+#define PGLUE_B_REG_VF_GRC_SPACE_VIOLATION_DETAILS               0x9234
+/* [R 31] Details of first target VF request with length violation (too many
+ * DWs) accessing BAR0. [12:0] Address in DWs (bits [14:2] of byte address).
+ * [14:13] BAR. [20:15] VFID. [23:21] - PFID. [29:24] - Length in DWs. [30]
+ * valid - indicates if there was a request with length violation since the
+ * last time this register was cleared. Length violations: length of more
+ * than 2DWs; length of 2DWs and address not QW aligned; window is GRC and
+ * length is more than 1 DW. */
+#define PGLUE_B_REG_VF_LENGTH_VIOLATION_DETAILS          0x9230
+/* [R 8] Was_error indication dirty bits for PFs 0 to 7. Each bit indicates
+ * that there was a completion with uncorrectable error for the
+ * corresponding PF. Set by PXP. Reset by MCP writing 1 to
+ * was_error_pf_7_0_clr. */
+#define PGLUE_B_REG_WAS_ERROR_PF_7_0                             0x907c
+/* [W 8] Was_error indication dirty bits clear for PFs 0 to 7. MCP writes 1
+ * to a bit in this register in order to clear the corresponding bit in
+ * flr_request_pf_7_0 register. */
+#define PGLUE_B_REG_WAS_ERROR_PF_7_0_CLR                         0x9470
+/* [R 32] Was_error indication dirty bits for VFs 96 to 127. Each bit
+ * indicates that there was a completion with uncorrectable error for the
+ * corresponding VF. Set by PXP. Reset by MCP writing 1 to
+ * was_error_vf_127_96_clr. */
+#define PGLUE_B_REG_WAS_ERROR_VF_127_96                  0x9078
+/* [W 32] Was_error indication dirty bits clear for VFs 96 to 127. MCP
+ * writes 1 to a bit in this register in order to clear the corresponding
+ * bit in was_error_vf_127_96 register. */
+#define PGLUE_B_REG_WAS_ERROR_VF_127_96_CLR                      0x9474
+/* [R 32] Was_error indication dirty bits for VFs 0 to 31. Each bit
+ * indicates that there was a completion with uncorrectable error for the
+ * corresponding VF. Set by PXP. Reset by MCP writing 1 to
+ * was_error_vf_31_0_clr. */
+#define PGLUE_B_REG_WAS_ERROR_VF_31_0                            0x906c
+/* [W 32] Was_error indication dirty bits clear for VFs 0 to 31. MCP writes
+ * 1 to a bit in this register in order to clear the corresponding bit in
+ * was_error_vf_31_0 register. */
+#define PGLUE_B_REG_WAS_ERROR_VF_31_0_CLR                        0x9478
+/* [R 32] Was_error indication dirty bits for VFs 32 to 63. Each bit
+ * indicates that there was a completion with uncorrectable error for the
+ * corresponding VF. Set by PXP. Reset by MCP writing 1 to
+ * was_error_vf_63_32_clr. */
+#define PGLUE_B_REG_WAS_ERROR_VF_63_32                           0x9070
+/* [W 32] Was_error indication dirty bits clear for VFs 32 to 63. MCP writes
+ * 1 to a bit in this register in order to clear the corresponding bit in
+ * was_error_vf_63_32 register. */
+#define PGLUE_B_REG_WAS_ERROR_VF_63_32_CLR                       0x947c
+/* [R 32] Was_error indication dirty bits for VFs 64 to 95. Each bit
+ * indicates that there was a completion with uncorrectable error for the
+ * corresponding VF. Set by PXP. Reset by MCP writing 1 to
+ * was_error_vf_95_64_clr. */
+#define PGLUE_B_REG_WAS_ERROR_VF_95_64                           0x9074
+/* [W 32] Was_error indication dirty bits clear for VFs 64 to 95. MCP writes
+ * 1 to a bit in this register in order to clear the corresponding bit in
+ * was_error_vf_95_64 register. */
+#define PGLUE_B_REG_WAS_ERROR_VF_95_64_CLR                       0x9480
+/* [RW 1] Type A PF enable inbound interrupt table for XSDM. 0 - disable; 1
+ * - enable. */
+#define PGLUE_B_REG_XSDM_INB_INT_A_PF_ENABLE                     0x9188
+/* [RW 16] Start offset of XSDM zone A (queue zone) in the internal RAM */
+#define PGLUE_B_REG_XSDM_START_OFFSET_A                  0x90ec
+/* [RW 16] Start offset of XSDM zone B (legacy zone) in the internal RAM */
+#define PGLUE_B_REG_XSDM_START_OFFSET_B                  0x90f4
+/* [RW 5] VF Shift of XSDM zone B (legacy zone) in the internal RAM */
+#define PGLUE_B_REG_XSDM_VF_SHIFT_B                              0x90fc
+/* [RW 1] 0 - Zone A size is 136x32B; 1 - Zone A size is 152x32B. */
+#define PGLUE_B_REG_XSDM_ZONE_A_SIZE_PF                  0x91a8
 #define PRS_REG_A_PRSU_20                                        0x40134
 /* [R 8] debug only: CFC load request current credit. Transaction based. */
 #define PRS_REG_CFC_LD_CURRENT_CREDIT                            0x40164
@@ -1866,9 +2370,13 @@
 #define PRS_REG_FLUSH_REGIONS_TYPE_5                             0x40018
 #define PRS_REG_FLUSH_REGIONS_TYPE_6                             0x4001c
 #define PRS_REG_FLUSH_REGIONS_TYPE_7                             0x40020
+/* [RW 6] Bit-map indicating which L2 hdrs may appear after the basic
+ * Ethernet header. */
+#define PRS_REG_HDRS_AFTER_BASIC                                 0x40238
 /* [RW 4] The increment value to send in the CFC load request message */
 #define PRS_REG_INC_VALUE                                        0x40048
-/* [RW 1] If set indicates not to send messages to CFC on received packets */
+/* [RW 6] Bit-map indicating which headers must appear in the packet */
+#define PRS_REG_MUST_HAVE_HDRS                                   0x40254
 #define PRS_REG_NIC_MODE                                         0x40138
 /* [RW 8] The 8-bit event ID for cases where there is no match on the
    connection. Used in packet start message to TCM. */
@@ -1919,6 +2427,13 @@
 #define PRS_REG_TCM_CURRENT_CREDIT                               0x40160
 /* [R 8] debug only: TSDM current credit. Transaction based. */
 #define PRS_REG_TSDM_CURRENT_CREDIT                              0x4015c
+#define PXP2_PXP2_INT_MASK_0_REG_PGL_CPL_AFT                     (0x1<<19)
+#define PXP2_PXP2_INT_MASK_0_REG_PGL_CPL_OF                      (0x1<<20)
+#define PXP2_PXP2_INT_MASK_0_REG_PGL_PCIE_ATTN                   (0x1<<22)
+#define PXP2_PXP2_INT_MASK_0_REG_PGL_READ_BLOCKED                (0x1<<23)
+#define PXP2_PXP2_INT_MASK_0_REG_PGL_WRITE_BLOCKED               (0x1<<24)
+#define PXP2_PXP2_INT_STS_0_REG_WR_PGLUE_EOP_ERROR               (0x1<<7)
+#define PXP2_PXP2_INT_STS_CLR_0_REG_WR_PGLUE_EOP_ERROR           (0x1<<7)
 /* [R 6] Debug only: Number of used entries in the data FIFO */
 #define PXP2_REG_HST_DATA_FIFO_STATUS                            0x12047c
 /* [R 7] Debug only: Number of used entries in the header FIFO */
@@ -2244,8 +2759,17 @@
 /* [RW 1] When '1'; requests will enter input buffers but wont get out
    towards the glue */
 #define PXP2_REG_RQ_DISABLE_INPUTS                               0x120330
-/* [RW 1] 1 - SR will be aligned by 64B; 0 - SR will be aligned by 8B */
+/* [RW 4] Determines alignment of write SRs when a request is split into
+ * several SRs. 0 - 8B aligned. 1 - 64B aligned. 2 - 128B aligned. 3 - 256B
+ * aligned. 4 - 512B aligned. */
 #define PXP2_REG_RQ_DRAM_ALIGN                                   0x1205b0
+/* [RW 4] Determines alignment of read SRs when a request is split into
+ * several SRs. 0 - 8B aligned. 1 - 64B aligned. 2 - 128B aligned. 3 - 256B
+ * aligned. 4 - 512B aligned. */
+#define PXP2_REG_RQ_DRAM_ALIGN_RD                                0x12092c
+/* [RW 1] when set the new alignment method (E2) will be applied; when reset
+ * the original alignment method (E1 E1H) will be applied */
+#define PXP2_REG_RQ_DRAM_ALIGN_SEL                               0x120930
 /* [RW 1] If 1 ILT failiue will not result in ELT access; An interrupt will
    be asserted */
 #define PXP2_REG_RQ_ELT_DISABLE                                  0x12066c
@@ -2436,7 +2960,8 @@
 #define PXP_REG_PXP_INT_STS_1                                    0x103078
 /* [RC 32] Interrupt register #0 read clear */
 #define PXP_REG_PXP_INT_STS_CLR_0                                0x10306c
-/* [RW 26] Parity mask register #0 read/write */
+#define PXP_REG_PXP_INT_STS_CLR_1                                0x10307c
+/* [RW 27] Parity mask register #0 read/write */
 #define PXP_REG_PXP_PRTY_MASK                                    0x103094
 /* [R 26] Parity register #0 read */
 #define PXP_REG_PXP_PRTY_STS                                     0x103088
@@ -2566,6 +3091,7 @@
 #define QM_REG_PAUSESTATE7                                       0x16e698
 /* [RW 2] The PCI attributes field used in the PCI request. */
 #define QM_REG_PCIREQAT                                          0x168054
+#define QM_REG_PF_EN                                             0x16e70c
 /* [R 16] The byte credit of port 0 */
 #define QM_REG_PORT0BYTECRD                                      0x168300
 /* [R 16] The byte credit of port 1 */
@@ -3402,6 +3928,14 @@
 /* [R 32] Parity register #0 read */
 #define TSEM_REG_TSEM_PRTY_STS_0                                 0x180114
 #define TSEM_REG_TSEM_PRTY_STS_1                                 0x180124
+/* [W 7] VF or PF ID for reset error bit. Values 0-63 reset error bit for 64
+ * VF; values 64-67 reset error for 4 PF; values 68-127 are not valid. */
+#define TSEM_REG_VFPF_ERR_NUM                                    0x180380
+/* [RW 32] Indirect access to AG context with 32-bits granularity. The bits
+ * [10:8] of the address should be the offset within the accessed LCID
+ * context; the bits [7:0] are the accessed LCID.Example: to write to REG10
+ * LCID100. The RBC address should be 12'ha64. */
+#define UCM_REG_AG_CTX                                           0xe2000
 /* [R 5] Used to read the XX protection CAM occupancy counter. */
 #define UCM_REG_CAM_OCCUP                                        0xe0170
 /* [RW 1] CDU AG read Interface enable. If 0 - the request input is
@@ -3851,6 +4385,17 @@
 /* [R 32] Parity register #0 read */
 #define USEM_REG_USEM_PRTY_STS_0                                 0x300124
 #define USEM_REG_USEM_PRTY_STS_1                                 0x300134
+/* [W 7] VF or PF ID for reset error bit. Values 0-63 reset error bit for 64
+ * VF; values 64-67 reset error for 4 PF; values 68-127 are not valid. */
+#define USEM_REG_VFPF_ERR_NUM                                    0x300380
+#define VFC_MEMORIES_RST_REG_CAM_RST                             (0x1<<0)
+#define VFC_MEMORIES_RST_REG_RAM_RST                             (0x1<<1)
+#define VFC_REG_MEMORIES_RST                                     0x1943c
+/* [RW 32] Indirect access to AG context with 32-bits granularity. The bits
+ * [12:8] of the address should be the offset within the accessed LCID
+ * context; the bits [7:0] are the accessed LCID.Example: to write to REG10
+ * LCID100. The RBC address should be 13'ha64. */
+#define XCM_REG_AG_CTX                                           0x28000
 /* [RW 2] The queue index for registration on Aux1 counter flag. */
 #define XCM_REG_AUX1_Q                                           0x20134
 /* [RW 2] Per each decision rule the queue index to register to. */
@@ -4333,6 +4878,9 @@
 #define XSEM_REG_TS_8_AS                                         0x280058
 /* [RW 3] The arbitration scheme of time_slot 9 */
 #define XSEM_REG_TS_9_AS                                         0x28005c
+/* [W 7] VF or PF ID for reset error bit. Values 0-63 reset error bit for 64
+ * VF; values 64-67 reset error for 4 PF; values 68-127 are not valid. */
+#define XSEM_REG_VFPF_ERR_NUM                                    0x280380
 /* [RW 32] Interrupt mask register #0 read/write */
 #define XSEM_REG_XSEM_INT_MASK_0                                 0x280110
 #define XSEM_REG_XSEM_INT_MASK_1                                 0x280120
@@ -4371,6 +4919,23 @@
 #define BIGMAC_REGISTER_TX_SOURCE_ADDR                           (0x08<<3)
 #define BIGMAC_REGISTER_TX_STAT_GTBYT                            (0x20<<3)
 #define BIGMAC_REGISTER_TX_STAT_GTPKT                            (0x0C<<3)
+#define BIGMAC2_REGISTER_BMAC_CONTROL                            (0x00<<3)
+#define BIGMAC2_REGISTER_BMAC_XGXS_CONTROL                       (0x01<<3)
+#define BIGMAC2_REGISTER_CNT_MAX_SIZE                            (0x05<<3)
+#define BIGMAC2_REGISTER_PFC_CONTROL                             (0x06<<3)
+#define BIGMAC2_REGISTER_RX_CONTROL                              (0x3A<<3)
+#define BIGMAC2_REGISTER_RX_LLFC_MSG_FLDS                        (0x62<<3)
+#define BIGMAC2_REGISTER_RX_MAX_SIZE                             (0x3C<<3)
+#define BIGMAC2_REGISTER_RX_STAT_GR64                            (0x40<<3)
+#define BIGMAC2_REGISTER_RX_STAT_GRIPJ                           (0x5f<<3)
+#define BIGMAC2_REGISTER_RX_STAT_GRPP                            (0x51<<3)
+#define BIGMAC2_REGISTER_TX_CONTROL                              (0x1C<<3)
+#define BIGMAC2_REGISTER_TX_MAX_SIZE                             (0x1E<<3)
+#define BIGMAC2_REGISTER_TX_PAUSE_CONTROL                        (0x20<<3)
+#define BIGMAC2_REGISTER_TX_SOURCE_ADDR                  (0x1D<<3)
+#define BIGMAC2_REGISTER_TX_STAT_GTBYT                           (0x39<<3)
+#define BIGMAC2_REGISTER_TX_STAT_GTPOK                           (0x22<<3)
+#define BIGMAC2_REGISTER_TX_STAT_GTPP                            (0x24<<3)
 #define EMAC_LED_1000MB_OVERRIDE                                 (1L<<1)
 #define EMAC_LED_100MB_OVERRIDE                                  (1L<<2)
 #define EMAC_LED_10MB_OVERRIDE                                   (1L<<3)
@@ -4478,6 +5043,8 @@
 #define HW_LOCK_RESOURCE_SPIO                                    2
 #define HW_LOCK_RESOURCE_UNDI                                    5
 #define PRS_FLAG_OVERETH_IPV4                                    1
+#define AEU_INPUTS_ATTN_BITS_ATC_HW_INTERRUPT                 (0x1<<4)
+#define AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR                 (0x1<<5)
 #define AEU_INPUTS_ATTN_BITS_BRB_PARITY_ERROR                 (1<<18)
 #define AEU_INPUTS_ATTN_BITS_CCM_HW_INTERRUPT                 (1<<31)
 #define AEU_INPUTS_ATTN_BITS_CDU_HW_INTERRUPT                 (1<<9)
@@ -4504,6 +5071,8 @@
 #define AEU_INPUTS_ATTN_BITS_PARSER_PARITY_ERROR              (1<<20)
 #define AEU_INPUTS_ATTN_BITS_PBCLIENT_PARITY_ERROR            (1<<0)
 #define AEU_INPUTS_ATTN_BITS_PBF_HW_INTERRUPT                 (1<<31)
+#define AEU_INPUTS_ATTN_BITS_PGLUE_HW_INTERRUPT       (0x1<<2)
+#define AEU_INPUTS_ATTN_BITS_PGLUE_PARITY_ERROR       (0x1<<3)
 #define AEU_INPUTS_ATTN_BITS_PXP_HW_INTERRUPT                 (1<<3)
 #define AEU_INPUTS_ATTN_BITS_PXP_PARITY_ERROR                 (1<<2)
 #define AEU_INPUTS_ATTN_BITS_PXPPCICLOCKCLIENT_HW_INTERRUPT   (1<<5)
@@ -4796,6 +5365,253 @@
 #define PCI_ID_VAL1                                     0x434
 #define PCI_ID_VAL2                                     0x438
 
+#define PXPCS_TL_CONTROL_5                  0x814
+#define PXPCS_TL_CONTROL_5_UNKNOWNTYPE_ERR_ATTN    (1 << 29) /*WC*/
+#define PXPCS_TL_CONTROL_5_BOUNDARY4K_ERR_ATTN     (1 << 28)   /*WC*/
+#define PXPCS_TL_CONTROL_5_MRRS_ERR_ATTN   (1 << 27)   /*WC*/
+#define PXPCS_TL_CONTROL_5_MPS_ERR_ATTN    (1 << 26)   /*WC*/
+#define PXPCS_TL_CONTROL_5_TTX_BRIDGE_FORWARD_ERR  (1 << 25)   /*WC*/
+#define PXPCS_TL_CONTROL_5_TTX_TXINTF_OVERFLOW     (1 << 24)   /*WC*/
+#define PXPCS_TL_CONTROL_5_PHY_ERR_ATTN    (1 << 23)   /*RO*/
+#define PXPCS_TL_CONTROL_5_DL_ERR_ATTN     (1 << 22)   /*RO*/
+#define PXPCS_TL_CONTROL_5_TTX_ERR_NP_TAG_IN_USE   (1 << 21)   /*WC*/
+#define PXPCS_TL_CONTROL_5_TRX_ERR_UNEXP_RTAG  (1 << 20)   /*WC*/
+#define PXPCS_TL_CONTROL_5_PRI_SIG_TARGET_ABORT1   (1 << 19)   /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_UNSPPORT1   (1 << 18)   /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_ECRC1   (1 << 17)   /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_MALF_TLP1   (1 << 16)   /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_RX_OFLOW1   (1 << 15)   /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_UNEXP_CPL1  (1 << 14)   /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_MASTER_ABRT1    (1 << 13)   /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_CPL_TIMEOUT1    (1 << 12)   /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_FC_PRTL1    (1 << 11)   /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_PSND_TLP1   (1 << 10)   /*WC*/
+#define PXPCS_TL_CONTROL_5_PRI_SIG_TARGET_ABORT    (1 << 9)    /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_UNSPPORT    (1 << 8)    /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_ECRC    (1 << 7)    /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_MALF_TLP    (1 << 6)    /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_RX_OFLOW    (1 << 5)    /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_UNEXP_CPL   (1 << 4)    /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_MASTER_ABRT     (1 << 3)    /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_CPL_TIMEOUT     (1 << 2)    /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_FC_PRTL     (1 << 1)    /*WC*/
+#define PXPCS_TL_CONTROL_5_ERR_PSND_TLP    (1 << 0)    /*WC*/
+
+
+#define PXPCS_TL_FUNC345_STAT      0x854
+#define PXPCS_TL_FUNC345_STAT_PRI_SIG_TARGET_ABORT4    (1 << 29)   /* WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_UNSPPORT4\
+        (1 << 28) /* Unsupported Request Error Status in function4, if \
+        set, generate pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_ECRC4\
+        (1 << 27) /* ECRC Error TLP Status Status in function 4, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_MALF_TLP4\
+        (1 << 26) /* Malformed TLP Status Status in function 4, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_RX_OFLOW4\
+        (1 << 25) /* Receiver Overflow Status Status in function 4, if \
+        set, generate pcie_err_attn output when this error is seen.. WC \
+        */
+#define PXPCS_TL_FUNC345_STAT_ERR_UNEXP_CPL4\
+        (1 << 24) /* Unexpected Completion Status Status in function 4, \
+        if set, generate pcie_err_attn output when this error is seen. WC \
+        */
+#define PXPCS_TL_FUNC345_STAT_ERR_MASTER_ABRT4\
+        (1 << 23) /* Receive UR Statusin function 4. If set, generate \
+        pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_CPL_TIMEOUT4\
+        (1 << 22) /* Completer Timeout Status Status in function 4, if \
+        set, generate pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_FC_PRTL4\
+        (1 << 21) /* Flow Control Protocol Error Status Status in \
+        function 4, if set, generate pcie_err_attn output when this error \
+        is seen. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_PSND_TLP4\
+        (1 << 20) /* Poisoned Error Status Status in function 4, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC345_STAT_PRI_SIG_TARGET_ABORT3    (1 << 19)   /* WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_UNSPPORT3\
+        (1 << 18) /* Unsupported Request Error Status in function3, if \
+        set, generate pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_ECRC3\
+        (1 << 17) /* ECRC Error TLP Status Status in function 3, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_MALF_TLP3\
+        (1 << 16) /* Malformed TLP Status Status in function 3, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_RX_OFLOW3\
+        (1 << 15) /* Receiver Overflow Status Status in function 3, if \
+        set, generate pcie_err_attn output when this error is seen.. WC \
+        */
+#define PXPCS_TL_FUNC345_STAT_ERR_UNEXP_CPL3\
+        (1 << 14) /* Unexpected Completion Status Status in function 3, \
+        if set, generate pcie_err_attn output when this error is seen. WC \
+        */
+#define PXPCS_TL_FUNC345_STAT_ERR_MASTER_ABRT3\
+        (1 << 13) /* Receive UR Statusin function 3. If set, generate \
+        pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_CPL_TIMEOUT3\
+        (1 << 12) /* Completer Timeout Status Status in function 3, if \
+        set, generate pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_FC_PRTL3\
+        (1 << 11) /* Flow Control Protocol Error Status Status in \
+        function 3, if set, generate pcie_err_attn output when this error \
+        is seen. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_PSND_TLP3\
+        (1 << 10) /* Poisoned Error Status Status in function 3, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC345_STAT_PRI_SIG_TARGET_ABORT2    (1 << 9)    /* WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_UNSPPORT2\
+        (1 << 8) /* Unsupported Request Error Status for Function 2, if \
+        set, generate pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_ECRC2\
+        (1 << 7) /* ECRC Error TLP Status Status for Function 2, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_MALF_TLP2\
+        (1 << 6) /* Malformed TLP Status Status for Function 2, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_RX_OFLOW2\
+        (1 << 5) /* Receiver Overflow Status Status for Function 2, if \
+        set, generate pcie_err_attn output when this error is seen.. WC \
+        */
+#define PXPCS_TL_FUNC345_STAT_ERR_UNEXP_CPL2\
+        (1 << 4) /* Unexpected Completion Status Status for Function 2, \
+        if set, generate pcie_err_attn output when this error is seen. WC \
+        */
+#define PXPCS_TL_FUNC345_STAT_ERR_MASTER_ABRT2\
+        (1 << 3) /* Receive UR Statusfor Function 2. If set, generate \
+        pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_CPL_TIMEOUT2\
+        (1 << 2) /* Completer Timeout Status Status for Function 2, if \
+        set, generate pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_FC_PRTL2\
+        (1 << 1) /* Flow Control Protocol Error Status Status for \
+        Function 2, if set, generate pcie_err_attn output when this error \
+        is seen. WC */
+#define PXPCS_TL_FUNC345_STAT_ERR_PSND_TLP2\
+        (1 << 0) /* Poisoned Error Status Status for Function 2, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+
+
+#define PXPCS_TL_FUNC678_STAT  0x85C
+#define PXPCS_TL_FUNC678_STAT_PRI_SIG_TARGET_ABORT7    (1 << 29)   /*    WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_UNSPPORT7\
+        (1 << 28) /* Unsupported Request Error Status in function7, if \
+        set, generate pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_ECRC7\
+        (1 << 27) /* ECRC Error TLP Status Status in function 7, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_MALF_TLP7\
+        (1 << 26) /* Malformed TLP Status Status in function 7, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_RX_OFLOW7\
+        (1 << 25) /* Receiver Overflow Status Status in function 7, if \
+        set, generate pcie_err_attn output when this error is seen.. WC \
+        */
+#define PXPCS_TL_FUNC678_STAT_ERR_UNEXP_CPL7\
+        (1 << 24) /* Unexpected Completion Status Status in function 7, \
+        if set, generate pcie_err_attn output when this error is seen. WC \
+        */
+#define PXPCS_TL_FUNC678_STAT_ERR_MASTER_ABRT7\
+        (1 << 23) /* Receive UR Statusin function 7. If set, generate \
+        pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_CPL_TIMEOUT7\
+        (1 << 22) /* Completer Timeout Status Status in function 7, if \
+        set, generate pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_FC_PRTL7\
+        (1 << 21) /* Flow Control Protocol Error Status Status in \
+        function 7, if set, generate pcie_err_attn output when this error \
+        is seen. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_PSND_TLP7\
+        (1 << 20) /* Poisoned Error Status Status in function 7, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC678_STAT_PRI_SIG_TARGET_ABORT6    (1 << 19)    /*    WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_UNSPPORT6\
+        (1 << 18) /* Unsupported Request Error Status in function6, if \
+        set, generate pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_ECRC6\
+        (1 << 17) /* ECRC Error TLP Status Status in function 6, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_MALF_TLP6\
+        (1 << 16) /* Malformed TLP Status Status in function 6, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_RX_OFLOW6\
+        (1 << 15) /* Receiver Overflow Status Status in function 6, if \
+        set, generate pcie_err_attn output when this error is seen.. WC \
+        */
+#define PXPCS_TL_FUNC678_STAT_ERR_UNEXP_CPL6\
+        (1 << 14) /* Unexpected Completion Status Status in function 6, \
+        if set, generate pcie_err_attn output when this error is seen. WC \
+        */
+#define PXPCS_TL_FUNC678_STAT_ERR_MASTER_ABRT6\
+        (1 << 13) /* Receive UR Statusin function 6. If set, generate \
+        pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_CPL_TIMEOUT6\
+        (1 << 12) /* Completer Timeout Status Status in function 6, if \
+        set, generate pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_FC_PRTL6\
+        (1 << 11) /* Flow Control Protocol Error Status Status in \
+        function 6, if set, generate pcie_err_attn output when this error \
+        is seen. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_PSND_TLP6\
+        (1 << 10) /* Poisoned Error Status Status in function 6, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC678_STAT_PRI_SIG_TARGET_ABORT5    (1 << 9) /*    WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_UNSPPORT5\
+        (1 << 8) /* Unsupported Request Error Status for Function 5, if \
+        set, generate pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_ECRC5\
+        (1 << 7) /* ECRC Error TLP Status Status for Function 5, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_MALF_TLP5\
+        (1 << 6) /* Malformed TLP Status Status for Function 5, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_RX_OFLOW5\
+        (1 << 5) /* Receiver Overflow Status Status for Function 5, if \
+        set, generate pcie_err_attn output when this error is seen.. WC \
+        */
+#define PXPCS_TL_FUNC678_STAT_ERR_UNEXP_CPL5\
+        (1 << 4) /* Unexpected Completion Status Status for Function 5, \
+        if set, generate pcie_err_attn output when this error is seen. WC \
+        */
+#define PXPCS_TL_FUNC678_STAT_ERR_MASTER_ABRT5\
+        (1 << 3) /* Receive UR Statusfor Function 5. If set, generate \
+        pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_CPL_TIMEOUT5\
+        (1 << 2) /* Completer Timeout Status Status for Function 5, if \
+        set, generate pcie_err_attn output when this error is seen. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_FC_PRTL5\
+        (1 << 1) /* Flow Control Protocol Error Status Status for \
+        Function 5, if set, generate pcie_err_attn output when this error \
+        is seen. WC */
+#define PXPCS_TL_FUNC678_STAT_ERR_PSND_TLP5\
+        (1 << 0) /* Poisoned Error Status Status for Function 5, if set, \
+        generate pcie_err_attn output when this error is seen.. WC */
+
+
+#define BAR_USTRORM_INTMEM                              0x400000
+#define BAR_CSTRORM_INTMEM                              0x410000
+#define BAR_XSTRORM_INTMEM                              0x420000
+#define BAR_TSTRORM_INTMEM                              0x430000
+
+/* for accessing the IGU in case of status block ACK */
+#define BAR_IGU_INTMEM                                  0x440000
+
+#define BAR_DOORBELL_OFFSET                             0x800000
+
+#define BAR_ME_REGISTER                         0x450000
+#define ME_REG_PF_NUM_SHIFT             0
+#define ME_REG_PF_NUM\
+        (7L<<ME_REG_PF_NUM_SHIFT) /* Relative PF Num */
+#define ME_REG_VF_VALID         (1<<8)
+#define ME_REG_VF_NUM_SHIFT             9
+#define ME_REG_VF_NUM_MASK              (0x3f<<ME_REG_VF_NUM_SHIFT)
+#define ME_REG_VF_ERR                   (0x1<<3)
+#define ME_REG_ABS_PF_NUM_SHIFT 16
+#define ME_REG_ABS_PF_NUM\
+        (7L<<ME_REG_ABS_PF_NUM_SHIFT) /* Absolute PF Num */
+
 
 #define MDIO_REG_BANK_CL73_IEEEB0       0x0
 #define MDIO_CL73_IEEEB0_CL73_AN_CONTROL        0x0
@@ -5276,6 +6092,11 @@ Theotherbitsarereservedandshouldbezero*/
 #define IGU_INT_NOP                             2
 #define IGU_INT_NOP2                    3
 
+#define IGU_USE_REGISTER_ustorm_type_0_sb_cleanup  0
+#define IGU_USE_REGISTER_ustorm_type_1_sb_cleanup  1
+#define IGU_USE_REGISTER_cstorm_type_0_sb_cleanup  2
+#define IGU_USE_REGISTER_cstorm_type_1_sb_cleanup  3
+
 #define COMMAND_REG_INT_ACK         0x0
 #define COMMAND_REG_PROD_UPD        0x4
 #define COMMAND_REG_ATTN_BITS_UPD   0x8
@@ -5318,6 +6139,50 @@ Theotherbitsarereservedandshouldbezero*/
 #define IGU_REG_SISR_MDPC_WOMASK_UPPER          0x05a6
 
 #define IGU_REG_RESERVED_UPPER                          0x05ff
+/* Fields of IGU PF CONFIGRATION REGISTER */
+#define IGU_PF_CONF_FUNC_EN       (0x1<<0)  /* function enable        */
+#define IGU_PF_CONF_MSI_MSIX_EN   (0x1<<1)  /* MSI/MSIX enable        */
+#define IGU_PF_CONF_INT_LINE_EN   (0x1<<2)  /* INT enable             */
+#define IGU_PF_CONF_ATTN_BIT_EN   (0x1<<3)  /* attention enable       */
+#define IGU_PF_CONF_SINGLE_ISR_EN (0x1<<4)  /* single ISR mode enable */
+#define IGU_PF_CONF_SIMD_MODE     (0x1<<5)  /* simd all ones mode     */
+
+/* Fields of IGU VF CONFIGRATION REGISTER */
+#define IGU_VF_CONF_FUNC_EN        (0x1<<0)  /* function enable        */
+#define IGU_VF_CONF_MSI_MSIX_EN    (0x1<<1)  /* MSI/MSIX enable        */
+#define IGU_VF_CONF_PARENT_MASK    (0x3<<2)  /* Parent PF              */
+#define IGU_VF_CONF_PARENT_SHIFT   2         /* Parent PF              */
+#define IGU_VF_CONF_SINGLE_ISR_EN  (0x1<<4)  /* single ISR mode enable */
+
+
+#define IGU_BC_DSB_NUM_SEGS    5
+#define IGU_BC_NDSB_NUM_SEGS   2
+#define IGU_NORM_DSB_NUM_SEGS  2
+#define IGU_NORM_NDSB_NUM_SEGS 1
+#define IGU_BC_BASE_DSB_PROD   128
+#define IGU_NORM_BASE_DSB_PROD 136
+
+#define IGU_CTRL_CMD_TYPE_WR\
+        1
+#define IGU_CTRL_CMD_TYPE_RD\
+        0
+
+#define IGU_SEG_ACCESS_NORM   0
+#define IGU_SEG_ACCESS_DEF    1
+#define IGU_SEG_ACCESS_ATTN   2
+
+        /* FID (if VF - [6] = 0; [5:0] = VF number; if PF - [6] = 1; \
+        [5:2] = 0; [1:0] = PF number) */
+#define IGU_FID_ENCODE_IS_PF        (0x1<<6)
+#define IGU_FID_ENCODE_IS_PF_SHIFT  6
+#define IGU_FID_VF_NUM_MASK         (0x3f)
+#define IGU_FID_PF_NUM_MASK         (0x7)
+
+#define IGU_REG_MAPPING_MEMORY_VALID            (1<<0)
+#define IGU_REG_MAPPING_MEMORY_VECTOR_MASK      (0x3F<<1)
+#define IGU_REG_MAPPING_MEMORY_VECTOR_SHIFT     1
+#define IGU_REG_MAPPING_MEMORY_FID_MASK (0x7F<<7)
+#define IGU_REG_MAPPING_MEMORY_FID_SHIFT        7
 
 
 #define CDU_REGION_NUMBER_XCM_AG 2
diff --git a/drivers/net/bnx2x/bnx2x_stats.c b/drivers/net/bnx2x/bnx2x_stats.c
index efa1403ebf82..4733c835dad9 100644
--- a/drivers/net/bnx2x/bnx2x_stats.c
+++ b/drivers/net/bnx2x/bnx2x_stats.c
@@ -14,8 +14,8 @@
  * Statistics and Link management by Yitchak Gertner
  *
  */
- #include "bnx2x_cmn.h"
- #include "bnx2x_stats.h"
+#include "bnx2x_cmn.h"
+#include "bnx2x_stats.h"
 
 /* Statistics */
 
@@ -153,7 +153,7 @@ static inline long bnx2x_hilo(u32 *hiref)
 static void bnx2x_storm_stats_post(struct bnx2x *bp)
 {
         if (!bp->stats_pending) {
-                struct eth_query_ramrod_data ramrod_data = {0};
+                struct common_query_ramrod_data ramrod_data = {0};
                 int i, rc;
 
                 spin_lock_bh(&bp->stats_lock);
@@ -163,14 +163,11 @@ static void bnx2x_storm_stats_post(struct bnx2x *bp)
                 for_each_queue(bp, i)
                         ramrod_data.ctr_id_vector |= (1 << bp->fp[i].cl_id);
 
-                rc = bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_STAT_QUERY, 0,
+                rc = bnx2x_sp_post(bp, RAMROD_CMD_ID_COMMON_STAT_QUERY, 0,
                                    ((u32 *)&ramrod_data)[1],
-                                   ((u32 *)&ramrod_data)[0], 0);
-                if (rc == 0) {
-                        /* stats ramrod has it's own slot on the spq */
-                        bp->spq_left++;
+                                   ((u32 *)&ramrod_data)[0], 1);
+                if (rc == 0)
                         bp->stats_pending = 1;
-                }
 
                 spin_unlock_bh(&bp->stats_lock);
         }
@@ -188,20 +185,12 @@ static void bnx2x_hw_stats_post(struct bnx2x *bp)
         /* loader */
         if (bp->executer_idx) {
                 int loader_idx = PMF_DMAE_C(bp);
+                u32 opcode =  bnx2x_dmae_opcode(bp, DMAE_SRC_PCI, DMAE_DST_GRC,
+                                                 true, DMAE_COMP_GRC);
+                opcode = bnx2x_dmae_opcode_clr_src_reset(opcode);
 
                 memset(dmae, 0, sizeof(struct dmae_command));
-
-                dmae->opcode = (DMAE_CMD_SRC_PCI | DMAE_CMD_DST_GRC |
-                                DMAE_CMD_C_DST_GRC | DMAE_CMD_C_ENABLE |
-                                DMAE_CMD_DST_RESET |
-#ifdef __BIG_ENDIAN
-                                DMAE_CMD_ENDIANITY_B_DW_SWAP |
-#else
-                                DMAE_CMD_ENDIANITY_DW_SWAP |
-#endif
-                                (BP_PORT(bp) ? DMAE_CMD_PORT_1 :
-                                               DMAE_CMD_PORT_0) |
-                                (BP_E1HVN(bp) << DMAE_CMD_E1HVN_SHIFT));
+                dmae->opcode = opcode;
                 dmae->src_addr_lo = U64_LO(bnx2x_sp_mapping(bp, dmae[0]));
                 dmae->src_addr_hi = U64_HI(bnx2x_sp_mapping(bp, dmae[0]));
                 dmae->dst_addr_lo = (DMAE_REG_CMD_MEM +
@@ -253,26 +242,17 @@ static void bnx2x_stats_pmf_update(struct bnx2x *bp)
         u32 *stats_comp = bnx2x_sp(bp, stats_comp);
 
         /* sanity */
-        if (!IS_E1HMF(bp) || !bp->port.pmf || !bp->port.port_stx) {
+        if (!IS_MF(bp) || !bp->port.pmf || !bp->port.port_stx) {
                 BNX2X_ERR("BUG!\n");
                 return;
         }
 
         bp->executer_idx = 0;
 
-        opcode = (DMAE_CMD_SRC_GRC | DMAE_CMD_DST_PCI |
-                  DMAE_CMD_C_ENABLE |
-                  DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET |
-#ifdef __BIG_ENDIAN
-                  DMAE_CMD_ENDIANITY_B_DW_SWAP |
-#else
-                  DMAE_CMD_ENDIANITY_DW_SWAP |
-#endif
-                  (BP_PORT(bp) ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0) |
-                  (BP_E1HVN(bp) << DMAE_CMD_E1HVN_SHIFT));
+        opcode = bnx2x_dmae_opcode(bp, DMAE_SRC_GRC, DMAE_DST_PCI, false, 0);
 
         dmae = bnx2x_sp(bp, dmae[bp->executer_idx++]);
-        dmae->opcode = (opcode | DMAE_CMD_C_DST_GRC);
+        dmae->opcode = bnx2x_dmae_opcode_add_comp(opcode, DMAE_COMP_GRC);
         dmae->src_addr_lo = bp->port.port_stx >> 2;
         dmae->src_addr_hi = 0;
         dmae->dst_addr_lo = U64_LO(bnx2x_sp_mapping(bp, port_stats));
@@ -283,7 +263,7 @@ static void bnx2x_stats_pmf_update(struct bnx2x *bp)
         dmae->comp_val = 1;
 
         dmae = bnx2x_sp(bp, dmae[bp->executer_idx++]);
-        dmae->opcode = (opcode | DMAE_CMD_C_DST_PCI);
+        dmae->opcode = bnx2x_dmae_opcode_add_comp(opcode, DMAE_COMP_PCI);
         dmae->src_addr_lo = (bp->port.port_stx >> 2) + DMAE_LEN32_RD_MAX;
         dmae->src_addr_hi = 0;
         dmae->dst_addr_lo = U64_LO(bnx2x_sp_mapping(bp, port_stats) +
@@ -304,7 +284,6 @@ static void bnx2x_port_stats_init(struct bnx2x *bp)
 {
         struct dmae_command *dmae;
         int port = BP_PORT(bp);
-        int vn = BP_E1HVN(bp);
         u32 opcode;
         int loader_idx = PMF_DMAE_C(bp);
         u32 mac_addr;
@@ -319,16 +298,8 @@ static void bnx2x_port_stats_init(struct bnx2x *bp)
         bp->executer_idx = 0;
 
         /* MCP */
-        opcode = (DMAE_CMD_SRC_PCI | DMAE_CMD_DST_GRC |
-                  DMAE_CMD_C_DST_GRC | DMAE_CMD_C_ENABLE |
-                  DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET |
-#ifdef __BIG_ENDIAN
-                  DMAE_CMD_ENDIANITY_B_DW_SWAP |
-#else
-                  DMAE_CMD_ENDIANITY_DW_SWAP |
-#endif
-                  (port ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0) |
-                  (vn << DMAE_CMD_E1HVN_SHIFT));
+        opcode = bnx2x_dmae_opcode(bp, DMAE_SRC_PCI, DMAE_DST_GRC,
+                                    true, DMAE_COMP_GRC);
 
         if (bp->port.port_stx) {
 
@@ -359,16 +330,8 @@ static void bnx2x_port_stats_init(struct bnx2x *bp)
         }
 
         /* MAC */
-        opcode = (DMAE_CMD_SRC_GRC | DMAE_CMD_DST_PCI |
-                  DMAE_CMD_C_DST_GRC | DMAE_CMD_C_ENABLE |
-                  DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET |
-#ifdef __BIG_ENDIAN
-                  DMAE_CMD_ENDIANITY_B_DW_SWAP |
-#else
-                  DMAE_CMD_ENDIANITY_DW_SWAP |
-#endif
-                  (port ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0) |
-                  (vn << DMAE_CMD_E1HVN_SHIFT));
+        opcode = bnx2x_dmae_opcode(bp, DMAE_SRC_GRC, DMAE_DST_PCI,
+                                   true, DMAE_COMP_GRC);
 
         if (bp->link_vars.mac_type == MAC_TYPE_BMAC) {
 
@@ -379,13 +342,21 @@ static void bnx2x_port_stats_init(struct bnx2x *bp)
                    BIGMAC_REGISTER_TX_STAT_GTBYT */
                 dmae = bnx2x_sp(bp, dmae[bp->executer_idx++]);
                 dmae->opcode = opcode;
-                dmae->src_addr_lo = (mac_addr +
+                if (CHIP_IS_E1x(bp)) {
+                        dmae->src_addr_lo = (mac_addr +
                                      BIGMAC_REGISTER_TX_STAT_GTPKT) >> 2;
+                        dmae->len = (8 + BIGMAC_REGISTER_TX_STAT_GTBYT -
+                                     BIGMAC_REGISTER_TX_STAT_GTPKT) >> 2;
+                } else {
+                        dmae->src_addr_lo = (mac_addr +
+                                     BIGMAC2_REGISTER_TX_STAT_GTPOK) >> 2;
+                        dmae->len = (8 + BIGMAC2_REGISTER_TX_STAT_GTBYT -
+                                     BIGMAC2_REGISTER_TX_STAT_GTPOK) >> 2;
+                }
+
                 dmae->src_addr_hi = 0;
                 dmae->dst_addr_lo = U64_LO(bnx2x_sp_mapping(bp, mac_stats));
                 dmae->dst_addr_hi = U64_HI(bnx2x_sp_mapping(bp, mac_stats));
-                dmae->len = (8 + BIGMAC_REGISTER_TX_STAT_GTBYT -
-                             BIGMAC_REGISTER_TX_STAT_GTPKT) >> 2;
                 dmae->comp_addr_lo = dmae_reg_go_c[loader_idx] >> 2;
                 dmae->comp_addr_hi = 0;
                 dmae->comp_val = 1;
@@ -394,15 +365,31 @@ static void bnx2x_port_stats_init(struct bnx2x *bp)
                    BIGMAC_REGISTER_RX_STAT_GRIPJ */
                 dmae = bnx2x_sp(bp, dmae[bp->executer_idx++]);
                 dmae->opcode = opcode;
-                dmae->src_addr_lo = (mac_addr +
-                                     BIGMAC_REGISTER_RX_STAT_GR64) >> 2;
                 dmae->src_addr_hi = 0;
-                dmae->dst_addr_lo = U64_LO(bnx2x_sp_mapping(bp, mac_stats) +
-                                offsetof(struct bmac_stats, rx_stat_gr64_lo));
-                dmae->dst_addr_hi = U64_HI(bnx2x_sp_mapping(bp, mac_stats) +
-                                offsetof(struct bmac_stats, rx_stat_gr64_lo));
-                dmae->len = (8 + BIGMAC_REGISTER_RX_STAT_GRIPJ -
-                             BIGMAC_REGISTER_RX_STAT_GR64) >> 2;
+                if (CHIP_IS_E1x(bp)) {
+                        dmae->src_addr_lo = (mac_addr +
+                                             BIGMAC_REGISTER_RX_STAT_GR64) >> 2;
+                        dmae->dst_addr_lo =
+                                U64_LO(bnx2x_sp_mapping(bp, mac_stats) +
+                                offsetof(struct bmac1_stats, rx_stat_gr64_lo));
+                        dmae->dst_addr_hi =
+                                U64_HI(bnx2x_sp_mapping(bp, mac_stats) +
+                                offsetof(struct bmac1_stats, rx_stat_gr64_lo));
+                        dmae->len = (8 + BIGMAC_REGISTER_RX_STAT_GRIPJ -
+                                     BIGMAC_REGISTER_RX_STAT_GR64) >> 2;
+                } else {
+                        dmae->src_addr_lo =
+                                (mac_addr + BIGMAC2_REGISTER_RX_STAT_GR64) >> 2;
+                        dmae->dst_addr_lo =
+                                U64_LO(bnx2x_sp_mapping(bp, mac_stats) +
+                                offsetof(struct bmac2_stats, rx_stat_gr64_lo));
+                        dmae->dst_addr_hi =
+                                U64_HI(bnx2x_sp_mapping(bp, mac_stats) +
+                                offsetof(struct bmac2_stats, rx_stat_gr64_lo));
+                        dmae->len = (8 + BIGMAC2_REGISTER_RX_STAT_GRIPJ -
+                                     BIGMAC2_REGISTER_RX_STAT_GR64) >> 2;
+                }
+
                 dmae->comp_addr_lo = dmae_reg_go_c[loader_idx] >> 2;
                 dmae->comp_addr_hi = 0;
                 dmae->comp_val = 1;
@@ -483,16 +470,8 @@ static void bnx2x_port_stats_init(struct bnx2x *bp)
         dmae->comp_val = 1;
 
         dmae = bnx2x_sp(bp, dmae[bp->executer_idx++]);
-        dmae->opcode = (DMAE_CMD_SRC_GRC | DMAE_CMD_DST_PCI |
-                        DMAE_CMD_C_DST_PCI | DMAE_CMD_C_ENABLE |
-                        DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET |
-#ifdef __BIG_ENDIAN
-                        DMAE_CMD_ENDIANITY_B_DW_SWAP |
-#else
-                        DMAE_CMD_ENDIANITY_DW_SWAP |
-#endif
-                        (port ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0) |
-                        (vn << DMAE_CMD_E1HVN_SHIFT));
+        dmae->opcode = bnx2x_dmae_opcode(bp, DMAE_SRC_GRC, DMAE_DST_PCI,
+                                         true, DMAE_COMP_PCI);
         dmae->src_addr_lo = (port ? NIG_REG_STAT1_EGRESS_MAC_PKT1 :
                                     NIG_REG_STAT0_EGRESS_MAC_PKT1) >> 2;
         dmae->src_addr_hi = 0;
@@ -522,16 +501,8 @@ static void bnx2x_func_stats_init(struct bnx2x *bp)
         bp->executer_idx = 0;
         memset(dmae, 0, sizeof(struct dmae_command));
 
-        dmae->opcode = (DMAE_CMD_SRC_PCI | DMAE_CMD_DST_GRC |
-                        DMAE_CMD_C_DST_PCI | DMAE_CMD_C_ENABLE |
-                        DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET |
-#ifdef __BIG_ENDIAN
-                        DMAE_CMD_ENDIANITY_B_DW_SWAP |
-#else
-                        DMAE_CMD_ENDIANITY_DW_SWAP |
-#endif
-                        (BP_PORT(bp) ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0) |
-                        (BP_E1HVN(bp) << DMAE_CMD_E1HVN_SHIFT));
+        dmae->opcode = bnx2x_dmae_opcode(bp, DMAE_SRC_PCI, DMAE_DST_GRC,
+                                         true, DMAE_COMP_PCI);
         dmae->src_addr_lo = U64_LO(bnx2x_sp_mapping(bp, func_stats));
         dmae->src_addr_hi = U64_HI(bnx2x_sp_mapping(bp, func_stats));
         dmae->dst_addr_lo = bp->func_stx >> 2;
@@ -571,7 +542,6 @@ static void bnx2x_stats_restart(struct bnx2x *bp)
 
 static void bnx2x_bmac_stats_update(struct bnx2x *bp)
 {
-        struct bmac_stats *new = bnx2x_sp(bp, mac_stats.bmac_stats);
         struct host_port_stats *pstats = bnx2x_sp(bp, port_stats);
         struct bnx2x_eth_stats *estats = &bp->eth_stats;
         struct {
@@ -579,35 +549,74 @@ static void bnx2x_bmac_stats_update(struct bnx2x *bp)
                 u32 hi;
         } diff;
 
-        UPDATE_STAT64(rx_stat_grerb, rx_stat_ifhcinbadoctets);
-        UPDATE_STAT64(rx_stat_grfcs, rx_stat_dot3statsfcserrors);
-        UPDATE_STAT64(rx_stat_grund, rx_stat_etherstatsundersizepkts);
-        UPDATE_STAT64(rx_stat_grovr, rx_stat_dot3statsframestoolong);
-        UPDATE_STAT64(rx_stat_grfrg, rx_stat_etherstatsfragments);
-        UPDATE_STAT64(rx_stat_grjbr, rx_stat_etherstatsjabbers);
-        UPDATE_STAT64(rx_stat_grxcf, rx_stat_maccontrolframesreceived);
-        UPDATE_STAT64(rx_stat_grxpf, rx_stat_xoffstateentered);
-        UPDATE_STAT64(rx_stat_grxpf, rx_stat_bmac_xpf);
-        UPDATE_STAT64(tx_stat_gtxpf, tx_stat_outxoffsent);
-        UPDATE_STAT64(tx_stat_gtxpf, tx_stat_flowcontroldone);
-        UPDATE_STAT64(tx_stat_gt64, tx_stat_etherstatspkts64octets);
-        UPDATE_STAT64(tx_stat_gt127,
+        if (CHIP_IS_E1x(bp)) {
+                struct bmac1_stats *new = bnx2x_sp(bp, mac_stats.bmac1_stats);
+
+                /* the macros below will use "bmac1_stats" type */
+                UPDATE_STAT64(rx_stat_grerb, rx_stat_ifhcinbadoctets);
+                UPDATE_STAT64(rx_stat_grfcs, rx_stat_dot3statsfcserrors);
+                UPDATE_STAT64(rx_stat_grund, rx_stat_etherstatsundersizepkts);
+                UPDATE_STAT64(rx_stat_grovr, rx_stat_dot3statsframestoolong);
+                UPDATE_STAT64(rx_stat_grfrg, rx_stat_etherstatsfragments);
+                UPDATE_STAT64(rx_stat_grjbr, rx_stat_etherstatsjabbers);
+                UPDATE_STAT64(rx_stat_grxcf, rx_stat_maccontrolframesreceived);
+                UPDATE_STAT64(rx_stat_grxpf, rx_stat_xoffstateentered);
+                UPDATE_STAT64(rx_stat_grxpf, rx_stat_bmac_xpf);
+                UPDATE_STAT64(tx_stat_gtxpf, tx_stat_outxoffsent);
+                UPDATE_STAT64(tx_stat_gtxpf, tx_stat_flowcontroldone);
+                UPDATE_STAT64(tx_stat_gt64, tx_stat_etherstatspkts64octets);
+                UPDATE_STAT64(tx_stat_gt127,
+                                tx_stat_etherstatspkts65octetsto127octets);
+                UPDATE_STAT64(tx_stat_gt255,
+                                tx_stat_etherstatspkts128octetsto255octets);
+                UPDATE_STAT64(tx_stat_gt511,
+                                tx_stat_etherstatspkts256octetsto511octets);
+                UPDATE_STAT64(tx_stat_gt1023,
+                                tx_stat_etherstatspkts512octetsto1023octets);
+                UPDATE_STAT64(tx_stat_gt1518,
+                                tx_stat_etherstatspkts1024octetsto1522octets);
+                UPDATE_STAT64(tx_stat_gt2047, tx_stat_bmac_2047);
+                UPDATE_STAT64(tx_stat_gt4095, tx_stat_bmac_4095);
+                UPDATE_STAT64(tx_stat_gt9216, tx_stat_bmac_9216);
+                UPDATE_STAT64(tx_stat_gt16383, tx_stat_bmac_16383);
+                UPDATE_STAT64(tx_stat_gterr,
+                                tx_stat_dot3statsinternalmactransmiterrors);
+                UPDATE_STAT64(tx_stat_gtufl, tx_stat_bmac_ufl);
+
+        } else {
+                struct bmac2_stats *new = bnx2x_sp(bp, mac_stats.bmac2_stats);
+
+                /* the macros below will use "bmac2_stats" type */
+                UPDATE_STAT64(rx_stat_grerb, rx_stat_ifhcinbadoctets);
+                UPDATE_STAT64(rx_stat_grfcs, rx_stat_dot3statsfcserrors);
+                UPDATE_STAT64(rx_stat_grund, rx_stat_etherstatsundersizepkts);
+                UPDATE_STAT64(rx_stat_grovr, rx_stat_dot3statsframestoolong);
+                UPDATE_STAT64(rx_stat_grfrg, rx_stat_etherstatsfragments);
+                UPDATE_STAT64(rx_stat_grjbr, rx_stat_etherstatsjabbers);
+                UPDATE_STAT64(rx_stat_grxcf, rx_stat_maccontrolframesreceived);
+                UPDATE_STAT64(rx_stat_grxpf, rx_stat_xoffstateentered);
+                UPDATE_STAT64(rx_stat_grxpf, rx_stat_bmac_xpf);
+                UPDATE_STAT64(tx_stat_gtxpf, tx_stat_outxoffsent);
+                UPDATE_STAT64(tx_stat_gtxpf, tx_stat_flowcontroldone);
+                UPDATE_STAT64(tx_stat_gt64, tx_stat_etherstatspkts64octets);
+                UPDATE_STAT64(tx_stat_gt127,
                                 tx_stat_etherstatspkts65octetsto127octets);
-        UPDATE_STAT64(tx_stat_gt255,
+                UPDATE_STAT64(tx_stat_gt255,
                                 tx_stat_etherstatspkts128octetsto255octets);
-        UPDATE_STAT64(tx_stat_gt511,
+                UPDATE_STAT64(tx_stat_gt511,
                                 tx_stat_etherstatspkts256octetsto511octets);
-        UPDATE_STAT64(tx_stat_gt1023,
+                UPDATE_STAT64(tx_stat_gt1023,
                                 tx_stat_etherstatspkts512octetsto1023octets);
-        UPDATE_STAT64(tx_stat_gt1518,
+                UPDATE_STAT64(tx_stat_gt1518,
                                 tx_stat_etherstatspkts1024octetsto1522octets);
-        UPDATE_STAT64(tx_stat_gt2047, tx_stat_bmac_2047);
-        UPDATE_STAT64(tx_stat_gt4095, tx_stat_bmac_4095);
-        UPDATE_STAT64(tx_stat_gt9216, tx_stat_bmac_9216);
-        UPDATE_STAT64(tx_stat_gt16383, tx_stat_bmac_16383);
-        UPDATE_STAT64(tx_stat_gterr,
+                UPDATE_STAT64(tx_stat_gt2047, tx_stat_bmac_2047);
+                UPDATE_STAT64(tx_stat_gt4095, tx_stat_bmac_4095);
+                UPDATE_STAT64(tx_stat_gt9216, tx_stat_bmac_9216);
+                UPDATE_STAT64(tx_stat_gt16383, tx_stat_bmac_16383);
+                UPDATE_STAT64(tx_stat_gterr,
                                 tx_stat_dot3statsinternalmactransmiterrors);
-        UPDATE_STAT64(tx_stat_gtufl, tx_stat_bmac_ufl);
+                UPDATE_STAT64(tx_stat_gtufl, tx_stat_bmac_ufl);
+        }
 
         estats->pause_frames_received_hi =
                                 pstats->mac_stx[1].rx_stat_bmac_xpf_hi;
@@ -1124,24 +1133,17 @@ static void bnx2x_port_stats_stop(struct bnx2x *bp)
 
         bp->executer_idx = 0;
 
-        opcode = (DMAE_CMD_SRC_PCI | DMAE_CMD_DST_GRC |
-                  DMAE_CMD_C_ENABLE |
-                  DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET |
-#ifdef __BIG_ENDIAN
-                  DMAE_CMD_ENDIANITY_B_DW_SWAP |
-#else
-                  DMAE_CMD_ENDIANITY_DW_SWAP |
-#endif
-                  (BP_PORT(bp) ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0) |
-                  (BP_E1HVN(bp) << DMAE_CMD_E1HVN_SHIFT));
+        opcode = bnx2x_dmae_opcode(bp, DMAE_SRC_PCI, DMAE_DST_GRC, false, 0);
 
         if (bp->port.port_stx) {
 
                 dmae = bnx2x_sp(bp, dmae[bp->executer_idx++]);
                 if (bp->func_stx)
-                        dmae->opcode = (opcode | DMAE_CMD_C_DST_GRC);
+                        dmae->opcode = bnx2x_dmae_opcode_add_comp(
+                                                opcode, DMAE_COMP_GRC);
                 else
-                        dmae->opcode = (opcode | DMAE_CMD_C_DST_PCI);
+                        dmae->opcode = bnx2x_dmae_opcode_add_comp(
+                                                opcode, DMAE_COMP_PCI);
                 dmae->src_addr_lo = U64_LO(bnx2x_sp_mapping(bp, port_stats));
                 dmae->src_addr_hi = U64_HI(bnx2x_sp_mapping(bp, port_stats));
                 dmae->dst_addr_lo = bp->port.port_stx >> 2;
@@ -1165,7 +1167,8 @@ static void bnx2x_port_stats_stop(struct bnx2x *bp)
         if (bp->func_stx) {
 
                 dmae = bnx2x_sp(bp, dmae[bp->executer_idx++]);
-                dmae->opcode = (opcode | DMAE_CMD_C_DST_PCI);
+                dmae->opcode =
+                        bnx2x_dmae_opcode_add_comp(opcode, DMAE_COMP_PCI);
                 dmae->src_addr_lo = U64_LO(bnx2x_sp_mapping(bp, func_stats));
                 dmae->src_addr_hi = U64_HI(bnx2x_sp_mapping(bp, func_stats));
                 dmae->dst_addr_lo = bp->func_stx >> 2;
@@ -1258,16 +1261,8 @@ static void bnx2x_port_stats_base_init(struct bnx2x *bp)
         bp->executer_idx = 0;
 
         dmae = bnx2x_sp(bp, dmae[bp->executer_idx++]);
-        dmae->opcode = (DMAE_CMD_SRC_PCI | DMAE_CMD_DST_GRC |
-                        DMAE_CMD_C_DST_PCI | DMAE_CMD_C_ENABLE |
-                        DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET |
-#ifdef __BIG_ENDIAN
-                        DMAE_CMD_ENDIANITY_B_DW_SWAP |
-#else
-                        DMAE_CMD_ENDIANITY_DW_SWAP |
-#endif
-                        (BP_PORT(bp) ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0) |
-                        (BP_E1HVN(bp) << DMAE_CMD_E1HVN_SHIFT));
+        dmae->opcode = bnx2x_dmae_opcode(bp, DMAE_SRC_PCI, DMAE_DST_GRC,
+                                         true, DMAE_COMP_PCI);
         dmae->src_addr_lo = U64_LO(bnx2x_sp_mapping(bp, port_stats));
         dmae->src_addr_hi = U64_HI(bnx2x_sp_mapping(bp, port_stats));
         dmae->dst_addr_lo = bp->port.port_stx >> 2;
@@ -1284,9 +1279,7 @@ static void bnx2x_port_stats_base_init(struct bnx2x *bp)
 
 static void bnx2x_func_stats_base_init(struct bnx2x *bp)
 {
-        int vn, vn_max = IS_E1HMF(bp) ? E1HVN_MAX : E1VN_MAX;
-        int port = BP_PORT(bp);
-        int func;
+        int vn, vn_max = IS_MF(bp) ? E1HVN_MAX : E1VN_MAX;
         u32 func_stx;
 
         /* sanity */
@@ -1299,9 +1292,9 @@ static void bnx2x_func_stats_base_init(struct bnx2x *bp)
         func_stx = bp->func_stx;
 
         for (vn = VN_0; vn < vn_max; vn++) {
-                func = 2*vn + port;
+                int mb_idx = !CHIP_IS_E2(bp) ? 2*vn + BP_PORT(bp) : vn;
 
-                bp->func_stx = SHMEM_RD(bp, func_mb[func].fw_mb_param);
+                bp->func_stx = SHMEM_RD(bp, func_mb[mb_idx].fw_mb_param);
                 bnx2x_func_stats_init(bp);
                 bnx2x_hw_stats_post(bp);
                 bnx2x_stats_comp(bp);
@@ -1325,16 +1318,8 @@ static void bnx2x_func_stats_base_update(struct bnx2x *bp)
         bp->executer_idx = 0;
         memset(dmae, 0, sizeof(struct dmae_command));
 
-        dmae->opcode = (DMAE_CMD_SRC_GRC | DMAE_CMD_DST_PCI |
-                        DMAE_CMD_C_DST_PCI | DMAE_CMD_C_ENABLE |
-                        DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET |
-#ifdef __BIG_ENDIAN
-                        DMAE_CMD_ENDIANITY_B_DW_SWAP |
-#else
-                        DMAE_CMD_ENDIANITY_DW_SWAP |
-#endif
-                        (BP_PORT(bp) ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0) |
-                        (BP_E1HVN(bp) << DMAE_CMD_E1HVN_SHIFT));
+        dmae->opcode = bnx2x_dmae_opcode(bp, DMAE_SRC_GRC, DMAE_DST_PCI,
+                                         true, DMAE_COMP_PCI);
         dmae->src_addr_lo = bp->func_stx >> 2;
         dmae->src_addr_hi = 0;
         dmae->dst_addr_lo = U64_LO(bnx2x_sp_mapping(bp, func_stats_base));
@@ -1352,8 +1337,9 @@ static void bnx2x_func_stats_base_update(struct bnx2x *bp)
 void bnx2x_stats_init(struct bnx2x *bp)
 {
         int port = BP_PORT(bp);
-        int func = BP_FUNC(bp);
+        int mb_idx = BP_FW_MB_IDX(bp);
         int i;
+        struct eth_stats_query *stats = bnx2x_sp(bp, fw_stats);
 
         bp->stats_pending = 0;
         bp->executer_idx = 0;
@@ -1362,7 +1348,7 @@ void bnx2x_stats_init(struct bnx2x *bp)
         /* port and func stats for management */
         if (!BP_NOMCP(bp)) {
                 bp->port.port_stx = SHMEM_RD(bp, port_mb[port].port_stx);
-                bp->func_stx = SHMEM_RD(bp, func_mb[func].fw_mb_param);
+                bp->func_stx = SHMEM_RD(bp, func_mb[mb_idx].fw_mb_param);
 
         } else {
                 bp->port.port_stx = 0;
@@ -1395,6 +1381,18 @@ void bnx2x_stats_init(struct bnx2x *bp)
                 memset(&fp->eth_q_stats, 0, sizeof(struct bnx2x_eth_q_stats));
         }
 
+        for_each_queue(bp, i) {
+                /* Set initial stats counter in the stats ramrod data to -1 */
+                int cl_id = bp->fp[i].cl_id;
+
+                stats->xstorm_common.client_statistics[cl_id].
+                        stats_counter = 0xffff;
+                stats->ustorm_common.client_statistics[cl_id].
+                        stats_counter = 0xffff;
+                stats->tstorm_common.client_statistics[cl_id].
+                        stats_counter = 0xffff;
+        }
+
         memset(&bp->dev->stats, 0, sizeof(struct net_device_stats));
         memset(&bp->eth_stats, 0, sizeof(struct bnx2x_eth_stats));
 
diff --git a/drivers/net/bnx2x/bnx2x_stats.h b/drivers/net/bnx2x/bnx2x_stats.h
index 38a4e908f4fb..afd15efa429a 100644
--- a/drivers/net/bnx2x/bnx2x_stats.h
+++ b/drivers/net/bnx2x/bnx2x_stats.h
@@ -9,6 +9,10 @@
  * Maintained by: Eilon Greenstein <eilong@broadcom.com>
  * Written by: Eliezer Tamir
  * Based on code from Michael Chan's bnx2 driver
+ * UDP CSUM errata workaround by Arik Gendelman
+ * Slowpath and fastpath rework by Vladislav Zolotarov
+ * Statistics and Link management by Yitchak Gertner
+ *
  */
 
 #ifndef BNX2X_STATS_H
@@ -228,12 +232,8 @@ struct bnx2x_eth_stats {
 /* Forward declaration */
 struct bnx2x;
 
-
 void bnx2x_stats_init(struct bnx2x *bp);
 
 extern const u32 dmae_reg_go_c[];
-extern int bnx2x_sp_post(struct bnx2x *bp, int command, int cid,
-                         u32 data_hi, u32 data_lo, int common);
-
 
 #endif /* BNX2X_STATS_H */
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 822f586d72af..881914bc4e9c 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -93,7 +93,7 @@
 // compare MAC addresses
 #define MAC_ADDRESS_COMPARE(A, B) memcmp(A, B, ETH_ALEN)
 
-static struct mac_addr null_mac_addr = {{0, 0, 0, 0, 0, 0}};
+static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } };
 static u16 ad_ticks_per_sec;
 static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000;
 
@@ -129,9 +129,8 @@ static void ad_marker_response_received(struct bond_marker *marker, struct port
  */
 static inline struct bonding *__get_bond_by_port(struct port *port)
 {
-        if (port->slave == NULL) {
+        if (port->slave == NULL)
                 return NULL;
-        }
 
         return bond_get_bond_by_slave(port->slave);
 }
@@ -144,9 +143,8 @@ static inline struct bonding *__get_bond_by_port(struct port *port)
  */
 static inline struct port *__get_first_port(struct bonding *bond)
 {
-        if (bond->slave_cnt == 0) {
+        if (bond->slave_cnt == 0)
                 return NULL;
-        }
 
         return &(SLAVE_AD_INFO(bond->first_slave).port);
 }
@@ -164,9 +162,8 @@ static inline struct port *__get_next_port(struct port *port)
         struct slave *slave = port->slave;
 
         // If there's no bond for this port, or this is the last slave
-        if ((bond == NULL) || (slave->next == bond->first_slave)) {
+        if ((bond == NULL) || (slave->next == bond->first_slave))
                 return NULL;
-        }
 
         return &(SLAVE_AD_INFO(slave->next).port);
 }
@@ -183,9 +180,8 @@ static inline struct aggregator *__get_first_agg(struct port *port)
         struct bonding *bond = __get_bond_by_port(port);
 
         // If there's no bond for this port, or bond has no slaves
-        if ((bond == NULL) || (bond->slave_cnt == 0)) {
+        if ((bond == NULL) || (bond->slave_cnt == 0))
                 return NULL;
-        }
 
         return &(SLAVE_AD_INFO(bond->first_slave).aggregator);
 }
@@ -203,9 +199,8 @@ static inline struct aggregator *__get_next_agg(struct aggregator *aggregator)
         struct bonding *bond = bond_get_bond_by_slave(slave);
 
         // If there's no bond for this aggregator, or this is the last slave
-        if ((bond == NULL) || (slave->next == bond->first_slave)) {
+        if ((bond == NULL) || (slave->next == bond->first_slave))
                 return NULL;
-        }
 
         return &(SLAVE_AD_INFO(slave->next).aggregator);
 }
@@ -240,9 +235,8 @@ static inline void __enable_port(struct port *port)
 {
         struct slave *slave = port->slave;
 
-        if ((slave->link == BOND_LINK_UP) && IS_UP(slave->dev)) {
+        if ((slave->link == BOND_LINK_UP) && IS_UP(slave->dev))
                 bond_set_slave_active_flags(slave);
-        }
 }
 
 /**
@@ -252,7 +246,7 @@ static inline void __enable_port(struct port *port)
  */
 static inline int __port_is_enabled(struct port *port)
 {
-        return(port->slave->state == BOND_STATE_ACTIVE);
+        return port->slave->state == BOND_STATE_ACTIVE;
 }
 
 /**
@@ -265,9 +259,8 @@ static inline u32 __get_agg_selection_mode(struct port *port)
 {
         struct bonding *bond = __get_bond_by_port(port);
 
-        if (bond == NULL) {
+        if (bond == NULL)
                 return BOND_AD_STABLE;
-        }
 
         return BOND_AD_INFO(bond).agg_select_mode;
 }
@@ -281,9 +274,8 @@ static inline int __check_agg_selection_timer(struct port *port)
 {
         struct bonding *bond = __get_bond_by_port(port);
 
-        if (bond == NULL) {
+        if (bond == NULL)
                 return 0;
-        }
 
         return BOND_AD_INFO(bond).agg_select_timer ? 1 : 0;
 }
@@ -328,9 +320,9 @@ static u16 __get_link_speed(struct port *port)
          * link down, it sets the speed to 0.
          * This is done in spite of the fact that the e100 driver reports 0 to be
          * compatible with MVT in the future.*/
-        if (slave->link != BOND_LINK_UP) {
-                speed=0;
-        } else {
+        if (slave->link != BOND_LINK_UP)
+                speed = 0;
+        else {
                 switch (slave->speed) {
                 case SPEED_10:
                         speed = AD_LINK_SPEED_BITMASK_10MBPS;
@@ -375,18 +367,18 @@ static u8 __get_duplex(struct port *port)
 
         //  handling a special case: when the configuration starts with
         // link down, it sets the duplex to 0.
-        if (slave->link != BOND_LINK_UP) {
-                retval=0x0;
-        } else {
+        if (slave->link != BOND_LINK_UP)
+                retval = 0x0;
+        else {
                 switch (slave->duplex) {
                 case DUPLEX_FULL:
-                        retval=0x1;
+                        retval = 0x1;
                         pr_debug("Port %d Received status full duplex update from adapter\n",
                                  port->actor_port_number);
                         break;
                 case DUPLEX_HALF:
                 default:
-                        retval=0x0;
+                        retval = 0x0;
                         pr_debug("Port %d Received status NOT full duplex update from adapter\n",
                                  port->actor_port_number);
                         break;
@@ -419,15 +411,14 @@ static inline void __initialize_port_locks(struct port *port)
  */
 static u16 __ad_timer_to_ticks(u16 timer_type, u16 par)
 {
-        u16 retval=0;    //to silence the compiler
+        u16 retval = 0; /* to silence the compiler */
 
         switch (timer_type) {
         case AD_CURRENT_WHILE_TIMER:   // for rx machine usage
-                if (par) {            // for short or long timeout
+                if (par)
                         retval = (AD_SHORT_TIMEOUT_TIME*ad_ticks_per_sec); // short timeout
-                } else {
+                else
                         retval = (AD_LONG_TIMEOUT_TIME*ad_ticks_per_sec); // long timeout
-                }
                 break;
         case AD_ACTOR_CHURN_TIMER:          // for local churn machine
                 retval = (AD_CHURN_DETECTION_TIME*ad_ticks_per_sec);
@@ -519,11 +510,11 @@ static void __record_pdu(struct lacpdu *lacpdu, struct port *port)
                 port->actor_oper_port_state &= ~AD_STATE_DEFAULTED;
 
                 // set the partner sync. to on if the partner is sync. and the port is matched
-                if ((port->sm_vars & AD_PORT_MATCHED) && (lacpdu->actor_state & AD_STATE_SYNCHRONIZATION)) {
+                if ((port->sm_vars & AD_PORT_MATCHED)
+                    && (lacpdu->actor_state & AD_STATE_SYNCHRONIZATION))
                         partner->port_state |= AD_STATE_SYNCHRONIZATION;
-                } else {
+                else
                         partner->port_state &= ~AD_STATE_SYNCHRONIZATION;
-                }
         }
 }
 
@@ -653,7 +644,7 @@ static void __update_ntt(struct lacpdu *lacpdu, struct port *port)
  */
 static void __attach_bond_to_agg(struct port *port)
 {
-        port=NULL; // just to satisfy the compiler
+        port = NULL; /* just to satisfy the compiler */
         // This function does nothing since the parser/multiplexer of the receive
         // and the parser/multiplexer of the aggregator are already combined
 }
@@ -668,7 +659,7 @@ static void __attach_bond_to_agg(struct port *port)
  */
 static void __detach_bond_from_agg(struct port *port)
 {
-        port=NULL; // just to satisfy the compiler
+        port = NULL; /* just to satisfy the compiler */
         // This function does nothing sience the parser/multiplexer of the receive
         // and the parser/multiplexer of the aggregator are already combined
 }
@@ -685,7 +676,9 @@ static int __agg_ports_are_ready(struct aggregator *aggregator)
 
         if (aggregator) {
                 // scan all ports in this aggregator to verfy if they are all ready
-                for (port=aggregator->lag_ports; port; port=port->next_port_in_aggregator) {
+                for (port = aggregator->lag_ports;
+                     port;
+                     port = port->next_port_in_aggregator) {
                         if (!(port->sm_vars & AD_PORT_READY_N)) {
                                 retval = 0;
                                 break;
@@ -706,12 +699,12 @@ static void __set_agg_ports_ready(struct aggregator *aggregator, int val)
 {
         struct port *port;
 
-        for (port=aggregator->lag_ports; port; port=port->next_port_in_aggregator) {
-                if (val) {
+        for (port = aggregator->lag_ports; port;
+             port = port->next_port_in_aggregator) {
+                if (val)
                         port->sm_vars |= AD_PORT_READY;
-                } else {
+                else
                         port->sm_vars &= ~AD_PORT_READY;
-                }
         }
 }
 
@@ -722,7 +715,7 @@ static void __set_agg_ports_ready(struct aggregator *aggregator, int val)
  */
 static u32 __get_agg_bandwidth(struct aggregator *aggregator)
 {
-        u32 bandwidth=0;
+        u32 bandwidth = 0;
         u32 basic_speed;
 
         if (aggregator->num_of_ports) {
@@ -744,7 +737,7 @@ static u32 __get_agg_bandwidth(struct aggregator *aggregator)
                         bandwidth = aggregator->num_of_ports * 10000;
                         break;
                 default:
-                        bandwidth=0; // to silent the compilor ....
+                        bandwidth = 0; /*to silence the compiler ....*/
                 }
         }
         return bandwidth;
@@ -835,9 +828,8 @@ static int ad_lacpdu_send(struct port *port)
         int length = sizeof(struct lacpdu_header);
 
         skb = dev_alloc_skb(length);
-        if (!skb) {
+        if (!skb)
                 return -ENOMEM;
-        }
 
         skb->dev = slave->dev;
         skb_reset_mac_header(skb);
@@ -876,9 +868,8 @@ static int ad_marker_send(struct port *port, struct bond_marker *marker)
         int length = sizeof(struct bond_marker_header);
 
         skb = dev_alloc_skb(length + 16);
-        if (!skb) {
+        if (!skb)
                 return -ENOMEM;
-        }
 
         skb_reserve(skb, 16);
 
@@ -919,9 +910,10 @@ static void ad_mux_machine(struct port *port)
         } else {
                 switch (port->sm_mux_state) {
                 case AD_MUX_DETACHED:
-                        if ((port->sm_vars & AD_PORT_SELECTED) || (port->sm_vars & AD_PORT_STANDBY)) { // if SELECTED or STANDBY
+                        if ((port->sm_vars & AD_PORT_SELECTED)
+                            || (port->sm_vars & AD_PORT_STANDBY))
+                                /* if SELECTED or STANDBY */
                                 port->sm_mux_state = AD_MUX_WAITING; // next state
-                        }
                         break;
                 case AD_MUX_WAITING:
                         // if SELECTED == FALSE return to DETACH state
@@ -935,18 +927,18 @@ static void ad_mux_machine(struct port *port)
                         }
 
                         // check if the wait_while_timer expired
-                        if (port->sm_mux_timer_counter && !(--port->sm_mux_timer_counter)) {
+                        if (port->sm_mux_timer_counter
+                            && !(--port->sm_mux_timer_counter))
                                 port->sm_vars |= AD_PORT_READY_N;
-                        }
 
                         // in order to withhold the selection logic to check all ports READY_N value
                         // every callback cycle to update ready variable, we check READY_N and update READY here
                         __set_agg_ports_ready(port->aggregator, __agg_ports_are_ready(port->aggregator));
 
                         // if the wait_while_timer expired, and the port is in READY state, move to ATTACHED state
-                        if ((port->sm_vars & AD_PORT_READY) && !port->sm_mux_timer_counter) {
+                        if ((port->sm_vars & AD_PORT_READY)
+                            && !port->sm_mux_timer_counter)
                                 port->sm_mux_state = AD_MUX_ATTACHED;    // next state
-                        }
                         break;
                 case AD_MUX_ATTACHED:
                         // check also if agg_select_timer expired(so the edable port will take place only after this timer)
@@ -1041,13 +1033,14 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
 
         // check if state machine should change state
         // first, check if port was reinitialized
-        if (port->sm_vars & AD_PORT_BEGIN) {
-                port->sm_rx_state = AD_RX_INITIALIZE;               // next state
-        }
+        if (port->sm_vars & AD_PORT_BEGIN)
+                /* next state */
+                port->sm_rx_state = AD_RX_INITIALIZE;
         // check if port is not enabled
-        else if (!(port->sm_vars & AD_PORT_BEGIN) && !port->is_enabled && !(port->sm_vars & AD_PORT_MOVED)) {
-                port->sm_rx_state = AD_RX_PORT_DISABLED;            // next state
-        }
+        else if (!(port->sm_vars & AD_PORT_BEGIN)
+                 && !port->is_enabled && !(port->sm_vars & AD_PORT_MOVED))
+                /* next state */
+                port->sm_rx_state = AD_RX_PORT_DISABLED;
         // check if new lacpdu arrived
         else if (lacpdu && ((port->sm_rx_state == AD_RX_EXPIRED) || (port->sm_rx_state == AD_RX_DEFAULTED) || (port->sm_rx_state == AD_RX_CURRENT))) {
                 port->sm_rx_timer_counter = 0; // zero timer
@@ -1069,13 +1062,16 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
                         // if no lacpdu arrived and no timer is on
                         switch (port->sm_rx_state) {
                         case AD_RX_PORT_DISABLED:
-                                if (port->sm_vars & AD_PORT_MOVED) {
+                                if (port->sm_vars & AD_PORT_MOVED)
                                         port->sm_rx_state = AD_RX_INITIALIZE;       // next state
-                                } else if (port->is_enabled && (port->sm_vars & AD_PORT_LACP_ENABLED)) {
+                                else if (port->is_enabled
+                                         && (port->sm_vars
+                                             & AD_PORT_LACP_ENABLED))
                                         port->sm_rx_state = AD_RX_EXPIRED;      // next state
-                                } else if (port->is_enabled && ((port->sm_vars & AD_PORT_LACP_ENABLED) == 0)) {
+                                else if (port->is_enabled
+                                         && ((port->sm_vars
+                                              & AD_PORT_LACP_ENABLED) == 0))
                                         port->sm_rx_state = AD_RX_LACP_DISABLED;    // next state
-                                }
                                 break;
                         default:    //to silence the compiler
                                 break;
@@ -1091,11 +1087,10 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
                          port->sm_rx_state);
                 switch (port->sm_rx_state) {
                 case AD_RX_INITIALIZE:
-                        if (!(port->actor_oper_port_key & AD_DUPLEX_KEY_BITS)) {
+                        if (!(port->actor_oper_port_key & AD_DUPLEX_KEY_BITS))
                                 port->sm_vars &= ~AD_PORT_LACP_ENABLED;
-                        } else {
+                        else
                                 port->sm_vars |= AD_PORT_LACP_ENABLED;
-                        }
                         port->sm_vars &= ~AD_PORT_SELECTED;
                         __record_default(port);
                         port->actor_oper_port_state &= ~AD_STATE_EXPIRED;
@@ -1149,9 +1144,10 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
                         // verify that if the aggregator is enabled, the port is enabled too.
                         //(because if the link goes down for a short time, the 802.3ad will not
                         // catch it, and the port will continue to be disabled)
-                        if (port->aggregator && port->aggregator->is_active && !__port_is_enabled(port)) {
+                        if (port->aggregator
+                            && port->aggregator->is_active
+                            && !__port_is_enabled(port))
                                 __enable_port(port);
-                        }
                         break;
                 default:    //to silence the compiler
                         break;
@@ -1183,7 +1179,8 @@ static void ad_tx_machine(struct port *port)
                         }
                 }
                 // restart tx timer(to verify that we will not exceed AD_MAX_TX_IN_SECOND
-                port->sm_tx_timer_counter=ad_ticks_per_sec/AD_MAX_TX_IN_SECOND;
+                port->sm_tx_timer_counter =
+                        ad_ticks_per_sec/AD_MAX_TX_IN_SECOND;
         }
 }
 
@@ -1216,9 +1213,9 @@ static void ad_periodic_machine(struct port *port)
                         // If not expired, check if there is some new timeout parameter from the partner state
                         switch (port->sm_periodic_state) {
                         case AD_FAST_PERIODIC:
-                                if (!(port->partner_oper.port_state & AD_STATE_LACP_TIMEOUT)) {
+                                if (!(port->partner_oper.port_state
+                                      & AD_STATE_LACP_TIMEOUT))
                                         port->sm_periodic_state = AD_SLOW_PERIODIC;  // next state
-                                }
                                 break;
                         case AD_SLOW_PERIODIC:
                                 if ((port->partner_oper.port_state & AD_STATE_LACP_TIMEOUT)) {
@@ -1237,11 +1234,11 @@ static void ad_periodic_machine(struct port *port)
                         port->sm_periodic_state = AD_FAST_PERIODIC;      // next state
                         break;
                 case AD_PERIODIC_TX:
-                        if (!(port->partner_oper.port_state & AD_STATE_LACP_TIMEOUT)) {
+                        if (!(port->partner_oper.port_state
+                              & AD_STATE_LACP_TIMEOUT))
                                 port->sm_periodic_state = AD_SLOW_PERIODIC;  // next state
-                        } else {
+                        else
                                 port->sm_periodic_state = AD_FAST_PERIODIC;  // next state
-                        }
                         break;
                 default:    //to silence the compiler
                         break;
@@ -1287,35 +1284,37 @@ static void ad_port_selection_logic(struct port *port)
         int found = 0;
 
         // if the port is already Selected, do nothing
-        if (port->sm_vars & AD_PORT_SELECTED) {
+        if (port->sm_vars & AD_PORT_SELECTED)
                 return;
-        }
 
         // if the port is connected to other aggregator, detach it
         if (port->aggregator) {
                 // detach the port from its former aggregator
-                temp_aggregator=port->aggregator;
-                for (curr_port=temp_aggregator->lag_ports; curr_port; last_port=curr_port, curr_port=curr_port->next_port_in_aggregator) {
+                temp_aggregator = port->aggregator;
+                for (curr_port = temp_aggregator->lag_ports; curr_port;
+                     last_port = curr_port,
+                             curr_port = curr_port->next_port_in_aggregator) {
                         if (curr_port == port) {
                                 temp_aggregator->num_of_ports--;
                                 if (!last_port) {// if it is the first port attached to the aggregator
-                                        temp_aggregator->lag_ports=port->next_port_in_aggregator;
+                                        temp_aggregator->lag_ports =
+                                                port->next_port_in_aggregator;
                                 } else {// not the first port attached to the aggregator
-                                        last_port->next_port_in_aggregator=port->next_port_in_aggregator;
+                                        last_port->next_port_in_aggregator =
+                                                port->next_port_in_aggregator;
                                 }
 
                                 // clear the port's relations to this aggregator
                                 port->aggregator = NULL;
-                                port->next_port_in_aggregator=NULL;
-                                port->actor_port_aggregator_identifier=0;
+                                port->next_port_in_aggregator = NULL;
+                                port->actor_port_aggregator_identifier = 0;
 
                                 pr_debug("Port %d left LAG %d\n",
                                          port->actor_port_number,
                                          temp_aggregator->aggregator_identifier);
                                 // if the aggregator is empty, clear its parameters, and set it ready to be attached
-                                if (!temp_aggregator->lag_ports) {
+                                if (!temp_aggregator->lag_ports)
                                         ad_clear_agg(temp_aggregator);
-                                }
                                 break;
                         }
                 }
@@ -1333,9 +1332,8 @@ static void ad_port_selection_logic(struct port *port)
 
                 // keep a free aggregator for later use(if needed)
                 if (!aggregator->lag_ports) {
-                        if (!free_aggregator) {
-                                free_aggregator=aggregator;
-                        }
+                        if (!free_aggregator)
+                                free_aggregator = aggregator;
                         continue;
                 }
                 // check if current aggregator suits us
@@ -1350,10 +1348,11 @@ static void ad_port_selection_logic(struct port *port)
                    ) {
                         // attach to the founded aggregator
                         port->aggregator = aggregator;
-                        port->actor_port_aggregator_identifier=port->aggregator->aggregator_identifier;
-                        port->next_port_in_aggregator=aggregator->lag_ports;
+                        port->actor_port_aggregator_identifier =
+                                port->aggregator->aggregator_identifier;
+                        port->next_port_in_aggregator = aggregator->lag_ports;
                         port->aggregator->num_of_ports++;
-                        aggregator->lag_ports=port;
+                        aggregator->lag_ports = port;
                         pr_debug("Port %d joined LAG %d(existing LAG)\n",
                                  port->actor_port_number,
                                  port->aggregator->aggregator_identifier);
@@ -1370,20 +1369,23 @@ static void ad_port_selection_logic(struct port *port)
                 if (free_aggregator) {
                         // assign port a new aggregator
                         port->aggregator = free_aggregator;
-                        port->actor_port_aggregator_identifier=port->aggregator->aggregator_identifier;
+                        port->actor_port_aggregator_identifier =
+                                port->aggregator->aggregator_identifier;
 
                         // update the new aggregator's parameters
                         // if port was responsed from the end-user
-                        if (port->actor_oper_port_key & AD_DUPLEX_KEY_BITS) {// if port is full duplex
+                        if (port->actor_oper_port_key & AD_DUPLEX_KEY_BITS)
+                                /* if port is full duplex */
                                 port->aggregator->is_individual = false;
-                        } else {
+                        else
                                 port->aggregator->is_individual = true;
-                        }
 
                         port->aggregator->actor_admin_aggregator_key = port->actor_admin_port_key;
                         port->aggregator->actor_oper_aggregator_key = port->actor_oper_port_key;
-                        port->aggregator->partner_system=port->partner_oper.system;
-                        port->aggregator->partner_system_priority = port->partner_oper.system_priority;
+                        port->aggregator->partner_system =
+                                port->partner_oper.system;
+                        port->aggregator->partner_system_priority =
+                                port->partner_oper.system_priority;
                         port->aggregator->partner_oper_aggregator_key = port->partner_oper.key;
                         port->aggregator->receive_state = 1;
                         port->aggregator->transmit_state = 1;
@@ -1704,9 +1706,8 @@ static void ad_initialize_port(struct port *port, int lacp_fast)
                 port->actor_admin_port_state = AD_STATE_AGGREGATION | AD_STATE_LACP_ACTIVITY;
                 port->actor_oper_port_state  = AD_STATE_AGGREGATION | AD_STATE_LACP_ACTIVITY;
 
-                if (lacp_fast) {
+                if (lacp_fast)
                         port->actor_oper_port_state |= AD_STATE_LACP_TIMEOUT;
-                }
 
                 memcpy(&port->partner_admin, &tmpl, sizeof(tmpl));
                 memcpy(&port->partner_oper, &tmpl, sizeof(tmpl));
@@ -1785,13 +1786,16 @@ static void ad_marker_info_send(struct port *port)
         marker.requester_port = (((port->actor_port_number & 0xFF) << 8) |((u16)(port->actor_port_number & 0xFF00) >> 8));
         marker.requester_system = port->actor_system;
         // convert requester_port(u32) to Big Endian
-        marker.requester_transaction_id = (((++port->transaction_id & 0xFF) << 24) |((port->transaction_id & 0xFF00) << 8) |((port->transaction_id & 0xFF0000) >> 8) |((port->transaction_id & 0xFF000000) >> 24));
+        marker.requester_transaction_id =
+                (((++port->transaction_id & 0xFF) << 24)
+                 | ((port->transaction_id & 0xFF00) << 8)
+                 | ((port->transaction_id & 0xFF0000) >> 8)
+                 | ((port->transaction_id & 0xFF000000) >> 24));
         marker.pad = 0;
         marker.tlv_type_terminator = 0x00;
         marker.terminator_length = 0x00;
-        for (index=0; index<90; index++) {
-                marker.reserved_90[index]=0;
-        }
+        for (index = 0; index < 90; index++)
+                marker.reserved_90[index] = 0;
 
         // send the marker information
         if (ad_marker_send(port, &marker) >= 0) {
@@ -1816,7 +1820,7 @@ static void ad_marker_info_received(struct bond_marker *marker_info,
         //marker = *marker_info;
         memcpy(&marker, marker_info, sizeof(struct bond_marker));
         // change the marker subtype to marker response
-        marker.tlv_type=AD_MARKER_RESPONSE_SUBTYPE;
+        marker.tlv_type = AD_MARKER_RESPONSE_SUBTYPE;
         // send the marker response
 
         if (ad_marker_send(port, &marker) >= 0) {
@@ -1837,8 +1841,8 @@ static void ad_marker_info_received(struct bond_marker *marker_info,
 static void ad_marker_response_received(struct bond_marker *marker,
         struct port *port)
 {
-        marker=NULL; // just to satisfy the compiler
-        port=NULL;  // just to satisfy the compiler
+        marker = NULL; /* just to satisfy the compiler */
+        port = NULL;  /* just to satisfy the compiler */
         // DO NOTHING, SINCE WE DECIDED NOT TO IMPLEMENT THIS FEATURE FOR NOW
 }
 
@@ -1932,9 +1936,8 @@ int bond_3ad_bind_slave(struct slave *slave)
                 port->actor_admin_port_key |= (__get_link_speed(port) << 1);
                 port->actor_oper_port_key = port->actor_admin_port_key;
                 // if the port is not full duplex, then the port should be not lacp Enabled
-                if (!(port->actor_oper_port_key & AD_DUPLEX_KEY_BITS)) {
+                if (!(port->actor_oper_port_key & AD_DUPLEX_KEY_BITS))
                         port->sm_vars &= ~AD_PORT_LACP_ENABLED;
-                }
                 // actor system is the bond's system
                 port->actor_system = BOND_AD_INFO(bond).system.sys_mac_addr;
                 // tx timer(to verify that no more than MAX_TX_IN_SECOND lacpdu's are sent in one second)
@@ -2006,9 +2009,10 @@ void bond_3ad_unbind_slave(struct slave *slave)
                         new_aggregator = __get_first_agg(port);
                         for (; new_aggregator; new_aggregator = __get_next_agg(new_aggregator)) {
                                 // if the new aggregator is empty, or it is connected to our port only
-                                if (!new_aggregator->lag_ports || ((new_aggregator->lag_ports == port) && !new_aggregator->lag_ports->next_port_in_aggregator)) {
+                                if (!new_aggregator->lag_ports
+                                    || ((new_aggregator->lag_ports == port)
+                                        && !new_aggregator->lag_ports->next_port_in_aggregator))
                                         break;
-                                }
                         }
                         // if new aggregator found, copy the aggregator's parameters
                         // and connect the related lag_ports to the new aggregator
@@ -2037,17 +2041,17 @@ void bond_3ad_unbind_slave(struct slave *slave)
                                 new_aggregator->num_of_ports = aggregator->num_of_ports;
 
                                 // update the information that is written on the ports about the aggregator
-                                for (temp_port=aggregator->lag_ports; temp_port; temp_port=temp_port->next_port_in_aggregator) {
-                                        temp_port->aggregator=new_aggregator;
+                                for (temp_port = aggregator->lag_ports; temp_port;
+                                     temp_port = temp_port->next_port_in_aggregator) {
+                                        temp_port->aggregator = new_aggregator;
                                         temp_port->actor_port_aggregator_identifier = new_aggregator->aggregator_identifier;
                                 }
 
                                 // clear the aggregator
                                 ad_clear_agg(aggregator);
 
-                                if (select_new_active_agg) {
+                                if (select_new_active_agg)
                                         ad_agg_selection_logic(__get_first_agg(port));
-                                }
                         } else {
                                 pr_warning("%s: Warning: unbinding aggregator, and could not find a new aggregator for its ports\n",
                                            slave->dev->master->name);
@@ -2071,15 +2075,16 @@ void bond_3ad_unbind_slave(struct slave *slave)
         for (; temp_aggregator; temp_aggregator = __get_next_agg(temp_aggregator)) {
                 prev_port = NULL;
                 // search the port in the aggregator's related ports
-                for (temp_port=temp_aggregator->lag_ports; temp_port; prev_port=temp_port, temp_port=temp_port->next_port_in_aggregator) {
+                for (temp_port = temp_aggregator->lag_ports; temp_port;
+                     prev_port = temp_port,
+                             temp_port = temp_port->next_port_in_aggregator) {
                         if (temp_port == port) { // the aggregator found - detach the port from this aggregator
-                                if (prev_port) {
+                                if (prev_port)
                                         prev_port->next_port_in_aggregator = temp_port->next_port_in_aggregator;
-                                } else {
+                                else
                                         temp_aggregator->lag_ports = temp_port->next_port_in_aggregator;
-                                }
                                 temp_aggregator->num_of_ports--;
-                                if (temp_aggregator->num_of_ports==0) {
+                                if (temp_aggregator->num_of_ports == 0) {
                                         select_new_active_agg = temp_aggregator->is_active;
                                         // clear the aggregator
                                         ad_clear_agg(temp_aggregator);
@@ -2094,7 +2099,7 @@ void bond_3ad_unbind_slave(struct slave *slave)
                         }
                 }
         }
-        port->slave=NULL;
+        port->slave = NULL;
 }
 
 /**
@@ -2119,14 +2124,12 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
 
         read_lock(&bond->lock);
 
-        if (bond->kill_timers) {
+        if (bond->kill_timers)
                 goto out;
-        }
 
         //check if there are any slaves
-        if (bond->slave_cnt == 0) {
+        if (bond->slave_cnt == 0)
                 goto re_arm;
-        }
 
         // check if agg_select_timer timer after initialize is timed out
         if (BOND_AD_INFO(bond).agg_select_timer && !(--BOND_AD_INFO(bond).agg_select_timer)) {
@@ -2159,9 +2162,8 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
                 ad_tx_machine(port);
 
                 // turn off the BEGIN bit, since we already handled it
-                if (port->sm_vars & AD_PORT_BEGIN) {
+                if (port->sm_vars & AD_PORT_BEGIN)
                         port->sm_vars &= ~AD_PORT_BEGIN;
-                }
         }
 
 re_arm:
@@ -2245,7 +2247,8 @@ void bond_3ad_adapter_speed_changed(struct slave *slave)
         }
 
         port->actor_admin_port_key &= ~AD_SPEED_KEY_BITS;
-        port->actor_oper_port_key=port->actor_admin_port_key |= (__get_link_speed(port) << 1);
+        port->actor_oper_port_key = port->actor_admin_port_key |=
+                (__get_link_speed(port) << 1);
         pr_debug("Port %d changed speed\n", port->actor_port_number);
         // there is no need to reselect a new aggregator, just signal the
         // state machines to reinitialize
@@ -2262,7 +2265,7 @@ void bond_3ad_adapter_duplex_changed(struct slave *slave)
 {
         struct port *port;
 
-        port=&(SLAVE_AD_INFO(slave).port);
+        port = &(SLAVE_AD_INFO(slave).port);
 
         // if slave is null, the whole port is not initialized
         if (!port->slave) {
@@ -2272,7 +2275,8 @@ void bond_3ad_adapter_duplex_changed(struct slave *slave)
         }
 
         port->actor_admin_port_key &= ~AD_DUPLEX_KEY_BITS;
-        port->actor_oper_port_key=port->actor_admin_port_key |= __get_duplex(port);
+        port->actor_oper_port_key = port->actor_admin_port_key |=
+                __get_duplex(port);
         pr_debug("Port %d changed duplex\n", port->actor_port_number);
         // there is no need to reselect a new aggregator, just signal the
         // state machines to reinitialize
@@ -2304,14 +2308,17 @@ void bond_3ad_handle_link_change(struct slave *slave, char link)
         if (link == BOND_LINK_UP) {
                 port->is_enabled = true;
                 port->actor_admin_port_key &= ~AD_DUPLEX_KEY_BITS;
-                port->actor_oper_port_key=port->actor_admin_port_key |= __get_duplex(port);
+                port->actor_oper_port_key = port->actor_admin_port_key |=
+                        __get_duplex(port);
                 port->actor_admin_port_key &= ~AD_SPEED_KEY_BITS;
-                port->actor_oper_port_key=port->actor_admin_port_key |= (__get_link_speed(port) << 1);
+                port->actor_oper_port_key = port->actor_admin_port_key |=
+                        (__get_link_speed(port) << 1);
         } else {
                 /* link has failed */
                 port->is_enabled = false;
                 port->actor_admin_port_key &= ~AD_DUPLEX_KEY_BITS;
-                port->actor_oper_port_key= (port->actor_admin_port_key &= ~AD_SPEED_KEY_BITS);
+                port->actor_oper_port_key = (port->actor_admin_port_key &=
+                                             ~AD_SPEED_KEY_BITS);
         }
         //BOND_PRINT_DBG(("Port %d changed link status to %s", port->actor_port_number, ((link == BOND_LINK_UP)?"UP":"DOWN")));
         // there is no need to reselect a new aggregator, just signal the
@@ -2394,9 +2401,8 @@ int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev)
          */
         read_lock(&bond->lock);
 
-        if (!BOND_IS_OK(bond)) {
+        if (!BOND_IS_OK(bond))
                 goto out;
-        }
 
         if (bond_3ad_get_active_agg_info(bond, &ad_info)) {
                 pr_debug("%s: Error: bond_3ad_get_active_agg_info failed\n",
@@ -2420,9 +2426,8 @@ int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev)
 
                 if (agg && (agg->aggregator_identifier == agg_id)) {
                         slave_agg_no--;
-                        if (slave_agg_no < 0) {
+                        if (slave_agg_no < 0)
                                 break;
-                        }
                 }
         }
 
@@ -2438,9 +2443,8 @@ int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev)
                 int slave_agg_id = 0;
                 struct aggregator *agg = SLAVE_AD_INFO(slave).port.aggregator;
 
-                if (agg) {
+                if (agg)
                         slave_agg_id = agg->aggregator_identifier;
-                }
 
                 if (SLAVE_IS_OK(slave) && agg && (slave_agg_id == agg_id)) {
                         res = bond_dev_queue_xmit(bond, skb, slave->dev);
@@ -2466,6 +2470,9 @@ int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct pac
         if (!(dev->flags & IFF_MASTER))
                 goto out;
 
+        if (!pskb_may_pull(skb, sizeof(struct lacpdu)))
+                goto out;
+
         read_lock(&bond->lock);
         slave = bond_get_slave_by_dev((struct bonding *)netdev_priv(dev),
                                         orig_dev);
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index c746b331771d..26bb118c4533 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -362,6 +362,9 @@ static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct
                 goto out;
         }
 
+        if (!pskb_may_pull(skb, arp_hdr_len(bond_dev)))
+                goto out;
+
         if (skb->len < sizeof(struct arp_pkt)) {
                 pr_debug("Packet is too small to be an ARP\n");
                 goto out;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3b16f62d5606..beb3b7cecd52 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -76,6 +76,7 @@
 #include <linux/if_vlan.h>
 #include <linux/if_bonding.h>
 #include <linux/jiffies.h>
+#include <linux/preempt.h>
 #include <net/route.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
@@ -109,6 +110,7 @@ static char *arp_validate;
 static char *fail_over_mac;
 static int all_slaves_active = 0;
 static struct bond_params bonding_defaults;
+static int resend_igmp = BOND_DEFAULT_RESEND_IGMP;
 
 module_param(max_bonds, int, 0);
 MODULE_PARM_DESC(max_bonds, "Max number of bonded devices");
@@ -163,9 +165,15 @@ module_param(all_slaves_active, int, 0);
 MODULE_PARM_DESC(all_slaves_active, "Keep all frames received on an interface"
                                      "by setting active flag for all slaves.  "
                                      "0 for never (default), 1 for always.");
+module_param(resend_igmp, int, 0);
+MODULE_PARM_DESC(resend_igmp, "Number of IGMP membership reports to send on link failure");
 
 /*----------------------------- Global variables ----------------------------*/
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+cpumask_var_t netpoll_block_tx;
+#endif
+
 static const char * const version =
         DRV_DESCRIPTION ": v" DRV_VERSION " (" DRV_RELDATE ")\n";
 
@@ -176,9 +184,6 @@ static int arp_ip_count;
 static int bond_mode    = BOND_MODE_ROUNDROBIN;
 static int xmit_hashtype = BOND_XMIT_POLICY_LAYER2;
 static int lacp_fast;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static int disable_netpoll = 1;
-#endif
 
 const struct bond_parm_tbl bond_lacp_tbl[] = {
 {       "slow",         AD_LACP_SLOW},
@@ -307,6 +312,7 @@ static int bond_del_vlan(struct bonding *bond, unsigned short vlan_id)
 
         pr_debug("bond: %s, vlan id %d\n", bond->dev->name, vlan_id);
 
+        block_netpoll_tx();
         write_lock_bh(&bond->lock);
 
         list_for_each_entry(vlan, &bond->vlan_list, vlan_list) {
@@ -341,6 +347,7 @@ static int bond_del_vlan(struct bonding *bond, unsigned short vlan_id)
 
 out:
         write_unlock_bh(&bond->lock);
+        unblock_netpoll_tx();
         return res;
 }
 
@@ -446,11 +453,9 @@ int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb,
         if (unlikely(bond->dev->priv_flags & IFF_IN_NETPOLL)) {
                 struct netpoll *np = bond->dev->npinfo->netpoll;
                 slave_dev->npinfo = bond->dev->npinfo;
-                np->real_dev = np->dev = skb->dev;
                 slave_dev->priv_flags |= IFF_IN_NETPOLL;
-                netpoll_send_skb(np, skb);
+                netpoll_send_skb_on_dev(np, skb, slave_dev);
                 slave_dev->priv_flags &= ~IFF_IN_NETPOLL;
-                np->dev = bond->dev;
         } else
 #endif
                 dev_queue_xmit(skb);
@@ -865,18 +870,13 @@ static void bond_mc_del(struct bonding *bond, void *addr)
 }
 
 
-/*
- * Retrieve the list of registered multicast addresses for the bonding
- * device and retransmit an IGMP JOIN request to the current active
- * slave.
- */
-static void bond_resend_igmp_join_requests(struct bonding *bond)
+static void __bond_resend_igmp_join_requests(struct net_device *dev)
 {
         struct in_device *in_dev;
         struct ip_mc_list *im;
 
         rcu_read_lock();
-        in_dev = __in_dev_get_rcu(bond->dev);
+        in_dev = __in_dev_get_rcu(dev);
         if (in_dev) {
                 for (im = in_dev->mc_list; im; im = im->next)
                         ip_mc_rejoin_group(im);
@@ -886,6 +886,44 @@ static void bond_resend_igmp_join_requests(struct bonding *bond)
 }
 
 /*
+ * Retrieve the list of registered multicast addresses for the bonding
+ * device and retransmit an IGMP JOIN request to the current active
+ * slave.
+ */
+static void bond_resend_igmp_join_requests(struct bonding *bond)
+{
+        struct net_device *vlan_dev;
+        struct vlan_entry *vlan;
+
+        read_lock(&bond->lock);
+
+        /* rejoin all groups on bond device */
+        __bond_resend_igmp_join_requests(bond->dev);
+
+        /* rejoin all groups on vlan devices */
+        if (bond->vlgrp) {
+                list_for_each_entry(vlan, &bond->vlan_list, vlan_list) {
+                        vlan_dev = vlan_group_get_device(bond->vlgrp,
+                                                         vlan->vlan_id);
+                        if (vlan_dev)
+                                __bond_resend_igmp_join_requests(vlan_dev);
+                }
+        }
+
+        if (--bond->igmp_retrans > 0)
+                queue_delayed_work(bond->wq, &bond->mcast_work, HZ/5);
+
+        read_unlock(&bond->lock);
+}
+
+static void bond_resend_igmp_join_requests_delayed(struct work_struct *work)
+{
+        struct bonding *bond = container_of(work, struct bonding,
+                                                        mcast_work.work);
+        bond_resend_igmp_join_requests(bond);
+}
+
+/*
  * flush all members of flush->mc_list from device dev->mc_list
  */
 static void bond_mc_list_flush(struct net_device *bond_dev,
@@ -944,7 +982,6 @@ static void bond_mc_swap(struct bonding *bond, struct slave *new_active,
 
                 netdev_for_each_mc_addr(ha, bond->dev)
                         dev_mc_add(new_active->dev, ha->addr);
-                bond_resend_igmp_join_requests(bond);
         }
 }
 
@@ -1180,9 +1217,12 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active)
                 }
         }
 
-        /* resend IGMP joins since all were sent on curr_active_slave */
-        if (bond->params.mode == BOND_MODE_ROUNDROBIN) {
-                bond_resend_igmp_join_requests(bond);
+        /* resend IGMP joins since active slave has changed or
+         * all were sent on curr_active_slave */
+        if ((USES_PRIMARY(bond->params.mode) && new_active) ||
+            bond->params.mode == BOND_MODE_ROUNDROBIN) {
+                bond->igmp_retrans = bond->params.resend_igmp;
+                queue_delayed_work(bond->wq, &bond->mcast_work, 0);
         }
 }
 
@@ -1294,9 +1334,14 @@ static bool slaves_support_netpoll(struct net_device *bond_dev)
 
 static void bond_poll_controller(struct net_device *bond_dev)
 {
-        struct net_device *dev = bond_dev->npinfo->netpoll->real_dev;
-        if (dev != bond_dev)
-                netpoll_poll_dev(dev);
+        struct bonding *bond = netdev_priv(bond_dev);
+        struct slave *slave;
+        int i;
+
+        bond_for_each_slave(bond, slave, i) {
+                if (slave->dev && IS_UP(slave->dev))
+                        netpoll_poll_dev(slave->dev);
+        }
 }
 
 static void bond_netpoll_cleanup(struct net_device *bond_dev)
@@ -1763,23 +1808,15 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         bond_set_carrier(bond);
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        /*
-         * Netpoll and bonding is broken, make sure it is not initialized
-         * until it is fixed.
-         */
-        if (disable_netpoll) {
+        if (slaves_support_netpoll(bond_dev)) {
+                bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
+                if (bond_dev->npinfo)
+                        slave_dev->npinfo = bond_dev->npinfo;
+        } else if (!(bond_dev->priv_flags & IFF_DISABLE_NETPOLL)) {
                 bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
-        } else {
-                if (slaves_support_netpoll(bond_dev)) {
-                        bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
-                        if (bond_dev->npinfo)
-                                slave_dev->npinfo = bond_dev->npinfo;
-                } else if (!(bond_dev->priv_flags & IFF_DISABLE_NETPOLL)) {
-                        bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
-                        pr_info("New slave device %s does not support netpoll\n",
-                                slave_dev->name);
-                        pr_info("Disabling netpoll support for %s\n", bond_dev->name);
-                }
+                pr_info("New slave device %s does not support netpoll\n",
+                        slave_dev->name);
+                pr_info("Disabling netpoll support for %s\n", bond_dev->name);
         }
 #endif
         read_unlock(&bond->lock);
@@ -1851,6 +1888,7 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
                 return -EINVAL;
         }
 
+        block_netpoll_tx();
         netdev_bonding_change(bond_dev, NETDEV_BONDING_DESLAVE);
         write_lock_bh(&bond->lock);
 
@@ -1860,6 +1898,7 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
                 pr_info("%s: %s not enslaved\n",
                         bond_dev->name, slave_dev->name);
                 write_unlock_bh(&bond->lock);
+                unblock_netpoll_tx();
                 return -EINVAL;
         }
 
@@ -1953,6 +1992,7 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
         }
 
         write_unlock_bh(&bond->lock);
+        unblock_netpoll_tx();
 
         /* must do this from outside any spinlocks */
         bond_destroy_slave_symlinks(bond_dev, slave_dev);
@@ -1983,10 +2023,8 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
 #ifdef CONFIG_NET_POLL_CONTROLLER
         read_lock_bh(&bond->lock);
 
-         /* Make sure netpoll over stays disabled until fixed. */
-        if (!disable_netpoll)
-                if (slaves_support_netpoll(bond_dev))
-                                bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
+        if (slaves_support_netpoll(bond_dev))
+                bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
         read_unlock_bh(&bond->lock);
         if (slave_dev->netdev_ops->ndo_netpoll_cleanup)
                 slave_dev->netdev_ops->ndo_netpoll_cleanup(slave_dev);
@@ -2019,8 +2057,8 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
 * First release a slave and than destroy the bond if no more slaves are left.
 * Must be under rtnl_lock when this function is called.
 */
-int  bond_release_and_destroy(struct net_device *bond_dev,
-                              struct net_device *slave_dev)
+static int  bond_release_and_destroy(struct net_device *bond_dev,
+                                     struct net_device *slave_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
         int ret;
@@ -2142,7 +2180,6 @@ static int bond_release_all(struct net_device *bond_dev)
 
 out:
         write_unlock_bh(&bond->lock);
-
         return 0;
 }
 
@@ -2191,9 +2228,11 @@ static int bond_ioctl_change_active(struct net_device *bond_dev, struct net_devi
             (old_active) &&
             (new_active->link == BOND_LINK_UP) &&
             IS_UP(new_active->dev)) {
+                block_netpoll_tx();
                 write_lock_bh(&bond->curr_slave_lock);
                 bond_change_active_slave(bond, new_active);
                 write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
         } else
                 res = -EINVAL;
 
@@ -2368,8 +2407,11 @@ static void bond_miimon_commit(struct bonding *bond)
                                 slave->state = BOND_STATE_BACKUP;
                         }
 
-                        pr_info("%s: link status definitely up for interface %s.\n",
-                                bond->dev->name, slave->dev->name);
+                        bond_update_speed_duplex(slave);
+
+                        pr_info("%s: link status definitely up for interface %s, %d Mbps %s duplex.\n",
+                                bond->dev->name, slave->dev->name,
+                                slave->speed, slave->duplex ? "full" : "half");
 
                         /* notify ad that the link status has changed */
                         if (bond->params.mode == BOND_MODE_8023AD)
@@ -2422,9 +2464,11 @@ static void bond_miimon_commit(struct bonding *bond)
 
 do_failover:
                 ASSERT_RTNL();
+                block_netpoll_tx();
                 write_lock_bh(&bond->curr_slave_lock);
                 bond_select_active_slave(bond);
                 write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
         }
 
         bond_set_carrier(bond);
@@ -2867,11 +2911,13 @@ void bond_loadbalance_arp_mon(struct work_struct *work)
         }
 
         if (do_failover) {
+                block_netpoll_tx();
                 write_lock_bh(&bond->curr_slave_lock);
 
                 bond_select_active_slave(bond);
 
                 write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
         }
 
 re_arm:
@@ -3030,9 +3076,11 @@ static void bond_ab_arp_commit(struct bonding *bond, int delta_in_ticks)
 
 do_failover:
                 ASSERT_RTNL();
+                block_netpoll_tx();
                 write_lock_bh(&bond->curr_slave_lock);
                 bond_select_active_slave(bond);
                 write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
         }
 
         bond_set_carrier(bond);
@@ -3312,6 +3360,8 @@ static void bond_info_show_slave(struct seq_file *seq,
         seq_printf(seq, "\nSlave Interface: %s\n", slave->dev->name);
         seq_printf(seq, "MII Status: %s\n",
                    (slave->link == BOND_LINK_UP) ?  "up" : "down");
+        seq_printf(seq, "Speed: %d Mbps\n", slave->speed);
+        seq_printf(seq, "Duplex: %s\n", slave->duplex ? "full" : "half");
         seq_printf(seq, "Link Failure Count: %u\n",
                    slave->link_failure_count);
 
@@ -3744,6 +3794,8 @@ static int bond_open(struct net_device *bond_dev)
 
         bond->kill_timers = 0;
 
+        INIT_DELAYED_WORK(&bond->mcast_work, bond_resend_igmp_join_requests_delayed);
+
         if (bond_is_lb(bond)) {
                 /* bond_alb_initialize must be called before the timer
                  * is started.
@@ -3828,6 +3880,8 @@ static int bond_close(struct net_device *bond_dev)
                 break;
         }
 
+        if (delayed_work_pending(&bond->mcast_work))
+                cancel_delayed_work(&bond->mcast_work);
 
         if (bond_is_lb(bond)) {
                 /* Must be called only after all
@@ -4514,6 +4568,13 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct bonding *bond = netdev_priv(dev);
 
+        /*
+         * If we risk deadlock from transmitting this in the
+         * netpoll path, tell netpoll to queue the frame for later tx
+         */
+        if (is_netpoll_tx_blocked(dev))
+                return NETDEV_TX_BUSY;
+
         if (TX_QUEUE_OVERRIDE(bond->params.mode)) {
                 if (!bond_slave_override(bond, skb))
                         return NETDEV_TX_OK;
@@ -4678,6 +4739,10 @@ static void bond_setup(struct net_device *bond_dev)
                                NETIF_F_HW_VLAN_RX |
                                NETIF_F_HW_VLAN_FILTER);
 
+        /* By default, we enable GRO on bonding devices.
+         * Actual support requires lowlevel drivers are GRO ready.
+         */
+        bond_dev->features |= NETIF_F_GRO;
 }
 
 static void bond_work_cancel_all(struct bonding *bond)
@@ -4699,6 +4764,9 @@ static void bond_work_cancel_all(struct bonding *bond)
         if (bond->params.mode == BOND_MODE_8023AD &&
             delayed_work_pending(&bond->ad_work))
                 cancel_delayed_work(&bond->ad_work);
+
+        if (delayed_work_pending(&bond->mcast_work))
+                cancel_delayed_work(&bond->mcast_work);
 }
 
 /*
@@ -4891,6 +4959,13 @@ static int bond_check_params(struct bond_params *params)
                 all_slaves_active = 0;
         }
 
+        if (resend_igmp < 0 || resend_igmp > 255) {
+                pr_warning("Warning: resend_igmp (%d) should be between "
+                           "0 and 255, resetting to %d\n",
+                           resend_igmp, BOND_DEFAULT_RESEND_IGMP);
+                resend_igmp = BOND_DEFAULT_RESEND_IGMP;
+        }
+
         /* reset values for TLB/ALB */
         if ((bond_mode == BOND_MODE_TLB) ||
             (bond_mode == BOND_MODE_ALB)) {
@@ -5063,6 +5138,7 @@ static int bond_check_params(struct bond_params *params)
         params->fail_over_mac = fail_over_mac_value;
         params->tx_queues = tx_queues;
         params->all_slaves_active = all_slaves_active;
+        params->resend_igmp = resend_igmp;
 
         if (primary) {
                 strncpy(params->primary, primary, IFNAMSIZ);
@@ -5164,6 +5240,15 @@ int bond_create(struct net *net, const char *name)
                 res = dev_alloc_name(bond_dev, "bond%d");
                 if (res < 0)
                         goto out;
+        } else {
+                /*
+                 * If we're given a name to register
+                 * we need to ensure that its not already
+                 * registered
+                 */
+                res = -EEXIST;
+                if (__dev_get_by_name(net, name) != NULL)
+                        goto out;
         }
 
         res = register_netdevice(bond_dev);
@@ -5212,6 +5297,13 @@ static int __init bonding_init(void)
         if (res)
                 goto out;
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        if (!alloc_cpumask_var(&netpoll_block_tx, GFP_KERNEL)) {
+                res = -ENOMEM;
+                goto out;
+        }
+#endif
+
         res = register_pernet_subsys(&bond_net_ops);
         if (res)
                 goto out;
@@ -5230,6 +5322,7 @@ static int __init bonding_init(void)
         if (res)
                 goto err;
 
+
         register_netdevice_notifier(&bond_netdev_notifier);
         register_inetaddr_notifier(&bond_inetaddr_notifier);
         bond_register_ipv6_notifier();
@@ -5239,6 +5332,9 @@ err:
         rtnl_link_unregister(&bond_link_ops);
 err_link:
         unregister_pernet_subsys(&bond_net_ops);
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        free_cpumask_var(netpoll_block_tx);
+#endif
         goto out;
 
 }
@@ -5253,6 +5349,10 @@ static void __exit bonding_exit(void)
 
         rtnl_link_unregister(&bond_link_ops);
         unregister_pernet_subsys(&bond_net_ops);
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        free_cpumask_var(netpoll_block_tx);
+#endif
 }
 
 module_init(bonding_init);
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index c311aed9bd02..8fd0174c5380 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1066,6 +1066,7 @@ static ssize_t bonding_store_primary(struct device *d,
 
         if (!rtnl_trylock())
                 return restart_syscall();
+        block_netpoll_tx();
         read_lock(&bond->lock);
         write_lock_bh(&bond->curr_slave_lock);
 
@@ -1101,6 +1102,7 @@ static ssize_t bonding_store_primary(struct device *d,
 out:
         write_unlock_bh(&bond->curr_slave_lock);
         read_unlock(&bond->lock);
+        unblock_netpoll_tx();
         rtnl_unlock();
 
         return count;
@@ -1146,11 +1148,13 @@ static ssize_t bonding_store_primary_reselect(struct device *d,
                 bond->dev->name, pri_reselect_tbl[new_value].modename,
                 new_value);
 
+        block_netpoll_tx();
         read_lock(&bond->lock);
         write_lock_bh(&bond->curr_slave_lock);
         bond_select_active_slave(bond);
         write_unlock_bh(&bond->curr_slave_lock);
         read_unlock(&bond->lock);
+        unblock_netpoll_tx();
 out:
         rtnl_unlock();
         return ret;
@@ -1232,6 +1236,8 @@ static ssize_t bonding_store_active_slave(struct device *d,
 
         if (!rtnl_trylock())
                 return restart_syscall();
+
+        block_netpoll_tx();
         read_lock(&bond->lock);
         write_lock_bh(&bond->curr_slave_lock);
 
@@ -1288,6 +1294,8 @@ static ssize_t bonding_store_active_slave(struct device *d,
  out:
         write_unlock_bh(&bond->curr_slave_lock);
         read_unlock(&bond->lock);
+        unblock_netpoll_tx();
+
         rtnl_unlock();
 
         return count;
@@ -1592,6 +1600,49 @@ out:
 static DEVICE_ATTR(all_slaves_active, S_IRUGO | S_IWUSR,
                    bonding_show_slaves_active, bonding_store_slaves_active);
 
+/*
+ * Show and set the number of IGMP membership reports to send on link failure
+ */
+static ssize_t bonding_show_resend_igmp(struct device *d,
+                                         struct device_attribute *attr,
+                                         char *buf)
+{
+        struct bonding *bond = to_bond(d);
+
+        return sprintf(buf, "%d\n", bond->params.resend_igmp);
+}
+
+static ssize_t bonding_store_resend_igmp(struct device *d,
+                                          struct device_attribute *attr,
+                                          const char *buf, size_t count)
+{
+        int new_value, ret = count;
+        struct bonding *bond = to_bond(d);
+
+        if (sscanf(buf, "%d", &new_value) != 1) {
+                pr_err("%s: no resend_igmp value specified.\n",
+                       bond->dev->name);
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (new_value < 0) {
+                pr_err("%s: Invalid resend_igmp value %d not in range 0-255; rejected.\n",
+                       bond->dev->name, new_value);
+                ret = -EINVAL;
+                goto out;
+        }
+
+        pr_info("%s: Setting resend_igmp to %d.\n",
+                bond->dev->name, new_value);
+        bond->params.resend_igmp = new_value;
+out:
+        return ret;
+}
+
+static DEVICE_ATTR(resend_igmp, S_IRUGO | S_IWUSR,
+                   bonding_show_resend_igmp, bonding_store_resend_igmp);
+
 static struct attribute *per_bond_attrs[] = {
         &dev_attr_slaves.attr,
         &dev_attr_mode.attr,
@@ -1619,6 +1670,7 @@ static struct attribute *per_bond_attrs[] = {
         &dev_attr_ad_partner_mac.attr,
         &dev_attr_queue_id.attr,
         &dev_attr_all_slaves_active.attr,
+        &dev_attr_resend_igmp.attr,
         NULL,
 };
 
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index c6fdd851579a..4eedb12df6ca 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -19,6 +19,7 @@
 #include <linux/proc_fs.h>
 #include <linux/if_bonding.h>
 #include <linux/kobject.h>
+#include <linux/cpumask.h>
 #include <linux/in6.h>
 #include "bond_3ad.h"
 #include "bond_alb.h"
@@ -117,6 +118,35 @@
                 bond_for_each_slave_from(bond, pos, cnt, (bond)->first_slave)
 
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+extern cpumask_var_t netpoll_block_tx;
+
+static inline void block_netpoll_tx(void)
+{
+        preempt_disable();
+        BUG_ON(cpumask_test_and_set_cpu(smp_processor_id(),
+                                        netpoll_block_tx));
+}
+
+static inline void unblock_netpoll_tx(void)
+{
+        BUG_ON(!cpumask_test_and_clear_cpu(smp_processor_id(),
+                                           netpoll_block_tx));
+        preempt_enable();
+}
+
+static inline int is_netpoll_tx_blocked(struct net_device *dev)
+{
+        if (unlikely(dev->priv_flags & IFF_IN_NETPOLL))
+                return cpumask_test_cpu(smp_processor_id(), netpoll_block_tx);
+        return 0;
+}
+#else
+#define block_netpoll_tx()
+#define unblock_netpoll_tx()
+#define is_netpoll_tx_blocked(dev) (0)
+#endif
+
 struct bond_params {
         int mode;
         int xmit_policy;
@@ -136,6 +166,7 @@ struct bond_params {
         __be32 arp_targets[BOND_MAX_ARP_TARGETS];
         int tx_queues;
         int all_slaves_active;
+        int resend_igmp;
 };
 
 struct bond_parm_tbl {
@@ -202,6 +233,7 @@ struct bonding {
         s8       send_grat_arp;
         s8       send_unsol_na;
         s8       setup_by_slave;
+        s8       igmp_retrans;
 #ifdef CONFIG_PROC_FS
         struct   proc_dir_entry *proc_entry;
         char     proc_file_name[IFNAMSIZ];
@@ -223,6 +255,7 @@ struct bonding {
         struct   delayed_work arp_work;
         struct   delayed_work alb_work;
         struct   delayed_work ad_work;
+        struct   delayed_work mcast_work;
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         struct   in6_addr master_ipv6;
 #endif
@@ -331,7 +364,6 @@ static inline void bond_unset_master_alb_flags(struct bonding *bond)
 struct vlan_entry *bond_next_vlan(struct bonding *bond, struct vlan_entry *curr);
 int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb, struct net_device *slave_dev);
 int bond_create(struct net *net, const char *name);
-int  bond_release_and_destroy(struct net_device *bond_dev, struct net_device *slave_dev);
 int bond_create_sysfs(void);
 void bond_destroy_sysfs(void);
 void bond_prepare_sysfs_group(struct bonding *bond);
diff --git a/drivers/net/bsd_comp.c b/drivers/net/bsd_comp.c
index 88edb986691a..6e99d80ec409 100644
--- a/drivers/net/bsd_comp.c
+++ b/drivers/net/bsd_comp.c
@@ -429,7 +429,7 @@ static void *bsd_alloc (unsigned char *options, int opt_len, int decomp)
         if (!db->lens)
           {
             bsd_free (db);
-            return (NULL);
+            return NULL;
           }
       }
 /*
diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
index b11a0cb5ed81..6aadc3e32bd5 100644
--- a/drivers/net/can/mcp251x.c
+++ b/drivers/net/can/mcp251x.c
@@ -38,14 +38,14 @@
  * static struct mcp251x_platform_data mcp251x_info = {
  *         .oscillator_frequency = 8000000,
  *         .board_specific_setup = &mcp251x_setup,
- *         .model = CAN_MCP251X_MCP2510,
  *         .power_enable = mcp251x_power_enable,
  *         .transceiver_enable = NULL,
  * };
  *
  * static struct spi_board_info spi_board_info[] = {
  *         {
- *                 .modalias = "mcp251x",
+ *                 .modalias = "mcp2510",
+ *                      // or "mcp2515" depending on your controller
  *                 .platform_data = &mcp251x_info,
  *                 .irq = IRQ_EINT13,
  *                 .max_speed_hz = 2*1000*1000,
@@ -125,6 +125,9 @@
 #  define CANINTF_TX0IF 0x04
 #  define CANINTF_RX1IF 0x02
 #  define CANINTF_RX0IF 0x01
+#  define CANINTF_RX (CANINTF_RX0IF | CANINTF_RX1IF)
+#  define CANINTF_TX (CANINTF_TX2IF | CANINTF_TX1IF | CANINTF_TX0IF)
+#  define CANINTF_ERR (CANINTF_ERRIF)
 #define EFLG          0x2d
 #  define EFLG_EWARN    0x01
 #  define EFLG_RXWAR    0x02
@@ -222,10 +225,16 @@ static struct can_bittiming_const mcp251x_bittiming_const = {
         .brp_inc = 1,
 };
 
+enum mcp251x_model {
+        CAN_MCP251X_MCP2510     = 0x2510,
+        CAN_MCP251X_MCP2515     = 0x2515,
+};
+
 struct mcp251x_priv {
         struct can_priv    can;
         struct net_device *net;
         struct spi_device *spi;
+        enum mcp251x_model model;
 
         struct mutex mcp_lock; /* SPI device lock */
 
@@ -250,6 +259,16 @@ struct mcp251x_priv {
         int restart_tx;
 };
 
+#define MCP251X_IS(_model) \
+static inline int mcp251x_is_##_model(struct spi_device *spi) \
+{ \
+        struct mcp251x_priv *priv = dev_get_drvdata(&spi->dev); \
+        return priv->model == CAN_MCP251X_MCP##_model; \
+}
+
+MCP251X_IS(2510);
+MCP251X_IS(2515);
+
 static void mcp251x_clean(struct net_device *net)
 {
         struct mcp251x_priv *priv = netdev_priv(net);
@@ -319,6 +338,20 @@ static u8 mcp251x_read_reg(struct spi_device *spi, uint8_t reg)
         return val;
 }
 
+static void mcp251x_read_2regs(struct spi_device *spi, uint8_t reg,
+                uint8_t *v1, uint8_t *v2)
+{
+        struct mcp251x_priv *priv = dev_get_drvdata(&spi->dev);
+
+        priv->spi_tx_buf[0] = INSTRUCTION_READ;
+        priv->spi_tx_buf[1] = reg;
+
+        mcp251x_spi_trans(spi, 4);
+
+        *v1 = priv->spi_rx_buf[2];
+        *v2 = priv->spi_rx_buf[3];
+}
+
 static void mcp251x_write_reg(struct spi_device *spi, u8 reg, uint8_t val)
 {
         struct mcp251x_priv *priv = dev_get_drvdata(&spi->dev);
@@ -346,10 +379,9 @@ static void mcp251x_write_bits(struct spi_device *spi, u8 reg,
 static void mcp251x_hw_tx_frame(struct spi_device *spi, u8 *buf,
                                 int len, int tx_buf_idx)
 {
-        struct mcp251x_platform_data *pdata = spi->dev.platform_data;
         struct mcp251x_priv *priv = dev_get_drvdata(&spi->dev);
 
-        if (pdata->model == CAN_MCP251X_MCP2510) {
+        if (mcp251x_is_2510(spi)) {
                 int i;
 
                 for (i = 1; i < TXBDAT_OFF + len; i++)
@@ -392,9 +424,8 @@ static void mcp251x_hw_rx_frame(struct spi_device *spi, u8 *buf,
                                 int buf_idx)
 {
         struct mcp251x_priv *priv = dev_get_drvdata(&spi->dev);
-        struct mcp251x_platform_data *pdata = spi->dev.platform_data;
 
-        if (pdata->model == CAN_MCP251X_MCP2510) {
+        if (mcp251x_is_2510(spi)) {
                 int i, len;
 
                 for (i = 1; i < RXBDAT_OFF; i++)
@@ -451,7 +482,7 @@ static void mcp251x_hw_rx(struct spi_device *spi, int buf_idx)
 
         priv->net->stats.rx_packets++;
         priv->net->stats.rx_bytes += frame->can_dlc;
-        netif_rx(skb);
+        netif_rx_ni(skb);
 }
 
 static void mcp251x_hw_sleep(struct spi_device *spi)
@@ -674,9 +705,9 @@ static void mcp251x_error_skb(struct net_device *net, int can_id, int data1)
 
         skb = alloc_can_err_skb(net, &frame);
         if (skb) {
-                frame->can_id = can_id;
+                frame->can_id |= can_id;
                 frame->data[1] = data1;
-                netif_rx(skb);
+                netif_rx_ni(skb);
         } else {
                 dev_err(&net->dev,
                         "cannot allocate error skb\n");
@@ -754,24 +785,42 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id)
         mutex_lock(&priv->mcp_lock);
         while (!priv->force_quit) {
                 enum can_state new_state;
-                u8 intf = mcp251x_read_reg(spi, CANINTF);
-                u8 eflag;
+                u8 intf, eflag;
+                u8 clear_intf = 0;
                 int can_id = 0, data1 = 0;
 
+                mcp251x_read_2regs(spi, CANINTF, &intf, &eflag);
+
+                /* mask out flags we don't care about */
+                intf &= CANINTF_RX | CANINTF_TX | CANINTF_ERR;
+
+                /* receive buffer 0 */
                 if (intf & CANINTF_RX0IF) {
                         mcp251x_hw_rx(spi, 0);
-                        /* Free one buffer ASAP */
-                        mcp251x_write_bits(spi, CANINTF, intf & CANINTF_RX0IF,
-                                           0x00);
+                        /*
+                         * Free one buffer ASAP
+                         * (The MCP2515 does this automatically.)
+                         */
+                        if (mcp251x_is_2510(spi))
+                                mcp251x_write_bits(spi, CANINTF, CANINTF_RX0IF, 0x00);
                 }
 
-                if (intf & CANINTF_RX1IF)
+                /* receive buffer 1 */
+                if (intf & CANINTF_RX1IF) {
                         mcp251x_hw_rx(spi, 1);
+                        /* the MCP2515 does this automatically */
+                        if (mcp251x_is_2510(spi))
+                                clear_intf |= CANINTF_RX1IF;
+                }
 
-                mcp251x_write_bits(spi, CANINTF, intf, 0x00);
+                /* any error or tx interrupt we need to clear? */
+                if (intf & (CANINTF_ERR | CANINTF_TX))
+                        clear_intf |= intf & (CANINTF_ERR | CANINTF_TX);
+                if (clear_intf)
+                        mcp251x_write_bits(spi, CANINTF, clear_intf, 0x00);
 
-                eflag = mcp251x_read_reg(spi, EFLG);
-                mcp251x_write_reg(spi, EFLG, 0x00);
+                if (eflag)
+                        mcp251x_write_bits(spi, EFLG, eflag, 0x00);
 
                 /* Update can state */
                 if (eflag & EFLG_TXBO) {
@@ -816,10 +865,14 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id)
                 if (intf & CANINTF_ERRIF) {
                         /* Handle overflow counters */
                         if (eflag & (EFLG_RX0OVR | EFLG_RX1OVR)) {
-                                if (eflag & EFLG_RX0OVR)
+                                if (eflag & EFLG_RX0OVR) {
                                         net->stats.rx_over_errors++;
-                                if (eflag & EFLG_RX1OVR)
+                                        net->stats.rx_errors++;
+                                }
+                                if (eflag & EFLG_RX1OVR) {
                                         net->stats.rx_over_errors++;
+                                        net->stats.rx_errors++;
+                                }
                                 can_id |= CAN_ERR_CRTL;
                                 data1 |= CAN_ERR_CRTL_RX_OVERFLOW;
                         }
@@ -838,7 +891,7 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id)
                 if (intf == 0)
                         break;
 
-                if (intf & (CANINTF_TX2IF | CANINTF_TX1IF | CANINTF_TX0IF)) {
+                if (intf & CANINTF_TX) {
                         net->stats.tx_packets++;
                         net->stats.tx_bytes += priv->tx_len - 1;
                         if (priv->tx_len) {
@@ -921,16 +974,12 @@ static int __devinit mcp251x_can_probe(struct spi_device *spi)
         struct net_device *net;
         struct mcp251x_priv *priv;
         struct mcp251x_platform_data *pdata = spi->dev.platform_data;
-        int model = spi_get_device_id(spi)->driver_data;
         int ret = -ENODEV;
 
         if (!pdata)
                 /* Platform data is required for osc freq */
                 goto error_out;
 
-        if (model)
-                pdata->model = model;
-
         /* Allocate can/net device */
         net = alloc_candev(sizeof(struct mcp251x_priv), TX_ECHO_SKB_MAX);
         if (!net) {
@@ -947,6 +996,7 @@ static int __devinit mcp251x_can_probe(struct spi_device *spi)
         priv->can.clock.freq = pdata->oscillator_frequency / 2;
         priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES |
                 CAN_CTRLMODE_LOOPBACK | CAN_CTRLMODE_LISTENONLY;
+        priv->model = spi_get_device_id(spi)->driver_data;
         priv->net = net;
         dev_set_drvdata(&spi->dev, priv);
 
@@ -1120,8 +1170,7 @@ static int mcp251x_can_resume(struct spi_device *spi)
 #define mcp251x_can_resume NULL
 #endif
 
-static struct spi_device_id mcp251x_id_table[] = {
-        { "mcp251x",    0 /* Use pdata.model */ },
+static const struct spi_device_id mcp251x_id_table[] = {
         { "mcp2510",    CAN_MCP251X_MCP2510 },
         { "mcp2515",    CAN_MCP251X_MCP2515 },
         { },
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
index 32aaadc4734f..d6b6d6aa565a 100644
--- a/drivers/net/cassini.c
+++ b/drivers/net/cassini.c
@@ -419,7 +419,7 @@ static u16 cas_phy_read(struct cas *cp, int reg)
                 udelay(10);
                 cmd = readl(cp->regs + REG_MIF_FRAME);
                 if (cmd & MIF_FRAME_TURN_AROUND_LSB)
-                        return (cmd & MIF_FRAME_DATA_MASK);
+                        return cmd & MIF_FRAME_DATA_MASK;
         }
         return 0xFFFF; /* -1 */
 }
@@ -804,7 +804,7 @@ static int cas_reset_mii_phy(struct cas *cp)
                         break;
                 udelay(10);
         }
-        return (limit <= 0);
+        return limit <= 0;
 }
 
 static int cas_saturn_firmware_init(struct cas *cp)
diff --git a/drivers/net/chelsio/sge.c b/drivers/net/chelsio/sge.c
index 1950b9a20ecd..70221ca32683 100644
--- a/drivers/net/chelsio/sge.c
+++ b/drivers/net/chelsio/sge.c
@@ -1551,7 +1551,7 @@ static inline int responses_pending(const struct adapter *adapter)
         const struct respQ *Q = &adapter->sge->respQ;
         const struct respQ_e *e = &Q->entries[Q->cidx];
 
-        return (e->GenerationBit == Q->genbit);
+        return e->GenerationBit == Q->genbit;
 }
 
 /*
@@ -1870,7 +1870,7 @@ netdev_tx_t t1_start_xmit(struct sk_buff *skb, struct net_device *dev)
         cpl->iff = dev->if_port;
 
 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
-        if (adapter->vlan_grp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 cpl->vlan_valid = 1;
                 cpl->vlan = htons(vlan_tx_tag_get(skb));
                 st->vlan_insert++;
diff --git a/drivers/net/chelsio/vsc7326.c b/drivers/net/chelsio/vsc7326.c
index c844111cffeb..106a590f0d9a 100644
--- a/drivers/net/chelsio/vsc7326.c
+++ b/drivers/net/chelsio/vsc7326.c
@@ -255,7 +255,7 @@ static int bist_rd(adapter_t *adapter, int moduleid, int address)
         else if ((result & (1 << 8)) != 0x0)
                 pr_err("bist read error: 0x%x\n", result);
 
-        return (result & 0xff);
+        return result & 0xff;
 }
 
 static int bist_wr(adapter_t *adapter, int moduleid, int address, int value)
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 2ab6a7c4ffc1..92bac19ad60a 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -60,6 +60,7 @@ MODULE_LICENSE("GPL");
 MODULE_VERSION(CNIC_MODULE_VERSION);
 
 static LIST_HEAD(cnic_dev_list);
+static LIST_HEAD(cnic_udev_list);
 static DEFINE_RWLOCK(cnic_dev_lock);
 static DEFINE_MUTEX(cnic_lock);
 
@@ -81,29 +82,34 @@ static struct cnic_ops cnic_bnx2x_ops = {
         .cnic_ctl       = cnic_ctl,
 };
 
+static struct workqueue_struct *cnic_wq;
+
 static void cnic_shutdown_rings(struct cnic_dev *);
 static void cnic_init_rings(struct cnic_dev *);
 static int cnic_cm_set_pg(struct cnic_sock *);
 
 static int cnic_uio_open(struct uio_info *uinfo, struct inode *inode)
 {
-        struct cnic_dev *dev = uinfo->priv;
-        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_uio_dev *udev = uinfo->priv;
+        struct cnic_dev *dev;
 
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
-        if (cp->uio_dev != -1)
+        if (udev->uio_dev != -1)
                 return -EBUSY;
 
         rtnl_lock();
-        if (!test_bit(CNIC_F_CNIC_UP, &dev->flags)) {
+        dev = udev->dev;
+
+        if (!dev || !test_bit(CNIC_F_CNIC_UP, &dev->flags)) {
                 rtnl_unlock();
                 return -ENODEV;
         }
 
-        cp->uio_dev = iminor(inode);
+        udev->uio_dev = iminor(inode);
 
+        cnic_shutdown_rings(dev);
         cnic_init_rings(dev);
         rtnl_unlock();
 
@@ -112,12 +118,9 @@ static int cnic_uio_open(struct uio_info *uinfo, struct inode *inode)
 
 static int cnic_uio_close(struct uio_info *uinfo, struct inode *inode)
 {
-        struct cnic_dev *dev = uinfo->priv;
-        struct cnic_local *cp = dev->cnic_priv;
-
-        cnic_shutdown_rings(dev);
+        struct cnic_uio_dev *udev = uinfo->priv;
 
-        cp->uio_dev = -1;
+        udev->uio_dev = -1;
         return 0;
 }
 
@@ -242,14 +245,14 @@ static int cnic_in_use(struct cnic_sock *csk)
         return test_bit(SK_F_INUSE, &csk->flags);
 }
 
-static void cnic_kwq_completion(struct cnic_dev *dev, u32 count)
+static void cnic_spq_completion(struct cnic_dev *dev, int cmd, u32 count)
 {
         struct cnic_local *cp = dev->cnic_priv;
         struct cnic_eth_dev *ethdev = cp->ethdev;
         struct drv_ctl_info info;
 
-        info.cmd = DRV_CTL_COMPLETION_CMD;
-        info.data.comp.comp_count = count;
+        info.cmd = cmd;
+        info.data.credit.credit_count = count;
         ethdev->drv_ctl(dev->netdev, &info);
 }
 
@@ -274,8 +277,9 @@ static int cnic_send_nlmsg(struct cnic_local *cp, u32 type,
         u16 len = 0;
         u32 msg_type = ISCSI_KEVENT_IF_DOWN;
         struct cnic_ulp_ops *ulp_ops;
+        struct cnic_uio_dev *udev = cp->udev;
 
-        if (cp->uio_dev == -1)
+        if (!udev || udev->uio_dev == -1)
                 return -ENODEV;
 
         if (csk) {
@@ -406,8 +410,7 @@ static void cnic_uio_stop(void)
         list_for_each_entry(dev, &cnic_dev_list, list) {
                 struct cnic_local *cp = dev->cnic_priv;
 
-                if (cp->cnic_uinfo)
-                        cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
         }
         read_unlock(&cnic_dev_lock);
 }
@@ -768,31 +771,45 @@ static void cnic_free_context(struct cnic_dev *dev)
         }
 }
 
-static void cnic_free_resc(struct cnic_dev *dev)
+static void __cnic_free_uio(struct cnic_uio_dev *udev)
 {
-        struct cnic_local *cp = dev->cnic_priv;
-        int i = 0;
+        uio_unregister_device(&udev->cnic_uinfo);
 
-        if (cp->cnic_uinfo) {
-                while (cp->uio_dev != -1 && i < 15) {
-                        msleep(100);
-                        i++;
-                }
-                uio_unregister_device(cp->cnic_uinfo);
-                kfree(cp->cnic_uinfo);
-                cp->cnic_uinfo = NULL;
+        if (udev->l2_buf) {
+                dma_free_coherent(&udev->pdev->dev, udev->l2_buf_size,
+                                  udev->l2_buf, udev->l2_buf_map);
+                udev->l2_buf = NULL;
         }
 
-        if (cp->l2_buf) {
-                dma_free_coherent(&dev->pcidev->dev, cp->l2_buf_size,
-                                  cp->l2_buf, cp->l2_buf_map);
-                cp->l2_buf = NULL;
+        if (udev->l2_ring) {
+                dma_free_coherent(&udev->pdev->dev, udev->l2_ring_size,
+                                  udev->l2_ring, udev->l2_ring_map);
+                udev->l2_ring = NULL;
         }
 
-        if (cp->l2_ring) {
-                dma_free_coherent(&dev->pcidev->dev, cp->l2_ring_size,
-                                  cp->l2_ring, cp->l2_ring_map);
-                cp->l2_ring = NULL;
+        pci_dev_put(udev->pdev);
+        kfree(udev);
+}
+
+static void cnic_free_uio(struct cnic_uio_dev *udev)
+{
+        if (!udev)
+                return;
+
+        write_lock(&cnic_dev_lock);
+        list_del_init(&udev->list);
+        write_unlock(&cnic_dev_lock);
+        __cnic_free_uio(udev);
+}
+
+static void cnic_free_resc(struct cnic_dev *dev)
+{
+        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_uio_dev *udev = cp->udev;
+
+        if (udev) {
+                udev->dev = NULL;
+                cp->udev = NULL;
         }
 
         cnic_free_context(dev);
@@ -894,37 +911,68 @@ static int cnic_alloc_kcq(struct cnic_dev *dev, struct kcq_info *info)
         return 0;
 }
 
-static int cnic_alloc_l2_rings(struct cnic_dev *dev, int pages)
+static int cnic_alloc_uio_rings(struct cnic_dev *dev, int pages)
 {
         struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_uio_dev *udev;
+
+        read_lock(&cnic_dev_lock);
+        list_for_each_entry(udev, &cnic_udev_list, list) {
+                if (udev->pdev == dev->pcidev) {
+                        udev->dev = dev;
+                        cp->udev = udev;
+                        read_unlock(&cnic_dev_lock);
+                        return 0;
+                }
+        }
+        read_unlock(&cnic_dev_lock);
+
+        udev = kzalloc(sizeof(struct cnic_uio_dev), GFP_ATOMIC);
+        if (!udev)
+                return -ENOMEM;
 
-        cp->l2_ring_size = pages * BCM_PAGE_SIZE;
-        cp->l2_ring = dma_alloc_coherent(&dev->pcidev->dev, cp->l2_ring_size,
-                                         &cp->l2_ring_map,
-                                         GFP_KERNEL | __GFP_COMP);
-        if (!cp->l2_ring)
+        udev->uio_dev = -1;
+
+        udev->dev = dev;
+        udev->pdev = dev->pcidev;
+        udev->l2_ring_size = pages * BCM_PAGE_SIZE;
+        udev->l2_ring = dma_alloc_coherent(&udev->pdev->dev, udev->l2_ring_size,
+                                           &udev->l2_ring_map,
+                                           GFP_KERNEL | __GFP_COMP);
+        if (!udev->l2_ring)
                 return -ENOMEM;
 
-        cp->l2_buf_size = (cp->l2_rx_ring_size + 1) * cp->l2_single_buf_size;
-        cp->l2_buf_size = PAGE_ALIGN(cp->l2_buf_size);
-        cp->l2_buf = dma_alloc_coherent(&dev->pcidev->dev, cp->l2_buf_size,
-                                        &cp->l2_buf_map,
-                                        GFP_KERNEL | __GFP_COMP);
-        if (!cp->l2_buf)
+        udev->l2_buf_size = (cp->l2_rx_ring_size + 1) * cp->l2_single_buf_size;
+        udev->l2_buf_size = PAGE_ALIGN(udev->l2_buf_size);
+        udev->l2_buf = dma_alloc_coherent(&udev->pdev->dev, udev->l2_buf_size,
+                                          &udev->l2_buf_map,
+                                          GFP_KERNEL | __GFP_COMP);
+        if (!udev->l2_buf)
                 return -ENOMEM;
 
+        write_lock(&cnic_dev_lock);
+        list_add(&udev->list, &cnic_udev_list);
+        write_unlock(&cnic_dev_lock);
+
+        pci_dev_get(udev->pdev);
+
+        cp->udev = udev;
+
         return 0;
 }
 
-static int cnic_alloc_uio(struct cnic_dev *dev) {
+static int cnic_init_uio(struct cnic_dev *dev)
+{
         struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_uio_dev *udev = cp->udev;
         struct uio_info *uinfo;
-        int ret;
+        int ret = 0;
 
-        uinfo = kzalloc(sizeof(*uinfo), GFP_ATOMIC);
-        if (!uinfo)
+        if (!udev)
                 return -ENOMEM;
 
+        uinfo = &udev->cnic_uinfo;
+
         uinfo->mem[0].addr = dev->netdev->base_addr;
         uinfo->mem[0].internal_addr = dev->regview;
         uinfo->mem[0].size = dev->netdev->mem_end - dev->netdev->mem_start;
@@ -932,7 +980,7 @@ static int cnic_alloc_uio(struct cnic_dev *dev) {
 
         if (test_bit(CNIC_F_BNX2_CLASS, &dev->flags)) {
                 uinfo->mem[1].addr = (unsigned long) cp->status_blk.gen &
-                        PAGE_MASK;
+                                        PAGE_MASK;
                 if (cp->ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX)
                         uinfo->mem[1].size = BNX2_SBLK_MSIX_ALIGN_SIZE * 9;
                 else
@@ -942,19 +990,19 @@ static int cnic_alloc_uio(struct cnic_dev *dev) {
         } else if (test_bit(CNIC_F_BNX2X_CLASS, &dev->flags)) {
                 uinfo->mem[1].addr = (unsigned long) cp->bnx2x_def_status_blk &
                         PAGE_MASK;
-                uinfo->mem[1].size = sizeof(struct host_def_status_block);
+                uinfo->mem[1].size = sizeof(*cp->bnx2x_def_status_blk);
 
                 uinfo->name = "bnx2x_cnic";
         }
 
         uinfo->mem[1].memtype = UIO_MEM_LOGICAL;
 
-        uinfo->mem[2].addr = (unsigned long) cp->l2_ring;
-        uinfo->mem[2].size = cp->l2_ring_size;
+        uinfo->mem[2].addr = (unsigned long) udev->l2_ring;
+        uinfo->mem[2].size = udev->l2_ring_size;
         uinfo->mem[2].memtype = UIO_MEM_LOGICAL;
 
-        uinfo->mem[3].addr = (unsigned long) cp->l2_buf;
-        uinfo->mem[3].size = cp->l2_buf_size;
+        uinfo->mem[3].addr = (unsigned long) udev->l2_buf;
+        uinfo->mem[3].size = udev->l2_buf_size;
         uinfo->mem[3].memtype = UIO_MEM_LOGICAL;
 
         uinfo->version = CNIC_MODULE_VERSION;
@@ -963,16 +1011,17 @@ static int cnic_alloc_uio(struct cnic_dev *dev) {
         uinfo->open = cnic_uio_open;
         uinfo->release = cnic_uio_close;
 
-        uinfo->priv = dev;
+        if (udev->uio_dev == -1) {
+                if (!uinfo->priv) {
+                        uinfo->priv = udev;
 
-        ret = uio_register_device(&dev->pcidev->dev, uinfo);
-        if (ret) {
-                kfree(uinfo);
-                return ret;
+                        ret = uio_register_device(&udev->pdev->dev, uinfo);
+                }
+        } else {
+                cnic_init_rings(dev);
         }
 
-        cp->cnic_uinfo = uinfo;
-        return 0;
+        return ret;
 }
 
 static int cnic_alloc_bnx2_resc(struct cnic_dev *dev)
@@ -993,11 +1042,11 @@ static int cnic_alloc_bnx2_resc(struct cnic_dev *dev)
         if (ret)
                 goto error;
 
-        ret = cnic_alloc_l2_rings(dev, 2);
+        ret = cnic_alloc_uio_rings(dev, 2);
         if (ret)
                 goto error;
 
-        ret = cnic_alloc_uio(dev);
+        ret = cnic_init_uio(dev);
         if (ret)
                 goto error;
 
@@ -1028,7 +1077,7 @@ static int cnic_alloc_bnx2x_context(struct cnic_dev *dev)
 
         cp->ctx_blks = blks;
         cp->ctx_blk_size = ctx_blk_size;
-        if (BNX2X_CHIP_IS_E1H(cp->chip_id))
+        if (!BNX2X_CHIP_IS_57710(cp->chip_id))
                 cp->ctx_align = 0;
         else
                 cp->ctx_align = ctx_blk_size;
@@ -1063,6 +1112,8 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
         int i, j, n, ret, pages;
         struct cnic_dma *kwq_16_dma = &cp->kwq_16_data_info;
 
+        cp->iro_arr = ethdev->iro_arr;
+
         cp->max_cid_space = MAX_ISCSI_TBL_SZ;
         cp->iscsi_start_cid = start_cid;
         if (start_cid < BNX2X_ISCSI_START_CID) {
@@ -1127,15 +1178,13 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
 
         cp->bnx2x_def_status_blk = cp->ethdev->irq_arr[1].status_blk;
 
-        memset(cp->status_blk.bnx2x, 0, sizeof(*cp->status_blk.bnx2x));
-
         cp->l2_rx_ring_size = 15;
 
-        ret = cnic_alloc_l2_rings(dev, 4);
+        ret = cnic_alloc_uio_rings(dev, 4);
         if (ret)
                 goto error;
 
-        ret = cnic_alloc_uio(dev);
+        ret = cnic_init_uio(dev);
         if (ret)
                 goto error;
 
@@ -1209,9 +1258,9 @@ static int cnic_submit_kwqe_16(struct cnic_dev *dev, u32 cmd, u32 cid,
 
         kwqe.hdr.conn_and_cmd_data =
                 cpu_to_le32(((cmd << SPE_HDR_CMD_ID_SHIFT) |
-                             BNX2X_HW_CID(cid, cp->func)));
+                             BNX2X_HW_CID(cp, cid)));
         kwqe.hdr.type = cpu_to_le16(type);
-        kwqe.hdr.reserved = 0;
+        kwqe.hdr.reserved1 = 0;
         kwqe.data.phy_address.lo = cpu_to_le32(l5_data->phy_address.lo);
         kwqe.data.phy_address.hi = cpu_to_le32(l5_data->phy_address.hi);
 
@@ -1246,8 +1295,8 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
 {
         struct cnic_local *cp = dev->cnic_priv;
         struct iscsi_kwqe_init1 *req1 = (struct iscsi_kwqe_init1 *) kwqe;
-        int func = cp->func, pages;
-        int hq_bds;
+        int hq_bds, pages;
+        u32 pfid = cp->pfid;
 
         cp->num_iscsi_tasks = req1->num_tasks_per_conn;
         cp->num_ccells = req1->num_ccells_per_conn;
@@ -1264,60 +1313,60 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
                 return 0;
 
         /* init Tstorm RAM */
-        CNIC_WR16(dev, BAR_TSTRORM_INTMEM + TSTORM_ISCSI_RQ_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_TSTRORM_INTMEM + TSTORM_ISCSI_RQ_SIZE_OFFSET(pfid),
                   req1->rq_num_wqes);
-        CNIC_WR16(dev, BAR_TSTRORM_INTMEM + TSTORM_ISCSI_PAGE_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_TSTRORM_INTMEM + TSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
                   PAGE_SIZE);
         CNIC_WR8(dev, BAR_TSTRORM_INTMEM +
-                 TSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(func), PAGE_SHIFT);
+                 TSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
         CNIC_WR16(dev, BAR_TSTRORM_INTMEM +
-                  TSTORM_ISCSI_NUM_OF_TASKS_OFFSET(func),
+                  TSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                   req1->num_tasks_per_conn);
 
         /* init Ustorm RAM */
         CNIC_WR16(dev, BAR_USTRORM_INTMEM +
-                  USTORM_ISCSI_RQ_BUFFER_SIZE_OFFSET(func),
+                  USTORM_ISCSI_RQ_BUFFER_SIZE_OFFSET(pfid),
                   req1->rq_buffer_size);
-        CNIC_WR16(dev, BAR_USTRORM_INTMEM + USTORM_ISCSI_PAGE_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_USTRORM_INTMEM + USTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
                   PAGE_SIZE);
         CNIC_WR8(dev, BAR_USTRORM_INTMEM +
-                 USTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(func), PAGE_SHIFT);
+                 USTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
         CNIC_WR16(dev, BAR_USTRORM_INTMEM +
-                  USTORM_ISCSI_NUM_OF_TASKS_OFFSET(func),
+                  USTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                   req1->num_tasks_per_conn);
-        CNIC_WR16(dev, BAR_USTRORM_INTMEM + USTORM_ISCSI_RQ_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_USTRORM_INTMEM + USTORM_ISCSI_RQ_SIZE_OFFSET(pfid),
                   req1->rq_num_wqes);
-        CNIC_WR16(dev, BAR_USTRORM_INTMEM + USTORM_ISCSI_CQ_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_USTRORM_INTMEM + USTORM_ISCSI_CQ_SIZE_OFFSET(pfid),
                   req1->cq_num_wqes);
-        CNIC_WR16(dev, BAR_USTRORM_INTMEM + USTORM_ISCSI_R2TQ_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_USTRORM_INTMEM + USTORM_ISCSI_R2TQ_SIZE_OFFSET(pfid),
                   cp->num_iscsi_tasks * BNX2X_ISCSI_MAX_PENDING_R2TS);
 
         /* init Xstorm RAM */
-        CNIC_WR16(dev, BAR_XSTRORM_INTMEM + XSTORM_ISCSI_PAGE_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_XSTRORM_INTMEM + XSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
                   PAGE_SIZE);
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(func), PAGE_SHIFT);
+                 XSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
         CNIC_WR16(dev, BAR_XSTRORM_INTMEM +
-                  XSTORM_ISCSI_NUM_OF_TASKS_OFFSET(func),
+                  XSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                   req1->num_tasks_per_conn);
-        CNIC_WR16(dev, BAR_XSTRORM_INTMEM + XSTORM_ISCSI_HQ_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_XSTRORM_INTMEM + XSTORM_ISCSI_HQ_SIZE_OFFSET(pfid),
                   hq_bds);
-        CNIC_WR16(dev, BAR_XSTRORM_INTMEM + XSTORM_ISCSI_SQ_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_XSTRORM_INTMEM + XSTORM_ISCSI_SQ_SIZE_OFFSET(pfid),
                   req1->num_tasks_per_conn);
-        CNIC_WR16(dev, BAR_XSTRORM_INTMEM + XSTORM_ISCSI_R2TQ_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_XSTRORM_INTMEM + XSTORM_ISCSI_R2TQ_SIZE_OFFSET(pfid),
                   cp->num_iscsi_tasks * BNX2X_ISCSI_MAX_PENDING_R2TS);
 
         /* init Cstorm RAM */
-        CNIC_WR16(dev, BAR_CSTRORM_INTMEM + CSTORM_ISCSI_PAGE_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_CSTRORM_INTMEM + CSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
                   PAGE_SIZE);
         CNIC_WR8(dev, BAR_CSTRORM_INTMEM +
-                 CSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(func), PAGE_SHIFT);
+                 CSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
         CNIC_WR16(dev, BAR_CSTRORM_INTMEM +
-                  CSTORM_ISCSI_NUM_OF_TASKS_OFFSET(func),
+                  CSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                   req1->num_tasks_per_conn);
-        CNIC_WR16(dev, BAR_CSTRORM_INTMEM + CSTORM_ISCSI_CQ_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_CSTRORM_INTMEM + CSTORM_ISCSI_CQ_SIZE_OFFSET(pfid),
                   req1->cq_num_wqes);
-        CNIC_WR16(dev, BAR_CSTRORM_INTMEM + CSTORM_ISCSI_HQ_SIZE_OFFSET(func),
+        CNIC_WR16(dev, BAR_CSTRORM_INTMEM + CSTORM_ISCSI_HQ_SIZE_OFFSET(pfid),
                   hq_bds);
 
         return 0;
@@ -1327,7 +1376,7 @@ static int cnic_bnx2x_iscsi_init2(struct cnic_dev *dev, struct kwqe *kwqe)
 {
         struct iscsi_kwqe_init2 *req2 = (struct iscsi_kwqe_init2 *) kwqe;
         struct cnic_local *cp = dev->cnic_priv;
-        int func = cp->func;
+        u32 pfid = cp->pfid;
         struct iscsi_kcqe kcqe;
         struct kcqe *cqes[1];
 
@@ -1339,21 +1388,21 @@ static int cnic_bnx2x_iscsi_init2(struct cnic_dev *dev, struct kwqe *kwqe)
         }
 
         CNIC_WR(dev, BAR_TSTRORM_INTMEM +
-                TSTORM_ISCSI_ERROR_BITMAP_OFFSET(func), req2->error_bit_map[0]);
+                TSTORM_ISCSI_ERROR_BITMAP_OFFSET(pfid), req2->error_bit_map[0]);
         CNIC_WR(dev, BAR_TSTRORM_INTMEM +
-                TSTORM_ISCSI_ERROR_BITMAP_OFFSET(func) + 4,
+                TSTORM_ISCSI_ERROR_BITMAP_OFFSET(pfid) + 4,
                 req2->error_bit_map[1]);
 
         CNIC_WR16(dev, BAR_USTRORM_INTMEM +
-                  USTORM_ISCSI_CQ_SQN_SIZE_OFFSET(func), req2->max_cq_sqn);
+                  USTORM_ISCSI_CQ_SQN_SIZE_OFFSET(pfid), req2->max_cq_sqn);
         CNIC_WR(dev, BAR_USTRORM_INTMEM +
-                USTORM_ISCSI_ERROR_BITMAP_OFFSET(func), req2->error_bit_map[0]);
+                USTORM_ISCSI_ERROR_BITMAP_OFFSET(pfid), req2->error_bit_map[0]);
         CNIC_WR(dev, BAR_USTRORM_INTMEM +
-                USTORM_ISCSI_ERROR_BITMAP_OFFSET(func) + 4,
+                USTORM_ISCSI_ERROR_BITMAP_OFFSET(pfid) + 4,
                 req2->error_bit_map[1]);
 
         CNIC_WR16(dev, BAR_CSTRORM_INTMEM +
-                  CSTORM_ISCSI_CQ_SQN_SIZE_OFFSET(func), req2->max_cq_sqn);
+                  CSTORM_ISCSI_CQ_SQN_SIZE_OFFSET(pfid), req2->max_cq_sqn);
 
         kcqe.completion_status = ISCSI_KCQE_COMPLETION_STATUS_SUCCESS;
 
@@ -1461,7 +1510,7 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
         struct cnic_context *ctx = &cp->ctx_tbl[req1->iscsi_conn_id];
         struct cnic_iscsi *iscsi = ctx->proto.iscsi;
         u32 cid = ctx->cid;
-        u32 hw_cid = BNX2X_HW_CID(cid, cp->func);
+        u32 hw_cid = BNX2X_HW_CID(cp, cid);
         struct iscsi_context *ictx;
         struct regpair context_addr;
         int i, j, n = 2, n_max;
@@ -1527,8 +1576,10 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
         ictx->tstorm_st_context.tcp.cwnd = 0x5A8;
         ictx->tstorm_st_context.tcp.flags2 |=
                 TSTORM_TCP_ST_CONTEXT_SECTION_DA_EN;
+        ictx->tstorm_st_context.tcp.ooo_support_mode =
+                TCP_TSTORM_OOO_DROP_AND_PROC_ACK;
 
-        ictx->timers_context.flags |= ISCSI_TIMERS_BLOCK_CONTEXT_CONN_VALID_FLG;
+        ictx->timers_context.flags |= TIMERS_BLOCK_CONTEXT_CONN_VALID_FLG;
 
         ictx->ustorm_st_context.ring.rq.pbl_base.lo =
                 req2->rq_page_table_addr_lo;
@@ -1627,10 +1678,11 @@ static int cnic_bnx2x_iscsi_ofld1(struct cnic_dev *dev, struct kwqe *wqes[],
         struct iscsi_kwqe_conn_offload1 *req1;
         struct iscsi_kwqe_conn_offload2 *req2;
         struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_context *ctx;
         struct iscsi_kcqe kcqe;
         struct kcqe *cqes[1];
         u32 l5_cid;
-        int ret;
+        int ret = 0;
 
         if (num < 2) {
                 *work = num;
@@ -1654,9 +1706,15 @@ static int cnic_bnx2x_iscsi_ofld1(struct cnic_dev *dev, struct kwqe *wqes[],
         kcqe.iscsi_conn_id = l5_cid;
         kcqe.completion_status = ISCSI_KCQE_COMPLETION_STATUS_CTX_ALLOC_FAILURE;
 
+        ctx = &cp->ctx_tbl[l5_cid];
+        if (test_bit(CTX_FL_OFFLD_START, &ctx->ctx_flags)) {
+                kcqe.completion_status =
+                        ISCSI_KCQE_COMPLETION_STATUS_CID_BUSY;
+                goto done;
+        }
+
         if (atomic_inc_return(&cp->iscsi_conn) > dev->max_iscsi_conn) {
                 atomic_dec(&cp->iscsi_conn);
-                ret = 0;
                 goto done;
         }
         ret = cnic_alloc_bnx2x_conn_resc(dev, l5_cid);
@@ -1673,8 +1731,7 @@ static int cnic_bnx2x_iscsi_ofld1(struct cnic_dev *dev, struct kwqe *wqes[],
         }
 
         kcqe.completion_status = ISCSI_KCQE_COMPLETION_STATUS_SUCCESS;
-        kcqe.iscsi_conn_context_id = BNX2X_HW_CID(cp->ctx_tbl[l5_cid].cid,
-                                                  cp->func);
+        kcqe.iscsi_conn_context_id = BNX2X_HW_CID(cp, cp->ctx_tbl[l5_cid].cid);
 
 done:
         cqes[0] = (struct kcqe *) &kcqe;
@@ -1707,40 +1764,66 @@ static int cnic_bnx2x_iscsi_update(struct cnic_dev *dev, struct kwqe *kwqe)
         return ret;
 }
 
+static int cnic_bnx2x_destroy_ramrod(struct cnic_dev *dev, u32 l5_cid)
+{
+        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_context *ctx = &cp->ctx_tbl[l5_cid];
+        union l5cm_specific_data l5_data;
+        int ret;
+        u32 hw_cid, type;
+
+        init_waitqueue_head(&ctx->waitq);
+        ctx->wait_cond = 0;
+        memset(&l5_data, 0, sizeof(l5_data));
+        hw_cid = BNX2X_HW_CID(cp, ctx->cid);
+        type = (NONE_CONNECTION_TYPE << SPE_HDR_CONN_TYPE_SHIFT)
+                & SPE_HDR_CONN_TYPE;
+        type |= ((cp->pfid << SPE_HDR_FUNCTION_ID_SHIFT) &
+                 SPE_HDR_FUNCTION_ID);
+
+        ret = cnic_submit_kwqe_16(dev, RAMROD_CMD_ID_COMMON_CFC_DEL,
+                                  hw_cid, type, &l5_data);
+
+        if (ret == 0)
+                wait_event(ctx->waitq, ctx->wait_cond);
+
+        return ret;
+}
+
 static int cnic_bnx2x_iscsi_destroy(struct cnic_dev *dev, struct kwqe *kwqe)
 {
         struct cnic_local *cp = dev->cnic_priv;
         struct iscsi_kwqe_conn_destroy *req =
                 (struct iscsi_kwqe_conn_destroy *) kwqe;
-        union l5cm_specific_data l5_data;
         u32 l5_cid = req->reserved0;
         struct cnic_context *ctx = &cp->ctx_tbl[l5_cid];
         int ret = 0;
         struct iscsi_kcqe kcqe;
         struct kcqe *cqes[1];
 
-        if (!(ctx->ctx_flags & CTX_FL_OFFLD_START))
+        if (!test_bit(CTX_FL_OFFLD_START, &ctx->ctx_flags))
                 goto skip_cfc_delete;
 
-        while (!time_after(jiffies, ctx->timestamp + (2 * HZ)))
-                msleep(250);
+        if (!time_after(jiffies, ctx->timestamp + (2 * HZ))) {
+                unsigned long delta = ctx->timestamp + (2 * HZ) - jiffies;
 
-        init_waitqueue_head(&ctx->waitq);
-        ctx->wait_cond = 0;
-        memset(&l5_data, 0, sizeof(l5_data));
-        ret = cnic_submit_kwqe_16(dev, RAMROD_CMD_ID_ETH_CFC_DEL,
-                                  req->context_id,
-                                  ETH_CONNECTION_TYPE |
-                                  (1 << SPE_HDR_COMMON_RAMROD_SHIFT),
-                                  &l5_data);
-        if (ret == 0)
-                wait_event(ctx->waitq, ctx->wait_cond);
+                if (delta > (2 * HZ))
+                        delta = 0;
+
+                set_bit(CTX_FL_DELETE_WAIT, &ctx->ctx_flags);
+                queue_delayed_work(cnic_wq, &cp->delete_task, delta);
+                goto destroy_reply;
+        }
+
+        ret = cnic_bnx2x_destroy_ramrod(dev, l5_cid);
 
 skip_cfc_delete:
         cnic_free_bnx2x_conn_resc(dev, l5_cid);
 
         atomic_dec(&cp->iscsi_conn);
+        clear_bit(CTX_FL_OFFLD_START, &ctx->ctx_flags);
 
+destroy_reply:
         memset(&kcqe, 0, sizeof(kcqe));
         kcqe.op_code = ISCSI_KCQE_OPCODE_DESTROY_CONN;
         kcqe.iscsi_conn_id = l5_cid;
@@ -1805,37 +1888,37 @@ static void cnic_init_storm_conn_bufs(struct cnic_dev *dev,
 static void cnic_init_bnx2x_mac(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
-        int func = CNIC_FUNC(cp);
+        u32 pfid = cp->pfid;
         u8 *mac = dev->mac_addr;
 
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_LOCAL_MAC_ADDR0_OFFSET(func), mac[0]);
+                 XSTORM_ISCSI_LOCAL_MAC_ADDR0_OFFSET(pfid), mac[0]);
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_LOCAL_MAC_ADDR1_OFFSET(func), mac[1]);
+                 XSTORM_ISCSI_LOCAL_MAC_ADDR1_OFFSET(pfid), mac[1]);
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_LOCAL_MAC_ADDR2_OFFSET(func), mac[2]);
+                 XSTORM_ISCSI_LOCAL_MAC_ADDR2_OFFSET(pfid), mac[2]);
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_LOCAL_MAC_ADDR3_OFFSET(func), mac[3]);
+                 XSTORM_ISCSI_LOCAL_MAC_ADDR3_OFFSET(pfid), mac[3]);
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_LOCAL_MAC_ADDR4_OFFSET(func), mac[4]);
+                 XSTORM_ISCSI_LOCAL_MAC_ADDR4_OFFSET(pfid), mac[4]);
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_LOCAL_MAC_ADDR5_OFFSET(func), mac[5]);
+                 XSTORM_ISCSI_LOCAL_MAC_ADDR5_OFFSET(pfid), mac[5]);
 
         CNIC_WR8(dev, BAR_TSTRORM_INTMEM +
-                 TSTORM_ISCSI_TCP_VARS_LSB_LOCAL_MAC_ADDR_OFFSET(func), mac[5]);
+                 TSTORM_ISCSI_TCP_VARS_LSB_LOCAL_MAC_ADDR_OFFSET(pfid), mac[5]);
         CNIC_WR8(dev, BAR_TSTRORM_INTMEM +
-                 TSTORM_ISCSI_TCP_VARS_LSB_LOCAL_MAC_ADDR_OFFSET(func) + 1,
+                 TSTORM_ISCSI_TCP_VARS_LSB_LOCAL_MAC_ADDR_OFFSET(pfid) + 1,
                  mac[4]);
         CNIC_WR8(dev, BAR_TSTRORM_INTMEM +
-                 TSTORM_ISCSI_TCP_VARS_MSB_LOCAL_MAC_ADDR_OFFSET(func), mac[3]);
+                 TSTORM_ISCSI_TCP_VARS_MSB_LOCAL_MAC_ADDR_OFFSET(pfid), mac[3]);
         CNIC_WR8(dev, BAR_TSTRORM_INTMEM +
-                 TSTORM_ISCSI_TCP_VARS_MSB_LOCAL_MAC_ADDR_OFFSET(func) + 1,
+                 TSTORM_ISCSI_TCP_VARS_MSB_LOCAL_MAC_ADDR_OFFSET(pfid) + 1,
                  mac[2]);
         CNIC_WR8(dev, BAR_TSTRORM_INTMEM +
-                 TSTORM_ISCSI_TCP_VARS_MSB_LOCAL_MAC_ADDR_OFFSET(func) + 2,
+                 TSTORM_ISCSI_TCP_VARS_MSB_LOCAL_MAC_ADDR_OFFSET(pfid) + 2,
                  mac[1]);
         CNIC_WR8(dev, BAR_TSTRORM_INTMEM +
-                 TSTORM_ISCSI_TCP_VARS_MSB_LOCAL_MAC_ADDR_OFFSET(func) + 3,
+                 TSTORM_ISCSI_TCP_VARS_MSB_LOCAL_MAC_ADDR_OFFSET(pfid) + 3,
                  mac[0]);
 }
 
@@ -1851,10 +1934,10 @@ static void cnic_bnx2x_set_tcp_timestamp(struct cnic_dev *dev, int tcp_ts)
         }
 
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_TCP_VARS_FLAGS_OFFSET(cp->func), xstorm_flags);
+                 XSTORM_ISCSI_TCP_VARS_FLAGS_OFFSET(cp->pfid), xstorm_flags);
 
         CNIC_WR16(dev, BAR_TSTRORM_INTMEM +
-                  TSTORM_ISCSI_TCP_VARS_FLAGS_OFFSET(cp->func), tstorm_flags);
+                  TSTORM_ISCSI_TCP_VARS_FLAGS_OFFSET(cp->pfid), tstorm_flags);
 }
 
 static int cnic_bnx2x_connect(struct cnic_dev *dev, struct kwqe *wqes[],
@@ -1929,7 +2012,7 @@ static int cnic_bnx2x_connect(struct cnic_dev *dev, struct kwqe *wqes[],
         cnic_init_storm_conn_bufs(dev, kwqe1, kwqe3, conn_buf);
 
         CNIC_WR16(dev, BAR_XSTRORM_INTMEM +
-                  XSTORM_ISCSI_LOCAL_VLAN_OFFSET(cp->func), csk->vlan_id);
+                  XSTORM_ISCSI_LOCAL_VLAN_OFFSET(cp->pfid), csk->vlan_id);
 
         cnic_bnx2x_set_tcp_timestamp(dev,
                 kwqe1->tcp_flags & L4_KWQ_CONNECT_REQ1_TIME_STAMP);
@@ -1937,7 +2020,7 @@ static int cnic_bnx2x_connect(struct cnic_dev *dev, struct kwqe *wqes[],
         ret = cnic_submit_kwqe_16(dev, L5CM_RAMROD_CMD_ID_TCP_CONNECT,
                         kwqe1->cid, ISCSI_CONNECTION_TYPE, &l5_data);
         if (!ret)
-                ctx->ctx_flags |= CTX_FL_OFFLD_START;
+                set_bit(CTX_FL_OFFLD_START, &ctx->ctx_flags);
 
         return ret;
 }
@@ -2063,7 +2146,7 @@ static int cnic_submit_bnx2x_kwqes(struct cnic_dev *dev, struct kwqe *wqes[],
 static void service_kcqes(struct cnic_dev *dev, int num_cqes)
 {
         struct cnic_local *cp = dev->cnic_priv;
-        int i, j;
+        int i, j, comp = 0;
 
         i = 0;
         j = 1;
@@ -2074,7 +2157,7 @@ static void service_kcqes(struct cnic_dev *dev, int num_cqes)
                 u32 kcqe_layer = kcqe_op_flag & KCQE_FLAGS_LAYER_MASK;
 
                 if (unlikely(kcqe_op_flag & KCQE_RAMROD_COMPLETION))
-                        cnic_kwq_completion(dev, 1);
+                        comp++;
 
                 while (j < num_cqes) {
                         u32 next_op = cp->completed_kcq[i + j]->kcqe_op_flag;
@@ -2083,7 +2166,7 @@ static void service_kcqes(struct cnic_dev *dev, int num_cqes)
                                 break;
 
                         if (unlikely(next_op & KCQE_RAMROD_COMPLETION))
-                                cnic_kwq_completion(dev, 1);
+                                comp++;
                         j++;
                 }
 
@@ -2113,6 +2196,8 @@ end:
                 i += j;
                 j = 1;
         }
+        if (unlikely(comp))
+                cnic_spq_completion(dev, DRV_CTL_RET_L5_SPQ_CREDIT_CMD, comp);
 }
 
 static u16 cnic_bnx2_next_idx(u16 idx)
@@ -2171,8 +2256,9 @@ static int cnic_get_kcqes(struct cnic_dev *dev, struct kcq_info *info)
 static int cnic_l2_completion(struct cnic_local *cp)
 {
         u16 hw_cons, sw_cons;
+        struct cnic_uio_dev *udev = cp->udev;
         union eth_rx_cqe *cqe, *cqe_ring = (union eth_rx_cqe *)
-                                        (cp->l2_ring + (2 * BCM_PAGE_SIZE));
+                                        (udev->l2_ring + (2 * BCM_PAGE_SIZE));
         u32 cmd;
         int comp = 0;
 
@@ -2203,13 +2289,14 @@ static int cnic_l2_completion(struct cnic_local *cp)
 
 static void cnic_chk_pkt_rings(struct cnic_local *cp)
 {
-        u16 rx_cons = *cp->rx_cons_ptr;
-        u16 tx_cons = *cp->tx_cons_ptr;
+        u16 rx_cons, tx_cons;
         int comp = 0;
 
-        if (!test_bit(CNIC_F_CNIC_UP, &cp->dev->flags))
+        if (!test_bit(CNIC_LCL_FL_RINGS_INITED, &cp->cnic_local_flags))
                 return;
 
+        rx_cons = *cp->rx_cons_ptr;
+        tx_cons = *cp->tx_cons_ptr;
         if (cp->tx_cons != tx_cons || cp->rx_cons != rx_cons) {
                 if (test_bit(CNIC_LCL_FL_L2_WAIT, &cp->cnic_local_flags))
                         comp = cnic_l2_completion(cp);
@@ -2217,7 +2304,8 @@ static void cnic_chk_pkt_rings(struct cnic_local *cp)
                 cp->tx_cons = tx_cons;
                 cp->rx_cons = rx_cons;
 
-                uio_event_notify(cp->cnic_uinfo);
+                if (cp->udev)
+                        uio_event_notify(&cp->udev->cnic_uinfo);
         }
         if (comp)
                 clear_bit(CNIC_LCL_FL_L2_WAIT, &cp->cnic_local_flags);
@@ -2318,14 +2406,38 @@ static inline void cnic_ack_bnx2x_int(struct cnic_dev *dev, u8 id, u8 storm,
         CNIC_WR(dev, hc_addr, (*(u32 *)&igu_ack));
 }
 
+static void cnic_ack_igu_sb(struct cnic_dev *dev, u8 igu_sb_id, u8 segment,
+                            u16 index, u8 op, u8 update)
+{
+        struct igu_regular cmd_data;
+        u32 igu_addr = BAR_IGU_INTMEM + (IGU_CMD_INT_ACK_BASE + igu_sb_id) * 8;
+
+        cmd_data.sb_id_and_flags =
+                (index << IGU_REGULAR_SB_INDEX_SHIFT) |
+                (segment << IGU_REGULAR_SEGMENT_ACCESS_SHIFT) |
+                (update << IGU_REGULAR_BUPDATE_SHIFT) |
+                (op << IGU_REGULAR_ENABLE_INT_SHIFT);
+
+
+        CNIC_WR(dev, igu_addr, cmd_data.sb_id_and_flags);
+}
+
 static void cnic_ack_bnx2x_msix(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
 
-        cnic_ack_bnx2x_int(dev, cp->status_blk_num, CSTORM_ID, 0,
+        cnic_ack_bnx2x_int(dev, cp->bnx2x_igu_sb_id, CSTORM_ID, 0,
                            IGU_INT_DISABLE, 0);
 }
 
+static void cnic_ack_bnx2x_e2_msix(struct cnic_dev *dev)
+{
+        struct cnic_local *cp = dev->cnic_priv;
+
+        cnic_ack_igu_sb(dev, cp->bnx2x_igu_sb_id, IGU_SEG_ACCESS_DEF, 0,
+                        IGU_INT_DISABLE, 0);
+}
+
 static u32 cnic_service_bnx2x_kcq(struct cnic_dev *dev, struct kcq_info *info)
 {
         u32 last_status = *info->status_idx_ptr;
@@ -2357,8 +2469,12 @@ static void cnic_service_bnx2x_bh(unsigned long data)
         status_idx = cnic_service_bnx2x_kcq(dev, &cp->kcq1);
 
         CNIC_WR16(dev, cp->kcq1.io_addr, cp->kcq1.sw_prod_idx + MAX_KCQ_IDX);
-        cnic_ack_bnx2x_int(dev, cp->status_blk_num, CSTORM_ID,
-                           status_idx, IGU_INT_ENABLE, 1);
+        if (BNX2X_CHIP_IS_E2(cp->chip_id))
+                cnic_ack_igu_sb(dev, cp->bnx2x_igu_sb_id, IGU_SEG_ACCESS_DEF,
+                                status_idx, IGU_INT_ENABLE, 1);
+        else
+                cnic_ack_bnx2x_int(dev, cp->bnx2x_igu_sb_id, USTORM_ID,
+                                   status_idx, IGU_INT_ENABLE, 1);
 }
 
 static int cnic_service_bnx2x(void *data, void *status_blk)
@@ -2379,8 +2495,7 @@ static void cnic_ulp_stop(struct cnic_dev *dev)
         struct cnic_local *cp = dev->cnic_priv;
         int if_type;
 
-        if (cp->cnic_uinfo)
-                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+        cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
 
         for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                 struct cnic_ulp_ops *ulp_ops;
@@ -2728,6 +2843,13 @@ static int cnic_cm_create(struct cnic_dev *dev, int ulp_type, u32 cid,
         if (l5_cid >= MAX_CM_SK_TBL_SZ)
                 return -EINVAL;
 
+        if (cp->ctx_tbl) {
+                struct cnic_context *ctx = &cp->ctx_tbl[l5_cid];
+
+                if (test_bit(CTX_FL_OFFLD_START, &ctx->ctx_flags))
+                        return -EAGAIN;
+        }
+
         csk1 = &cp->csk_tbl[l5_cid];
         if (atomic_read(&csk1->ref_count))
                 return -EAGAIN;
@@ -3279,39 +3401,106 @@ static void cnic_close_bnx2x_conn(struct cnic_sock *csk, u32 opcode)
 
 static void cnic_cm_stop_bnx2x_hw(struct cnic_dev *dev)
 {
+        struct cnic_local *cp = dev->cnic_priv;
+        int i;
+
+        if (!cp->ctx_tbl)
+                return;
+
+        if (!netif_running(dev->netdev))
+                return;
+
+        for (i = 0; i < cp->max_cid_space; i++) {
+                struct cnic_context *ctx = &cp->ctx_tbl[i];
+
+                while (test_bit(CTX_FL_DELETE_WAIT, &ctx->ctx_flags))
+                        msleep(10);
+
+                if (test_bit(CTX_FL_OFFLD_START, &ctx->ctx_flags))
+                        netdev_warn(dev->netdev, "CID %x not deleted\n",
+                                   ctx->cid);
+        }
+
+        cancel_delayed_work(&cp->delete_task);
+        flush_workqueue(cnic_wq);
+
+        if (atomic_read(&cp->iscsi_conn) != 0)
+                netdev_warn(dev->netdev, "%d iSCSI connections not destroyed\n",
+                            atomic_read(&cp->iscsi_conn));
 }
 
 static int cnic_cm_init_bnx2x_hw(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
-        int func = CNIC_FUNC(cp);
+        u32 pfid = cp->pfid;
+        u32 port = CNIC_PORT(cp);
 
         cnic_init_bnx2x_mac(dev);
         cnic_bnx2x_set_tcp_timestamp(dev, 1);
 
         CNIC_WR16(dev, BAR_XSTRORM_INTMEM +
-                  XSTORM_ISCSI_LOCAL_VLAN_OFFSET(func), 0);
+                  XSTORM_ISCSI_LOCAL_VLAN_OFFSET(pfid), 0);
 
         CNIC_WR(dev, BAR_XSTRORM_INTMEM +
-                XSTORM_TCP_GLOBAL_DEL_ACK_COUNTER_ENABLED_OFFSET(func), 1);
+                XSTORM_TCP_GLOBAL_DEL_ACK_COUNTER_ENABLED_OFFSET(port), 1);
         CNIC_WR(dev, BAR_XSTRORM_INTMEM +
-                XSTORM_TCP_GLOBAL_DEL_ACK_COUNTER_MAX_COUNT_OFFSET(func),
+                XSTORM_TCP_GLOBAL_DEL_ACK_COUNTER_MAX_COUNT_OFFSET(port),
                 DEF_MAX_DA_COUNT);
 
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_TCP_VARS_TTL_OFFSET(func), DEF_TTL);
+                 XSTORM_ISCSI_TCP_VARS_TTL_OFFSET(pfid), DEF_TTL);
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_TCP_VARS_TOS_OFFSET(func), DEF_TOS);
+                 XSTORM_ISCSI_TCP_VARS_TOS_OFFSET(pfid), DEF_TOS);
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_TCP_VARS_ADV_WND_SCL_OFFSET(func), 2);
+                 XSTORM_ISCSI_TCP_VARS_ADV_WND_SCL_OFFSET(pfid), 2);
         CNIC_WR(dev, BAR_XSTRORM_INTMEM +
-                XSTORM_TCP_TX_SWS_TIMER_VAL_OFFSET(func), DEF_SWS_TIMER);
+                XSTORM_TCP_TX_SWS_TIMER_VAL_OFFSET(pfid), DEF_SWS_TIMER);
 
-        CNIC_WR(dev, BAR_TSTRORM_INTMEM + TSTORM_TCP_MAX_CWND_OFFSET(func),
+        CNIC_WR(dev, BAR_TSTRORM_INTMEM + TSTORM_TCP_MAX_CWND_OFFSET(pfid),
                 DEF_MAX_CWND);
         return 0;
 }
 
+static void cnic_delete_task(struct work_struct *work)
+{
+        struct cnic_local *cp;
+        struct cnic_dev *dev;
+        u32 i;
+        int need_resched = 0;
+
+        cp = container_of(work, struct cnic_local, delete_task.work);
+        dev = cp->dev;
+
+        for (i = 0; i < cp->max_cid_space; i++) {
+                struct cnic_context *ctx = &cp->ctx_tbl[i];
+
+                if (!test_bit(CTX_FL_OFFLD_START, &ctx->ctx_flags) ||
+                    !test_bit(CTX_FL_DELETE_WAIT, &ctx->ctx_flags))
+                        continue;
+
+                if (!time_after(jiffies, ctx->timestamp + (2 * HZ))) {
+                        need_resched = 1;
+                        continue;
+                }
+
+                if (!test_and_clear_bit(CTX_FL_DELETE_WAIT, &ctx->ctx_flags))
+                        continue;
+
+                cnic_bnx2x_destroy_ramrod(dev, i);
+
+                cnic_free_bnx2x_conn_resc(dev, i);
+                if (ctx->ulp_proto_id == CNIC_ULP_ISCSI)
+                        atomic_dec(&cp->iscsi_conn);
+
+                clear_bit(CTX_FL_OFFLD_START, &ctx->ctx_flags);
+        }
+
+        if (need_resched)
+                queue_delayed_work(cnic_wq, &cp->delete_task,
+                                   msecs_to_jiffies(10));
+
+}
+
 static int cnic_cm_open(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
@@ -3326,6 +3515,8 @@ static int cnic_cm_open(struct cnic_dev *dev)
         if (err)
                 goto err_out;
 
+        INIT_DELAYED_WORK(&cp->delete_task, cnic_delete_task);
+
         dev->cm_create = cnic_cm_create;
         dev->cm_destroy = cnic_cm_destroy;
         dev->cm_connect = cnic_cm_connect;
@@ -3418,11 +3609,24 @@ static void cnic_free_irq(struct cnic_dev *dev)
 
         if (ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX) {
                 cp->disable_int_sync(dev);
-                tasklet_disable(&cp->cnic_irq_task);
+                tasklet_kill(&cp->cnic_irq_task);
                 free_irq(ethdev->irq_arr[0].vector, dev);
         }
 }
 
+static int cnic_request_irq(struct cnic_dev *dev)
+{
+        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_eth_dev *ethdev = cp->ethdev;
+        int err;
+
+        err = request_irq(ethdev->irq_arr[0].vector, cnic_irq, 0, "cnic", dev);
+        if (err)
+                tasklet_disable(&cp->cnic_irq_task);
+
+        return err;
+}
+
 static int cnic_init_bnx2_irq(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
@@ -3443,12 +3647,10 @@ static int cnic_init_bnx2_irq(struct cnic_dev *dev)
                 cp->last_status_idx = cp->status_blk.bnx2->status_idx;
                 tasklet_init(&cp->cnic_irq_task, cnic_service_bnx2_msix,
                              (unsigned long) dev);
-                err = request_irq(ethdev->irq_arr[0].vector, cnic_irq, 0,
-                                  "cnic", dev);
-                if (err) {
-                        tasklet_disable(&cp->cnic_irq_task);
+                err = cnic_request_irq(dev);
+                if (err)
                         return err;
-                }
+
                 while (cp->status_blk.bnx2->status_completion_producer_index &&
                        i < 10) {
                         CNIC_WR(dev, BNX2_HC_COALESCE_NOW,
@@ -3515,11 +3717,12 @@ static void cnic_init_bnx2_tx_ring(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
         struct cnic_eth_dev *ethdev = cp->ethdev;
+        struct cnic_uio_dev *udev = cp->udev;
         u32 cid_addr, tx_cid, sb_id;
         u32 val, offset0, offset1, offset2, offset3;
         int i;
         struct tx_bd *txbd;
-        dma_addr_t buf_map;
+        dma_addr_t buf_map, ring_map = udev->l2_ring_map;
         struct status_block *s_blk = cp->status_blk.gen;
 
         sb_id = cp->status_blk_num;
@@ -3561,18 +3764,18 @@ static void cnic_init_bnx2_tx_ring(struct cnic_dev *dev)
         val = BNX2_L2CTX_CMD_TYPE_TYPE_L2 | (8 << 16);
         cnic_ctx_wr(dev, cid_addr, offset1, val);
 
-        txbd = (struct tx_bd *) cp->l2_ring;
+        txbd = (struct tx_bd *) udev->l2_ring;
 
-        buf_map = cp->l2_buf_map;
+        buf_map = udev->l2_buf_map;
         for (i = 0; i < MAX_TX_DESC_CNT; i++, txbd++) {
                 txbd->tx_bd_haddr_hi = (u64) buf_map >> 32;
                 txbd->tx_bd_haddr_lo = (u64) buf_map & 0xffffffff;
         }
-        val = (u64) cp->l2_ring_map >> 32;
+        val = (u64) ring_map >> 32;
         cnic_ctx_wr(dev, cid_addr, offset2, val);
         txbd->tx_bd_haddr_hi = val;
 
-        val = (u64) cp->l2_ring_map & 0xffffffff;
+        val = (u64) ring_map & 0xffffffff;
         cnic_ctx_wr(dev, cid_addr, offset3, val);
         txbd->tx_bd_haddr_lo = val;
 }
@@ -3581,10 +3784,12 @@ static void cnic_init_bnx2_rx_ring(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
         struct cnic_eth_dev *ethdev = cp->ethdev;
+        struct cnic_uio_dev *udev = cp->udev;
         u32 cid_addr, sb_id, val, coal_reg, coal_val;
         int i;
         struct rx_bd *rxbd;
         struct status_block *s_blk = cp->status_blk.gen;
+        dma_addr_t ring_map = udev->l2_ring_map;
 
         sb_id = cp->status_blk_num;
         cnic_init_context(dev, 2);
@@ -3618,22 +3823,22 @@ static void cnic_init_bnx2_rx_ring(struct cnic_dev *dev)
                 val = BNX2_L2CTX_L2_STATUSB_NUM(sb_id);
         cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_HOST_BDIDX, val);
 
-        rxbd = (struct rx_bd *) (cp->l2_ring + BCM_PAGE_SIZE);
+        rxbd = (struct rx_bd *) (udev->l2_ring + BCM_PAGE_SIZE);
         for (i = 0; i < MAX_RX_DESC_CNT; i++, rxbd++) {
                 dma_addr_t buf_map;
                 int n = (i % cp->l2_rx_ring_size) + 1;
 
-                buf_map = cp->l2_buf_map + (n * cp->l2_single_buf_size);
+                buf_map = udev->l2_buf_map + (n * cp->l2_single_buf_size);
                 rxbd->rx_bd_len = cp->l2_single_buf_size;
                 rxbd->rx_bd_flags = RX_BD_FLAGS_START | RX_BD_FLAGS_END;
                 rxbd->rx_bd_haddr_hi = (u64) buf_map >> 32;
                 rxbd->rx_bd_haddr_lo = (u64) buf_map & 0xffffffff;
         }
-        val = (u64) (cp->l2_ring_map + BCM_PAGE_SIZE) >> 32;
+        val = (u64) (ring_map + BCM_PAGE_SIZE) >> 32;
         cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_NX_BDHADDR_HI, val);
         rxbd->rx_bd_haddr_hi = val;
 
-        val = (u64) (cp->l2_ring_map + BCM_PAGE_SIZE) & 0xffffffff;
+        val = (u64) (ring_map + BCM_PAGE_SIZE) & 0xffffffff;
         cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_NX_BDHADDR_LO, val);
         rxbd->rx_bd_haddr_lo = val;
 
@@ -3850,42 +4055,55 @@ static int cnic_init_bnx2x_irq(struct cnic_dev *dev)
 
         tasklet_init(&cp->cnic_irq_task, cnic_service_bnx2x_bh,
                      (unsigned long) dev);
-        if (ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX) {
-                err = request_irq(ethdev->irq_arr[0].vector, cnic_irq, 0,
-                                  "cnic", dev);
-                if (err)
-                        tasklet_disable(&cp->cnic_irq_task);
-        }
+        if (ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX)
+                err = cnic_request_irq(dev);
+
         return err;
 }
 
+static inline void cnic_storm_memset_hc_disable(struct cnic_dev *dev,
+                                                u16 sb_id, u8 sb_index,
+                                                u8 disable)
+{
+
+        u32 addr = BAR_CSTRORM_INTMEM +
+                        CSTORM_STATUS_BLOCK_DATA_OFFSET(sb_id) +
+                        offsetof(struct hc_status_block_data_e1x, index_data) +
+                        sizeof(struct hc_index_data)*sb_index +
+                        offsetof(struct hc_index_data, flags);
+        u16 flags = CNIC_RD16(dev, addr);
+        /* clear and set */
+        flags &= ~HC_INDEX_DATA_HC_ENABLED;
+        flags |= (((~disable) << HC_INDEX_DATA_HC_ENABLED_SHIFT) &
+                  HC_INDEX_DATA_HC_ENABLED);
+        CNIC_WR16(dev, addr, flags);
+}
+
 static void cnic_enable_bnx2x_int(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
         u8 sb_id = cp->status_blk_num;
-        int port = CNIC_PORT(cp);
 
         CNIC_WR8(dev, BAR_CSTRORM_INTMEM +
-                 CSTORM_SB_HC_TIMEOUT_C_OFFSET(port, sb_id,
-                                               HC_INDEX_C_ISCSI_EQ_CONS),
-                 64 / 12);
-        CNIC_WR16(dev, BAR_CSTRORM_INTMEM +
-                  CSTORM_SB_HC_DISABLE_C_OFFSET(port, sb_id,
-                                                HC_INDEX_C_ISCSI_EQ_CONS), 0);
+                        CSTORM_STATUS_BLOCK_DATA_OFFSET(sb_id) +
+                        offsetof(struct hc_status_block_data_e1x, index_data) +
+                        sizeof(struct hc_index_data)*HC_INDEX_ISCSI_EQ_CONS +
+                        offsetof(struct hc_index_data, timeout), 64 / 12);
+        cnic_storm_memset_hc_disable(dev, sb_id, HC_INDEX_ISCSI_EQ_CONS, 0);
 }
 
 static void cnic_disable_bnx2x_int_sync(struct cnic_dev *dev)
 {
 }
 
-static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev)
+static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev,
+                                    struct client_init_ramrod_data *data)
 {
         struct cnic_local *cp = dev->cnic_priv;
-        union eth_tx_bd_types *txbd = (union eth_tx_bd_types *) cp->l2_ring;
-        struct eth_context *context;
-        struct regpair context_addr;
-        dma_addr_t buf_map;
-        int func = CNIC_FUNC(cp);
+        struct cnic_uio_dev *udev = cp->udev;
+        union eth_tx_bd_types *txbd = (union eth_tx_bd_types *) udev->l2_ring;
+        dma_addr_t buf_map, ring_map = udev->l2_ring_map;
+        struct host_sp_status_block *sb = cp->bnx2x_def_status_blk;
         int port = CNIC_PORT(cp);
         int i;
         int cli = BNX2X_ISCSI_CL_ID(CNIC_E1HVN(cp));
@@ -3893,7 +4111,7 @@ static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev)
 
         memset(txbd, 0, BCM_PAGE_SIZE);
 
-        buf_map = cp->l2_buf_map;
+        buf_map = udev->l2_buf_map;
         for (i = 0; i < MAX_TX_DESC_CNT; i += 3, txbd += 3) {
                 struct eth_tx_start_bd *start_bd = &txbd->start_bd;
                 struct eth_tx_bd *reg_bd = &((txbd + 2)->reg_bd);
@@ -3910,33 +4128,23 @@ static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev)
                 start_bd->general_data |= (1 << ETH_TX_START_BD_HDR_NBDS_SHIFT);
 
         }
-        context = cnic_get_bnx2x_ctx(dev, BNX2X_ISCSI_L2_CID, 1, &context_addr);
 
-        val = (u64) cp->l2_ring_map >> 32;
+        val = (u64) ring_map >> 32;
         txbd->next_bd.addr_hi = cpu_to_le32(val);
 
-        context->xstorm_st_context.tx_bd_page_base_hi = val;
+        data->tx.tx_bd_page_base.hi = cpu_to_le32(val);
 
-        val = (u64) cp->l2_ring_map & 0xffffffff;
+        val = (u64) ring_map & 0xffffffff;
         txbd->next_bd.addr_lo = cpu_to_le32(val);
 
-        context->xstorm_st_context.tx_bd_page_base_lo = val;
-
-        context->cstorm_st_context.sb_index_number =
-                HC_INDEX_DEF_C_ETH_ISCSI_CQ_CONS;
-        context->cstorm_st_context.status_block_id = BNX2X_DEF_SB_ID;
+        data->tx.tx_bd_page_base.lo = cpu_to_le32(val);
 
-        if (cli < MAX_X_STAT_COUNTER_ID)
-                context->xstorm_st_context.statistics_data = cli |
-                                XSTORM_ETH_ST_CONTEXT_STATISTICS_ENABLE;
-
-        context->xstorm_ag_context.cdu_reserved =
-                CDU_RSRVD_VALUE_TYPE_A(BNX2X_HW_CID(BNX2X_ISCSI_L2_CID, func),
-                                        CDU_REGION_NUMBER_XCM_AG,
-                                        ETH_CONNECTION_TYPE);
+        /* Other ramrod params */
+        data->tx.tx_sb_index_number = HC_SP_INDEX_ETH_ISCSI_CQ_CONS;
+        data->tx.tx_status_block_id = BNX2X_DEF_SB_ID;
 
         /* reset xstorm per client statistics */
-        if (cli < MAX_X_STAT_COUNTER_ID) {
+        if (cli < MAX_STAT_COUNTER_ID) {
                 val = BAR_XSTRORM_INTMEM +
                       XSTORM_PER_COUNTER_ID_STATS_OFFSET(port, cli);
                 for (i = 0; i < sizeof(struct xstorm_per_client_stats) / 4; i++)
@@ -3944,111 +4152,77 @@ static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev)
         }
 
         cp->tx_cons_ptr =
-                &cp->bnx2x_def_status_blk->c_def_status_block.index_values[
-                        HC_INDEX_DEF_C_ETH_ISCSI_CQ_CONS];
+                &sb->sp_sb.index_values[HC_SP_INDEX_ETH_ISCSI_CQ_CONS];
 }
 
-static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev)
+static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev,
+                                    struct client_init_ramrod_data *data)
 {
         struct cnic_local *cp = dev->cnic_priv;
-        struct eth_rx_bd *rxbd = (struct eth_rx_bd *) (cp->l2_ring +
+        struct cnic_uio_dev *udev = cp->udev;
+        struct eth_rx_bd *rxbd = (struct eth_rx_bd *) (udev->l2_ring +
                                 BCM_PAGE_SIZE);
         struct eth_rx_cqe_next_page *rxcqe = (struct eth_rx_cqe_next_page *)
-                                (cp->l2_ring + (2 * BCM_PAGE_SIZE));
-        struct eth_context *context;
-        struct regpair context_addr;
+                                (udev->l2_ring + (2 * BCM_PAGE_SIZE));
+        struct host_sp_status_block *sb = cp->bnx2x_def_status_blk;
         int i;
         int port = CNIC_PORT(cp);
-        int func = CNIC_FUNC(cp);
         int cli = BNX2X_ISCSI_CL_ID(CNIC_E1HVN(cp));
+        int cl_qzone_id = BNX2X_CL_QZONE_ID(cp, cli);
         u32 val;
-        struct tstorm_eth_client_config tstorm_client = {0};
+        dma_addr_t ring_map = udev->l2_ring_map;
+
+        /* General data */
+        data->general.client_id = cli;
+        data->general.statistics_en_flg = 1;
+        data->general.statistics_counter_id = cli;
+        data->general.activate_flg = 1;
+        data->general.sp_client_id = cli;
 
         for (i = 0; i < BNX2X_MAX_RX_DESC_CNT; i++, rxbd++) {
                 dma_addr_t buf_map;
                 int n = (i % cp->l2_rx_ring_size) + 1;
 
-                buf_map = cp->l2_buf_map + (n * cp->l2_single_buf_size);
+                buf_map = udev->l2_buf_map + (n * cp->l2_single_buf_size);
                 rxbd->addr_hi = cpu_to_le32((u64) buf_map >> 32);
                 rxbd->addr_lo = cpu_to_le32(buf_map & 0xffffffff);
         }
-        context = cnic_get_bnx2x_ctx(dev, BNX2X_ISCSI_L2_CID, 0, &context_addr);
 
-        val = (u64) (cp->l2_ring_map + BCM_PAGE_SIZE) >> 32;
+        val = (u64) (ring_map + BCM_PAGE_SIZE) >> 32;
         rxbd->addr_hi = cpu_to_le32(val);
+        data->rx.bd_page_base.hi = cpu_to_le32(val);
 
-        context->ustorm_st_context.common.bd_page_base_hi = val;
-
-        val = (u64) (cp->l2_ring_map + BCM_PAGE_SIZE) & 0xffffffff;
+        val = (u64) (ring_map + BCM_PAGE_SIZE) & 0xffffffff;
         rxbd->addr_lo = cpu_to_le32(val);
-
-        context->ustorm_st_context.common.bd_page_base_lo = val;
-
-        context->ustorm_st_context.common.sb_index_numbers =
-                                                BNX2X_ISCSI_RX_SB_INDEX_NUM;
-        context->ustorm_st_context.common.clientId = cli;
-        context->ustorm_st_context.common.status_block_id = BNX2X_DEF_SB_ID;
-        if (cli < MAX_U_STAT_COUNTER_ID) {
-                context->ustorm_st_context.common.flags =
-                        USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_STATISTICS;
-                context->ustorm_st_context.common.statistics_counter_id = cli;
-        }
-        context->ustorm_st_context.common.mc_alignment_log_size = 0;
-        context->ustorm_st_context.common.bd_buff_size =
-                                                cp->l2_single_buf_size;
-
-        context->ustorm_ag_context.cdu_usage =
-                CDU_RSRVD_VALUE_TYPE_A(BNX2X_HW_CID(BNX2X_ISCSI_L2_CID, func),
-                                        CDU_REGION_NUMBER_UCM_AG,
-                                        ETH_CONNECTION_TYPE);
+        data->rx.bd_page_base.lo = cpu_to_le32(val);
 
         rxcqe += BNX2X_MAX_RCQ_DESC_CNT;
-        val = (u64) (cp->l2_ring_map + (2 * BCM_PAGE_SIZE)) >> 32;
+        val = (u64) (ring_map + (2 * BCM_PAGE_SIZE)) >> 32;
         rxcqe->addr_hi = cpu_to_le32(val);
+        data->rx.cqe_page_base.hi = cpu_to_le32(val);
 
-        CNIC_WR(dev, BAR_USTRORM_INTMEM +
-                USTORM_CQE_PAGE_BASE_OFFSET(port, cli) + 4, val);
-
-        CNIC_WR(dev, BAR_USTRORM_INTMEM +
-                USTORM_CQE_PAGE_NEXT_OFFSET(port, cli) + 4, val);
-
-        val = (u64) (cp->l2_ring_map + (2 * BCM_PAGE_SIZE)) & 0xffffffff;
+        val = (u64) (ring_map + (2 * BCM_PAGE_SIZE)) & 0xffffffff;
         rxcqe->addr_lo = cpu_to_le32(val);
+        data->rx.cqe_page_base.lo = cpu_to_le32(val);
 
-        CNIC_WR(dev, BAR_USTRORM_INTMEM +
-                USTORM_CQE_PAGE_BASE_OFFSET(port, cli), val);
-
-        CNIC_WR(dev, BAR_USTRORM_INTMEM +
-                USTORM_CQE_PAGE_NEXT_OFFSET(port, cli), val);
-
-        /* client tstorm info */
-        tstorm_client.mtu = cp->l2_single_buf_size - 14;
-        tstorm_client.config_flags = TSTORM_ETH_CLIENT_CONFIG_E1HOV_REM_ENABLE;
-
-        if (cli < MAX_T_STAT_COUNTER_ID) {
-                tstorm_client.config_flags |=
-                                TSTORM_ETH_CLIENT_CONFIG_STATSITICS_ENABLE;
-                tstorm_client.statistics_counter_id = cli;
-        }
+        /* Other ramrod params */
+        data->rx.client_qzone_id = cl_qzone_id;
+        data->rx.rx_sb_index_number = HC_SP_INDEX_ETH_ISCSI_RX_CQ_CONS;
+        data->rx.status_block_id = BNX2X_DEF_SB_ID;
 
-        CNIC_WR(dev, BAR_TSTRORM_INTMEM +
-                   TSTORM_CLIENT_CONFIG_OFFSET(port, cli),
-                   ((u32 *)&tstorm_client)[0]);
-        CNIC_WR(dev, BAR_TSTRORM_INTMEM +
-                   TSTORM_CLIENT_CONFIG_OFFSET(port, cli) + 4,
-                   ((u32 *)&tstorm_client)[1]);
+        data->rx.cache_line_alignment_log_size = L1_CACHE_SHIFT;
+        data->rx.bd_buff_size = cpu_to_le16(cp->l2_single_buf_size);
 
-        /* reset tstorm per client statistics */
-        if (cli < MAX_T_STAT_COUNTER_ID) {
+        data->rx.mtu = cpu_to_le16(cp->l2_single_buf_size - 14);
+        data->rx.outer_vlan_removal_enable_flg = 1;
 
+        /* reset tstorm and ustorm per client statistics */
+        if (cli < MAX_STAT_COUNTER_ID) {
                 val = BAR_TSTRORM_INTMEM +
                       TSTORM_PER_COUNTER_ID_STATS_OFFSET(port, cli);
                 for (i = 0; i < sizeof(struct tstorm_per_client_stats) / 4; i++)
                         CNIC_WR(dev, val + i * 4, 0);
-        }
 
-        /* reset ustorm per client statistics */
-        if (cli < MAX_U_STAT_COUNTER_ID) {
                 val = BAR_USTRORM_INTMEM +
                       USTORM_PER_COUNTER_ID_STATS_OFFSET(port, cli);
                 for (i = 0; i < sizeof(struct ustorm_per_client_stats) / 4; i++)
@@ -4056,21 +4230,22 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev)
         }
 
         cp->rx_cons_ptr =
-                &cp->bnx2x_def_status_blk->u_def_status_block.index_values[
-                        HC_INDEX_DEF_U_ETH_ISCSI_RX_CQ_CONS];
+                &sb->sp_sb.index_values[HC_SP_INDEX_ETH_ISCSI_RX_CQ_CONS];
 }
 
 static void cnic_get_bnx2x_iscsi_info(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
-        u32 base, addr, val;
+        u32 base, base2, addr, val;
         int port = CNIC_PORT(cp);
 
         dev->max_iscsi_conn = 0;
         base = CNIC_RD(dev, MISC_REG_SHARED_MEM_ADDR);
-        if (base < 0xa0000 || base >= 0xc0000)
+        if (base == 0)
                 return;
 
+        base2 = CNIC_RD(dev, (CNIC_PATH(cp) ? MISC_REG_GENERIC_CR_1 :
+                                              MISC_REG_GENERIC_CR_0));
         addr = BNX2X_SHMEM_ADDR(base,
                 dev_info.port_hw_config[port].iscsi_mac_upper);
 
@@ -4103,16 +4278,25 @@ static void cnic_get_bnx2x_iscsi_info(struct cnic_dev *dev)
                         val16 ^= 0x1e1e;
                 dev->max_iscsi_conn = val16;
         }
-        if (BNX2X_CHIP_IS_E1H(cp->chip_id)) {
+        if (BNX2X_CHIP_IS_E1H(cp->chip_id) || BNX2X_CHIP_IS_E2(cp->chip_id)) {
                 int func = CNIC_FUNC(cp);
+                u32 mf_cfg_addr;
+
+                if (BNX2X_SHMEM2_HAS(base2, mf_cfg_addr))
+                        mf_cfg_addr = CNIC_RD(dev, BNX2X_SHMEM2_ADDR(base2,
+                                              mf_cfg_addr));
+                else
+                        mf_cfg_addr = base + BNX2X_SHMEM_MF_BLK_OFFSET;
+
+                addr = mf_cfg_addr +
+                        offsetof(struct mf_cfg, func_mf_config[func].e1hov_tag);
 
-                addr = BNX2X_SHMEM_ADDR(base,
-                                mf_cfg.func_mf_config[func].e1hov_tag);
                 val = CNIC_RD(dev, addr);
                 val &= FUNC_MF_CFG_E1HOV_TAG_MASK;
                 if (val != FUNC_MF_CFG_E1HOV_TAG_DEFAULT) {
-                        addr = BNX2X_SHMEM_ADDR(base,
-                                mf_cfg.func_mf_config[func].config);
+                        addr = mf_cfg_addr +
+                                offsetof(struct mf_cfg,
+                                         func_mf_config[func].config);
                         val = CNIC_RD(dev, addr);
                         val &= FUNC_MF_CFG_PROTOCOL_MASK;
                         if (val != FUNC_MF_CFG_PROTOCOL_ISCSI)
@@ -4124,10 +4308,26 @@ static void cnic_get_bnx2x_iscsi_info(struct cnic_dev *dev)
 static int cnic_start_bnx2x_hw(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_eth_dev *ethdev = cp->ethdev;
         int func = CNIC_FUNC(cp), ret, i;
-        int port = CNIC_PORT(cp);
-        u16 eq_idx;
-        u8 sb_id = cp->status_blk_num;
+        u32 pfid;
+
+        if (BNX2X_CHIP_IS_E2(cp->chip_id)) {
+                u32 val = CNIC_RD(dev, MISC_REG_PORT4MODE_EN_OVWR);
+
+                if (!(val & 1))
+                        val = CNIC_RD(dev, MISC_REG_PORT4MODE_EN);
+                else
+                        val = (val >> 1) & 1;
+
+                if (val)
+                        cp->pfid = func >> 1;
+                else
+                        cp->pfid = func & 0x6;
+        } else {
+                cp->pfid = func;
+        }
+        pfid = cp->pfid;
 
         ret = cnic_init_id_tbl(&cp->cid_tbl, MAX_ISCSI_TBL_SZ,
                                cp->iscsi_start_cid);
@@ -4135,86 +4335,98 @@ static int cnic_start_bnx2x_hw(struct cnic_dev *dev)
         if (ret)
                 return -ENOMEM;
 
+        cp->bnx2x_igu_sb_id = ethdev->irq_arr[0].status_blk_num2;
+
         cp->kcq1.io_addr = BAR_CSTRORM_INTMEM +
-                          CSTORM_ISCSI_EQ_PROD_OFFSET(func, 0);
+                          CSTORM_ISCSI_EQ_PROD_OFFSET(pfid, 0);
         cp->kcq1.sw_prod_idx = 0;
 
-        cp->kcq1.hw_prod_idx_ptr =
-                &cp->status_blk.bnx2x->c_status_block.index_values[
-                        HC_INDEX_C_ISCSI_EQ_CONS];
-        cp->kcq1.status_idx_ptr =
-                &cp->status_blk.bnx2x->c_status_block.status_block_index;
+        if (BNX2X_CHIP_IS_E2(cp->chip_id)) {
+                struct host_hc_status_block_e2 *sb = cp->status_blk.gen;
+
+                cp->kcq1.hw_prod_idx_ptr =
+                        &sb->sb.index_values[HC_INDEX_ISCSI_EQ_CONS];
+                cp->kcq1.status_idx_ptr =
+                        &sb->sb.running_index[SM_RX_ID];
+        } else {
+                struct host_hc_status_block_e1x *sb = cp->status_blk.gen;
+
+                cp->kcq1.hw_prod_idx_ptr =
+                        &sb->sb.index_values[HC_INDEX_ISCSI_EQ_CONS];
+                cp->kcq1.status_idx_ptr =
+                        &sb->sb.running_index[SM_RX_ID];
+        }
 
         cnic_get_bnx2x_iscsi_info(dev);
 
         /* Only 1 EQ */
         CNIC_WR16(dev, cp->kcq1.io_addr, MAX_KCQ_IDX);
         CNIC_WR(dev, BAR_CSTRORM_INTMEM +
-                CSTORM_ISCSI_EQ_CONS_OFFSET(func, 0), 0);
+                CSTORM_ISCSI_EQ_CONS_OFFSET(pfid, 0), 0);
         CNIC_WR(dev, BAR_CSTRORM_INTMEM +
-                CSTORM_ISCSI_EQ_NEXT_PAGE_ADDR_OFFSET(func, 0),
+                CSTORM_ISCSI_EQ_NEXT_PAGE_ADDR_OFFSET(pfid, 0),
                 cp->kcq1.dma.pg_map_arr[1] & 0xffffffff);
         CNIC_WR(dev, BAR_CSTRORM_INTMEM +
-                CSTORM_ISCSI_EQ_NEXT_PAGE_ADDR_OFFSET(func, 0) + 4,
+                CSTORM_ISCSI_EQ_NEXT_PAGE_ADDR_OFFSET(pfid, 0) + 4,
                 (u64) cp->kcq1.dma.pg_map_arr[1] >> 32);
         CNIC_WR(dev, BAR_CSTRORM_INTMEM +
-                CSTORM_ISCSI_EQ_NEXT_EQE_ADDR_OFFSET(func, 0),
+                CSTORM_ISCSI_EQ_NEXT_EQE_ADDR_OFFSET(pfid, 0),
                 cp->kcq1.dma.pg_map_arr[0] & 0xffffffff);
         CNIC_WR(dev, BAR_CSTRORM_INTMEM +
-                CSTORM_ISCSI_EQ_NEXT_EQE_ADDR_OFFSET(func, 0) + 4,
+                CSTORM_ISCSI_EQ_NEXT_EQE_ADDR_OFFSET(pfid, 0) + 4,
                 (u64) cp->kcq1.dma.pg_map_arr[0] >> 32);
         CNIC_WR8(dev, BAR_CSTRORM_INTMEM +
-                CSTORM_ISCSI_EQ_NEXT_PAGE_ADDR_VALID_OFFSET(func, 0), 1);
+                CSTORM_ISCSI_EQ_NEXT_PAGE_ADDR_VALID_OFFSET(pfid, 0), 1);
         CNIC_WR16(dev, BAR_CSTRORM_INTMEM +
-                CSTORM_ISCSI_EQ_SB_NUM_OFFSET(func, 0), cp->status_blk_num);
+                CSTORM_ISCSI_EQ_SB_NUM_OFFSET(pfid, 0), cp->status_blk_num);
         CNIC_WR8(dev, BAR_CSTRORM_INTMEM +
-                CSTORM_ISCSI_EQ_SB_INDEX_OFFSET(func, 0),
-                HC_INDEX_C_ISCSI_EQ_CONS);
+                CSTORM_ISCSI_EQ_SB_INDEX_OFFSET(pfid, 0),
+                HC_INDEX_ISCSI_EQ_CONS);
 
         for (i = 0; i < cp->conn_buf_info.num_pages; i++) {
                 CNIC_WR(dev, BAR_TSTRORM_INTMEM +
-                        TSTORM_ISCSI_CONN_BUF_PBL_OFFSET(func, i),
+                        TSTORM_ISCSI_CONN_BUF_PBL_OFFSET(pfid, i),
                         cp->conn_buf_info.pgtbl[2 * i]);
                 CNIC_WR(dev, BAR_TSTRORM_INTMEM +
-                        TSTORM_ISCSI_CONN_BUF_PBL_OFFSET(func, i) + 4,
+                        TSTORM_ISCSI_CONN_BUF_PBL_OFFSET(pfid, i) + 4,
                         cp->conn_buf_info.pgtbl[(2 * i) + 1]);
         }
 
         CNIC_WR(dev, BAR_USTRORM_INTMEM +
-                USTORM_ISCSI_GLOBAL_BUF_PHYS_ADDR_OFFSET(func),
+                USTORM_ISCSI_GLOBAL_BUF_PHYS_ADDR_OFFSET(pfid),
                 cp->gbl_buf_info.pg_map_arr[0] & 0xffffffff);
         CNIC_WR(dev, BAR_USTRORM_INTMEM +
-                USTORM_ISCSI_GLOBAL_BUF_PHYS_ADDR_OFFSET(func) + 4,
+                USTORM_ISCSI_GLOBAL_BUF_PHYS_ADDR_OFFSET(pfid) + 4,
                 (u64) cp->gbl_buf_info.pg_map_arr[0] >> 32);
 
+        CNIC_WR(dev, BAR_TSTRORM_INTMEM +
+                TSTORM_ISCSI_TCP_LOCAL_ADV_WND_OFFSET(pfid), DEF_RCV_BUF);
+
         cnic_setup_bnx2x_context(dev);
 
-        eq_idx = CNIC_RD16(dev, BAR_CSTRORM_INTMEM +
-                           CSTORM_SB_HOST_STATUS_BLOCK_C_OFFSET(port, sb_id) +
-                           offsetof(struct cstorm_status_block_c,
-                                    index_values[HC_INDEX_C_ISCSI_EQ_CONS]));
-        if (eq_idx != 0) {
-                netdev_err(dev->netdev, "EQ cons index %x != 0\n", eq_idx);
-                return -EBUSY;
-        }
         ret = cnic_init_bnx2x_irq(dev);
         if (ret)
                 return ret;
 
-        cnic_init_bnx2x_tx_ring(dev);
-        cnic_init_bnx2x_rx_ring(dev);
-
         return 0;
 }
 
 static void cnic_init_rings(struct cnic_dev *dev)
 {
+        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_uio_dev *udev = cp->udev;
+
+        if (test_bit(CNIC_LCL_FL_RINGS_INITED, &cp->cnic_local_flags))
+                return;
+
         if (test_bit(CNIC_F_BNX2_CLASS, &dev->flags)) {
                 cnic_init_bnx2_tx_ring(dev);
                 cnic_init_bnx2_rx_ring(dev);
+                set_bit(CNIC_LCL_FL_RINGS_INITED, &cp->cnic_local_flags);
         } else if (test_bit(CNIC_F_BNX2X_CLASS, &dev->flags)) {
-                struct cnic_local *cp = dev->cnic_priv;
                 u32 cli = BNX2X_ISCSI_CL_ID(CNIC_E1HVN(cp));
+                u32 cl_qzone_id, type;
+                struct client_init_ramrod_data *data;
                 union l5cm_specific_data l5_data;
                 struct ustorm_eth_rx_producers rx_prods = {0};
                 u32 off, i;
@@ -4223,21 +4435,38 @@ static void cnic_init_rings(struct cnic_dev *dev)
                 rx_prods.cqe_prod = BNX2X_MAX_RCQ_DESC_CNT;
                 barrier();
 
+                cl_qzone_id = BNX2X_CL_QZONE_ID(cp, cli);
+
                 off = BAR_USTRORM_INTMEM +
-                        USTORM_RX_PRODS_OFFSET(CNIC_PORT(cp), cli);
+                        (BNX2X_CHIP_IS_E2(cp->chip_id) ?
+                         USTORM_RX_PRODS_E2_OFFSET(cl_qzone_id) :
+                         USTORM_RX_PRODS_E1X_OFFSET(CNIC_PORT(cp), cli));
 
                 for (i = 0; i < sizeof(struct ustorm_eth_rx_producers) / 4; i++)
                         CNIC_WR(dev, off + i * 4, ((u32 *) &rx_prods)[i]);
 
                 set_bit(CNIC_LCL_FL_L2_WAIT, &cp->cnic_local_flags);
 
-                cnic_init_bnx2x_tx_ring(dev);
-                cnic_init_bnx2x_rx_ring(dev);
+                data = udev->l2_buf;
+
+                memset(data, 0, sizeof(*data));
+
+                cnic_init_bnx2x_tx_ring(dev, data);
+                cnic_init_bnx2x_rx_ring(dev, data);
+
+                l5_data.phy_address.lo = udev->l2_buf_map & 0xffffffff;
+                l5_data.phy_address.hi = (u64) udev->l2_buf_map >> 32;
+
+                type = (ETH_CONNECTION_TYPE << SPE_HDR_CONN_TYPE_SHIFT)
+                        & SPE_HDR_CONN_TYPE;
+                type |= ((cp->pfid << SPE_HDR_FUNCTION_ID_SHIFT) &
+                        SPE_HDR_FUNCTION_ID);
+
+                set_bit(CNIC_LCL_FL_RINGS_INITED, &cp->cnic_local_flags);
 
-                l5_data.phy_address.lo = cli;
-                l5_data.phy_address.hi = 0;
                 cnic_submit_kwqe_16(dev, RAMROD_CMD_ID_ETH_CLIENT_SETUP,
-                        BNX2X_ISCSI_L2_CID, ETH_CONNECTION_TYPE, &l5_data);
+                        BNX2X_ISCSI_L2_CID, type, &l5_data);
+
                 i = 0;
                 while (test_bit(CNIC_LCL_FL_L2_WAIT, &cp->cnic_local_flags) &&
                        ++i < 10)
@@ -4246,13 +4475,18 @@ static void cnic_init_rings(struct cnic_dev *dev)
                 if (test_bit(CNIC_LCL_FL_L2_WAIT, &cp->cnic_local_flags))
                         netdev_err(dev->netdev,
                                 "iSCSI CLIENT_SETUP did not complete\n");
-                cnic_kwq_completion(dev, 1);
+                cnic_spq_completion(dev, DRV_CTL_RET_L2_SPQ_CREDIT_CMD, 1);
                 cnic_ring_ctl(dev, BNX2X_ISCSI_L2_CID, cli, 1);
         }
 }
 
 static void cnic_shutdown_rings(struct cnic_dev *dev)
 {
+        struct cnic_local *cp = dev->cnic_priv;
+
+        if (!test_bit(CNIC_LCL_FL_RINGS_INITED, &cp->cnic_local_flags))
+                return;
+
         if (test_bit(CNIC_F_BNX2_CLASS, &dev->flags)) {
                 cnic_shutdown_bnx2_rx_ring(dev);
         } else if (test_bit(CNIC_F_BNX2X_CLASS, &dev->flags)) {
@@ -4260,6 +4494,7 @@ static void cnic_shutdown_rings(struct cnic_dev *dev)
                 u32 cli = BNX2X_ISCSI_CL_ID(CNIC_E1HVN(cp));
                 union l5cm_specific_data l5_data;
                 int i;
+                u32 type;
 
                 cnic_ring_ctl(dev, BNX2X_ISCSI_L2_CID, cli, 0);
 
@@ -4277,14 +4512,18 @@ static void cnic_shutdown_rings(struct cnic_dev *dev)
                 if (test_bit(CNIC_LCL_FL_L2_WAIT, &cp->cnic_local_flags))
                         netdev_err(dev->netdev,
                                 "iSCSI CLIENT_HALT did not complete\n");
-                cnic_kwq_completion(dev, 1);
+                cnic_spq_completion(dev, DRV_CTL_RET_L2_SPQ_CREDIT_CMD, 1);
 
                 memset(&l5_data, 0, sizeof(l5_data));
-                cnic_submit_kwqe_16(dev, RAMROD_CMD_ID_ETH_CFC_DEL,
-                        BNX2X_ISCSI_L2_CID, ETH_CONNECTION_TYPE |
-                        (1 << SPE_HDR_COMMON_RAMROD_SHIFT), &l5_data);
+                type = (NONE_CONNECTION_TYPE << SPE_HDR_CONN_TYPE_SHIFT)
+                        & SPE_HDR_CONN_TYPE;
+                type |= ((cp->pfid << SPE_HDR_FUNCTION_ID_SHIFT) &
+                         SPE_HDR_FUNCTION_ID);
+                cnic_submit_kwqe_16(dev, RAMROD_CMD_ID_COMMON_CFC_DEL,
+                        BNX2X_ISCSI_L2_CID, type, &l5_data);
                 msleep(10);
         }
+        clear_bit(CNIC_LCL_FL_RINGS_INITED, &cp->cnic_local_flags);
 }
 
 static int cnic_register_netdev(struct cnic_dev *dev)
@@ -4327,7 +4566,6 @@ static int cnic_start_hw(struct cnic_dev *dev)
                 return -EALREADY;
 
         dev->regview = ethdev->io_base;
-        cp->chip_id = ethdev->chip_id;
         pci_dev_get(dev->pcidev);
         cp->func = PCI_FUNC(dev->pcidev->devfn);
         cp->status_blk.gen = ethdev->irq_arr[0].status_blk;
@@ -4379,17 +4617,11 @@ static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
 static void cnic_stop_bnx2x_hw(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
-        u8 sb_id = cp->status_blk_num;
-        int port = CNIC_PORT(cp);
 
         cnic_free_irq(dev);
-        CNIC_WR16(dev, BAR_CSTRORM_INTMEM +
-                  CSTORM_SB_HOST_STATUS_BLOCK_C_OFFSET(port, sb_id) +
-                  offsetof(struct cstorm_status_block_c,
-                           index_values[HC_INDEX_C_ISCSI_EQ_CONS]),
-                  0);
+        *cp->kcq1.hw_prod_idx_ptr = 0;
         CNIC_WR(dev, BAR_CSTRORM_INTMEM +
-                CSTORM_ISCSI_EQ_CONS_OFFSET(cp->func, 0), 0);
+                CSTORM_ISCSI_EQ_CONS_OFFSET(cp->pfid, 0), 0);
         CNIC_WR16(dev, cp->kcq1.io_addr, 0);
         cnic_free_resc(dev);
 }
@@ -4403,10 +4635,11 @@ static void cnic_stop_hw(struct cnic_dev *dev)
                 /* Need to wait for the ring shutdown event to complete
                  * before clearing the CNIC_UP flag.
                  */
-                while (cp->uio_dev != -1 && i < 15) {
+                while (cp->udev->uio_dev != -1 && i < 15) {
                         msleep(100);
                         i++;
                 }
+                cnic_shutdown_rings(dev);
                 clear_bit(CNIC_F_CNIC_UP, &dev->flags);
                 rcu_assign_pointer(cp->ulp_ops[CNIC_ULP_L4], NULL);
                 synchronize_rcu();
@@ -4455,7 +4688,6 @@ static struct cnic_dev *cnic_alloc_dev(struct net_device *dev,
 
         cp = cdev->cnic_priv;
         cp->dev = cdev;
-        cp->uio_dev = -1;
         cp->l2_single_buf_size = 0x400;
         cp->l2_rx_ring_size = 3;
 
@@ -4510,6 +4742,7 @@ static struct cnic_dev *init_bnx2_cnic(struct net_device *dev)
         cp = cdev->cnic_priv;
         cp->ethdev = ethdev;
         cdev->pcidev = pdev;
+        cp->chip_id = ethdev->chip_id;
 
         cp->cnic_ops = &cnic_bnx2_ops;
         cp->start_hw = cnic_start_bnx2_hw;
@@ -4564,6 +4797,7 @@ static struct cnic_dev *init_bnx2x_cnic(struct net_device *dev)
         cp = cdev->cnic_priv;
         cp->ethdev = ethdev;
         cdev->pcidev = pdev;
+        cp->chip_id = ethdev->chip_id;
 
         cp->cnic_ops = &cnic_bnx2x_ops;
         cp->start_hw = cnic_start_bnx2x_hw;
@@ -4575,7 +4809,10 @@ static struct cnic_dev *init_bnx2x_cnic(struct net_device *dev)
         cp->stop_cm = cnic_cm_stop_bnx2x_hw;
         cp->enable_int = cnic_enable_bnx2x_int;
         cp->disable_int_sync = cnic_disable_bnx2x_int_sync;
-        cp->ack_int = cnic_ack_bnx2x_msix;
+        if (BNX2X_CHIP_IS_E2(cp->chip_id))
+                cp->ack_int = cnic_ack_bnx2x_e2_msix;
+        else
+                cp->ack_int = cnic_ack_bnx2x_msix;
         cp->close_conn = cnic_close_bnx2x_conn;
         cp->next_idx = cnic_bnx2x_next_idx;
         cp->hw_idx = cnic_bnx2x_hw_idx;
@@ -4683,6 +4920,7 @@ static struct notifier_block cnic_netdev_notifier = {
 static void cnic_release(void)
 {
         struct cnic_dev *dev;
+        struct cnic_uio_dev *udev;
 
         while (!list_empty(&cnic_dev_list)) {
                 dev = list_entry(cnic_dev_list.next, struct cnic_dev, list);
@@ -4696,6 +4934,11 @@ static void cnic_release(void)
                 list_del_init(&dev->list);
                 cnic_free_dev(dev);
         }
+        while (!list_empty(&cnic_udev_list)) {
+                udev = list_entry(cnic_udev_list.next, struct cnic_uio_dev,
+                                  list);
+                cnic_free_uio(udev);
+        }
 }
 
 static int __init cnic_init(void)
@@ -4710,6 +4953,13 @@ static int __init cnic_init(void)
                 return rc;
         }
 
+        cnic_wq = create_singlethread_workqueue("cnic_wq");
+        if (!cnic_wq) {
+                cnic_release();
+                unregister_netdevice_notifier(&cnic_netdev_notifier);
+                return -ENOMEM;
+        }
+
         return 0;
 }
 
@@ -4717,6 +4967,7 @@ static void __exit cnic_exit(void)
 {
         unregister_netdevice_notifier(&cnic_netdev_notifier);
         cnic_release();
+        destroy_workqueue(cnic_wq);
 }
 
 module_init(cnic_init);
diff --git a/drivers/net/cnic.h b/drivers/net/cnic.h
index 275c36114d85..6a4a0ae5cfe3 100644
--- a/drivers/net/cnic.h
+++ b/drivers/net/cnic.h
@@ -12,6 +12,13 @@
 #ifndef CNIC_H
 #define CNIC_H
 
+#define HC_INDEX_ISCSI_EQ_CONS                  6
+
+#define HC_INDEX_FCOE_EQ_CONS                   3
+
+#define HC_SP_INDEX_ETH_ISCSI_CQ_CONS           5
+#define HC_SP_INDEX_ETH_ISCSI_RX_CQ_CONS        1
+
 #define KWQ_PAGE_CNT    4
 #define KCQ_PAGE_CNT    16
 
@@ -161,8 +168,9 @@ struct cnic_context {
         wait_queue_head_t       waitq;
         int                     wait_cond;
         unsigned long           timestamp;
-        u32                     ctx_flags;
-#define CTX_FL_OFFLD_START      0x00000001
+        unsigned long           ctx_flags;
+#define CTX_FL_OFFLD_START      0
+#define CTX_FL_DELETE_WAIT      1
         u8                      ulp_proto_id;
         union {
                 struct cnic_iscsi       *iscsi;
@@ -179,6 +187,31 @@ struct kcq_info {
         u32             io_addr;
 };
 
+struct iro {
+        u32 base;
+        u16 m1;
+        u16 m2;
+        u16 m3;
+        u16 size;
+};
+
+struct cnic_uio_dev {
+        struct uio_info         cnic_uinfo;
+        u32                     uio_dev;
+
+        int                     l2_ring_size;
+        void                    *l2_ring;
+        dma_addr_t              l2_ring_map;
+
+        int                     l2_buf_size;
+        void                    *l2_buf;
+        dma_addr_t              l2_buf_map;
+
+        struct cnic_dev         *dev;
+        struct pci_dev          *pdev;
+        struct list_head        list;
+};
+
 struct cnic_local {
 
         spinlock_t cnic_ulp_lock;
@@ -192,19 +225,15 @@ struct cnic_local {
         unsigned long cnic_local_flags;
 #define CNIC_LCL_FL_KWQ_INIT            0x0
 #define CNIC_LCL_FL_L2_WAIT             0x1
+#define CNIC_LCL_FL_RINGS_INITED        0x2
 
         struct cnic_dev *dev;
 
         struct cnic_eth_dev *ethdev;
 
-        void            *l2_ring;
-        dma_addr_t      l2_ring_map;
-        int             l2_ring_size;
-        int             l2_rx_ring_size;
+        struct cnic_uio_dev *udev;
 
-        void            *l2_buf;
-        dma_addr_t      l2_buf_map;
-        int             l2_buf_size;
+        int             l2_rx_ring_size;
         int             l2_single_buf_size;
 
         u16             *rx_cons_ptr;
@@ -212,6 +241,9 @@ struct cnic_local {
         u16             rx_cons;
         u16             tx_cons;
 
+        struct iro              *iro_arr;
+#define IRO (((struct cnic_local *) dev->cnic_priv)->iro_arr)
+
         struct cnic_dma         kwq_info;
         struct kwqe             **kwq;
 
@@ -230,12 +262,16 @@ struct cnic_local {
         union {
                 void                            *gen;
                 struct status_block_msix        *bnx2;
-                struct host_status_block        *bnx2x;
+                struct host_hc_status_block_e1x *bnx2x_e1x;
+                /* index values - which counter to update */
+                #define SM_RX_ID                0
+                #define SM_TX_ID                1
         } status_blk;
 
-        struct host_def_status_block    *bnx2x_def_status_blk;
+        struct host_sp_status_block     *bnx2x_def_status_blk;
 
         u32                             status_blk_num;
+        u32                             bnx2x_igu_sb_id;
         u32                             int_num;
         u32                             last_status_idx;
         struct tasklet_struct           cnic_irq_task;
@@ -264,6 +300,8 @@ struct cnic_local {
         int                     hq_size;
         int                     num_cqs;
 
+        struct delayed_work     delete_task;
+
         struct cnic_ctx         *ctx_arr;
         int                     ctx_blks;
         int                     ctx_blk_size;
@@ -272,11 +310,9 @@ struct cnic_local {
 
         u32                     chip_id;
         int                     func;
+        u32                     pfid;
         u32                     shmem_base;
 
-        u32                     uio_dev;
-        struct uio_info         *cnic_uinfo;
-
         struct cnic_ops         *cnic_ops;
         int                     (*start_hw)(struct cnic_dev *);
         void                    (*stop_hw)(struct cnic_dev *);
@@ -335,18 +371,36 @@ struct bnx2x_bd_chain_next {
 #define BNX2X_ISCSI_GLB_BUF_SIZE        64
 #define BNX2X_ISCSI_PBL_NOT_CACHED      0xff
 #define BNX2X_ISCSI_PDU_HEADER_NOT_CACHED       0xff
-#define BNX2X_HW_CID(x, func)           ((x) | (((func) % PORT_MAX) << 23) | \
-                                         (((func) >> 1) << 17))
-#define BNX2X_SW_CID(x)                 (x & 0x1ffff)
+
+#define BNX2X_CHIP_NUM_57710            0x164e
 #define BNX2X_CHIP_NUM_57711            0x164f
 #define BNX2X_CHIP_NUM_57711E           0x1650
+#define BNX2X_CHIP_NUM_57712            0x1662
+#define BNX2X_CHIP_NUM_57712E           0x1663
+#define BNX2X_CHIP_NUM_57713            0x1651
+#define BNX2X_CHIP_NUM_57713E           0x1652
+
 #define BNX2X_CHIP_NUM(x)               (x >> 16)
+#define BNX2X_CHIP_IS_57710(x)          \
+        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57710)
 #define BNX2X_CHIP_IS_57711(x)          \
         (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57711)
 #define BNX2X_CHIP_IS_57711E(x)         \
         (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57711E)
 #define BNX2X_CHIP_IS_E1H(x)            \
         (BNX2X_CHIP_IS_57711(x) || BNX2X_CHIP_IS_57711E(x))
+#define BNX2X_CHIP_IS_57712(x)          \
+        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57712)
+#define BNX2X_CHIP_IS_57712E(x)         \
+        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57712E)
+#define BNX2X_CHIP_IS_57713(x)          \
+        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57713)
+#define BNX2X_CHIP_IS_57713E(x)         \
+        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57713E)
+#define BNX2X_CHIP_IS_E2(x)             \
+        (BNX2X_CHIP_IS_57712(x) || BNX2X_CHIP_IS_57712E(x) || \
+         BNX2X_CHIP_IS_57713(x) || BNX2X_CHIP_IS_57713E(x))
+
 #define IS_E1H_OFFSET                   BNX2X_CHIP_IS_E1H(cp->chip_id)
 
 #define BNX2X_RX_DESC_CNT               (BCM_PAGE_SIZE / sizeof(struct eth_rx_bd))
@@ -358,19 +412,35 @@ struct bnx2x_bd_chain_next {
                 (BNX2X_MAX_RCQ_DESC_CNT - 1)) ?                         \
                 ((x) + 2) : ((x) + 1)
 
-#define BNX2X_DEF_SB_ID                 16
+#define BNX2X_DEF_SB_ID                 HC_SP_SB_ID
 
-#define BNX2X_ISCSI_RX_SB_INDEX_NUM                                     \
-                ((HC_INDEX_DEF_U_ETH_ISCSI_RX_CQ_CONS << \
-                  USTORM_ETH_ST_CONTEXT_CONFIG_CQE_SB_INDEX_NUMBER_SHIFT) & \
-                 USTORM_ETH_ST_CONTEXT_CONFIG_CQE_SB_INDEX_NUMBER)
+#define BNX2X_SHMEM_MF_BLK_OFFSET       0x7e4
 
 #define BNX2X_SHMEM_ADDR(base, field)   (base + \
                                          offsetof(struct shmem_region, field))
 
-#define CNIC_PORT(cp)                   ((cp)->func % PORT_MAX)
+#define BNX2X_SHMEM2_ADDR(base, field)  (base + \
+                                         offsetof(struct shmem2_region, field))
+
+#define BNX2X_SHMEM2_HAS(base, field)                           \
+                ((base) &&                                      \
+                 (CNIC_RD(dev, BNX2X_SHMEM2_ADDR(base, size)) > \
+                  offsetof(struct shmem2_region, field)))
+
+#define CNIC_PORT(cp)                   ((cp)->pfid & 1)
 #define CNIC_FUNC(cp)                   ((cp)->func)
-#define CNIC_E1HVN(cp)                  ((cp)->func >> 1)
+#define CNIC_PATH(cp)                   (!BNX2X_CHIP_IS_E2(cp->chip_id) ? 0 :\
+                                         (CNIC_FUNC(cp) & 1))
+#define CNIC_E1HVN(cp)                  ((cp)->pfid >> 1)
+
+#define BNX2X_HW_CID(cp, x)             ((CNIC_PORT(cp) << 23) | \
+                                         (CNIC_E1HVN(cp) << 17) | (x))
+
+#define BNX2X_SW_CID(x)                 (x & 0x1ffff)
+
+#define BNX2X_CL_QZONE_ID(cp, cli)                                      \
+                (cli + (CNIC_PORT(cp) * ETH_MAX_RX_CLIENTS_E1H))
 
+#define TCP_TSTORM_OOO_DROP_AND_PROC_ACK        (0<<4)
 #endif
 
diff --git a/drivers/net/cnic_defs.h b/drivers/net/cnic_defs.h
index 7ce694d41b6b..328e8b2765a3 100644
--- a/drivers/net/cnic_defs.h
+++ b/drivers/net/cnic_defs.h
@@ -14,6 +14,7 @@
 
 /* KWQ (kernel work queue) request op codes */
 #define L2_KWQE_OPCODE_VALUE_FLUSH                  (4)
+#define L2_KWQE_OPCODE_VALUE_VM_FREE_RX_QUEUE       (8)
 
 #define L4_KWQE_OPCODE_VALUE_CONNECT1               (50)
 #define L4_KWQE_OPCODE_VALUE_CONNECT2               (51)
@@ -48,11 +49,14 @@
 #define L4_KCQE_OPCODE_VALUE_UPLOAD_PG              (14)
 
 /* KCQ (kernel completion queue) completion status */
-#define L4_KCQE_COMPLETION_STATUS_SUCCESS                   (0)
-#define L4_KCQE_COMPLETION_STATUS_TIMEOUT        (0x93)
+#define L4_KCQE_COMPLETION_STATUS_SUCCESS           (0)
+#define L4_KCQE_COMPLETION_STATUS_TIMEOUT           (0x93)
 
-#define L4_KCQE_COMPLETION_STATUS_CTX_ALLOC_FAIL (0x83)
-#define L4_KCQE_COMPLETION_STATUS_OFFLOADED_PG   (0x89)
+#define L4_KCQE_COMPLETION_STATUS_CTX_ALLOC_FAIL    (0x83)
+#define L4_KCQE_COMPLETION_STATUS_OFFLOADED_PG      (0x89)
+
+#define L4_KCQE_OPCODE_VALUE_OOO_EVENT_NOTIFICATION (0xa0)
+#define L4_KCQE_OPCODE_VALUE_OOO_FLUSH              (0xa1)
 
 #define L4_LAYER_CODE (4)
 #define L2_LAYER_CODE (2)
@@ -585,6 +589,100 @@ struct l4_kwq_upload {
  */
 
 /*
+ * The iscsi aggregative context of Cstorm
+ */
+struct cstorm_iscsi_ag_context {
+        u32 agg_vars1;
+#define CSTORM_ISCSI_AG_CONTEXT_STATE (0xFF<<0)
+#define CSTORM_ISCSI_AG_CONTEXT_STATE_SHIFT 0
+#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM0 (0x1<<8)
+#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM0_SHIFT 8
+#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM1 (0x1<<9)
+#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM1_SHIFT 9
+#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM2 (0x1<<10)
+#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM2_SHIFT 10
+#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM3 (0x1<<11)
+#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM3_SHIFT 11
+#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED_ULP_RX_SE_CF_EN (0x1<<12)
+#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED_ULP_RX_SE_CF_EN_SHIFT 12
+#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED_ULP_RX_INV_CF_EN (0x1<<13)
+#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED_ULP_RX_INV_CF_EN_SHIFT 13
+#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION3_CF (0x3<<14)
+#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION3_CF_SHIFT 14
+#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED66 (0x3<<16)
+#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED66_SHIFT 16
+#define __CSTORM_ISCSI_AG_CONTEXT_FIN_RECEIVED_CF_EN (0x1<<18)
+#define __CSTORM_ISCSI_AG_CONTEXT_FIN_RECEIVED_CF_EN_SHIFT 18
+#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION0_CF_EN (0x1<<19)
+#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION0_CF_EN_SHIFT 19
+#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION1_CF_EN (0x1<<20)
+#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION1_CF_EN_SHIFT 20
+#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION2_CF_EN (0x1<<21)
+#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION2_CF_EN_SHIFT 21
+#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION3_CF_EN (0x1<<22)
+#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION3_CF_EN_SHIFT 22
+#define __CSTORM_ISCSI_AG_CONTEXT_REL_SEQ_RULE (0x7<<23)
+#define __CSTORM_ISCSI_AG_CONTEXT_REL_SEQ_RULE_SHIFT 23
+#define CSTORM_ISCSI_AG_CONTEXT_HQ_PROD_RULE (0x3<<26)
+#define CSTORM_ISCSI_AG_CONTEXT_HQ_PROD_RULE_SHIFT 26
+#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED52 (0x3<<28)
+#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED52_SHIFT 28
+#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED53 (0x3<<30)
+#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED53_SHIFT 30
+#if defined(__BIG_ENDIAN)
+        u8 __aux1_th;
+        u8 __aux1_val;
+        u16 __agg_vars2;
+#elif defined(__LITTLE_ENDIAN)
+        u16 __agg_vars2;
+        u8 __aux1_val;
+        u8 __aux1_th;
+#endif
+        u32 rel_seq;
+        u32 rel_seq_th;
+#if defined(__BIG_ENDIAN)
+        u16 hq_cons;
+        u16 hq_prod;
+#elif defined(__LITTLE_ENDIAN)
+        u16 hq_prod;
+        u16 hq_cons;
+#endif
+#if defined(__BIG_ENDIAN)
+        u8 __reserved62;
+        u8 __reserved61;
+        u8 __reserved60;
+        u8 __reserved59;
+#elif defined(__LITTLE_ENDIAN)
+        u8 __reserved59;
+        u8 __reserved60;
+        u8 __reserved61;
+        u8 __reserved62;
+#endif
+#if defined(__BIG_ENDIAN)
+        u16 __reserved64;
+        u16 __cq_u_prod0;
+#elif defined(__LITTLE_ENDIAN)
+        u16 __cq_u_prod0;
+        u16 __reserved64;
+#endif
+        u32 __cq_u_prod1;
+#if defined(__BIG_ENDIAN)
+        u16 __agg_vars3;
+        u16 __cq_u_prod2;
+#elif defined(__LITTLE_ENDIAN)
+        u16 __cq_u_prod2;
+        u16 __agg_vars3;
+#endif
+#if defined(__BIG_ENDIAN)
+        u16 __aux2_th;
+        u16 __cq_u_prod3;
+#elif defined(__LITTLE_ENDIAN)
+        u16 __cq_u_prod3;
+        u16 __aux2_th;
+#endif
+};
+
+/*
  * iSCSI context region, used only in iSCSI
  */
 struct ustorm_iscsi_rq_db {
@@ -696,7 +794,7 @@ struct ustorm_iscsi_st_context {
         struct regpair task_pbl_base;
         struct regpair tce_phy_addr;
         struct ustorm_iscsi_placement_db place_db;
-        u32 data_rcv_seq;
+        u32 reserved8;
         u32 rem_rcv_len;
 #if defined(__BIG_ENDIAN)
         u16 hdr_itt;
@@ -713,8 +811,10 @@ struct ustorm_iscsi_st_context {
 #define USTORM_ISCSI_ST_CONTEXT_BMIDDLEOFPDU_SHIFT 0
 #define USTORM_ISCSI_ST_CONTEXT_BFENCECQE (0x1<<1)
 #define USTORM_ISCSI_ST_CONTEXT_BFENCECQE_SHIFT 1
-#define USTORM_ISCSI_ST_CONTEXT_RESERVED1 (0x3F<<2)
-#define USTORM_ISCSI_ST_CONTEXT_RESERVED1_SHIFT 2
+#define USTORM_ISCSI_ST_CONTEXT_BRESETCRC (0x1<<2)
+#define USTORM_ISCSI_ST_CONTEXT_BRESETCRC_SHIFT 2
+#define USTORM_ISCSI_ST_CONTEXT_RESERVED1 (0x1F<<3)
+#define USTORM_ISCSI_ST_CONTEXT_RESERVED1_SHIFT 3
         u8 task_pdu_cache_index;
         u8 task_pbe_cache_index;
 #elif defined(__LITTLE_ENDIAN)
@@ -725,8 +825,10 @@ struct ustorm_iscsi_st_context {
 #define USTORM_ISCSI_ST_CONTEXT_BMIDDLEOFPDU_SHIFT 0
 #define USTORM_ISCSI_ST_CONTEXT_BFENCECQE (0x1<<1)
 #define USTORM_ISCSI_ST_CONTEXT_BFENCECQE_SHIFT 1
-#define USTORM_ISCSI_ST_CONTEXT_RESERVED1 (0x3F<<2)
-#define USTORM_ISCSI_ST_CONTEXT_RESERVED1_SHIFT 2
+#define USTORM_ISCSI_ST_CONTEXT_BRESETCRC (0x1<<2)
+#define USTORM_ISCSI_ST_CONTEXT_BRESETCRC_SHIFT 2
+#define USTORM_ISCSI_ST_CONTEXT_RESERVED1 (0x1F<<3)
+#define USTORM_ISCSI_ST_CONTEXT_RESERVED1_SHIFT 3
         u8 hdr_second_byte_union;
 #endif
 #if defined(__BIG_ENDIAN)
@@ -777,14 +879,14 @@ struct ustorm_iscsi_st_context {
  */
 struct tstorm_tcp_st_context_section {
         u32 flags1;
-#define TSTORM_TCP_ST_CONTEXT_SECTION_RTT_SRTT_20B (0xFFFFFF<<0)
-#define TSTORM_TCP_ST_CONTEXT_SECTION_RTT_SRTT_20B_SHIFT 0
+#define TSTORM_TCP_ST_CONTEXT_SECTION_RTT_SRTT (0xFFFFFF<<0)
+#define TSTORM_TCP_ST_CONTEXT_SECTION_RTT_SRTT_SHIFT 0
 #define TSTORM_TCP_ST_CONTEXT_SECTION_PAWS_INVALID (0x1<<24)
 #define TSTORM_TCP_ST_CONTEXT_SECTION_PAWS_INVALID_SHIFT 24
 #define TSTORM_TCP_ST_CONTEXT_SECTION_TIMESTAMP_EXISTS (0x1<<25)
 #define TSTORM_TCP_ST_CONTEXT_SECTION_TIMESTAMP_EXISTS_SHIFT 25
-#define TSTORM_TCP_ST_CONTEXT_SECTION_ISLE_EXISTS (0x1<<26)
-#define TSTORM_TCP_ST_CONTEXT_SECTION_ISLE_EXISTS_SHIFT 26
+#define TSTORM_TCP_ST_CONTEXT_SECTION_RESERVED0 (0x1<<26)
+#define TSTORM_TCP_ST_CONTEXT_SECTION_RESERVED0_SHIFT 26
 #define TSTORM_TCP_ST_CONTEXT_SECTION_STOP_RX_PAYLOAD (0x1<<27)
 #define TSTORM_TCP_ST_CONTEXT_SECTION_STOP_RX_PAYLOAD_SHIFT 27
 #define TSTORM_TCP_ST_CONTEXT_SECTION_KA_ENABLED (0x1<<28)
@@ -793,11 +895,11 @@ struct tstorm_tcp_st_context_section {
 #define TSTORM_TCP_ST_CONTEXT_SECTION_FIRST_RTO_ESTIMATE_SHIFT 29
 #define TSTORM_TCP_ST_CONTEXT_SECTION_MAX_SEG_RETRANSMIT_EN (0x1<<30)
 #define TSTORM_TCP_ST_CONTEXT_SECTION_MAX_SEG_RETRANSMIT_EN_SHIFT 30
-#define TSTORM_TCP_ST_CONTEXT_SECTION_RESERVED3 (0x1<<31)
-#define TSTORM_TCP_ST_CONTEXT_SECTION_RESERVED3_SHIFT 31
+#define TSTORM_TCP_ST_CONTEXT_SECTION_LAST_ISLE_HAS_FIN (0x1<<31)
+#define TSTORM_TCP_ST_CONTEXT_SECTION_LAST_ISLE_HAS_FIN_SHIFT 31
         u32 flags2;
-#define TSTORM_TCP_ST_CONTEXT_SECTION_RTT_VARIATION_20B (0xFFFFFF<<0)
-#define TSTORM_TCP_ST_CONTEXT_SECTION_RTT_VARIATION_20B_SHIFT 0
+#define TSTORM_TCP_ST_CONTEXT_SECTION_RTT_VARIATION (0xFFFFFF<<0)
+#define TSTORM_TCP_ST_CONTEXT_SECTION_RTT_VARIATION_SHIFT 0
 #define TSTORM_TCP_ST_CONTEXT_SECTION_DA_EN (0x1<<24)
 #define TSTORM_TCP_ST_CONTEXT_SECTION_DA_EN_SHIFT 24
 #define TSTORM_TCP_ST_CONTEXT_SECTION_DA_COUNTER_EN (0x1<<25)
@@ -810,18 +912,18 @@ struct tstorm_tcp_st_context_section {
 #define TSTORM_TCP_ST_CONTEXT_SECTION_UPDATE_L2_STATSTICS_SHIFT 28
 #define TSTORM_TCP_ST_CONTEXT_SECTION_UPDATE_L4_STATSTICS (0x1<<29)
 #define TSTORM_TCP_ST_CONTEXT_SECTION_UPDATE_L4_STATSTICS_SHIFT 29
-#define __TSTORM_TCP_ST_CONTEXT_SECTION_SECOND_ISLE_DROPPED (0x1<<30)
-#define __TSTORM_TCP_ST_CONTEXT_SECTION_SECOND_ISLE_DROPPED_SHIFT 30
-#define __TSTORM_TCP_ST_CONTEXT_SECTION_DONT_SUPPORT_OOO (0x1<<31)
-#define __TSTORM_TCP_ST_CONTEXT_SECTION_DONT_SUPPORT_OOO_SHIFT 31
+#define __TSTORM_TCP_ST_CONTEXT_SECTION_IN_WINDOW_RST_ATTACK (0x1<<30)
+#define __TSTORM_TCP_ST_CONTEXT_SECTION_IN_WINDOW_RST_ATTACK_SHIFT 30
+#define __TSTORM_TCP_ST_CONTEXT_SECTION_IN_WINDOW_SYN_ATTACK (0x1<<31)
+#define __TSTORM_TCP_ST_CONTEXT_SECTION_IN_WINDOW_SYN_ATTACK_SHIFT 31
 #if defined(__BIG_ENDIAN)
-        u16 reserved_slowpath;
-        u8 tcp_sm_state_3b;
-        u8 rto_exp_3b;
+        u16 mss;
+        u8 tcp_sm_state;
+        u8 rto_exp;
 #elif defined(__LITTLE_ENDIAN)
-        u8 rto_exp_3b;
-        u8 tcp_sm_state_3b;
-        u16 reserved_slowpath;
+        u8 rto_exp;
+        u8 tcp_sm_state;
+        u16 mss;
 #endif
         u32 rcv_nxt;
         u32 timestamp_recent;
@@ -846,11 +948,11 @@ struct tstorm_tcp_st_context_section {
 #if defined(__BIG_ENDIAN)
         u8 statistics_counter_id;
         u8 ooo_support_mode;
-        u8 snd_wnd_scale_4b;
+        u8 snd_wnd_scale;
         u8 dup_ack_count;
 #elif defined(__LITTLE_ENDIAN)
         u8 dup_ack_count;
-        u8 snd_wnd_scale_4b;
+        u8 snd_wnd_scale;
         u8 ooo_support_mode;
         u8 statistics_counter_id;
 #endif
@@ -860,13 +962,21 @@ struct tstorm_tcp_st_context_section {
         u32 isle_start_seq;
         u32 isle_end_seq;
 #if defined(__BIG_ENDIAN)
-        u16 mss;
+        u16 second_isle_address;
         u16 recent_seg_wnd;
 #elif defined(__LITTLE_ENDIAN)
         u16 recent_seg_wnd;
-        u16 mss;
+        u16 second_isle_address;
+#endif
+#if defined(__BIG_ENDIAN)
+        u8 max_isles_ever_happened;
+        u8 isles_number;
+        u16 last_isle_address;
+#elif defined(__LITTLE_ENDIAN)
+        u16 last_isle_address;
+        u8 isles_number;
+        u8 max_isles_ever_happened;
 #endif
-        u32 reserved4;
         u32 max_rt_time;
 #if defined(__BIG_ENDIAN)
         u16 lsb_mac_address;
@@ -876,7 +986,7 @@ struct tstorm_tcp_st_context_section {
         u16 lsb_mac_address;
 #endif
         u32 msb_mac_address;
-        u32 reserved2;
+        u32 rightmost_received_seq;
 };
 
 /*
@@ -951,7 +1061,7 @@ struct tstorm_iscsi_st_context_section {
         u8 scratchpad_idx;
         struct iscsi_term_vars term_vars;
 #endif
-        u32 reserved2;
+        u32 process_nxt;
 };
 
 /*
@@ -1174,24 +1284,12 @@ struct xstorm_iscsi_ag_context {
 #endif
 #if defined(__BIG_ENDIAN)
         u8 cdu_reserved;
-        u8 agg_vars4;
-#define XSTORM_ISCSI_AG_CONTEXT_R2TQ_PROD_CF (0x3<<0)
-#define XSTORM_ISCSI_AG_CONTEXT_R2TQ_PROD_CF_SHIFT 0
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX21_CF (0x3<<2)
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX21_CF_SHIFT 2
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX18_CF_EN (0x1<<4)
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX18_CF_EN_SHIFT 4
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX19_CF_EN (0x1<<5)
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX19_CF_EN_SHIFT 5
-#define __XSTORM_ISCSI_AG_CONTEXT_R2TQ_PROD_CF_EN (0x1<<6)
-#define __XSTORM_ISCSI_AG_CONTEXT_R2TQ_PROD_CF_EN_SHIFT 6
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX21_CF_EN (0x1<<7)
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX21_CF_EN_SHIFT 7
+        u8 __agg_vars4;
         u8 agg_vars3;
 #define XSTORM_ISCSI_AG_CONTEXT_PHYSICAL_QUEUE_NUM2 (0x3F<<0)
 #define XSTORM_ISCSI_AG_CONTEXT_PHYSICAL_QUEUE_NUM2_SHIFT 0
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX19_CF (0x3<<6)
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX19_CF_SHIFT 6
+#define __XSTORM_ISCSI_AG_CONTEXT_RX_TS_EN_CF (0x3<<6)
+#define __XSTORM_ISCSI_AG_CONTEXT_RX_TS_EN_CF_SHIFT 6
         u8 agg_vars2;
 #define __XSTORM_ISCSI_AG_CONTEXT_DQ_CF (0x3<<0)
 #define __XSTORM_ISCSI_AG_CONTEXT_DQ_CF_SHIFT 0
@@ -1222,21 +1320,9 @@ struct xstorm_iscsi_ag_context {
         u8 agg_vars3;
 #define XSTORM_ISCSI_AG_CONTEXT_PHYSICAL_QUEUE_NUM2 (0x3F<<0)
 #define XSTORM_ISCSI_AG_CONTEXT_PHYSICAL_QUEUE_NUM2_SHIFT 0
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX19_CF (0x3<<6)
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX19_CF_SHIFT 6
-        u8 agg_vars4;
-#define XSTORM_ISCSI_AG_CONTEXT_R2TQ_PROD_CF (0x3<<0)
-#define XSTORM_ISCSI_AG_CONTEXT_R2TQ_PROD_CF_SHIFT 0
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX21_CF (0x3<<2)
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX21_CF_SHIFT 2
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX18_CF_EN (0x1<<4)
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX18_CF_EN_SHIFT 4
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX19_CF_EN (0x1<<5)
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX19_CF_EN_SHIFT 5
-#define __XSTORM_ISCSI_AG_CONTEXT_R2TQ_PROD_CF_EN (0x1<<6)
-#define __XSTORM_ISCSI_AG_CONTEXT_R2TQ_PROD_CF_EN_SHIFT 6
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX21_CF_EN (0x1<<7)
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX21_CF_EN_SHIFT 7
+#define __XSTORM_ISCSI_AG_CONTEXT_RX_TS_EN_CF (0x3<<6)
+#define __XSTORM_ISCSI_AG_CONTEXT_RX_TS_EN_CF_SHIFT 6
+        u8 __agg_vars4;
         u8 cdu_reserved;
 #endif
         u32 more_to_send;
@@ -1270,8 +1356,8 @@ struct xstorm_iscsi_ag_context {
 #define __XSTORM_ISCSI_AG_CONTEXT_AGG_VAL11_DECISION_RULE_SHIFT 0
 #define __XSTORM_ISCSI_AG_CONTEXT_AUX13_FLAG (0x1<<3)
 #define __XSTORM_ISCSI_AG_CONTEXT_AUX13_FLAG_SHIFT 3
-#define XSTORM_ISCSI_AG_CONTEXT_AUX18_CF (0x3<<4)
-#define XSTORM_ISCSI_AG_CONTEXT_AUX18_CF_SHIFT 4
+#define __XSTORM_ISCSI_AG_CONTEXT_STORMS_SYNC_CF (0x3<<4)
+#define __XSTORM_ISCSI_AG_CONTEXT_STORMS_SYNC_CF_SHIFT 4
 #define XSTORM_ISCSI_AG_CONTEXT_DECISION_RULE3 (0x3<<6)
 #define XSTORM_ISCSI_AG_CONTEXT_DECISION_RULE3_SHIFT 6
 #define XSTORM_ISCSI_AG_CONTEXT_AUX1_CF (0x3<<8)
@@ -1286,8 +1372,8 @@ struct xstorm_iscsi_ag_context {
 #define __XSTORM_ISCSI_AG_CONTEXT_AUX11_FLAG_SHIFT 13
 #define __XSTORM_ISCSI_AG_CONTEXT_AUX12_FLAG (0x1<<14)
 #define __XSTORM_ISCSI_AG_CONTEXT_AUX12_FLAG_SHIFT 14
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX2_FLAG (0x1<<15)
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX2_FLAG_SHIFT 15
+#define __XSTORM_ISCSI_AG_CONTEXT_RX_WND_SCL_EN (0x1<<15)
+#define __XSTORM_ISCSI_AG_CONTEXT_RX_WND_SCL_EN_SHIFT 15
         u8 agg_val3_th;
         u8 agg_vars6;
 #define XSTORM_ISCSI_AG_CONTEXT_DECISION_RULE6 (0x7<<0)
@@ -1310,8 +1396,8 @@ struct xstorm_iscsi_ag_context {
 #define __XSTORM_ISCSI_AG_CONTEXT_AGG_VAL11_DECISION_RULE_SHIFT 0
 #define __XSTORM_ISCSI_AG_CONTEXT_AUX13_FLAG (0x1<<3)
 #define __XSTORM_ISCSI_AG_CONTEXT_AUX13_FLAG_SHIFT 3
-#define XSTORM_ISCSI_AG_CONTEXT_AUX18_CF (0x3<<4)
-#define XSTORM_ISCSI_AG_CONTEXT_AUX18_CF_SHIFT 4
+#define __XSTORM_ISCSI_AG_CONTEXT_STORMS_SYNC_CF (0x3<<4)
+#define __XSTORM_ISCSI_AG_CONTEXT_STORMS_SYNC_CF_SHIFT 4
 #define XSTORM_ISCSI_AG_CONTEXT_DECISION_RULE3 (0x3<<6)
 #define XSTORM_ISCSI_AG_CONTEXT_DECISION_RULE3_SHIFT 6
 #define XSTORM_ISCSI_AG_CONTEXT_AUX1_CF (0x3<<8)
@@ -1326,14 +1412,14 @@ struct xstorm_iscsi_ag_context {
 #define __XSTORM_ISCSI_AG_CONTEXT_AUX11_FLAG_SHIFT 13
 #define __XSTORM_ISCSI_AG_CONTEXT_AUX12_FLAG (0x1<<14)
 #define __XSTORM_ISCSI_AG_CONTEXT_AUX12_FLAG_SHIFT 14
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX2_FLAG (0x1<<15)
-#define __XSTORM_ISCSI_AG_CONTEXT_AUX2_FLAG_SHIFT 15
+#define __XSTORM_ISCSI_AG_CONTEXT_RX_WND_SCL_EN (0x1<<15)
+#define __XSTORM_ISCSI_AG_CONTEXT_RX_WND_SCL_EN_SHIFT 15
 #endif
 #if defined(__BIG_ENDIAN)
         u16 __agg_val11_th;
-        u16 __agg_val11;
+        u16 __gen_data;
 #elif defined(__LITTLE_ENDIAN)
-        u16 __agg_val11;
+        u16 __gen_data;
         u16 __agg_val11_th;
 #endif
 #if defined(__BIG_ENDIAN)
@@ -1384,7 +1470,7 @@ struct xstorm_iscsi_ag_context {
 #endif
         u32 hq_cons_tcp_seq;
         u32 exp_stat_sn;
-        u32 agg_misc5;
+        u32 rst_seq_num;
 };
 
 /*
@@ -1478,12 +1564,12 @@ struct tstorm_iscsi_ag_context {
 #define TSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM2_SHIFT 2
 #define TSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM3 (0x1<<3)
 #define TSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM3_SHIFT 3
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX3_CF (0x3<<4)
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX3_CF_SHIFT 4
+#define __TSTORM_ISCSI_AG_CONTEXT_QUEUES_FLUSH_Q0_CF (0x3<<4)
+#define __TSTORM_ISCSI_AG_CONTEXT_QUEUES_FLUSH_Q0_CF_SHIFT 4
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX3_FLAG (0x1<<6)
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX3_FLAG_SHIFT 6
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX4_FLAG (0x1<<7)
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX4_FLAG_SHIFT 7
+#define __TSTORM_ISCSI_AG_CONTEXT_ACK_ON_FIN_SENT_FLAG (0x1<<7)
+#define __TSTORM_ISCSI_AG_CONTEXT_ACK_ON_FIN_SENT_FLAG_SHIFT 7
         u8 state;
 #elif defined(__LITTLE_ENDIAN)
         u8 state;
@@ -1496,63 +1582,63 @@ struct tstorm_iscsi_ag_context {
 #define TSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM2_SHIFT 2
 #define TSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM3 (0x1<<3)
 #define TSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM3_SHIFT 3
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX3_CF (0x3<<4)
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX3_CF_SHIFT 4
+#define __TSTORM_ISCSI_AG_CONTEXT_QUEUES_FLUSH_Q0_CF (0x3<<4)
+#define __TSTORM_ISCSI_AG_CONTEXT_QUEUES_FLUSH_Q0_CF_SHIFT 4
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX3_FLAG (0x1<<6)
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX3_FLAG_SHIFT 6
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX4_FLAG (0x1<<7)
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX4_FLAG_SHIFT 7
+#define __TSTORM_ISCSI_AG_CONTEXT_ACK_ON_FIN_SENT_FLAG (0x1<<7)
+#define __TSTORM_ISCSI_AG_CONTEXT_ACK_ON_FIN_SENT_FLAG_SHIFT 7
         u16 ulp_credit;
 #endif
 #if defined(__BIG_ENDIAN)
         u16 __agg_val4;
         u16 agg_vars2;
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX5_FLAG (0x1<<0)
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX5_FLAG_SHIFT 0
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX6_FLAG (0x1<<1)
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX6_FLAG_SHIFT 1
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX4_CF (0x3<<2)
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX4_CF_SHIFT 2
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX5_CF (0x3<<4)
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX5_CF_SHIFT 4
+#define __TSTORM_ISCSI_AG_CONTEXT_MSL_TIMER_SET_FLAG (0x1<<0)
+#define __TSTORM_ISCSI_AG_CONTEXT_MSL_TIMER_SET_FLAG_SHIFT 0
+#define __TSTORM_ISCSI_AG_CONTEXT_FIN_SENT_FIRST_FLAG (0x1<<1)
+#define __TSTORM_ISCSI_AG_CONTEXT_FIN_SENT_FIRST_FLAG_SHIFT 1
+#define __TSTORM_ISCSI_AG_CONTEXT_RST_SENT_CF (0x3<<2)
+#define __TSTORM_ISCSI_AG_CONTEXT_RST_SENT_CF_SHIFT 2
+#define __TSTORM_ISCSI_AG_CONTEXT_WAKEUP_CALL_CF (0x3<<4)
+#define __TSTORM_ISCSI_AG_CONTEXT_WAKEUP_CALL_CF_SHIFT 4
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX6_CF (0x3<<6)
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX6_CF_SHIFT 6
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX7_CF (0x3<<8)
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX7_CF_SHIFT 8
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX7_FLAG (0x1<<10)
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX7_FLAG_SHIFT 10
-#define TSTORM_ISCSI_AG_CONTEXT_AUX3_CF_EN (0x1<<11)
-#define TSTORM_ISCSI_AG_CONTEXT_AUX3_CF_EN_SHIFT 11
-#define TSTORM_ISCSI_AG_CONTEXT_AUX4_CF_EN (0x1<<12)
-#define TSTORM_ISCSI_AG_CONTEXT_AUX4_CF_EN_SHIFT 12
-#define TSTORM_ISCSI_AG_CONTEXT_AUX5_CF_EN (0x1<<13)
-#define TSTORM_ISCSI_AG_CONTEXT_AUX5_CF_EN_SHIFT 13
+#define __TSTORM_ISCSI_AG_CONTEXT_QUEUES_FLUSH_Q0_CF_EN (0x1<<11)
+#define __TSTORM_ISCSI_AG_CONTEXT_QUEUES_FLUSH_Q0_CF_EN_SHIFT 11
+#define __TSTORM_ISCSI_AG_CONTEXT_RST_SENT_CF_EN (0x1<<12)
+#define __TSTORM_ISCSI_AG_CONTEXT_RST_SENT_CF_EN_SHIFT 12
+#define __TSTORM_ISCSI_AG_CONTEXT_WAKEUP_CALL_CF_EN (0x1<<13)
+#define __TSTORM_ISCSI_AG_CONTEXT_WAKEUP_CALL_CF_EN_SHIFT 13
 #define TSTORM_ISCSI_AG_CONTEXT_AUX6_CF_EN (0x1<<14)
 #define TSTORM_ISCSI_AG_CONTEXT_AUX6_CF_EN_SHIFT 14
 #define TSTORM_ISCSI_AG_CONTEXT_AUX7_CF_EN (0x1<<15)
 #define TSTORM_ISCSI_AG_CONTEXT_AUX7_CF_EN_SHIFT 15
 #elif defined(__LITTLE_ENDIAN)
         u16 agg_vars2;
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX5_FLAG (0x1<<0)
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX5_FLAG_SHIFT 0
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX6_FLAG (0x1<<1)
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX6_FLAG_SHIFT 1
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX4_CF (0x3<<2)
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX4_CF_SHIFT 2
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX5_CF (0x3<<4)
-#define __TSTORM_ISCSI_AG_CONTEXT_AUX5_CF_SHIFT 4
+#define __TSTORM_ISCSI_AG_CONTEXT_MSL_TIMER_SET_FLAG (0x1<<0)
+#define __TSTORM_ISCSI_AG_CONTEXT_MSL_TIMER_SET_FLAG_SHIFT 0
+#define __TSTORM_ISCSI_AG_CONTEXT_FIN_SENT_FIRST_FLAG (0x1<<1)
+#define __TSTORM_ISCSI_AG_CONTEXT_FIN_SENT_FIRST_FLAG_SHIFT 1
+#define __TSTORM_ISCSI_AG_CONTEXT_RST_SENT_CF (0x3<<2)
+#define __TSTORM_ISCSI_AG_CONTEXT_RST_SENT_CF_SHIFT 2
+#define __TSTORM_ISCSI_AG_CONTEXT_WAKEUP_CALL_CF (0x3<<4)
+#define __TSTORM_ISCSI_AG_CONTEXT_WAKEUP_CALL_CF_SHIFT 4
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX6_CF (0x3<<6)
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX6_CF_SHIFT 6
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX7_CF (0x3<<8)
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX7_CF_SHIFT 8
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX7_FLAG (0x1<<10)
 #define __TSTORM_ISCSI_AG_CONTEXT_AUX7_FLAG_SHIFT 10
-#define TSTORM_ISCSI_AG_CONTEXT_AUX3_CF_EN (0x1<<11)
-#define TSTORM_ISCSI_AG_CONTEXT_AUX3_CF_EN_SHIFT 11
-#define TSTORM_ISCSI_AG_CONTEXT_AUX4_CF_EN (0x1<<12)
-#define TSTORM_ISCSI_AG_CONTEXT_AUX4_CF_EN_SHIFT 12
-#define TSTORM_ISCSI_AG_CONTEXT_AUX5_CF_EN (0x1<<13)
-#define TSTORM_ISCSI_AG_CONTEXT_AUX5_CF_EN_SHIFT 13
+#define __TSTORM_ISCSI_AG_CONTEXT_QUEUES_FLUSH_Q0_CF_EN (0x1<<11)
+#define __TSTORM_ISCSI_AG_CONTEXT_QUEUES_FLUSH_Q0_CF_EN_SHIFT 11
+#define __TSTORM_ISCSI_AG_CONTEXT_RST_SENT_CF_EN (0x1<<12)
+#define __TSTORM_ISCSI_AG_CONTEXT_RST_SENT_CF_EN_SHIFT 12
+#define __TSTORM_ISCSI_AG_CONTEXT_WAKEUP_CALL_CF_EN (0x1<<13)
+#define __TSTORM_ISCSI_AG_CONTEXT_WAKEUP_CALL_CF_EN_SHIFT 13
 #define TSTORM_ISCSI_AG_CONTEXT_AUX6_CF_EN (0x1<<14)
 #define TSTORM_ISCSI_AG_CONTEXT_AUX6_CF_EN_SHIFT 14
 #define TSTORM_ISCSI_AG_CONTEXT_AUX7_CF_EN (0x1<<15)
@@ -1563,100 +1649,6 @@ struct tstorm_iscsi_ag_context {
 };
 
 /*
- * The iscsi aggregative context of Cstorm
- */
-struct cstorm_iscsi_ag_context {
-        u32 agg_vars1;
-#define CSTORM_ISCSI_AG_CONTEXT_STATE (0xFF<<0)
-#define CSTORM_ISCSI_AG_CONTEXT_STATE_SHIFT 0
-#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM0 (0x1<<8)
-#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM0_SHIFT 8
-#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM1 (0x1<<9)
-#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM1_SHIFT 9
-#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM2 (0x1<<10)
-#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM2_SHIFT 10
-#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM3 (0x1<<11)
-#define __CSTORM_ISCSI_AG_CONTEXT_EXISTS_IN_QM3_SHIFT 11
-#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED_ULP_RX_SE_CF_EN (0x1<<12)
-#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED_ULP_RX_SE_CF_EN_SHIFT 12
-#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED_ULP_RX_INV_CF_EN (0x1<<13)
-#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED_ULP_RX_INV_CF_EN_SHIFT 13
-#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION3_CF (0x3<<14)
-#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION3_CF_SHIFT 14
-#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED66 (0x3<<16)
-#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED66_SHIFT 16
-#define __CSTORM_ISCSI_AG_CONTEXT_FIN_RECEIVED_CF_EN (0x1<<18)
-#define __CSTORM_ISCSI_AG_CONTEXT_FIN_RECEIVED_CF_EN_SHIFT 18
-#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION0_CF_EN (0x1<<19)
-#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION0_CF_EN_SHIFT 19
-#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION1_CF_EN (0x1<<20)
-#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION1_CF_EN_SHIFT 20
-#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION2_CF_EN (0x1<<21)
-#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION2_CF_EN_SHIFT 21
-#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION3_CF_EN (0x1<<22)
-#define __CSTORM_ISCSI_AG_CONTEXT_PENDING_COMPLETION3_CF_EN_SHIFT 22
-#define __CSTORM_ISCSI_AG_CONTEXT_REL_SEQ_RULE (0x7<<23)
-#define __CSTORM_ISCSI_AG_CONTEXT_REL_SEQ_RULE_SHIFT 23
-#define CSTORM_ISCSI_AG_CONTEXT_HQ_PROD_RULE (0x3<<26)
-#define CSTORM_ISCSI_AG_CONTEXT_HQ_PROD_RULE_SHIFT 26
-#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED52 (0x3<<28)
-#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED52_SHIFT 28
-#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED53 (0x3<<30)
-#define __CSTORM_ISCSI_AG_CONTEXT_RESERVED53_SHIFT 30
-#if defined(__BIG_ENDIAN)
-        u8 __aux1_th;
-        u8 __aux1_val;
-        u16 __agg_vars2;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __agg_vars2;
-        u8 __aux1_val;
-        u8 __aux1_th;
-#endif
-        u32 rel_seq;
-        u32 rel_seq_th;
-#if defined(__BIG_ENDIAN)
-        u16 hq_cons;
-        u16 hq_prod;
-#elif defined(__LITTLE_ENDIAN)
-        u16 hq_prod;
-        u16 hq_cons;
-#endif
-#if defined(__BIG_ENDIAN)
-        u8 __reserved62;
-        u8 __reserved61;
-        u8 __reserved60;
-        u8 __reserved59;
-#elif defined(__LITTLE_ENDIAN)
-        u8 __reserved59;
-        u8 __reserved60;
-        u8 __reserved61;
-        u8 __reserved62;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __reserved64;
-        u16 __cq_u_prod0;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __cq_u_prod0;
-        u16 __reserved64;
-#endif
-        u32 __cq_u_prod1;
-#if defined(__BIG_ENDIAN)
-        u16 __agg_vars3;
-        u16 __cq_u_prod2;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __cq_u_prod2;
-        u16 __agg_vars3;
-#endif
-#if defined(__BIG_ENDIAN)
-        u16 __aux2_th;
-        u16 __cq_u_prod3;
-#elif defined(__LITTLE_ENDIAN)
-        u16 __cq_u_prod3;
-        u16 __aux2_th;
-#endif
-};
-
-/*
  * The iscsi aggregative context of Ustorm
  */
 struct ustorm_iscsi_ag_context {
@@ -1746,8 +1738,8 @@ struct ustorm_iscsi_ag_context {
 #define USTORM_ISCSI_AG_CONTEXT_AGG_VAL2_RULE_SHIFT 0
 #define __USTORM_ISCSI_AG_CONTEXT_AGG_VAL3_RULE (0x7<<3)
 #define __USTORM_ISCSI_AG_CONTEXT_AGG_VAL3_RULE_SHIFT 3
-#define __USTORM_ISCSI_AG_CONTEXT_AGG_VAL2_ARM_N_FLAG (0x1<<6)
-#define __USTORM_ISCSI_AG_CONTEXT_AGG_VAL2_ARM_N_FLAG_SHIFT 6
+#define USTORM_ISCSI_AG_CONTEXT_AGG_VAL2_ARM_N_FLAG (0x1<<6)
+#define USTORM_ISCSI_AG_CONTEXT_AGG_VAL2_ARM_N_FLAG_SHIFT 6
 #define __USTORM_ISCSI_AG_CONTEXT_RESERVED1 (0x1<<7)
 #define __USTORM_ISCSI_AG_CONTEXT_RESERVED1_SHIFT 7
         u8 decision_rule_enable_bits;
@@ -1790,8 +1782,8 @@ struct ustorm_iscsi_ag_context {
 #define USTORM_ISCSI_AG_CONTEXT_AGG_VAL2_RULE_SHIFT 0
 #define __USTORM_ISCSI_AG_CONTEXT_AGG_VAL3_RULE (0x7<<3)
 #define __USTORM_ISCSI_AG_CONTEXT_AGG_VAL3_RULE_SHIFT 3
-#define __USTORM_ISCSI_AG_CONTEXT_AGG_VAL2_ARM_N_FLAG (0x1<<6)
-#define __USTORM_ISCSI_AG_CONTEXT_AGG_VAL2_ARM_N_FLAG_SHIFT 6
+#define USTORM_ISCSI_AG_CONTEXT_AGG_VAL2_ARM_N_FLAG (0x1<<6)
+#define USTORM_ISCSI_AG_CONTEXT_AGG_VAL2_ARM_N_FLAG_SHIFT 6
 #define __USTORM_ISCSI_AG_CONTEXT_RESERVED1 (0x1<<7)
 #define __USTORM_ISCSI_AG_CONTEXT_RESERVED1_SHIFT 7
         u16 __reserved2;
@@ -1799,22 +1791,6 @@ struct ustorm_iscsi_ag_context {
 };
 
 /*
- * Timers connection context
- */
-struct iscsi_timers_block_context {
-        u32 __reserved_0;
-        u32 __reserved_1;
-        u32 __reserved_2;
-        u32 flags;
-#define __ISCSI_TIMERS_BLOCK_CONTEXT_NUM_OF_ACTIVE_TIMERS (0x3<<0)
-#define __ISCSI_TIMERS_BLOCK_CONTEXT_NUM_OF_ACTIVE_TIMERS_SHIFT 0
-#define ISCSI_TIMERS_BLOCK_CONTEXT_CONN_VALID_FLG (0x1<<2)
-#define ISCSI_TIMERS_BLOCK_CONTEXT_CONN_VALID_FLG_SHIFT 2
-#define __ISCSI_TIMERS_BLOCK_CONTEXT_RESERVED0 (0x1FFFFFFF<<3)
-#define __ISCSI_TIMERS_BLOCK_CONTEXT_RESERVED0_SHIFT 3
-};
-
-/*
  * Ethernet context section, shared in TOE, RDMA and ISCSI
  */
 struct xstorm_eth_context_section {
@@ -1963,7 +1939,7 @@ struct xstorm_tcp_context_section {
 #endif
 #if defined(__BIG_ENDIAN)
         u8 original_nagle_1b;
-        u8 ts_enabled_1b;
+        u8 ts_enabled;
         u16 tcp_params;
 #define XSTORM_TCP_CONTEXT_SECTION_TOTAL_HEADER_SIZE (0xFF<<0)
 #define XSTORM_TCP_CONTEXT_SECTION_TOTAL_HEADER_SIZE_SHIFT 0
@@ -1973,8 +1949,8 @@ struct xstorm_tcp_context_section {
 #define __XSTORM_TCP_CONTEXT_SECTION_ECN_ENABLED_SHIFT 9
 #define XSTORM_TCP_CONTEXT_SECTION_SACK_ENABLED (0x1<<10)
 #define XSTORM_TCP_CONTEXT_SECTION_SACK_ENABLED_SHIFT 10
-#define XSTORM_TCP_CONTEXT_SECTION_KA_STATE (0x1<<11)
-#define XSTORM_TCP_CONTEXT_SECTION_KA_STATE_SHIFT 11
+#define XSTORM_TCP_CONTEXT_SECTION_SMALL_WIN_ADV (0x1<<11)
+#define XSTORM_TCP_CONTEXT_SECTION_SMALL_WIN_ADV_SHIFT 11
 #define XSTORM_TCP_CONTEXT_SECTION_FIN_SENT_FLAG (0x1<<12)
 #define XSTORM_TCP_CONTEXT_SECTION_FIN_SENT_FLAG_SHIFT 12
 #define XSTORM_TCP_CONTEXT_SECTION_WINDOW_SATURATED (0x1<<13)
@@ -1991,15 +1967,15 @@ struct xstorm_tcp_context_section {
 #define __XSTORM_TCP_CONTEXT_SECTION_ECN_ENABLED_SHIFT 9
 #define XSTORM_TCP_CONTEXT_SECTION_SACK_ENABLED (0x1<<10)
 #define XSTORM_TCP_CONTEXT_SECTION_SACK_ENABLED_SHIFT 10
-#define XSTORM_TCP_CONTEXT_SECTION_KA_STATE (0x1<<11)
-#define XSTORM_TCP_CONTEXT_SECTION_KA_STATE_SHIFT 11
+#define XSTORM_TCP_CONTEXT_SECTION_SMALL_WIN_ADV (0x1<<11)
+#define XSTORM_TCP_CONTEXT_SECTION_SMALL_WIN_ADV_SHIFT 11
 #define XSTORM_TCP_CONTEXT_SECTION_FIN_SENT_FLAG (0x1<<12)
 #define XSTORM_TCP_CONTEXT_SECTION_FIN_SENT_FLAG_SHIFT 12
 #define XSTORM_TCP_CONTEXT_SECTION_WINDOW_SATURATED (0x1<<13)
 #define XSTORM_TCP_CONTEXT_SECTION_WINDOW_SATURATED_SHIFT 13
 #define XSTORM_TCP_CONTEXT_SECTION_SLOWPATH_QUEUES_FLUSH_COUNTER (0x3<<14)
 #define XSTORM_TCP_CONTEXT_SECTION_SLOWPATH_QUEUES_FLUSH_COUNTER_SHIFT 14
-        u8 ts_enabled_1b;
+        u8 ts_enabled;
         u8 original_nagle_1b;
 #endif
 #if defined(__BIG_ENDIAN)
@@ -2030,8 +2006,8 @@ struct xstorm_common_context_section {
 #define XSTORM_COMMON_CONTEXT_SECTION_UPDATE_L4_STATSTICS_SHIFT 1
 #define XSTORM_COMMON_CONTEXT_SECTION_STATISTICS_COUNTER_ID (0x1F<<2)
 #define XSTORM_COMMON_CONTEXT_SECTION_STATISTICS_COUNTER_ID_SHIFT 2
-#define XSTORM_COMMON_CONTEXT_SECTION_RESERVED0 (0x1<<7)
-#define XSTORM_COMMON_CONTEXT_SECTION_RESERVED0_SHIFT 7
+#define XSTORM_COMMON_CONTEXT_SECTION_DCB_EXISTS (0x1<<7)
+#define XSTORM_COMMON_CONTEXT_SECTION_DCB_EXISTS_SHIFT 7
         u8 ip_version_1b;
 #elif defined(__LITTLE_ENDIAN)
         u8 ip_version_1b;
@@ -2042,8 +2018,8 @@ struct xstorm_common_context_section {
 #define XSTORM_COMMON_CONTEXT_SECTION_UPDATE_L4_STATSTICS_SHIFT 1
 #define XSTORM_COMMON_CONTEXT_SECTION_STATISTICS_COUNTER_ID (0x1F<<2)
 #define XSTORM_COMMON_CONTEXT_SECTION_STATISTICS_COUNTER_ID_SHIFT 2
-#define XSTORM_COMMON_CONTEXT_SECTION_RESERVED0 (0x1<<7)
-#define XSTORM_COMMON_CONTEXT_SECTION_RESERVED0_SHIFT 7
+#define XSTORM_COMMON_CONTEXT_SECTION_DCB_EXISTS (0x1<<7)
+#define XSTORM_COMMON_CONTEXT_SECTION_DCB_EXISTS_SHIFT 7
         u16 reserved;
 #endif
 };
@@ -2284,7 +2260,7 @@ struct iscsi_context {
         struct tstorm_iscsi_ag_context tstorm_ag_context;
         struct cstorm_iscsi_ag_context cstorm_ag_context;
         struct ustorm_iscsi_ag_context ustorm_ag_context;
-        struct iscsi_timers_block_context timers_context;
+        struct timers_block_context timers_context;
         struct regpair upb_context;
         struct xstorm_iscsi_st_context xstorm_st_context;
         struct regpair xpb_context;
@@ -2434,16 +2410,16 @@ struct l5cm_packet_size {
  * l5cm connection parameters
  */
 union l5cm_reduce_param_union {
-        u32 passive_side_scramble_key;
-        u32 pcs_id;
+        u32 opaque1;
+        u32 opaque2;
 };
 
 /*
  * l5cm connection parameters
  */
 struct l5cm_reduce_conn {
-        union l5cm_reduce_param_union param;
-        u32 isn;
+        union l5cm_reduce_param_union opaque1;
+        u32 opaque2;
 };
 
 /*
diff --git a/drivers/net/cnic_if.h b/drivers/net/cnic_if.h
index 344c842d55ab..0dbeaec4f03a 100644
--- a/drivers/net/cnic_if.h
+++ b/drivers/net/cnic_if.h
@@ -12,8 +12,8 @@
 #ifndef CNIC_IF_H
 #define CNIC_IF_H
 
-#define CNIC_MODULE_VERSION     "2.1.3"
-#define CNIC_MODULE_RELDATE     "June 24, 2010"
+#define CNIC_MODULE_VERSION     "2.2.6"
+#define CNIC_MODULE_RELDATE     "Oct 12, 2010"
 
 #define CNIC_ULP_RDMA           0
 #define CNIC_ULP_ISCSI          1
@@ -80,18 +80,15 @@ struct kcqe {
 #define DRV_CTL_IO_RD_CMD               0x102
 #define DRV_CTL_CTX_WR_CMD              0x103
 #define DRV_CTL_CTXTBL_WR_CMD           0x104
-#define DRV_CTL_COMPLETION_CMD          0x105
+#define DRV_CTL_RET_L5_SPQ_CREDIT_CMD   0x105
 #define DRV_CTL_START_L2_CMD            0x106
 #define DRV_CTL_STOP_L2_CMD             0x107
+#define DRV_CTL_RET_L2_SPQ_CREDIT_CMD   0x10c
 
 struct cnic_ctl_completion {
         u32     cid;
 };
 
-struct drv_ctl_completion {
-        u32     comp_count;
-};
-
 struct cnic_ctl_info {
         int     cmd;
         union {
@@ -100,6 +97,10 @@ struct cnic_ctl_info {
         } data;
 };
 
+struct drv_ctl_spq_credit {
+        u32     credit_count;
+};
+
 struct drv_ctl_io {
         u32             cid_addr;
         u32             offset;
@@ -115,7 +116,7 @@ struct drv_ctl_l2_ring {
 struct drv_ctl_info {
         int     cmd;
         union {
-                struct drv_ctl_completion comp;
+                struct drv_ctl_spq_credit credit;
                 struct drv_ctl_io io;
                 struct drv_ctl_l2_ring ring;
                 char bytes[MAX_DRV_CTL_DATA];
@@ -138,6 +139,7 @@ struct cnic_irq {
         unsigned int    vector;
         void            *status_blk;
         u32             status_blk_num;
+        u32             status_blk_num2;
         u32             irq_flags;
 #define CNIC_IRQ_FL_MSIX                0x00000001
 };
@@ -152,6 +154,7 @@ struct cnic_eth_dev {
         struct pci_dev  *pdev;
         void __iomem    *io_base;
         void __iomem    *io_base2;
+        void            *iro_arr;
 
         u32             ctx_tbl_offset;
         u32             ctx_tbl_len;
@@ -160,7 +163,9 @@ struct cnic_eth_dev {
         u32             max_iscsi_conn;
         u32             max_fcoe_conn;
         u32             max_rdma_conn;
-        u32             reserved0[2];
+        u32             fcoe_init_cid;
+        u16             iscsi_l2_client_id;
+        u16             iscsi_l2_cid;
 
         int             num_irq;
         struct cnic_irq irq_arr[MAX_CNIC_VEC];
diff --git a/drivers/net/cxgb3/adapter.h b/drivers/net/cxgb3/adapter.h
index 4cd7f420766a..ef67be59680f 100644
--- a/drivers/net/cxgb3/adapter.h
+++ b/drivers/net/cxgb3/adapter.h
@@ -336,9 +336,6 @@ int t3_sge_alloc_qset(struct adapter *adapter, unsigned int id, int nports,
                       int irq_vec_idx, const struct qset_params *p,
                       int ntxq, struct net_device *dev,
                       struct netdev_queue *netdevq);
-int t3_get_desc(const struct sge_qset *qs, unsigned int qnum, unsigned int idx,
-                unsigned char *data);
-irqreturn_t t3_sge_intr_msix(int irq, void *cookie);
 extern struct workqueue_struct *cxgb3_wq;
 
 int t3_get_edc_fw(struct cphy *phy, int edc_idx, int size);
diff --git a/drivers/net/cxgb3/common.h b/drivers/net/cxgb3/common.h
index fe08a004b0dd..5ccb77d078aa 100644
--- a/drivers/net/cxgb3/common.h
+++ b/drivers/net/cxgb3/common.h
@@ -673,7 +673,6 @@ void t3_xgm_intr_enable(struct adapter *adapter, int idx);
 void t3_xgm_intr_disable(struct adapter *adapter, int idx);
 void t3_port_intr_enable(struct adapter *adapter, int idx);
 void t3_port_intr_disable(struct adapter *adapter, int idx);
-void t3_port_intr_clear(struct adapter *adapter, int idx);
 int t3_slow_intr_handler(struct adapter *adapter);
 int t3_phy_intr_handler(struct adapter *adapter);
 
@@ -689,14 +688,10 @@ int t3_check_tpsram_version(struct adapter *adapter);
 int t3_check_tpsram(struct adapter *adapter, const u8 *tp_ram,
                     unsigned int size);
 int t3_set_proto_sram(struct adapter *adap, const u8 *data);
-int t3_read_flash(struct adapter *adapter, unsigned int addr,
-                  unsigned int nwords, u32 *data, int byte_oriented);
 int t3_load_fw(struct adapter *adapter, const u8 * fw_data, unsigned int size);
 int t3_get_fw_version(struct adapter *adapter, u32 *vers);
 int t3_check_fw_version(struct adapter *adapter);
 int t3_init_hw(struct adapter *adapter, u32 fw_params);
-void mac_prep(struct cmac *mac, struct adapter *adapter, int index);
-void early_hw_init(struct adapter *adapter, const struct adapter_info *ai);
 int t3_reset_adapter(struct adapter *adapter);
 int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
                     int reset);
@@ -706,8 +701,6 @@ void t3_fatal_err(struct adapter *adapter);
 void t3_set_vlan_accel(struct adapter *adapter, unsigned int ports, int on);
 void t3_config_rss(struct adapter *adapter, unsigned int rss_config,
                    const u8 * cpus, const u16 *rspq);
-int t3_read_rss(struct adapter *adapter, u8 * lkup, u16 *map);
-int t3_mps_set_active_ports(struct adapter *adap, unsigned int port_mask);
 int t3_cim_ctl_blk_read(struct adapter *adap, unsigned int addr,
                         unsigned int n, unsigned int *valp);
 int t3_mc7_bd_read(struct mc7 *mc7, unsigned int start, unsigned int n,
@@ -731,19 +724,12 @@ void t3_mc5_prep(struct adapter *adapter, struct mc5 *mc5, int mode);
 int t3_mc5_init(struct mc5 *mc5, unsigned int nservers, unsigned int nfilters,
                 unsigned int nroutes);
 void t3_mc5_intr_handler(struct mc5 *mc5);
-int t3_read_mc5_range(const struct mc5 *mc5, unsigned int start, unsigned int n,
-                      u32 *buf);
 
-int t3_tp_set_coalescing_size(struct adapter *adap, unsigned int size, int psh);
-void t3_tp_set_max_rxsize(struct adapter *adap, unsigned int size);
 void t3_tp_set_offload_mode(struct adapter *adap, int enable);
 void t3_tp_get_mib_stats(struct adapter *adap, struct tp_mib_stats *tps);
 void t3_load_mtus(struct adapter *adap, unsigned short mtus[NMTUS],
                   unsigned short alpha[NCCTRL_WIN],
                   unsigned short beta[NCCTRL_WIN], unsigned short mtu_cap);
-void t3_read_hw_mtus(struct adapter *adap, unsigned short mtus[NMTUS]);
-void t3_get_cong_cntl_tab(struct adapter *adap,
-                          unsigned short incr[NMTUS][NCCTRL_WIN]);
 void t3_config_trace_filter(struct adapter *adapter,
                             const struct trace_params *tp, int filter_index,
                             int invert, int enable);
@@ -769,10 +755,6 @@ int t3_sge_enable_ecntxt(struct adapter *adapter, unsigned int id, int enable);
 int t3_sge_disable_fl(struct adapter *adapter, unsigned int id);
 int t3_sge_disable_rspcntxt(struct adapter *adapter, unsigned int id);
 int t3_sge_disable_cqcntxt(struct adapter *adapter, unsigned int id);
-int t3_sge_read_ecntxt(struct adapter *adapter, unsigned int id, u32 data[4]);
-int t3_sge_read_fl(struct adapter *adapter, unsigned int id, u32 data[4]);
-int t3_sge_read_cq(struct adapter *adapter, unsigned int id, u32 data[4]);
-int t3_sge_read_rspq(struct adapter *adapter, unsigned int id, u32 data[4]);
 int t3_sge_cqcntxt_op(struct adapter *adapter, unsigned int id, unsigned int op,
                       unsigned int credits);
 
diff --git a/drivers/net/cxgb3/cxgb3_defs.h b/drivers/net/cxgb3/cxgb3_defs.h
index 47e53769af5b..920d918ed193 100644
--- a/drivers/net/cxgb3/cxgb3_defs.h
+++ b/drivers/net/cxgb3/cxgb3_defs.h
@@ -43,8 +43,6 @@
 
 void *cxgb_alloc_mem(unsigned long size);
 void cxgb_free_mem(void *addr);
-void cxgb_neigh_update(struct neighbour *neigh);
-void cxgb_redirect(struct dst_entry *old, struct dst_entry *new);
 
 /*
  * Map an ATID or STID to their entries in the corresponding TID tables.
@@ -111,7 +109,6 @@ static inline struct t3c_tid_entry *lookup_atid(const struct tid_info *t,
         return &e->t3c_tid;
 }
 
-int process_rx(struct t3cdev *dev, struct sk_buff **skbs, int n);
 int attach_t3cdev(struct t3cdev *dev);
 void detach_t3cdev(struct t3cdev *dev);
 #endif
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index 1ecf53dafe06..a04ce6a5f637 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -1399,7 +1399,10 @@ static int cxgb_open(struct net_device *dev)
                                "Could not initialize offload capabilities\n");
         }
 
-        dev->real_num_tx_queues = pi->nqsets;
+        netif_set_real_num_tx_queues(dev, pi->nqsets);
+        err = netif_set_real_num_rx_queues(dev, pi->nqsets);
+        if (err)
+                return err;
         link_start(dev);
         t3_port_intr_enable(adapter, pi->port_id);
         netif_tx_start_all_queues(dev);
@@ -2302,6 +2305,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
         case CHELSIO_GET_QSET_NUM:{
                 struct ch_reg edata;
 
+                memset(&edata, 0, sizeof(struct ch_reg));
+
                 edata.cmd = CHELSIO_GET_QSET_NUM;
                 edata.val = pi->nqsets;
                 if (copy_to_user(useraddr, &edata, sizeof(edata)))
diff --git a/drivers/net/cxgb3/cxgb3_offload.c b/drivers/net/cxgb3/cxgb3_offload.c
index c6485b39eb0e..bcf07532953d 100644
--- a/drivers/net/cxgb3/cxgb3_offload.c
+++ b/drivers/net/cxgb3/cxgb3_offload.c
@@ -60,11 +60,14 @@ static LIST_HEAD(adapter_list);
 static const unsigned int MAX_ATIDS = 64 * 1024;
 static const unsigned int ATID_BASE = 0x10000;
 
+static void cxgb_neigh_update(struct neighbour *neigh);
+static void cxgb_redirect(struct dst_entry *old, struct dst_entry *new);
+
 static inline int offload_activated(struct t3cdev *tdev)
 {
         const struct adapter *adapter = tdev2adap(tdev);
 
-        return (test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map));
+        return test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map);
 }
 
 /**
@@ -1015,7 +1018,7 @@ EXPORT_SYMBOL(t3_register_cpl_handler);
 /*
  * T3CDEV's receive method.
  */
-int process_rx(struct t3cdev *dev, struct sk_buff **skbs, int n)
+static int process_rx(struct t3cdev *dev, struct sk_buff **skbs, int n)
 {
         while (n--) {
                 struct sk_buff *skb = *skbs++;
@@ -1070,7 +1073,7 @@ static int is_offloading(struct net_device *dev)
         return 0;
 }
 
-void cxgb_neigh_update(struct neighbour *neigh)
+static void cxgb_neigh_update(struct neighbour *neigh)
 {
         struct net_device *dev = neigh->dev;
 
@@ -1104,7 +1107,7 @@ static void set_l2t_ix(struct t3cdev *tdev, u32 tid, struct l2t_entry *e)
         tdev->send(tdev, skb);
 }
 
-void cxgb_redirect(struct dst_entry *old, struct dst_entry *new)
+static void cxgb_redirect(struct dst_entry *old, struct dst_entry *new)
 {
         struct net_device *olddev, *newdev;
         struct tid_info *ti;
diff --git a/drivers/net/cxgb3/mc5.c b/drivers/net/cxgb3/mc5.c
index 3b5517b8fbde..a8766fb2f9ab 100644
--- a/drivers/net/cxgb3/mc5.c
+++ b/drivers/net/cxgb3/mc5.c
@@ -374,44 +374,6 @@ int t3_mc5_init(struct mc5 *mc5, unsigned int nservers, unsigned int nfilters,
         return err;
 }
 
-/*
- *      read_mc5_range - dump a part of the memory managed by MC5
- *      @mc5: the MC5 handle
- *      @start: the start address for the dump
- *      @n: number of 72-bit words to read
- *      @buf: result buffer
- *
- *      Read n 72-bit words from MC5 memory from the given start location.
- */
-int t3_read_mc5_range(const struct mc5 *mc5, unsigned int start,
-                      unsigned int n, u32 *buf)
-{
-        u32 read_cmd;
-        int err = 0;
-        struct adapter *adap = mc5->adapter;
-
-        if (mc5->part_type == IDT75P52100)
-                read_cmd = IDT_CMD_READ;
-        else if (mc5->part_type == IDT75N43102)
-                read_cmd = IDT4_CMD_READ;
-        else
-                return -EINVAL;
-
-        mc5_dbgi_mode_enable(mc5);
-
-        while (n--) {
-                t3_write_reg(adap, A_MC5_DB_DBGI_REQ_ADDR0, start++);
-                if (mc5_cmd_write(adap, read_cmd)) {
-                        err = -EIO;
-                        break;
-                }
-                dbgi_rd_rsp3(adap, buf + 2, buf + 1, buf);
-                buf += 3;
-        }
-
-        mc5_dbgi_mode_disable(mc5);
-        return 0;
-}
 
 #define MC5_INT_FATAL (F_PARITYERR | F_REQQPARERR | F_DISPQPARERR)
 
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index c5a142bea5e9..5d72bda54389 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -1145,7 +1145,7 @@ static void write_tx_pkt_wr(struct adapter *adap, struct sk_buff *skb,
         cpl->len = htonl(skb->len);
         cntrl = V_TXPKT_INTF(pi->port_id);
 
-        if (vlan_tx_tag_present(skb) && pi->vlan_grp)
+        if (vlan_tx_tag_present(skb))
                 cntrl |= F_TXPKT_VLAN_VLD | V_TXPKT_VLAN(vlan_tx_tag_get(skb));
 
         tso_info = V_LSO_MSS(skb_shinfo(skb)->gso_size);
@@ -1279,7 +1279,7 @@ netdev_tx_t t3_eth_xmit(struct sk_buff *skb, struct net_device *dev)
                 qs->port_stats[SGE_PSTAT_TX_CSUM]++;
         if (skb_shinfo(skb)->gso_size)
                 qs->port_stats[SGE_PSTAT_TSO]++;
-        if (vlan_tx_tag_present(skb) && pi->vlan_grp)
+        if (vlan_tx_tag_present(skb))
                 qs->port_stats[SGE_PSTAT_VLANINS]++;
 
         /*
@@ -2554,7 +2554,7 @@ static inline int handle_responses(struct adapter *adap, struct sge_rspq *q)
  * The MSI-X interrupt handler for an SGE response queue for the non-NAPI case
  * (i.e., response queue serviced in hard interrupt).
  */
-irqreturn_t t3_sge_intr_msix(int irq, void *cookie)
+static irqreturn_t t3_sge_intr_msix(int irq, void *cookie)
 {
         struct sge_qset *qs = cookie;
         struct adapter *adap = qs->adap;
@@ -3320,40 +3320,3 @@ void t3_sge_prep(struct adapter *adap, struct sge_params *p)
 
         spin_lock_init(&adap->sge.reg_lock);
 }
-
-/**
- *      t3_get_desc - dump an SGE descriptor for debugging purposes
- *      @qs: the queue set
- *      @qnum: identifies the specific queue (0..2: Tx, 3:response, 4..5: Rx)
- *      @idx: the descriptor index in the queue
- *      @data: where to dump the descriptor contents
- *
- *      Dumps the contents of a HW descriptor of an SGE queue.  Returns the
- *      size of the descriptor.
- */
-int t3_get_desc(const struct sge_qset *qs, unsigned int qnum, unsigned int idx,
-                unsigned char *data)
-{
-        if (qnum >= 6)
-                return -EINVAL;
-
-        if (qnum < 3) {
-                if (!qs->txq[qnum].desc || idx >= qs->txq[qnum].size)
-                        return -EINVAL;
-                memcpy(data, &qs->txq[qnum].desc[idx], sizeof(struct tx_desc));
-                return sizeof(struct tx_desc);
-        }
-
-        if (qnum == 3) {
-                if (!qs->rspq.desc || idx >= qs->rspq.size)
-                        return -EINVAL;
-                memcpy(data, &qs->rspq.desc[idx], sizeof(struct rsp_desc));
-                return sizeof(struct rsp_desc);
-        }
-
-        qnum -= 4;
-        if (!qs->fl[qnum].desc || idx >= qs->fl[qnum].size)
-                return -EINVAL;
-        memcpy(data, &qs->fl[qnum].desc[idx], sizeof(struct rx_desc));
-        return sizeof(struct rx_desc);
-}
diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
index 421d5589cecd..3a6adf0b3e9d 100644
--- a/drivers/net/cxgb3/t3_hw.c
+++ b/drivers/net/cxgb3/t3_hw.c
@@ -34,6 +34,8 @@
 #include "sge_defs.h"
 #include "firmware_exports.h"
 
+static void t3_port_intr_clear(struct adapter *adapter, int idx);
+
 /**
  *      t3_wait_op_done_val - wait until an operation is completed
  *      @adapter: the adapter performing the operation
@@ -840,8 +842,8 @@ static int flash_wait_op(struct adapter *adapter, int attempts, int delay)
  *      (i.e., big-endian), otherwise as 32-bit words in the platform's
  *      natural endianess.
  */
-int t3_read_flash(struct adapter *adapter, unsigned int addr,
-                  unsigned int nwords, u32 *data, int byte_oriented)
+static int t3_read_flash(struct adapter *adapter, unsigned int addr,
+                         unsigned int nwords, u32 *data, int byte_oriented)
 {
         int ret;
 
@@ -2111,7 +2113,7 @@ void t3_port_intr_disable(struct adapter *adapter, int idx)
  *      Clear port-specific (i.e., MAC and PHY) interrupts for the given
  *      adapter port.
  */
-void t3_port_intr_clear(struct adapter *adapter, int idx)
+static void t3_port_intr_clear(struct adapter *adapter, int idx)
 {
         struct cphy *phy = &adap2pinfo(adapter, idx)->phy;
 
@@ -2484,98 +2486,6 @@ int t3_sge_cqcntxt_op(struct adapter *adapter, unsigned int id, unsigned int op,
 }
 
 /**
- *      t3_sge_read_context - read an SGE context
- *      @type: the context type
- *      @adapter: the adapter
- *      @id: the context id
- *      @data: holds the retrieved context
- *
- *      Read an SGE egress context.  The caller is responsible for ensuring
- *      only one context operation occurs at a time.
- */
-static int t3_sge_read_context(unsigned int type, struct adapter *adapter,
-                               unsigned int id, u32 data[4])
-{
-        if (t3_read_reg(adapter, A_SG_CONTEXT_CMD) & F_CONTEXT_CMD_BUSY)
-                return -EBUSY;
-
-        t3_write_reg(adapter, A_SG_CONTEXT_CMD,
-                     V_CONTEXT_CMD_OPCODE(0) | type | V_CONTEXT(id));
-        if (t3_wait_op_done(adapter, A_SG_CONTEXT_CMD, F_CONTEXT_CMD_BUSY, 0,
-                            SG_CONTEXT_CMD_ATTEMPTS, 1))
-                return -EIO;
-        data[0] = t3_read_reg(adapter, A_SG_CONTEXT_DATA0);
-        data[1] = t3_read_reg(adapter, A_SG_CONTEXT_DATA1);
-        data[2] = t3_read_reg(adapter, A_SG_CONTEXT_DATA2);
-        data[3] = t3_read_reg(adapter, A_SG_CONTEXT_DATA3);
-        return 0;
-}
-
-/**
- *      t3_sge_read_ecntxt - read an SGE egress context
- *      @adapter: the adapter
- *      @id: the context id
- *      @data: holds the retrieved context
- *
- *      Read an SGE egress context.  The caller is responsible for ensuring
- *      only one context operation occurs at a time.
- */
-int t3_sge_read_ecntxt(struct adapter *adapter, unsigned int id, u32 data[4])
-{
-        if (id >= 65536)
-                return -EINVAL;
-        return t3_sge_read_context(F_EGRESS, adapter, id, data);
-}
-
-/**
- *      t3_sge_read_cq - read an SGE CQ context
- *      @adapter: the adapter
- *      @id: the context id
- *      @data: holds the retrieved context
- *
- *      Read an SGE CQ context.  The caller is responsible for ensuring
- *      only one context operation occurs at a time.
- */
-int t3_sge_read_cq(struct adapter *adapter, unsigned int id, u32 data[4])
-{
-        if (id >= 65536)
-                return -EINVAL;
-        return t3_sge_read_context(F_CQ, adapter, id, data);
-}
-
-/**
- *      t3_sge_read_fl - read an SGE free-list context
- *      @adapter: the adapter
- *      @id: the context id
- *      @data: holds the retrieved context
- *
- *      Read an SGE free-list context.  The caller is responsible for ensuring
- *      only one context operation occurs at a time.
- */
-int t3_sge_read_fl(struct adapter *adapter, unsigned int id, u32 data[4])
-{
-        if (id >= SGE_QSETS * 2)
-                return -EINVAL;
-        return t3_sge_read_context(F_FREELIST, adapter, id, data);
-}
-
-/**
- *      t3_sge_read_rspq - read an SGE response queue context
- *      @adapter: the adapter
- *      @id: the context id
- *      @data: holds the retrieved context
- *
- *      Read an SGE response queue context.  The caller is responsible for
- *      ensuring only one context operation occurs at a time.
- */
-int t3_sge_read_rspq(struct adapter *adapter, unsigned int id, u32 data[4])
-{
-        if (id >= SGE_QSETS)
-                return -EINVAL;
-        return t3_sge_read_context(F_RESPONSEQ, adapter, id, data);
-}
-
-/**
  *      t3_config_rss - configure Rx packet steering
  *      @adapter: the adapter
  *      @rss_config: RSS settings (written to TP_RSS_CONFIG)
@@ -2616,42 +2526,6 @@ void t3_config_rss(struct adapter *adapter, unsigned int rss_config,
 }
 
 /**
- *      t3_read_rss - read the contents of the RSS tables
- *      @adapter: the adapter
- *      @lkup: holds the contents of the RSS lookup table
- *      @map: holds the contents of the RSS map table
- *
- *      Reads the contents of the receive packet steering tables.
- */
-int t3_read_rss(struct adapter *adapter, u8 * lkup, u16 *map)
-{
-        int i;
-        u32 val;
-
-        if (lkup)
-                for (i = 0; i < RSS_TABLE_SIZE; ++i) {
-                        t3_write_reg(adapter, A_TP_RSS_LKP_TABLE,
-                                     0xffff0000 | i);
-                        val = t3_read_reg(adapter, A_TP_RSS_LKP_TABLE);
-                        if (!(val & 0x80000000))
-                                return -EAGAIN;
-                        *lkup++ = val;
-                        *lkup++ = (val >> 8);
-                }
-
-        if (map)
-                for (i = 0; i < RSS_TABLE_SIZE; ++i) {
-                        t3_write_reg(adapter, A_TP_RSS_MAP_TABLE,
-                                     0xffff0000 | i);
-                        val = t3_read_reg(adapter, A_TP_RSS_MAP_TABLE);
-                        if (!(val & 0x80000000))
-                                return -EAGAIN;
-                        *map++ = val;
-                }
-        return 0;
-}
-
-/**
  *      t3_tp_set_offload_mode - put TP in NIC/offload mode
  *      @adap: the adapter
  *      @enable: 1 to select offload mode, 0 for regular NIC
@@ -2868,7 +2742,8 @@ static void tp_set_timers(struct adapter *adap, unsigned int core_clk)
  *
  *      Set the receive coalescing size and PSH bit handling.
  */
-int t3_tp_set_coalescing_size(struct adapter *adap, unsigned int size, int psh)
+static int t3_tp_set_coalescing_size(struct adapter *adap,
+                                     unsigned int size, int psh)
 {
         u32 val;
 
@@ -2898,7 +2773,7 @@ int t3_tp_set_coalescing_size(struct adapter *adap, unsigned int size, int psh)
  *      Set TP's max receive size.  This is the limit that applies when
  *      receive coalescing is disabled.
  */
-void t3_tp_set_max_rxsize(struct adapter *adap, unsigned int size)
+static void t3_tp_set_max_rxsize(struct adapter *adap, unsigned int size)
 {
         t3_write_reg(adap, A_TP_PARA_REG7,
                      V_PMMAXXFERLEN0(size) | V_PMMAXXFERLEN1(size));
@@ -3018,48 +2893,6 @@ void t3_load_mtus(struct adapter *adap, unsigned short mtus[NMTUS],
 }
 
 /**
- *      t3_read_hw_mtus - returns the values in the HW MTU table
- *      @adap: the adapter
- *      @mtus: where to store the HW MTU values
- *
- *      Reads the HW MTU table.
- */
-void t3_read_hw_mtus(struct adapter *adap, unsigned short mtus[NMTUS])
-{
-        int i;
-
-        for (i = 0; i < NMTUS; ++i) {
-                unsigned int val;
-
-                t3_write_reg(adap, A_TP_MTU_TABLE, 0xff000000 | i);
-                val = t3_read_reg(adap, A_TP_MTU_TABLE);
-                mtus[i] = val & 0x3fff;
-        }
-}
-
-/**
- *      t3_get_cong_cntl_tab - reads the congestion control table
- *      @adap: the adapter
- *      @incr: where to store the alpha values
- *
- *      Reads the additive increments programmed into the HW congestion
- *      control table.
- */
-void t3_get_cong_cntl_tab(struct adapter *adap,
-                          unsigned short incr[NMTUS][NCCTRL_WIN])
-{
-        unsigned int mtu, w;
-
-        for (mtu = 0; mtu < NMTUS; ++mtu)
-                for (w = 0; w < NCCTRL_WIN; ++w) {
-                        t3_write_reg(adap, A_TP_CCTRL_TABLE,
-                                     0xffff0000 | (mtu << 5) | w);
-                        incr[mtu][w] = t3_read_reg(adap, A_TP_CCTRL_TABLE) &
-                                       0x1fff;
-                }
-}
-
-/**
  *      t3_tp_get_mib_stats - read TP's MIB counters
  *      @adap: the adapter
  *      @tps: holds the returned counter values
@@ -3223,15 +3056,6 @@ static int tp_init(struct adapter *adap, const struct tp_params *p)
         return busy;
 }
 
-int t3_mps_set_active_ports(struct adapter *adap, unsigned int port_mask)
-{
-        if (port_mask & ~((1 << adap->params.nports) - 1))
-                return -EINVAL;
-        t3_set_reg_field(adap, A_MPS_CFG, F_PORT1ACTIVE | F_PORT0ACTIVE,
-                         port_mask << S_PORT0ACTIVE);
-        return 0;
-}
-
 /*
  * Perform the bits of HW initialization that are dependent on the Tx
  * channels being used.
@@ -3687,7 +3511,7 @@ static void mc7_prep(struct adapter *adapter, struct mc7 *mc7,
         mc7->width = G_WIDTH(cfg);
 }
 
-void mac_prep(struct cmac *mac, struct adapter *adapter, int index)
+static void mac_prep(struct cmac *mac, struct adapter *adapter, int index)
 {
         u16 devid;
 
@@ -3707,7 +3531,8 @@ void mac_prep(struct cmac *mac, struct adapter *adapter, int index)
         }
 }
 
-void early_hw_init(struct adapter *adapter, const struct adapter_info *ai)
+static void early_hw_init(struct adapter *adapter,
+                          const struct adapter_info *ai)
 {
         u32 val = V_PORTSPEED(is_10G(adapter) ? 3 : 2);
 
diff --git a/drivers/net/cxgb4/cxgb4.h b/drivers/net/cxgb4/cxgb4.h
index 3ece9f5069fa..eaa49e4119f1 100644
--- a/drivers/net/cxgb4/cxgb4.h
+++ b/drivers/net/cxgb4/cxgb4.h
@@ -592,7 +592,6 @@ void t4_os_portmod_changed(const struct adapter *adap, int port_id);
 void t4_os_link_changed(struct adapter *adap, int port_id, int link_stat);
 
 void *t4_alloc_mem(size_t size);
-void t4_free_mem(void *addr);
 
 void t4_free_sge_resources(struct adapter *adap);
 irq_handler_t t4_intr_handler(struct adapter *adap);
@@ -651,7 +650,6 @@ static inline int t4_wr_mbox_ns(struct adapter *adap, int mbox, const void *cmd,
 
 void t4_intr_enable(struct adapter *adapter);
 void t4_intr_disable(struct adapter *adapter);
-void t4_intr_clear(struct adapter *adapter);
 int t4_slow_intr_handler(struct adapter *adapter);
 
 int t4_wait_dev_ready(struct adapter *adap);
@@ -664,24 +662,16 @@ int t4_check_fw_version(struct adapter *adapter);
 int t4_prep_adapter(struct adapter *adapter);
 int t4_port_init(struct adapter *adap, int mbox, int pf, int vf);
 void t4_fatal_err(struct adapter *adapter);
-int t4_set_trace_filter(struct adapter *adapter, const struct trace_params *tp,
-                        int filter_index, int enable);
-void t4_get_trace_filter(struct adapter *adapter, struct trace_params *tp,
-                         int filter_index, int *enabled);
 int t4_config_rss_range(struct adapter *adapter, int mbox, unsigned int viid,
                         int start, int n, const u16 *rspq, unsigned int nrspq);
 int t4_config_glbl_rss(struct adapter *adapter, int mbox, unsigned int mode,
                        unsigned int flags);
-int t4_read_rss(struct adapter *adapter, u16 *entries);
 int t4_mc_read(struct adapter *adap, u32 addr, __be32 *data, u64 *parity);
 int t4_edc_read(struct adapter *adap, int idx, u32 addr, __be32 *data,
                 u64 *parity);
 
 void t4_get_port_stats(struct adapter *adap, int idx, struct port_stats *p);
-void t4_get_lb_stats(struct adapter *adap, int idx, struct lb_port_stats *p);
-
 void t4_read_mtu_tbl(struct adapter *adap, u16 *mtus, u8 *mtu_log);
-void t4_tp_get_err_stats(struct adapter *adap, struct tp_err_stats *st);
 void t4_tp_get_tcp_stats(struct adapter *adap, struct tp_tcp_stats *v4,
                          struct tp_tcp_stats *v6);
 void t4_load_mtus(struct adapter *adap, const unsigned short *mtus,
@@ -711,8 +701,6 @@ int t4_cfg_pfvf(struct adapter *adap, unsigned int mbox, unsigned int pf,
 int t4_alloc_vi(struct adapter *adap, unsigned int mbox, unsigned int port,
                 unsigned int pf, unsigned int vf, unsigned int nmac, u8 *mac,
                 unsigned int *rss_size);
-int t4_free_vi(struct adapter *adap, unsigned int mbox, unsigned int pf,
-               unsigned int vf, unsigned int viid);
 int t4_set_rxmode(struct adapter *adap, unsigned int mbox, unsigned int viid,
                 int mtu, int promisc, int all_multi, int bcast, int vlanex,
                 bool sleep_ok);
@@ -731,9 +719,6 @@ int t4_mdio_rd(struct adapter *adap, unsigned int mbox, unsigned int phy_addr,
                unsigned int mmd, unsigned int reg, u16 *valp);
 int t4_mdio_wr(struct adapter *adap, unsigned int mbox, unsigned int phy_addr,
                unsigned int mmd, unsigned int reg, u16 val);
-int t4_iq_start_stop(struct adapter *adap, unsigned int mbox, bool start,
-                     unsigned int pf, unsigned int vf, unsigned int iqid,
-                     unsigned int fl0id, unsigned int fl1id);
 int t4_iq_free(struct adapter *adap, unsigned int mbox, unsigned int pf,
                unsigned int vf, unsigned int iqtype, unsigned int iqid,
                unsigned int fl0id, unsigned int fl1id);
diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
index 75b9401fd484..930bd075a43e 100644
--- a/drivers/net/cxgb4/cxgb4_main.c
+++ b/drivers/net/cxgb4/cxgb4_main.c
@@ -880,7 +880,7 @@ void *t4_alloc_mem(size_t size)
 /*
  * Free memory allocated through alloc_mem().
  */
-void t4_free_mem(void *addr)
+static void t4_free_mem(void *addr)
 {
         if (is_vmalloc_addr(addr))
                 vfree(addr);
@@ -2206,8 +2206,8 @@ static void mk_tid_release(struct sk_buff *skb, unsigned int chan,
  * Queue a TID release request and if necessary schedule a work queue to
  * process it.
  */
-void cxgb4_queue_tid_release(struct tid_info *t, unsigned int chan,
-                             unsigned int tid)
+static void cxgb4_queue_tid_release(struct tid_info *t, unsigned int chan,
+                                    unsigned int tid)
 {
         void **p = &t->tid_tab[tid];
         struct adapter *adap = container_of(t, struct adapter, tids);
@@ -2222,7 +2222,6 @@ void cxgb4_queue_tid_release(struct tid_info *t, unsigned int chan,
         }
         spin_unlock_bh(&adap->tid_release_lock);
 }
-EXPORT_SYMBOL(cxgb4_queue_tid_release);
 
 /*
  * Process the list of pending TID release requests.
@@ -2355,48 +2354,6 @@ int cxgb4_create_server(const struct net_device *dev, unsigned int stid,
 EXPORT_SYMBOL(cxgb4_create_server);
 
 /**
- *      cxgb4_create_server6 - create an IPv6 server
- *      @dev: the device
- *      @stid: the server TID
- *      @sip: local IPv6 address to bind server to
- *      @sport: the server's TCP port
- *      @queue: queue to direct messages from this server to
- *
- *      Create an IPv6 server for the given port and address.
- *      Returns <0 on error and one of the %NET_XMIT_* values on success.
- */
-int cxgb4_create_server6(const struct net_device *dev, unsigned int stid,
-                         const struct in6_addr *sip, __be16 sport,
-                         unsigned int queue)
-{
-        unsigned int chan;
-        struct sk_buff *skb;
-        struct adapter *adap;
-        struct cpl_pass_open_req6 *req;
-
-        skb = alloc_skb(sizeof(*req), GFP_KERNEL);
-        if (!skb)
-                return -ENOMEM;
-
-        adap = netdev2adap(dev);
-        req = (struct cpl_pass_open_req6 *)__skb_put(skb, sizeof(*req));
-        INIT_TP_WR(req, 0);
-        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_PASS_OPEN_REQ6, stid));
-        req->local_port = sport;
-        req->peer_port = htons(0);
-        req->local_ip_hi = *(__be64 *)(sip->s6_addr);
-        req->local_ip_lo = *(__be64 *)(sip->s6_addr + 8);
-        req->peer_ip_hi = cpu_to_be64(0);
-        req->peer_ip_lo = cpu_to_be64(0);
-        chan = rxq_to_chan(&adap->sge, queue);
-        req->opt0 = cpu_to_be64(TX_CHAN(chan));
-        req->opt1 = cpu_to_be64(CONN_POLICY_ASK |
-                                SYN_RSS_ENABLE | SYN_RSS_QUEUE(queue));
-        return t4_mgmt_tx(adap, skb);
-}
-EXPORT_SYMBOL(cxgb4_create_server6);
-
-/**
  *      cxgb4_best_mtu - find the entry in the MTU table closest to an MTU
  *      @mtus: the HW MTU table
  *      @mtu: the target MTU
@@ -2455,25 +2412,6 @@ unsigned int cxgb4_port_idx(const struct net_device *dev)
 }
 EXPORT_SYMBOL(cxgb4_port_idx);
 
-/**
- *      cxgb4_netdev_by_hwid - return the net device of a HW port
- *      @pdev: identifies the adapter
- *      @id: the HW port id
- *
- *      Return the net device associated with the interface with the given HW
- *      id.
- */
-struct net_device *cxgb4_netdev_by_hwid(struct pci_dev *pdev, unsigned int id)
-{
-        const struct adapter *adap = pci_get_drvdata(pdev);
-
-        if (!adap || id >= NCHAN)
-                return NULL;
-        id = adap->chan_map[id];
-        return id < MAX_NPORTS ? adap->port[id] : NULL;
-}
-EXPORT_SYMBOL(cxgb4_netdev_by_hwid);
-
 void cxgb4_get_tcp_stats(struct pci_dev *pdev, struct tp_tcp_stats *v4,
                          struct tp_tcp_stats *v6)
 {
@@ -2763,7 +2701,10 @@ static int cxgb_open(struct net_device *dev)
                         return err;
         }
 
-        dev->real_num_tx_queues = pi->nqsets;
+        netif_set_real_num_tx_queues(dev, pi->nqsets);
+        err = netif_set_real_num_rx_queues(dev, pi->nqsets);
+        if (err)
+                return err;
         err = link_start(dev);
         if (!err)
                 netif_tx_start_all_queues(dev);
@@ -3860,7 +3801,7 @@ static void __devexit remove_one(struct pci_dev *pdev)
                 pci_disable_device(pdev);
                 pci_release_regions(pdev);
                 pci_set_drvdata(pdev, NULL);
-        } else if (PCI_FUNC(pdev->devfn) > 0)
+        } else
                 pci_release_regions(pdev);
 }
 
diff --git a/drivers/net/cxgb4/cxgb4_uld.h b/drivers/net/cxgb4/cxgb4_uld.h
index 85d74e751ce0..1b48c0170145 100644
--- a/drivers/net/cxgb4/cxgb4_uld.h
+++ b/drivers/net/cxgb4/cxgb4_uld.h
@@ -139,16 +139,11 @@ int cxgb4_alloc_stid(struct tid_info *t, int family, void *data);
 void cxgb4_free_atid(struct tid_info *t, unsigned int atid);
 void cxgb4_free_stid(struct tid_info *t, unsigned int stid, int family);
 void cxgb4_remove_tid(struct tid_info *t, unsigned int qid, unsigned int tid);
-void cxgb4_queue_tid_release(struct tid_info *t, unsigned int chan,
-                             unsigned int tid);
 
 struct in6_addr;
 
 int cxgb4_create_server(const struct net_device *dev, unsigned int stid,
                         __be32 sip, __be16 sport, unsigned int queue);
-int cxgb4_create_server6(const struct net_device *dev, unsigned int stid,
-                         const struct in6_addr *sip, __be16 sport,
-                         unsigned int queue);
 
 static inline void set_wr_txq(struct sk_buff *skb, int prio, int queue)
 {
@@ -233,7 +228,6 @@ int cxgb4_ofld_send(struct net_device *dev, struct sk_buff *skb);
 unsigned int cxgb4_port_chan(const struct net_device *dev);
 unsigned int cxgb4_port_viid(const struct net_device *dev);
 unsigned int cxgb4_port_idx(const struct net_device *dev);
-struct net_device *cxgb4_netdev_by_hwid(struct pci_dev *pdev, unsigned int id);
 unsigned int cxgb4_best_mtu(const unsigned short *mtus, unsigned short mtu,
                             unsigned int *idx);
 void cxgb4_get_tcp_stats(struct pci_dev *pdev, struct tp_tcp_stats *v4,
diff --git a/drivers/net/cxgb4/l2t.c b/drivers/net/cxgb4/l2t.c
index e8f0f55e9d08..a2d323c473f8 100644
--- a/drivers/net/cxgb4/l2t.c
+++ b/drivers/net/cxgb4/l2t.c
@@ -481,40 +481,6 @@ void t4_l2t_update(struct adapter *adap, struct neighbour *neigh)
                 handle_failed_resolution(adap, arpq);
 }
 
-/*
- * Allocate an L2T entry for use by a switching rule.  Such entries need to be
- * explicitly freed and while busy they are not on any hash chain, so normal
- * address resolution updates do not see them.
- */
-struct l2t_entry *t4_l2t_alloc_switching(struct l2t_data *d)
-{
-        struct l2t_entry *e;
-
-        write_lock_bh(&d->lock);
-        e = alloc_l2e(d);
-        if (e) {
-                spin_lock(&e->lock);          /* avoid race with t4_l2t_free */
-                e->state = L2T_STATE_SWITCHING;
-                atomic_set(&e->refcnt, 1);
-                spin_unlock(&e->lock);
-        }
-        write_unlock_bh(&d->lock);
-        return e;
-}
-
-/*
- * Sets/updates the contents of a switching L2T entry that has been allocated
- * with an earlier call to @t4_l2t_alloc_switching.
- */
-int t4_l2t_set_switching(struct adapter *adap, struct l2t_entry *e, u16 vlan,
-                         u8 port, u8 *eth_addr)
-{
-        e->vlan = vlan;
-        e->lport = port;
-        memcpy(e->dmac, eth_addr, ETH_ALEN);
-        return write_l2e(adap, e, 0);
-}
-
 struct l2t_data *t4_init_l2t(void)
 {
         int i;
diff --git a/drivers/net/cxgb4/l2t.h b/drivers/net/cxgb4/l2t.h
index 643f27ed3cf4..7bd8f42378ff 100644
--- a/drivers/net/cxgb4/l2t.h
+++ b/drivers/net/cxgb4/l2t.h
@@ -100,9 +100,6 @@ struct l2t_entry *cxgb4_l2t_get(struct l2t_data *d, struct neighbour *neigh,
                                 unsigned int priority);
 
 void t4_l2t_update(struct adapter *adap, struct neighbour *neigh);
-struct l2t_entry *t4_l2t_alloc_switching(struct l2t_data *d);
-int t4_l2t_set_switching(struct adapter *adap, struct l2t_entry *e, u16 vlan,
-                         u8 port, u8 *eth_addr);
 struct l2t_data *t4_init_l2t(void);
 void do_l2t_write_rpl(struct adapter *p, const struct cpl_l2t_write_rpl *rpl);
 
diff --git a/drivers/net/cxgb4/t4_hw.c b/drivers/net/cxgb4/t4_hw.c
index 9e1a4b49b47a..bb813d94aea8 100644
--- a/drivers/net/cxgb4/t4_hw.c
+++ b/drivers/net/cxgb4/t4_hw.c
@@ -120,30 +120,6 @@ static void t4_read_indirect(struct adapter *adap, unsigned int addr_reg,
         }
 }
 
-#if 0
-/**
- *      t4_write_indirect - write indirectly addressed registers
- *      @adap: the adapter
- *      @addr_reg: register holding the indirect addresses
- *      @data_reg: register holding the value for the indirect registers
- *      @vals: values to write
- *      @nregs: how many indirect registers to write
- *      @start_idx: address of first indirect register to write
- *
- *      Writes a sequential block of registers that are accessed indirectly
- *      through an address/data register pair.
- */
-static void t4_write_indirect(struct adapter *adap, unsigned int addr_reg,
-                              unsigned int data_reg, const u32 *vals,
-                              unsigned int nregs, unsigned int start_idx)
-{
-        while (nregs--) {
-                t4_write_reg(adap, addr_reg, start_idx++);
-                t4_write_reg(adap, data_reg, *vals++);
-        }
-}
-#endif
-
 /*
  * Get the reply to a mailbox command and store it in @rpl in big-endian order.
  */
@@ -1560,44 +1536,6 @@ void t4_intr_disable(struct adapter *adapter)
 }
 
 /**
- *      t4_intr_clear - clear all interrupts
- *      @adapter: the adapter whose interrupts should be cleared
- *
- *      Clears all interrupts.  The caller must be a PCI function managing
- *      global interrupts.
- */
-void t4_intr_clear(struct adapter *adapter)
-{
-        static const unsigned int cause_reg[] = {
-                SGE_INT_CAUSE1, SGE_INT_CAUSE2, SGE_INT_CAUSE3,
-                PCIE_CORE_UTL_SYSTEM_BUS_AGENT_STATUS,
-                PCIE_CORE_UTL_PCI_EXPRESS_PORT_STATUS,
-                PCIE_NONFAT_ERR, PCIE_INT_CAUSE,
-                MC_INT_CAUSE,
-                MA_INT_WRAP_STATUS, MA_PARITY_ERROR_STATUS, MA_INT_CAUSE,
-                EDC_INT_CAUSE, EDC_REG(EDC_INT_CAUSE, 1),
-                CIM_HOST_INT_CAUSE, CIM_HOST_UPACC_INT_CAUSE,
-                MYPF_REG(CIM_PF_HOST_INT_CAUSE),
-                TP_INT_CAUSE,
-                ULP_RX_INT_CAUSE, ULP_TX_INT_CAUSE,
-                PM_RX_INT_CAUSE, PM_TX_INT_CAUSE,
-                MPS_RX_PERR_INT_CAUSE,
-                CPL_INTR_CAUSE,
-                MYPF_REG(PL_PF_INT_CAUSE),
-                PL_PL_INT_CAUSE,
-                LE_DB_INT_CAUSE,
-        };
-
-        unsigned int i;
-
-        for (i = 0; i < ARRAY_SIZE(cause_reg); ++i)
-                t4_write_reg(adapter, cause_reg[i], 0xffffffff);
-
-        t4_write_reg(adapter, PL_INT_CAUSE, GLBL_INTR_MASK);
-        (void) t4_read_reg(adapter, PL_INT_CAUSE);          /* flush */
-}
-
-/**
  *      hash_mac_addr - return the hash value of a MAC address
  *      @addr: the 48-bit Ethernet MAC address
  *
@@ -1709,36 +1647,6 @@ int t4_config_glbl_rss(struct adapter *adapter, int mbox, unsigned int mode,
         return t4_wr_mbox(adapter, mbox, &c, sizeof(c), NULL);
 }
 
-/* Read an RSS table row */
-static int rd_rss_row(struct adapter *adap, int row, u32 *val)
-{
-        t4_write_reg(adap, TP_RSS_LKP_TABLE, 0xfff00000 | row);
-        return t4_wait_op_done_val(adap, TP_RSS_LKP_TABLE, LKPTBLROWVLD, 1,
-                                   5, 0, val);
-}
-
-/**
- *      t4_read_rss - read the contents of the RSS mapping table
- *      @adapter: the adapter
- *      @map: holds the contents of the RSS mapping table
- *
- *      Reads the contents of the RSS hash->queue mapping table.
- */
-int t4_read_rss(struct adapter *adapter, u16 *map)
-{
-        u32 val;
-        int i, ret;
-
-        for (i = 0; i < RSS_NENTRIES / 2; ++i) {
-                ret = rd_rss_row(adapter, i, &val);
-                if (ret)
-                        return ret;
-                *map++ = LKPTBLQUEUE0_GET(val);
-                *map++ = LKPTBLQUEUE1_GET(val);
-        }
-        return 0;
-}
-
 /**
  *      t4_tp_get_tcp_stats - read TP's TCP MIB counters
  *      @adap: the adapter
@@ -1779,29 +1687,6 @@ void t4_tp_get_tcp_stats(struct adapter *adap, struct tp_tcp_stats *v4,
 }
 
 /**
- *      t4_tp_get_err_stats - read TP's error MIB counters
- *      @adap: the adapter
- *      @st: holds the counter values
- *
- *      Returns the values of TP's error counters.
- */
-void t4_tp_get_err_stats(struct adapter *adap, struct tp_err_stats *st)
-{
-        t4_read_indirect(adap, TP_MIB_INDEX, TP_MIB_DATA, st->macInErrs,
-                         12, TP_MIB_MAC_IN_ERR_0);
-        t4_read_indirect(adap, TP_MIB_INDEX, TP_MIB_DATA, st->tnlCongDrops,
-                         8, TP_MIB_TNL_CNG_DROP_0);
-        t4_read_indirect(adap, TP_MIB_INDEX, TP_MIB_DATA, st->tnlTxDrops,
-                         4, TP_MIB_TNL_DROP_0);
-        t4_read_indirect(adap, TP_MIB_INDEX, TP_MIB_DATA, st->ofldVlanDrops,
-                         4, TP_MIB_OFD_VLN_DROP_0);
-        t4_read_indirect(adap, TP_MIB_INDEX, TP_MIB_DATA, st->tcp6InErrs,
-                         4, TP_MIB_TCP_V6IN_ERR_0);
-        t4_read_indirect(adap, TP_MIB_INDEX, TP_MIB_DATA, &st->ofldNoNeigh,
-                         2, TP_MIB_OFD_ARP_DROP);
-}
-
-/**
  *      t4_read_mtu_tbl - returns the values in the HW path MTU table
  *      @adap: the adapter
  *      @mtus: where to store the MTU values
@@ -1916,122 +1801,6 @@ void t4_load_mtus(struct adapter *adap, const unsigned short *mtus,
 }
 
 /**
- *      t4_set_trace_filter - configure one of the tracing filters
- *      @adap: the adapter
- *      @tp: the desired trace filter parameters
- *      @idx: which filter to configure
- *      @enable: whether to enable or disable the filter
- *
- *      Configures one of the tracing filters available in HW.  If @enable is
- *      %0 @tp is not examined and may be %NULL.
- */
-int t4_set_trace_filter(struct adapter *adap, const struct trace_params *tp,
-                        int idx, int enable)
-{
-        int i, ofst = idx * 4;
-        u32 data_reg, mask_reg, cfg;
-        u32 multitrc = TRCMULTIFILTER;
-
-        if (!enable) {
-                t4_write_reg(adap, MPS_TRC_FILTER_MATCH_CTL_A + ofst, 0);
-                goto out;
-        }
-
-        if (tp->port > 11 || tp->invert > 1 || tp->skip_len > 0x1f ||
-            tp->skip_ofst > 0x1f || tp->min_len > 0x1ff ||
-            tp->snap_len > 9600 || (idx && tp->snap_len > 256))
-                return -EINVAL;
-
-        if (tp->snap_len > 256) {            /* must be tracer 0 */
-                if ((t4_read_reg(adap, MPS_TRC_FILTER_MATCH_CTL_A + 4) |
-                     t4_read_reg(adap, MPS_TRC_FILTER_MATCH_CTL_A + 8) |
-                     t4_read_reg(adap, MPS_TRC_FILTER_MATCH_CTL_A + 12)) & TFEN)
-                        return -EINVAL;  /* other tracers are enabled */
-                multitrc = 0;
-        } else if (idx) {
-                i = t4_read_reg(adap, MPS_TRC_FILTER_MATCH_CTL_B);
-                if (TFCAPTUREMAX_GET(i) > 256 &&
-                    (t4_read_reg(adap, MPS_TRC_FILTER_MATCH_CTL_A) & TFEN))
-                        return -EINVAL;
-        }
-
-        /* stop the tracer we'll be changing */
-        t4_write_reg(adap, MPS_TRC_FILTER_MATCH_CTL_A + ofst, 0);
-
-        /* disable tracing globally if running in the wrong single/multi mode */
-        cfg = t4_read_reg(adap, MPS_TRC_CFG);
-        if ((cfg & TRCEN) && multitrc != (cfg & TRCMULTIFILTER)) {
-                t4_write_reg(adap, MPS_TRC_CFG, cfg ^ TRCEN);
-                t4_read_reg(adap, MPS_TRC_CFG);                  /* flush */
-                msleep(1);
-                if (!(t4_read_reg(adap, MPS_TRC_CFG) & TRCFIFOEMPTY))
-                        return -ETIMEDOUT;
-        }
-        /*
-         * At this point either the tracing is enabled and in the right mode or
-         * disabled.
-         */
-
-        idx *= (MPS_TRC_FILTER1_MATCH - MPS_TRC_FILTER0_MATCH);
-        data_reg = MPS_TRC_FILTER0_MATCH + idx;
-        mask_reg = MPS_TRC_FILTER0_DONT_CARE + idx;
-
-        for (i = 0; i < TRACE_LEN / 4; i++, data_reg += 4, mask_reg += 4) {
-                t4_write_reg(adap, data_reg, tp->data[i]);
-                t4_write_reg(adap, mask_reg, ~tp->mask[i]);
-        }
-        t4_write_reg(adap, MPS_TRC_FILTER_MATCH_CTL_B + ofst,
-                     TFCAPTUREMAX(tp->snap_len) |
-                     TFMINPKTSIZE(tp->min_len));
-        t4_write_reg(adap, MPS_TRC_FILTER_MATCH_CTL_A + ofst,
-                     TFOFFSET(tp->skip_ofst) | TFLENGTH(tp->skip_len) |
-                     TFPORT(tp->port) | TFEN |
-                     (tp->invert ? TFINVERTMATCH : 0));
-
-        cfg &= ~TRCMULTIFILTER;
-        t4_write_reg(adap, MPS_TRC_CFG, cfg | TRCEN | multitrc);
-out:    t4_read_reg(adap, MPS_TRC_CFG);  /* flush */
-        return 0;
-}
-
-/**
- *      t4_get_trace_filter - query one of the tracing filters
- *      @adap: the adapter
- *      @tp: the current trace filter parameters
- *      @idx: which trace filter to query
- *      @enabled: non-zero if the filter is enabled
- *
- *      Returns the current settings of one of the HW tracing filters.
- */
-void t4_get_trace_filter(struct adapter *adap, struct trace_params *tp, int idx,
-                         int *enabled)
-{
-        u32 ctla, ctlb;
-        int i, ofst = idx * 4;
-        u32 data_reg, mask_reg;
-
-        ctla = t4_read_reg(adap, MPS_TRC_FILTER_MATCH_CTL_A + ofst);
-        ctlb = t4_read_reg(adap, MPS_TRC_FILTER_MATCH_CTL_B + ofst);
-
-        *enabled = !!(ctla & TFEN);
-        tp->snap_len = TFCAPTUREMAX_GET(ctlb);
-        tp->min_len = TFMINPKTSIZE_GET(ctlb);
-        tp->skip_ofst = TFOFFSET_GET(ctla);
-        tp->skip_len = TFLENGTH_GET(ctla);
-        tp->invert = !!(ctla & TFINVERTMATCH);
-        tp->port = TFPORT_GET(ctla);
-
-        ofst = (MPS_TRC_FILTER1_MATCH - MPS_TRC_FILTER0_MATCH) * idx;
-        data_reg = MPS_TRC_FILTER0_MATCH + ofst;
-        mask_reg = MPS_TRC_FILTER0_DONT_CARE + ofst;
-
-        for (i = 0; i < TRACE_LEN / 4; i++, data_reg += 4, mask_reg += 4) {
-                tp->mask[i] = ~t4_read_reg(adap, mask_reg);
-                tp->data[i] = t4_read_reg(adap, data_reg) & tp->mask[i];
-        }
-}
-
-/**
  *      get_mps_bg_map - return the buffer groups associated with a port
  *      @adap: the adapter
  *      @idx: the port index
@@ -2133,52 +1902,6 @@ void t4_get_port_stats(struct adapter *adap, int idx, struct port_stats *p)
 }
 
 /**
- *      t4_get_lb_stats - collect loopback port statistics
- *      @adap: the adapter
- *      @idx: the loopback port index
- *      @p: the stats structure to fill
- *
- *      Return HW statistics for the given loopback port.
- */
-void t4_get_lb_stats(struct adapter *adap, int idx, struct lb_port_stats *p)
-{
-        u32 bgmap = get_mps_bg_map(adap, idx);
-
-#define GET_STAT(name) \
-        t4_read_reg64(adap, PORT_REG(idx, MPS_PORT_STAT_LB_PORT_##name##_L))
-#define GET_STAT_COM(name) t4_read_reg64(adap, MPS_STAT_##name##_L)
-
-        p->octets           = GET_STAT(BYTES);
-        p->frames           = GET_STAT(FRAMES);
-        p->bcast_frames     = GET_STAT(BCAST);
-        p->mcast_frames     = GET_STAT(MCAST);
-        p->ucast_frames     = GET_STAT(UCAST);
-        p->error_frames     = GET_STAT(ERROR);
-
-        p->frames_64        = GET_STAT(64B);
-        p->frames_65_127    = GET_STAT(65B_127B);
-        p->frames_128_255   = GET_STAT(128B_255B);
-        p->frames_256_511   = GET_STAT(256B_511B);
-        p->frames_512_1023  = GET_STAT(512B_1023B);
-        p->frames_1024_1518 = GET_STAT(1024B_1518B);
-        p->frames_1519_max  = GET_STAT(1519B_MAX);
-        p->drop             = t4_read_reg(adap, PORT_REG(idx,
-                                          MPS_PORT_STAT_LB_PORT_DROP_FRAMES));
-
-        p->ovflow0 = (bgmap & 1) ? GET_STAT_COM(RX_BG_0_LB_DROP_FRAME) : 0;
-        p->ovflow1 = (bgmap & 2) ? GET_STAT_COM(RX_BG_1_LB_DROP_FRAME) : 0;
-        p->ovflow2 = (bgmap & 4) ? GET_STAT_COM(RX_BG_2_LB_DROP_FRAME) : 0;
-        p->ovflow3 = (bgmap & 8) ? GET_STAT_COM(RX_BG_3_LB_DROP_FRAME) : 0;
-        p->trunc0 = (bgmap & 1) ? GET_STAT_COM(RX_BG_0_LB_TRUNC_FRAME) : 0;
-        p->trunc1 = (bgmap & 2) ? GET_STAT_COM(RX_BG_1_LB_TRUNC_FRAME) : 0;
-        p->trunc2 = (bgmap & 4) ? GET_STAT_COM(RX_BG_2_LB_TRUNC_FRAME) : 0;
-        p->trunc3 = (bgmap & 8) ? GET_STAT_COM(RX_BG_3_LB_TRUNC_FRAME) : 0;
-
-#undef GET_STAT
-#undef GET_STAT_COM
-}
-
-/**
  *      t4_wol_magic_enable - enable/disable magic packet WoL
  *      @adap: the adapter
  *      @port: the physical port index
@@ -2584,30 +2307,6 @@ int t4_alloc_vi(struct adapter *adap, unsigned int mbox, unsigned int port,
 }
 
 /**
- *      t4_free_vi - free a virtual interface
- *      @adap: the adapter
- *      @mbox: mailbox to use for the FW command
- *      @pf: the PF owning the VI
- *      @vf: the VF owning the VI
- *      @viid: virtual interface identifiler
- *
- *      Free a previously allocated virtual interface.
- */
-int t4_free_vi(struct adapter *adap, unsigned int mbox, unsigned int pf,
-               unsigned int vf, unsigned int viid)
-{
-        struct fw_vi_cmd c;
-
-        memset(&c, 0, sizeof(c));
-        c.op_to_vfn = htonl(FW_CMD_OP(FW_VI_CMD) | FW_CMD_REQUEST |
-                            FW_CMD_EXEC | FW_VI_CMD_PFN(pf) |
-                            FW_VI_CMD_VFN(vf));
-        c.alloc_to_len16 = htonl(FW_VI_CMD_FREE | FW_LEN16(c));
-        c.type_viid = htons(FW_VI_CMD_VIID(viid));
-        return t4_wr_mbox(adap, mbox, &c, sizeof(c), &c);
-}
-
-/**
  *      t4_set_rxmode - set Rx properties of a virtual interface
  *      @adap: the adapter
  *      @mbox: mailbox to use for the FW command
@@ -2833,37 +2532,6 @@ int t4_identify_port(struct adapter *adap, unsigned int mbox, unsigned int viid,
 }
 
 /**
- *      t4_iq_start_stop - enable/disable an ingress queue and its FLs
- *      @adap: the adapter
- *      @mbox: mailbox to use for the FW command
- *      @start: %true to enable the queues, %false to disable them
- *      @pf: the PF owning the queues
- *      @vf: the VF owning the queues
- *      @iqid: ingress queue id
- *      @fl0id: FL0 queue id or 0xffff if no attached FL0
- *      @fl1id: FL1 queue id or 0xffff if no attached FL1
- *
- *      Starts or stops an ingress queue and its associated FLs, if any.
- */
-int t4_iq_start_stop(struct adapter *adap, unsigned int mbox, bool start,
-                     unsigned int pf, unsigned int vf, unsigned int iqid,
-                     unsigned int fl0id, unsigned int fl1id)
-{
-        struct fw_iq_cmd c;
-
-        memset(&c, 0, sizeof(c));
-        c.op_to_vfn = htonl(FW_CMD_OP(FW_IQ_CMD) | FW_CMD_REQUEST |
-                            FW_CMD_EXEC | FW_IQ_CMD_PFN(pf) |
-                            FW_IQ_CMD_VFN(vf));
-        c.alloc_to_len16 = htonl(FW_IQ_CMD_IQSTART(start) |
-                                 FW_IQ_CMD_IQSTOP(!start) | FW_LEN16(c));
-        c.iqid = htons(iqid);
-        c.fl0id = htons(fl0id);
-        c.fl1id = htons(fl1id);
-        return t4_wr_mbox(adap, mbox, &c, sizeof(c), NULL);
-}
-
-/**
  *      t4_iq_free - free an ingress queue and its FLs
  *      @adap: the adapter
  *      @mbox: mailbox to use for the FW command
diff --git a/drivers/net/cxgb4vf/cxgb4vf_main.c b/drivers/net/cxgb4vf/cxgb4vf_main.c
index 7b6d07f50c71..555ecc5a2e93 100644
--- a/drivers/net/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/cxgb4vf/cxgb4vf_main.c
@@ -748,7 +748,10 @@ static int cxgb4vf_open(struct net_device *dev)
         /*
          * Note that this interface is up and start everything up ...
          */
-        dev->real_num_tx_queues = pi->nqsets;
+        netif_set_real_num_tx_queues(dev, pi->nqsets);
+        err = netif_set_real_num_rx_queues(dev, pi->nqsets);
+        if (err)
+                return err;
         set_bit(pi->port_id, &adapter->open_device_map);
         link_start(dev);
         netif_tx_start_all_queues(dev);
diff --git a/drivers/net/cxgb4vf/t4vf_common.h b/drivers/net/cxgb4vf/t4vf_common.h
index 5c7bde7f9bae..873cb7d86c57 100644
--- a/drivers/net/cxgb4vf/t4vf_common.h
+++ b/drivers/net/cxgb4vf/t4vf_common.h
@@ -132,15 +132,15 @@ struct rss_params {
         unsigned int mode;              /* RSS mode */
         union {
             struct {
-                int synmapen:1;         /* SYN Map Enable */
-                int syn4tupenipv6:1;    /* enable hashing 4-tuple IPv6 SYNs */
-                int syn2tupenipv6:1;    /* enable hashing 2-tuple IPv6 SYNs */
-                int syn4tupenipv4:1;    /* enable hashing 4-tuple IPv4 SYNs */
-                int syn2tupenipv4:1;    /* enable hashing 2-tuple IPv4 SYNs */
-                int ofdmapen:1;         /* Offload Map Enable */
-                int tnlmapen:1;         /* Tunnel Map Enable */
-                int tnlalllookup:1;     /* Tunnel All Lookup */
-                int hashtoeplitz:1;     /* use Toeplitz hash */
+                unsigned int synmapen:1;        /* SYN Map Enable */
+                unsigned int syn4tupenipv6:1;   /* enable hashing 4-tuple IPv6 SYNs */
+                unsigned int syn2tupenipv6:1;   /* enable hashing 2-tuple IPv6 SYNs */
+                unsigned int syn4tupenipv4:1;   /* enable hashing 4-tuple IPv4 SYNs */
+                unsigned int syn2tupenipv4:1;   /* enable hashing 2-tuple IPv4 SYNs */
+                unsigned int ofdmapen:1;        /* Offload Map Enable */
+                unsigned int tnlmapen:1;        /* Tunnel Map Enable */
+                unsigned int tnlalllookup:1;    /* Tunnel All Lookup */
+                unsigned int hashtoeplitz:1;    /* use Toeplitz hash */
             } basicvirtual;
         } u;
 };
@@ -151,10 +151,10 @@ struct rss_params {
 union rss_vi_config {
     struct {
         u16 defaultq;                   /* Ingress Queue ID for !tnlalllookup */
-        int ip6fourtupen:1;             /* hash 4-tuple IPv6 ingress packets */
-        int ip6twotupen:1;              /* hash 2-tuple IPv6 ingress packets */
-        int ip4fourtupen:1;             /* hash 4-tuple IPv4 ingress packets */
-        int ip4twotupen:1;              /* hash 2-tuple IPv4 ingress packets */
+        unsigned int ip6fourtupen:1;    /* hash 4-tuple IPv6 ingress packets */
+        unsigned int ip6twotupen:1;     /* hash 2-tuple IPv6 ingress packets */
+        unsigned int ip4fourtupen:1;    /* hash 4-tuple IPv4 ingress packets */
+        unsigned int ip4twotupen:1;     /* hash 2-tuple IPv4 ingress packets */
         int udpen;                      /* hash 4-tuple UDP ingress packets */
     } basicvirtual;
 };
diff --git a/drivers/net/de620.c b/drivers/net/de620.c
index f3650fd096f4..1c51a7576119 100644
--- a/drivers/net/de620.c
+++ b/drivers/net/de620.c
@@ -676,7 +676,7 @@ static int de620_rx_intr(struct net_device *dev)
         de620_set_register(dev, W_NPRF, next_rx_page);
         pr_debug("next_rx_page=%d CPR=%d\n", next_rx_page, curr_page);
 
-        return (next_rx_page != curr_page); /* That was slightly tricky... */
+        return next_rx_page != curr_page; /* That was slightly tricky... */
 }
 
 /*********************************************
diff --git a/drivers/net/defxx.c b/drivers/net/defxx.c
index e5667c55844e..417e14385623 100644
--- a/drivers/net/defxx.c
+++ b/drivers/net/defxx.c
@@ -1024,7 +1024,7 @@ static int __devinit dfx_driver_init(struct net_device *dev,
                                  &data) != DFX_K_SUCCESS) {
                 printk("%s: Could not read adapter factory MAC address!\n",
                        print_name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
         }
         le32 = cpu_to_le32(data);
         memcpy(&bp->factory_mac_addr[0], &le32, sizeof(u32));
@@ -1033,7 +1033,7 @@ static int __devinit dfx_driver_init(struct net_device *dev,
                                  &data) != DFX_K_SUCCESS) {
                 printk("%s: Could not read adapter factory MAC address!\n",
                        print_name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
         }
         le32 = cpu_to_le32(data);
         memcpy(&bp->factory_mac_addr[4], &le32, sizeof(u16));
@@ -1075,7 +1075,7 @@ static int __devinit dfx_driver_init(struct net_device *dev,
         if (top_v == NULL) {
                 printk("%s: Could not allocate memory for host buffers "
                        "and structures!\n", print_name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
         }
         memset(top_v, 0, alloc_size);   /* zero out memory before continuing */
         top_p = bp->kmalloced_dma;      /* get physical address of buffer */
@@ -1145,7 +1145,7 @@ static int __devinit dfx_driver_init(struct net_device *dev,
         DBG_printk("%s: Consumer block virt = %0lX, phys = %0X\n",
                    print_name, (long)bp->cons_block_virt, bp->cons_block_phys);
 
-        return(DFX_K_SUCCESS);
+        return DFX_K_SUCCESS;
 }
 
 
@@ -1195,7 +1195,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
         if (dfx_hw_dma_uninit(bp, bp->reset_type) != DFX_K_SUCCESS)
                 {
                 printk("%s: Could not uninitialize/reset adapter!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /*
@@ -1229,7 +1229,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
                                                         NULL) != DFX_K_SUCCESS)
                 {
                 printk("%s: Could not set adapter burst size!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /*
@@ -1246,7 +1246,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
                                                         NULL) != DFX_K_SUCCESS)
                 {
                 printk("%s: Could not set consumer block address!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /*
@@ -1278,7 +1278,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
         if (dfx_hw_dma_cmd_req(bp) != DFX_K_SUCCESS)
                 {
                 printk("%s: DMA command request failed!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /* Set the initial values for eFDXEnable and MACTReq MIB objects */
@@ -1294,7 +1294,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
         if (dfx_hw_dma_cmd_req(bp) != DFX_K_SUCCESS)
                 {
                 printk("%s: DMA command request failed!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /* Initialize adapter CAM */
@@ -1302,7 +1302,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
         if (dfx_ctl_update_cam(bp) != DFX_K_SUCCESS)
                 {
                 printk("%s: Adapter CAM update failed!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /* Initialize adapter filters */
@@ -1310,7 +1310,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
         if (dfx_ctl_update_filters(bp) != DFX_K_SUCCESS)
                 {
                 printk("%s: Adapter filters update failed!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /*
@@ -1328,7 +1328,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
                 printk("%s: Receive buffer allocation failed\n", bp->dev->name);
                 if (get_buffers)
                         dfx_rcv_flush(bp);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /* Issue START command and bring adapter to LINK_(UN)AVAILABLE state */
@@ -1339,13 +1339,13 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
                 printk("%s: Start command failed\n", bp->dev->name);
                 if (get_buffers)
                         dfx_rcv_flush(bp);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /* Initialization succeeded, reenable PDQ interrupts */
 
         dfx_port_write_long(bp, PI_PDQ_K_REG_HOST_INT_ENB, PI_HOST_INT_K_ENABLE_DEF_INTS);
-        return(DFX_K_SUCCESS);
+        return DFX_K_SUCCESS;
         }
 
 
@@ -1434,7 +1434,7 @@ static int dfx_open(struct net_device *dev)
 
         /* Set device structure info */
         netif_start_queue(dev);
-        return(0);
+        return 0;
 }
 
 
@@ -1526,7 +1526,7 @@ static int dfx_close(struct net_device *dev)
 
         free_irq(dev->irq, dev);
 
-        return(0);
+        return 0;
 }
 
 
@@ -2027,7 +2027,7 @@ static struct net_device_stats *dfx_ctl_get_stats(struct net_device *dev)
 
         bp->cmd_req_virt->cmd_type = PI_CMD_K_SMT_MIB_GET;
         if (dfx_hw_dma_cmd_req(bp) != DFX_K_SUCCESS)
-                return((struct net_device_stats *) &bp->stats);
+                return (struct net_device_stats *)&bp->stats;
 
         /* Fill the bp->stats structure with the SMT MIB object values */
 
@@ -2128,7 +2128,7 @@ static struct net_device_stats *dfx_ctl_get_stats(struct net_device *dev)
 
         bp->cmd_req_virt->cmd_type = PI_CMD_K_CNTRS_GET;
         if (dfx_hw_dma_cmd_req(bp) != DFX_K_SUCCESS)
-                return((struct net_device_stats *) &bp->stats);
+                return (struct net_device_stats *)&bp->stats;
 
         /* Fill the bp->stats structure with the FDDI counter values */
 
@@ -2144,7 +2144,7 @@ static struct net_device_stats *dfx_ctl_get_stats(struct net_device *dev)
         bp->stats.port_lem_cts[0]                       = bp->cmd_rsp_virt->cntrs_get.cntrs.link_errors[0].ls;
         bp->stats.port_lem_cts[1]                       = bp->cmd_rsp_virt->cntrs_get.cntrs.link_errors[1].ls;
 
-        return((struct net_device_stats *) &bp->stats);
+        return (struct net_device_stats *)&bp->stats;
         }
 
 
@@ -2354,7 +2354,7 @@ static int dfx_ctl_set_mac_address(struct net_device *dev, void *addr)
                 {
                 DBG_printk("%s: Adapter CAM updated with new MAC address\n", dev->name);
                 }
-        return(0);                      /* always return zero */
+        return 0;                       /* always return zero */
         }
 
 
@@ -2438,8 +2438,8 @@ static int dfx_ctl_update_cam(DFX_board_t *bp)
         /* Issue command to update adapter CAM, then return */
 
         if (dfx_hw_dma_cmd_req(bp) != DFX_K_SUCCESS)
-                return(DFX_K_FAILURE);
-        return(DFX_K_SUCCESS);
+                return DFX_K_FAILURE;
+        return DFX_K_SUCCESS;
         }
 
 
@@ -2504,8 +2504,8 @@ static int dfx_ctl_update_filters(DFX_board_t *bp)
         /* Issue command to update adapter filters, then return */
 
         if (dfx_hw_dma_cmd_req(bp) != DFX_K_SUCCESS)
-                return(DFX_K_FAILURE);
-        return(DFX_K_SUCCESS);
+                return DFX_K_FAILURE;
+        return DFX_K_SUCCESS;
         }
 
 
@@ -2561,7 +2561,7 @@ static int dfx_hw_dma_cmd_req(DFX_board_t *bp)
                 (status == PI_STATE_K_HALTED)           ||
                 (status == PI_STATE_K_DMA_UNAVAIL)      ||
                 (status == PI_STATE_K_UPGRADE))
-                return(DFX_K_OUTSTATE);
+                return DFX_K_OUTSTATE;
 
         /* Put response buffer on the command response queue */
 
@@ -2599,7 +2599,7 @@ static int dfx_hw_dma_cmd_req(DFX_board_t *bp)
                 udelay(100);                    /* wait for 100 microseconds */
                 }
         if (timeout_cnt == 0)
-                return(DFX_K_HW_TIMEOUT);
+                return DFX_K_HW_TIMEOUT;
 
         /* Bump (and wrap) the completion index and write out to register */
 
@@ -2619,14 +2619,14 @@ static int dfx_hw_dma_cmd_req(DFX_board_t *bp)
                 udelay(100);                    /* wait for 100 microseconds */
                 }
         if (timeout_cnt == 0)
-                return(DFX_K_HW_TIMEOUT);
+                return DFX_K_HW_TIMEOUT;
 
         /* Bump (and wrap) the completion index and write out to register */
 
         bp->cmd_rsp_reg.index.comp += 1;
         bp->cmd_rsp_reg.index.comp &= PI_CMD_RSP_K_NUM_ENTRIES-1;
         dfx_port_write_long(bp, PI_PDQ_K_REG_CMD_RSP_PROD, bp->cmd_rsp_reg.lword);
-        return(DFX_K_SUCCESS);
+        return DFX_K_SUCCESS;
         }
 
 
@@ -2700,7 +2700,7 @@ static int dfx_hw_port_ctrl_req(
                 udelay(100);                    /* wait for 100 microseconds */
                 }
         if (timeout_cnt == 0)
-                return(DFX_K_HW_TIMEOUT);
+                return DFX_K_HW_TIMEOUT;
 
         /*
          * If the address of host_data is non-zero, assume caller has supplied a
@@ -2710,7 +2710,7 @@ static int dfx_hw_port_ctrl_req(
 
         if (host_data != NULL)
                 dfx_port_read_long(bp, PI_PDQ_K_REG_HOST_DATA, host_data);
-        return(DFX_K_SUCCESS);
+        return DFX_K_SUCCESS;
         }
 
 
@@ -2800,7 +2800,7 @@ static int dfx_hw_adap_state_rd(DFX_board_t *bp)
         PI_UINT32 port_status;          /* Port Status register value */
 
         dfx_port_read_long(bp, PI_PDQ_K_REG_PORT_STATUS, &port_status);
-        return((port_status & PI_PSTATUS_M_STATE) >> PI_PSTATUS_V_STATE);
+        return (port_status & PI_PSTATUS_M_STATE) >> PI_PSTATUS_V_STATE;
         }
 
 
@@ -2852,8 +2852,8 @@ static int dfx_hw_dma_uninit(DFX_board_t *bp, PI_UINT32 type)
                 udelay(100);                                    /* wait for 100 microseconds */
                 }
         if (timeout_cnt == 0)
-                return(DFX_K_HW_TIMEOUT);
-        return(DFX_K_SUCCESS);
+                return DFX_K_HW_TIMEOUT;
+        return DFX_K_SUCCESS;
         }
 
 /*
diff --git a/drivers/net/dnet.c b/drivers/net/dnet.c
index 7c075756611a..9d8a20b72fa9 100644
--- a/drivers/net/dnet.c
+++ b/drivers/net/dnet.c
@@ -27,7 +27,7 @@
 #undef DEBUG
 
 /* function for reading internal MAC register */
-u16 dnet_readw_mac(struct dnet *bp, u16 reg)
+static u16 dnet_readw_mac(struct dnet *bp, u16 reg)
 {
         u16 data_read;
 
@@ -46,7 +46,7 @@ u16 dnet_readw_mac(struct dnet *bp, u16 reg)
 }
 
 /* function for writing internal MAC register */
-void dnet_writew_mac(struct dnet *bp, u16 reg, u16 val)
+static void dnet_writew_mac(struct dnet *bp, u16 reg, u16 val)
 {
         /* load data to write */
         dnet_writel(bp, val, MACREG_DATA);
@@ -63,11 +63,11 @@ static void __dnet_set_hwaddr(struct dnet *bp)
 {
         u16 tmp;
 
-        tmp = cpu_to_be16(*((u16 *) bp->dev->dev_addr));
+        tmp = be16_to_cpup((__be16 *)bp->dev->dev_addr);
         dnet_writew_mac(bp, DNET_INTERNAL_MAC_ADDR_0_REG, tmp);
-        tmp = cpu_to_be16(*((u16 *) (bp->dev->dev_addr + 2)));
+        tmp = be16_to_cpup((__be16 *)(bp->dev->dev_addr + 2));
         dnet_writew_mac(bp, DNET_INTERNAL_MAC_ADDR_1_REG, tmp);
-        tmp = cpu_to_be16(*((u16 *) (bp->dev->dev_addr + 4)));
+        tmp = be16_to_cpup((__be16 *)(bp->dev->dev_addr + 4));
         dnet_writew_mac(bp, DNET_INTERNAL_MAC_ADDR_2_REG, tmp);
 }
 
@@ -89,11 +89,11 @@ static void __devinit dnet_get_hwaddr(struct dnet *bp)
          * Mac_addr[15:0]).
          */
         tmp = dnet_readw_mac(bp, DNET_INTERNAL_MAC_ADDR_0_REG);
-        *((u16 *) addr) = be16_to_cpu(tmp);
+        *((__be16 *)addr) = cpu_to_be16(tmp);
         tmp = dnet_readw_mac(bp, DNET_INTERNAL_MAC_ADDR_1_REG);
-        *((u16 *) (addr + 2)) = be16_to_cpu(tmp);
+        *((__be16 *)(addr + 2)) = cpu_to_be16(tmp);
         tmp = dnet_readw_mac(bp, DNET_INTERNAL_MAC_ADDR_2_REG);
-        *((u16 *) (addr + 4)) = be16_to_cpu(tmp);
+        *((__be16 *)(addr + 4)) = cpu_to_be16(tmp);
 
         if (is_valid_ether_addr(addr))
                 memcpy(bp->dev->dev_addr, addr, sizeof(addr));
@@ -361,7 +361,7 @@ err_out:
 }
 
 /* For Neptune board: LINK1000 as Link LED and TX as activity LED */
-int dnet_phy_marvell_fixup(struct phy_device *phydev)
+static int dnet_phy_marvell_fixup(struct phy_device *phydev)
 {
         return phy_write(phydev, 0x18, 0x4148);
 }
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index 37dcfdc63456..ff2d29b17858 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -36,6 +36,7 @@
 #include <linux/moduleparam.h>
 #include <linux/rtnetlink.h>
 #include <net/rtnetlink.h>
+#include <linux/u64_stats_sync.h>
 
 static int numdummies = 1;
 
@@ -55,21 +56,69 @@ static void set_multicast_list(struct net_device *dev)
 {
 }
 
+struct pcpu_dstats {
+        u64                     tx_packets;
+        u64                     tx_bytes;
+        struct u64_stats_sync   syncp;
+};
+
+static struct rtnl_link_stats64 *dummy_get_stats64(struct net_device *dev,
+                                                   struct rtnl_link_stats64 *stats)
+{
+        int i;
+
+        for_each_possible_cpu(i) {
+                const struct pcpu_dstats *dstats;
+                u64 tbytes, tpackets;
+                unsigned int start;
+
+                dstats = per_cpu_ptr(dev->dstats, i);
+                do {
+                        start = u64_stats_fetch_begin(&dstats->syncp);
+                        tbytes = dstats->tx_bytes;
+                        tpackets = dstats->tx_packets;
+                } while (u64_stats_fetch_retry(&dstats->syncp, start));
+                stats->tx_bytes += tbytes;
+                stats->tx_packets += tpackets;
+        }
+        return stats;
+}
 
 static netdev_tx_t dummy_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        dev->stats.tx_packets++;
-        dev->stats.tx_bytes += skb->len;
+        struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats);
+
+        u64_stats_update_begin(&dstats->syncp);
+        dstats->tx_packets++;
+        dstats->tx_bytes += skb->len;
+        u64_stats_update_end(&dstats->syncp);
 
         dev_kfree_skb(skb);
         return NETDEV_TX_OK;
 }
 
+static int dummy_dev_init(struct net_device *dev)
+{
+        dev->dstats = alloc_percpu(struct pcpu_dstats);
+        if (!dev->dstats)
+                return -ENOMEM;
+
+        return 0;
+}
+
+static void dummy_dev_free(struct net_device *dev)
+{
+        free_percpu(dev->dstats);
+        free_netdev(dev);
+}
+
 static const struct net_device_ops dummy_netdev_ops = {
+        .ndo_init               = dummy_dev_init,
         .ndo_start_xmit         = dummy_xmit,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_multicast_list = set_multicast_list,
         .ndo_set_mac_address    = dummy_set_address,
+        .ndo_get_stats64        = dummy_get_stats64,
 };
 
 static void dummy_setup(struct net_device *dev)
@@ -78,14 +127,17 @@ static void dummy_setup(struct net_device *dev)
 
         /* Initialize the device structure. */
         dev->netdev_ops = &dummy_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->destructor = dummy_dev_free;
 
         /* Fill in device structure with ethernet-generic values. */
         dev->tx_queue_len = 0;
         dev->flags |= IFF_NOARP;
         dev->flags &= ~IFF_MULTICAST;
+        dev->features   |= NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_TSO;
+        dev->features   |= NETIF_F_NO_CSUM | NETIF_F_HIGHDMA | NETIF_F_LLTX;
         random_ether_addr(dev->dev_addr);
 }
+
 static int dummy_validate(struct nlattr *tb[], struct nlattr *data[])
 {
         if (tb[IFLA_ADDRESS]) {
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 8e2eab4e7c75..b0aa9e68990a 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -2215,10 +2215,10 @@ static int e100_change_mtu(struct net_device *netdev, int new_mtu)
 static int e100_asf(struct nic *nic)
 {
         /* ASF can be enabled from eeprom */
-        return((nic->pdev->device >= 0x1050) && (nic->pdev->device <= 0x1057) &&
+        return (nic->pdev->device >= 0x1050) && (nic->pdev->device <= 0x1057) &&
            (nic->eeprom[eeprom_config_asf] & eeprom_asf) &&
            !(nic->eeprom[eeprom_config_asf] & eeprom_gcl) &&
-           ((nic->eeprom[eeprom_smbus_addr] & 0xFF) != 0xFE));
+           ((nic->eeprom[eeprom_smbus_addr] & 0xFF) != 0xFE);
 }
 
 static int e100_up(struct nic *nic)
diff --git a/drivers/net/e1000/e1000.h b/drivers/net/e1000/e1000.h
index 99288b95aead..a881dd0093bd 100644
--- a/drivers/net/e1000/e1000.h
+++ b/drivers/net/e1000/e1000.h
@@ -310,6 +310,9 @@ struct e1000_adapter {
         int need_ioport;
 
         bool discarding;
+
+        struct work_struct fifo_stall_task;
+        struct work_struct phy_info_task;
 };
 
 enum e1000_state_t {
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 8d9269d12a67..a117f2a0252e 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -123,8 +123,10 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter,
                                 struct e1000_rx_ring *rx_ring);
 static void e1000_set_rx_mode(struct net_device *netdev);
 static void e1000_update_phy_info(unsigned long data);
+static void e1000_update_phy_info_task(struct work_struct *work);
 static void e1000_watchdog(unsigned long data);
 static void e1000_82547_tx_fifo_stall(unsigned long data);
+static void e1000_82547_tx_fifo_stall_task(struct work_struct *work);
 static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
                                     struct net_device *netdev);
 static struct net_device_stats * e1000_get_stats(struct net_device *netdev);
@@ -519,8 +521,21 @@ void e1000_down(struct e1000_adapter *adapter)
         e1000_clean_all_rx_rings(adapter);
 }
 
+void e1000_reinit_safe(struct e1000_adapter *adapter)
+{
+        while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
+                msleep(1);
+        rtnl_lock();
+        e1000_down(adapter);
+        e1000_up(adapter);
+        rtnl_unlock();
+        clear_bit(__E1000_RESETTING, &adapter->flags);
+}
+
 void e1000_reinit_locked(struct e1000_adapter *adapter)
 {
+        /* if rtnl_lock is not held the call path is bogus */
+        ASSERT_RTNL();
         WARN_ON(in_interrupt());
         while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
                 msleep(1);
@@ -988,8 +1003,10 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
            (hw->mac_type != e1000_82547))
                 netdev->features |= NETIF_F_TSO;
 
-        if (pci_using_dac)
+        if (pci_using_dac) {
                 netdev->features |= NETIF_F_HIGHDMA;
+                netdev->vlan_features |= NETIF_F_HIGHDMA;
+        }
 
         netdev->vlan_features |= NETIF_F_TSO;
         netdev->vlan_features |= NETIF_F_HW_CSUM;
@@ -1045,7 +1062,9 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         adapter->phy_info_timer.function = e1000_update_phy_info;
         adapter->phy_info_timer.data = (unsigned long)adapter;
 
+        INIT_WORK(&adapter->fifo_stall_task, e1000_82547_tx_fifo_stall_task);
         INIT_WORK(&adapter->reset_task, e1000_reset_task);
+        INIT_WORK(&adapter->phy_info_task, e1000_update_phy_info_task);
 
         e1000_check_options(adapter);
 
@@ -2232,22 +2251,45 @@ static void e1000_set_rx_mode(struct net_device *netdev)
 static void e1000_update_phy_info(unsigned long data)
 {
         struct e1000_adapter *adapter = (struct e1000_adapter *)data;
+        schedule_work(&adapter->phy_info_task);
+}
+
+static void e1000_update_phy_info_task(struct work_struct *work)
+{
+        struct e1000_adapter *adapter = container_of(work,
+                                                     struct e1000_adapter,
+                                                     phy_info_task);
         struct e1000_hw *hw = &adapter->hw;
+
+        rtnl_lock();
         e1000_phy_get_info(hw, &adapter->phy_info);
+        rtnl_unlock();
 }
 
 /**
  * e1000_82547_tx_fifo_stall - Timer Call-back
  * @data: pointer to adapter cast into an unsigned long
  **/
-
 static void e1000_82547_tx_fifo_stall(unsigned long data)
 {
         struct e1000_adapter *adapter = (struct e1000_adapter *)data;
+        schedule_work(&adapter->fifo_stall_task);
+}
+
+/**
+ * e1000_82547_tx_fifo_stall_task - task to complete work
+ * @work: work struct contained inside adapter struct
+ **/
+static void e1000_82547_tx_fifo_stall_task(struct work_struct *work)
+{
+        struct e1000_adapter *adapter = container_of(work,
+                                                     struct e1000_adapter,
+                                                     fifo_stall_task);
         struct e1000_hw *hw = &adapter->hw;
         struct net_device *netdev = adapter->netdev;
         u32 tctl;
 
+        rtnl_lock();
         if (atomic_read(&adapter->tx_fifo_stall)) {
                 if ((er32(TDT) == er32(TDH)) &&
                    (er32(TDFT) == er32(TDFH)) &&
@@ -2268,6 +2310,7 @@ static void e1000_82547_tx_fifo_stall(unsigned long data)
                         mod_timer(&adapter->tx_fifo_stall_timer, jiffies + 1);
                 }
         }
+        rtnl_unlock();
 }
 
 bool e1000_has_link(struct e1000_adapter *adapter)
@@ -3076,7 +3119,7 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
                 }
         }
 
-        if (unlikely(adapter->vlgrp && vlan_tx_tag_present(skb))) {
+        if (unlikely(vlan_tx_tag_present(skb))) {
                 tx_flags |= E1000_TX_FLAGS_VLAN;
                 tx_flags |= (vlan_tx_tag_get(skb) << E1000_TX_FLAGS_VLAN_SHIFT);
         }
@@ -3135,7 +3178,7 @@ static void e1000_reset_task(struct work_struct *work)
         struct e1000_adapter *adapter =
                 container_of(work, struct e1000_adapter, reset_task);
 
-        e1000_reinit_locked(adapter);
+        e1000_reinit_safe(adapter);
 }
 
 /**
@@ -3557,7 +3600,7 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter,
         adapter->total_tx_packets += total_tx_packets;
         netdev->stats.tx_bytes += total_tx_bytes;
         netdev->stats.tx_packets += total_tx_packets;
-        return (count < tx_ring->count);
+        return count < tx_ring->count;
 }
 
 /**
@@ -3621,13 +3664,14 @@ static void e1000_consume_page(struct e1000_buffer *bi, struct sk_buff *skb,
 static void e1000_receive_skb(struct e1000_adapter *adapter, u8 status,
                               __le16 vlan, struct sk_buff *skb)
 {
-        if (unlikely(adapter->vlgrp && (status & E1000_RXD_STAT_VP))) {
-                vlan_hwaccel_receive_skb(skb, adapter->vlgrp,
-                                         le16_to_cpu(vlan) &
-                                         E1000_RXD_SPC_VLAN_MASK);
-        } else {
-                netif_receive_skb(skb);
-        }
+        skb->protocol = eth_type_trans(skb, adapter->netdev);
+
+        if ((unlikely(adapter->vlgrp && (status & E1000_RXD_STAT_VP))))
+                vlan_gro_receive(&adapter->napi, adapter->vlgrp,
+                                 le16_to_cpu(vlan) & E1000_RXD_SPC_VLAN_MASK,
+                                 skb);
+        else
+                napi_gro_receive(&adapter->napi, skb);
 }
 
 /**
@@ -3785,8 +3829,6 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
                         goto next_desc;
                 }
 
-                skb->protocol = eth_type_trans(skb, netdev);
-
                 e1000_receive_skb(adapter, status, rx_desc->special, skb);
 
 next_desc:
@@ -3949,8 +3991,6 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                                   ((u32)(rx_desc->errors) << 24),
                                   le16_to_cpu(rx_desc->csum), skb);
 
-                skb->protocol = eth_type_trans(skb, netdev);
-
                 e1000_receive_skb(adapter, status, rx_desc->special, skb);
 
 next_desc:
@@ -4501,7 +4541,7 @@ static void e1000_restore_vlan(struct e1000_adapter *adapter)
 
         if (adapter->vlgrp) {
                 u16 vid;
-                for (vid = 0; vid < VLAN_GROUP_ARRAY_LEN; vid++) {
+                for (vid = 0; vid < VLAN_N_VID; vid++) {
                         if (!vlan_group_get_device(adapter->vlgrp, vid))
                                 continue;
                         e1000_vlan_rx_add_vid(adapter->netdev, vid);
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index d3d4a57e2450..ca663f19d7df 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -1801,7 +1801,8 @@ struct e1000_info e1000_82571_info = {
                                   | FLAG_RESET_OVERWRITES_LAA /* errata */
                                   | FLAG_TARC_SPEED_MODE_BIT /* errata */
                                   | FLAG_APME_CHECK_PORT_B,
-        .flags2                 = FLAG2_DISABLE_ASPM_L1, /* errata 13 */
+        .flags2                 = FLAG2_DISABLE_ASPM_L1 /* errata 13 */
+                                  | FLAG2_DMA_BURST,
         .pba                    = 38,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
@@ -1819,7 +1820,8 @@ struct e1000_info e1000_82572_info = {
                                   | FLAG_RX_CSUM_ENABLED
                                   | FLAG_HAS_CTRLEXT_ON_LOAD
                                   | FLAG_TARC_SPEED_MODE_BIT, /* errata */
-        .flags2                 = FLAG2_DISABLE_ASPM_L1, /* errata 13 */
+        .flags2                 = FLAG2_DISABLE_ASPM_L1 /* errata 13 */
+                                  | FLAG2_DMA_BURST,
         .pba                    = 38,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
diff --git a/drivers/net/e1000e/defines.h b/drivers/net/e1000e/defines.h
index 93b3bedae8d2..d3f7a9c3f973 100644
--- a/drivers/net/e1000e/defines.h
+++ b/drivers/net/e1000e/defines.h
@@ -446,7 +446,9 @@
 
 /* Transmit Descriptor Control */
 #define E1000_TXDCTL_PTHRESH 0x0000003F /* TXDCTL Prefetch Threshold */
+#define E1000_TXDCTL_HTHRESH 0x00003F00 /* TXDCTL Host Threshold */
 #define E1000_TXDCTL_WTHRESH 0x003F0000 /* TXDCTL Writeback Threshold */
+#define E1000_TXDCTL_GRAN    0x01000000 /* TXDCTL Granularity */
 #define E1000_TXDCTL_FULL_TX_DESC_WB 0x01010000 /* GRAN=1, WTHRESH=1 */
 #define E1000_TXDCTL_MAX_TX_DESC_PREFETCH 0x0100001F /* GRAN=1, PTHRESH=31 */
 /* Enable the counting of desc. still to be processed. */
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index f9a31c82f871..cee882dd67bf 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -153,6 +153,33 @@ struct e1000_info;
 /* Time to wait before putting the device into D3 if there's no link (in ms). */
 #define LINK_TIMEOUT            100
 
+#define DEFAULT_RDTR                    0
+#define DEFAULT_RADV                    8
+#define BURST_RDTR                      0x20
+#define BURST_RADV                      0x20
+
+/*
+ * in the case of WTHRESH, it appears at least the 82571/2 hardware
+ * writes back 4 descriptors when WTHRESH=5, and 3 descriptors when
+ * WTHRESH=4, and since we want 64 bytes at a time written back, set
+ * it to 5
+ */
+#define E1000_TXDCTL_DMA_BURST_ENABLE                          \
+        (E1000_TXDCTL_GRAN | /* set descriptor granularity */  \
+         E1000_TXDCTL_COUNT_DESC |                             \
+         (5 << 16) | /* wthresh must be +1 more than desired */\
+         (1 << 8)  | /* hthresh */                             \
+         0x1f)       /* pthresh */
+
+#define E1000_RXDCTL_DMA_BURST_ENABLE                          \
+        (0x01000000 | /* set descriptor granularity */         \
+         (4 << 16)  | /* set writeback threshold    */         \
+         (4 << 8)   | /* set prefetch threshold     */         \
+         0x20)        /* set hthresh                */
+
+#define E1000_TIDV_FPD (1 << 31)
+#define E1000_RDTR_FPD (1 << 31)
+
 enum e1000_boards {
         board_82571,
         board_82572,
@@ -425,6 +452,8 @@ struct e1000_info {
 #define FLAG2_DISABLE_ASPM_L1             (1 << 3)
 #define FLAG2_HAS_PHY_STATS               (1 << 4)
 #define FLAG2_HAS_EEE                     (1 << 5)
+#define FLAG2_DMA_BURST                   (1 << 6)
+#define FLAG2_DISABLE_AIM                 (1 << 8)
 
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c
index 45aebb4a6fe1..24f8ac9cf703 100644
--- a/drivers/net/e1000e/es2lan.c
+++ b/drivers/net/e1000e/es2lan.c
@@ -1494,6 +1494,7 @@ struct e1000_info e1000_es2_info = {
                                   | FLAG_APME_CHECK_PORT_B
                                   | FLAG_DISABLE_FC_PAUSE_TIME /* errata */
                                   | FLAG_TIPG_MEDIUM_FOR_80003ESLAN,
+        .flags2                 = FLAG2_DMA_BURST,
         .pba                    = 38,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_80003es2lan,
diff --git a/drivers/net/e1000e/ethtool.c b/drivers/net/e1000e/ethtool.c
index 6355a1b779d3..8984d165a39b 100644
--- a/drivers/net/e1000e/ethtool.c
+++ b/drivers/net/e1000e/ethtool.c
@@ -368,7 +368,7 @@ out:
 static u32 e1000_get_rx_csum(struct net_device *netdev)
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
-        return (adapter->flags & FLAG_RX_CSUM_ENABLED);
+        return adapter->flags & FLAG_RX_CSUM_ENABLED;
 }
 
 static int e1000_set_rx_csum(struct net_device *netdev, u32 data)
@@ -389,7 +389,7 @@ static int e1000_set_rx_csum(struct net_device *netdev, u32 data)
 
 static u32 e1000_get_tx_csum(struct net_device *netdev)
 {
-        return ((netdev->features & NETIF_F_HW_CSUM) != 0);
+        return (netdev->features & NETIF_F_HW_CSUM) != 0;
 }
 
 static int e1000_set_tx_csum(struct net_device *netdev, u32 data)
@@ -1717,13 +1717,6 @@ static void e1000_diag_test(struct net_device *netdev,
 
                 e_info("offline testing starting\n");
 
-                /*
-                 * Link test performed before hardware reset so autoneg doesn't
-                 * interfere with test result
-                 */
-                if (e1000_link_test(adapter, &data[4]))
-                        eth_test->flags |= ETH_TEST_FL_FAILED;
-
                 if (if_running)
                         /* indicate we're in test mode */
                         dev_close(netdev);
@@ -1747,15 +1740,19 @@ static void e1000_diag_test(struct net_device *netdev,
                 if (e1000_loopback_test(adapter, &data[3]))
                         eth_test->flags |= ETH_TEST_FL_FAILED;
 
+                /* force this routine to wait until autoneg complete/timeout */
+                adapter->hw.phy.autoneg_wait_to_complete = 1;
+                e1000e_reset(adapter);
+                adapter->hw.phy.autoneg_wait_to_complete = 0;
+
+                if (e1000_link_test(adapter, &data[4]))
+                        eth_test->flags |= ETH_TEST_FL_FAILED;
+
                 /* restore speed, duplex, autoneg settings */
                 adapter->hw.phy.autoneg_advertised = autoneg_advertised;
                 adapter->hw.mac.forced_speed_duplex = forced_speed_duplex;
                 adapter->hw.mac.autoneg = autoneg;
-
-                /* force this routine to wait until autoneg complete/timeout */
-                adapter->hw.phy.autoneg_wait_to_complete = 1;
                 e1000e_reset(adapter);
-                adapter->hw.phy.autoneg_wait_to_complete = 0;
 
                 clear_bit(__E1000_TESTING, &adapter->state);
                 if (if_running)
diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
index 66ed08f726fb..ba302a5c2c30 100644
--- a/drivers/net/e1000e/hw.h
+++ b/drivers/net/e1000e/hw.h
@@ -57,6 +57,7 @@ enum e1e_registers {
         E1000_SCTL     = 0x00024, /* SerDes Control - RW */
         E1000_FCAL     = 0x00028, /* Flow Control Address Low - RW */
         E1000_FCAH     = 0x0002C, /* Flow Control Address High -RW */
+        E1000_FEXTNVM4 = 0x00024, /* Future Extended NVM 4 - RW */
         E1000_FEXTNVM  = 0x00028, /* Future Extended NVM - RW */
         E1000_FCT      = 0x00030, /* Flow Control Type - RW */
         E1000_VET      = 0x00038, /* VLAN Ether Type - RW */
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 63930d12711c..e3374d9a2472 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -105,6 +105,10 @@
 #define E1000_FEXTNVM_SW_CONFIG         1
 #define E1000_FEXTNVM_SW_CONFIG_ICH8M (1 << 27) /* Bit redefined for ICH8M :/ */
 
+#define E1000_FEXTNVM4_BEACON_DURATION_MASK    0x7
+#define E1000_FEXTNVM4_BEACON_DURATION_8USEC   0x7
+#define E1000_FEXTNVM4_BEACON_DURATION_16USEC  0x3
+
 #define PCIE_ICH8_SNOOP_ALL             PCIE_NO_SNOOP_ALL
 
 #define E1000_ICH_RAR_ENTRIES           7
@@ -125,6 +129,7 @@
 
 /* SMBus Address Phy Register */
 #define HV_SMB_ADDR            PHY_REG(768, 26)
+#define HV_SMB_ADDR_MASK       0x007F
 #define HV_SMB_ADDR_PEC_EN     0x0200
 #define HV_SMB_ADDR_VALID      0x0080
 
@@ -237,6 +242,8 @@ static s32  e1000_k1_gig_workaround_hv(struct e1000_hw *hw, bool link);
 static s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw);
 static bool e1000_check_mng_mode_ich8lan(struct e1000_hw *hw);
 static bool e1000_check_mng_mode_pchlan(struct e1000_hw *hw);
+static s32 e1000_k1_workaround_lv(struct e1000_hw *hw);
+static void e1000_gate_hw_phy_config_ich8lan(struct e1000_hw *hw, bool gate);
 
 static inline u16 __er16flash(struct e1000_hw *hw, unsigned long reg)
 {
@@ -272,7 +279,7 @@ static inline void __ew32flash(struct e1000_hw *hw, unsigned long reg, u32 val)
 static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
 {
         struct e1000_phy_info *phy = &hw->phy;
-        u32 ctrl;
+        u32 ctrl, fwsm;
         s32 ret_val = 0;
 
         phy->addr                     = 1;
@@ -294,7 +301,8 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
          * disabled, then toggle the LANPHYPC Value bit to force
          * the interconnect to PCIe mode.
          */
-        if (!(er32(FWSM) & E1000_ICH_FWSM_FW_VALID)) {
+        fwsm = er32(FWSM);
+        if (!(fwsm & E1000_ICH_FWSM_FW_VALID)) {
                 ctrl = er32(CTRL);
                 ctrl |=  E1000_CTRL_LANPHYPC_OVERRIDE;
                 ctrl &= ~E1000_CTRL_LANPHYPC_VALUE;
@@ -303,6 +311,13 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
                 ctrl &= ~E1000_CTRL_LANPHYPC_OVERRIDE;
                 ew32(CTRL, ctrl);
                 msleep(50);
+
+                /*
+                 * Gate automatic PHY configuration by hardware on
+                 * non-managed 82579
+                 */
+                if (hw->mac.type == e1000_pch2lan)
+                        e1000_gate_hw_phy_config_ich8lan(hw, true);
         }
 
         /*
@@ -315,6 +330,13 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
         if (ret_val)
                 goto out;
 
+        /* Ungate automatic PHY configuration on non-managed 82579 */
+        if ((hw->mac.type == e1000_pch2lan)  &&
+            !(fwsm & E1000_ICH_FWSM_FW_VALID)) {
+                msleep(10);
+                e1000_gate_hw_phy_config_ich8lan(hw, false);
+        }
+
         phy->id = e1000_phy_unknown;
         ret_val = e1000e_get_phy_id(hw);
         if (ret_val)
@@ -561,13 +583,10 @@ static s32 e1000_init_mac_params_ich8lan(struct e1000_adapter *adapter)
         if (mac->type == e1000_ich8lan)
                 e1000e_set_kmrn_lock_loss_workaround_ich8lan(hw, true);
 
-        /* Disable PHY configuration by hardware, config by software */
-        if (mac->type == e1000_pch2lan) {
-                u32 extcnf_ctrl = er32(EXTCNF_CTRL);
-
-                extcnf_ctrl |= E1000_EXTCNF_CTRL_GATE_PHY_CFG;
-                ew32(EXTCNF_CTRL, extcnf_ctrl);
-        }
+        /* Gate automatic PHY configuration by hardware on managed 82579 */
+        if ((mac->type == e1000_pch2lan) &&
+            (er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                e1000_gate_hw_phy_config_ich8lan(hw, true);
 
         return 0;
 }
@@ -652,6 +671,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                         goto out;
         }
 
+        if (hw->mac.type == e1000_pch2lan) {
+                ret_val = e1000_k1_workaround_lv(hw);
+                if (ret_val)
+                        goto out;
+        }
+
         /*
          * Check if there was DownShift, must be checked
          * immediately after link-up
@@ -895,6 +920,34 @@ static s32 e1000_check_reset_block_ich8lan(struct e1000_hw *hw)
 }
 
 /**
+ *  e1000_write_smbus_addr - Write SMBus address to PHY needed during Sx states
+ *  @hw: pointer to the HW structure
+ *
+ *  Assumes semaphore already acquired.
+ *
+ **/
+static s32 e1000_write_smbus_addr(struct e1000_hw *hw)
+{
+        u16 phy_data;
+        u32 strap = er32(STRAP);
+        s32 ret_val = 0;
+
+        strap &= E1000_STRAP_SMBUS_ADDRESS_MASK;
+
+        ret_val = e1000_read_phy_reg_hv_locked(hw, HV_SMB_ADDR, &phy_data);
+        if (ret_val)
+                goto out;
+
+        phy_data &= ~HV_SMB_ADDR_MASK;
+        phy_data |= (strap >> E1000_STRAP_SMBUS_ADDRESS_SHIFT);
+        phy_data |= HV_SMB_ADDR_PEC_EN | HV_SMB_ADDR_VALID;
+        ret_val = e1000_write_phy_reg_hv_locked(hw, HV_SMB_ADDR, phy_data);
+
+out:
+        return ret_val;
+}
+
+/**
  *  e1000_sw_lcd_config_ich8lan - SW-based LCD Configuration
  *  @hw:   pointer to the HW structure
  *
@@ -903,7 +956,6 @@ static s32 e1000_check_reset_block_ich8lan(struct e1000_hw *hw)
  **/
 static s32 e1000_sw_lcd_config_ich8lan(struct e1000_hw *hw)
 {
-        struct e1000_adapter *adapter = hw->adapter;
         struct e1000_phy_info *phy = &hw->phy;
         u32 i, data, cnf_size, cnf_base_addr, sw_cfg_mask;
         s32 ret_val = 0;
@@ -921,7 +973,8 @@ static s32 e1000_sw_lcd_config_ich8lan(struct e1000_hw *hw)
                 if (phy->type != e1000_phy_igp_3)
                         return ret_val;
 
-                if (adapter->pdev->device == E1000_DEV_ID_ICH8_IGP_AMT) {
+                if ((hw->adapter->pdev->device == E1000_DEV_ID_ICH8_IGP_AMT) ||
+                    (hw->adapter->pdev->device == E1000_DEV_ID_ICH8_IGP_C)) {
                         sw_cfg_mask = E1000_FEXTNVM_SW_CONFIG;
                         break;
                 }
@@ -961,21 +1014,16 @@ static s32 e1000_sw_lcd_config_ich8lan(struct e1000_hw *hw)
         cnf_base_addr = data & E1000_EXTCNF_CTRL_EXT_CNF_POINTER_MASK;
         cnf_base_addr >>= E1000_EXTCNF_CTRL_EXT_CNF_POINTER_SHIFT;
 
-        if (!(data & E1000_EXTCNF_CTRL_OEM_WRITE_ENABLE) &&
-            ((hw->mac.type == e1000_pchlan) ||
-             (hw->mac.type == e1000_pch2lan))) {
+        if ((!(data & E1000_EXTCNF_CTRL_OEM_WRITE_ENABLE) &&
+            (hw->mac.type == e1000_pchlan)) ||
+             (hw->mac.type == e1000_pch2lan)) {
                 /*
                  * HW configures the SMBus address and LEDs when the
                  * OEM and LCD Write Enable bits are set in the NVM.
                  * When both NVM bits are cleared, SW will configure
                  * them instead.
                  */
-                data = er32(STRAP);
-                data &= E1000_STRAP_SMBUS_ADDRESS_MASK;
-                reg_data = data >> E1000_STRAP_SMBUS_ADDRESS_SHIFT;
-                reg_data |= HV_SMB_ADDR_PEC_EN | HV_SMB_ADDR_VALID;
-                ret_val = e1000_write_phy_reg_hv_locked(hw, HV_SMB_ADDR,
-                                                        reg_data);
+                ret_val = e1000_write_smbus_addr(hw);
                 if (ret_val)
                         goto out;
 
@@ -1440,10 +1488,6 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
                         goto out;
 
                 /* Enable jumbo frame workaround in the PHY */
-                e1e_rphy(hw, PHY_REG(769, 20), &data);
-                ret_val = e1e_wphy(hw, PHY_REG(769, 20), data & ~(1 << 14));
-                if (ret_val)
-                        goto out;
                 e1e_rphy(hw, PHY_REG(769, 23), &data);
                 data &= ~(0x7F << 5);
                 data |= (0x37 << 5);
@@ -1452,7 +1496,6 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
                         goto out;
                 e1e_rphy(hw, PHY_REG(769, 16), &data);
                 data &= ~(1 << 13);
-                data |= (1 << 12);
                 ret_val = e1e_wphy(hw, PHY_REG(769, 16), data);
                 if (ret_val)
                         goto out;
@@ -1477,7 +1520,7 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
 
                 mac_reg = er32(RCTL);
                 mac_reg &= ~E1000_RCTL_SECRC;
-                ew32(FFLT_DBG, mac_reg);
+                ew32(RCTL, mac_reg);
 
                 ret_val = e1000e_read_kmrn_reg(hw,
                                                 E1000_KMRNCTRLSTA_CTRL_OFFSET,
@@ -1503,17 +1546,12 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
                         goto out;
 
                 /* Write PHY register values back to h/w defaults */
-                e1e_rphy(hw, PHY_REG(769, 20), &data);
-                ret_val = e1e_wphy(hw, PHY_REG(769, 20), data & ~(1 << 14));
-                if (ret_val)
-                        goto out;
                 e1e_rphy(hw, PHY_REG(769, 23), &data);
                 data &= ~(0x7F << 5);
                 ret_val = e1e_wphy(hw, PHY_REG(769, 23), data);
                 if (ret_val)
                         goto out;
                 e1e_rphy(hw, PHY_REG(769, 16), &data);
-                data &= ~(1 << 12);
                 data |= (1 << 13);
                 ret_val = e1e_wphy(hw, PHY_REG(769, 16), data);
                 if (ret_val)
@@ -1559,6 +1597,69 @@ out:
 }
 
 /**
+ *  e1000_k1_gig_workaround_lv - K1 Si workaround
+ *  @hw:   pointer to the HW structure
+ *
+ *  Workaround to set the K1 beacon duration for 82579 parts
+ **/
+static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
+{
+        s32 ret_val = 0;
+        u16 status_reg = 0;
+        u32 mac_reg;
+
+        if (hw->mac.type != e1000_pch2lan)
+                goto out;
+
+        /* Set K1 beacon duration based on 1Gbps speed or otherwise */
+        ret_val = e1e_rphy(hw, HV_M_STATUS, &status_reg);
+        if (ret_val)
+                goto out;
+
+        if ((status_reg & (HV_M_STATUS_LINK_UP | HV_M_STATUS_AUTONEG_COMPLETE))
+            == (HV_M_STATUS_LINK_UP | HV_M_STATUS_AUTONEG_COMPLETE)) {
+                mac_reg = er32(FEXTNVM4);
+                mac_reg &= ~E1000_FEXTNVM4_BEACON_DURATION_MASK;
+
+                if (status_reg & HV_M_STATUS_SPEED_1000)
+                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_8USEC;
+                else
+                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_16USEC;
+
+                ew32(FEXTNVM4, mac_reg);
+        }
+
+out:
+        return ret_val;
+}
+
+/**
+ *  e1000_gate_hw_phy_config_ich8lan - disable PHY config via hardware
+ *  @hw:   pointer to the HW structure
+ *  @gate: boolean set to true to gate, false to ungate
+ *
+ *  Gate/ungate the automatic PHY configuration via hardware; perform
+ *  the configuration via software instead.
+ **/
+static void e1000_gate_hw_phy_config_ich8lan(struct e1000_hw *hw, bool gate)
+{
+        u32 extcnf_ctrl;
+
+        if (hw->mac.type != e1000_pch2lan)
+                return;
+
+        extcnf_ctrl = er32(EXTCNF_CTRL);
+
+        if (gate)
+                extcnf_ctrl |= E1000_EXTCNF_CTRL_GATE_PHY_CFG;
+        else
+                extcnf_ctrl &= ~E1000_EXTCNF_CTRL_GATE_PHY_CFG;
+
+        ew32(EXTCNF_CTRL, extcnf_ctrl);
+        return;
+}
+
+/**
  *  e1000_lan_init_done_ich8lan - Check for PHY config completion
  *  @hw: pointer to the HW structure
  *
@@ -1602,6 +1703,9 @@ static s32 e1000_post_phy_reset_ich8lan(struct e1000_hw *hw)
         if (e1000_check_reset_block(hw))
                 goto out;
 
+        /* Allow time for h/w to get to quiescent state after reset */
+        msleep(10);
+
         /* Perform any necessary post-reset workarounds */
         switch (hw->mac.type) {
         case e1000_pchlan:
@@ -1630,6 +1734,13 @@ static s32 e1000_post_phy_reset_ich8lan(struct e1000_hw *hw)
         /* Configure the LCD with the OEM bits in NVM */
         ret_val = e1000_oem_bits_config_ich8lan(hw, true);
 
+        /* Ungate automatic PHY configuration on non-managed 82579 */
+        if ((hw->mac.type == e1000_pch2lan) &&
+            !(er32(FWSM) & E1000_ICH_FWSM_FW_VALID)) {
+                msleep(10);
+                e1000_gate_hw_phy_config_ich8lan(hw, false);
+        }
+
 out:
         return ret_val;
 }
@@ -1646,6 +1757,11 @@ static s32 e1000_phy_hw_reset_ich8lan(struct e1000_hw *hw)
 {
         s32 ret_val = 0;
 
+        /* Gate automatic PHY configuration by hardware on non-managed 82579 */
+        if ((hw->mac.type == e1000_pch2lan) &&
+            !(er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                e1000_gate_hw_phy_config_ich8lan(hw, true);
+
         ret_val = e1000e_phy_hw_reset_generic(hw);
         if (ret_val)
                 goto out;
@@ -2910,6 +3026,14 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
                  * external PHY is reset.
                  */
                 ctrl |= E1000_CTRL_PHY_RST;
+
+                /*
+                 * Gate automatic PHY configuration by hardware on
+                 * non-managed 82579
+                 */
+                if ((hw->mac.type == e1000_pch2lan) &&
+                    !(er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                        e1000_gate_hw_phy_config_ich8lan(hw, true);
         }
         ret_val = e1000_acquire_swflag_ich8lan(hw);
         e_dbg("Issuing a global reset to ich8lan\n");
@@ -3460,13 +3584,20 @@ void e1000e_gig_downshift_workaround_ich8lan(struct e1000_hw *hw)
 void e1000e_disable_gig_wol_ich8lan(struct e1000_hw *hw)
 {
         u32 phy_ctrl;
+        s32 ret_val;
 
         phy_ctrl = er32(PHY_CTRL);
         phy_ctrl |= E1000_PHY_CTRL_D0A_LPLU | E1000_PHY_CTRL_GBE_DISABLE;
         ew32(PHY_CTRL, phy_ctrl);
 
-        if (hw->mac.type >= e1000_pchlan)
-                e1000_phy_hw_reset_ich8lan(hw);
+        if (hw->mac.type >= e1000_pchlan) {
+                e1000_oem_bits_config_ich8lan(hw, true);
+                ret_val = hw->phy.ops.acquire(hw);
+                if (ret_val)
+                        return;
+                e1000_write_smbus_addr(hw);
+                hw->phy.ops.release(hw);
+        }
 }
 
 /**
@@ -3855,7 +3986,7 @@ struct e1000_info e1000_pch2_info = {
                                   | FLAG_APME_IN_WUC,
         .flags2                 = FLAG2_HAS_PHY_STATS
                                   | FLAG2_HAS_EEE,
-        .pba                    = 18,
+        .pba                    = 26,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_ich8lan,
         .mac_ops                = &ich8_mac_ops,
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index e2c7e0d767b1..ec8cf3f51423 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -1053,7 +1053,7 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
         adapter->total_tx_packets += total_tx_packets;
         netdev->stats.tx_bytes += total_tx_bytes;
         netdev->stats.tx_packets += total_tx_packets;
-        return (count < tx_ring->count);
+        return count < tx_ring->count;
 }
 
 /**
@@ -2290,6 +2290,11 @@ static void e1000_set_itr(struct e1000_adapter *adapter)
                 goto set_itr_now;
         }
 
+        if (adapter->flags2 & FLAG2_DISABLE_AIM) {
+                new_itr = 0;
+                goto set_itr_now;
+        }
+
         adapter->tx_itr = e1000_update_itr(adapter,
                                     adapter->tx_itr,
                                     adapter->total_tx_packets,
@@ -2338,7 +2343,10 @@ set_itr_now:
                 if (adapter->msix_entries)
                         adapter->rx_ring->set_itr = 1;
                 else
-                        ew32(ITR, 1000000000 / (new_itr * 256));
+                        if (new_itr)
+                                ew32(ITR, 1000000000 / (new_itr * 256));
+                        else
+                                ew32(ITR, 0);
         }
 }
 
@@ -2537,7 +2545,7 @@ static void e1000_restore_vlan(struct e1000_adapter *adapter)
         if (!adapter->vlgrp)
                 return;
 
-        for (vid = 0; vid < VLAN_GROUP_ARRAY_LEN; vid++) {
+        for (vid = 0; vid < VLAN_N_VID; vid++) {
                 if (!vlan_group_get_device(adapter->vlgrp, vid))
                         continue;
                 e1000_vlan_rx_add_vid(adapter->netdev, vid);
@@ -2650,6 +2658,26 @@ static void e1000_configure_tx(struct e1000_adapter *adapter)
         /* Tx irq moderation */
         ew32(TADV, adapter->tx_abs_int_delay);
 
+        if (adapter->flags2 & FLAG2_DMA_BURST) {
+                u32 txdctl = er32(TXDCTL(0));
+                txdctl &= ~(E1000_TXDCTL_PTHRESH | E1000_TXDCTL_HTHRESH |
+                            E1000_TXDCTL_WTHRESH);
+                /*
+                 * set up some performance related parameters to encourage the
+                 * hardware to use the bus more efficiently in bursts, depends
+                 * on the tx_int_delay to be enabled,
+                 * wthresh = 5 ==> burst write a cacheline (64 bytes) at a time
+                 * hthresh = 1 ==> prefetch when one or more available
+                 * pthresh = 0x1f ==> prefetch if internal cache 31 or less
+                 * BEWARE: this seems to work but should be considered first if
+                 * there are tx hangs or other tx related bugs
+                 */
+                txdctl |= E1000_TXDCTL_DMA_BURST_ENABLE;
+                ew32(TXDCTL(0), txdctl);
+                /* erratum work around: set txdctl the same for both queues */
+                ew32(TXDCTL(1), txdctl);
+        }
+
         /* Program the Transmit Control Register */
         tctl = er32(TCTL);
         tctl &= ~E1000_TCTL_CT;
@@ -2705,6 +2733,16 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
         u32 psrctl = 0;
         u32 pages = 0;
 
+        /* Workaround Si errata on 82579 - configure jumbo frame flow */
+        if (hw->mac.type == e1000_pch2lan) {
+                s32 ret_val;
+
+                if (adapter->netdev->mtu > ETH_DATA_LEN)
+                        ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, true);
+                else
+                        ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, false);
+        }
+
         /* Program MC offset vector base */
         rctl = er32(RCTL);
         rctl &= ~(3 << E1000_RCTL_MO_SHIFT);
@@ -2745,16 +2783,6 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
                 e1e_wphy(hw, 22, phy_data);
         }
 
-        /* Workaround Si errata on 82579 - configure jumbo frame flow */
-        if (hw->mac.type == e1000_pch2lan) {
-                s32 ret_val;
-
-                if (rctl & E1000_RCTL_LPE)
-                        ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, true);
-                else
-                        ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, false);
-        }
-
         /* Setup buffer sizes */
         rctl &= ~E1000_RCTL_SZ_4096;
         rctl |= E1000_RCTL_BSEX;
@@ -2872,12 +2900,35 @@ static void e1000_configure_rx(struct e1000_adapter *adapter)
         e1e_flush();
         msleep(10);
 
+        if (adapter->flags2 & FLAG2_DMA_BURST) {
+                /*
+                 * set the writeback threshold (only takes effect if the RDTR
+                 * is set). set GRAN=1 and write back up to 0x4 worth, and
+                 * enable prefetching of 0x20 rx descriptors
+                 * granularity = 01
+                 * wthresh = 04,
+                 * hthresh = 04,
+                 * pthresh = 0x20
+                 */
+                ew32(RXDCTL(0), E1000_RXDCTL_DMA_BURST_ENABLE);
+                ew32(RXDCTL(1), E1000_RXDCTL_DMA_BURST_ENABLE);
+
+                /*
+                 * override the delay timers for enabling bursting, only if
+                 * the value was not set by the user via module options
+                 */
+                if (adapter->rx_int_delay == DEFAULT_RDTR)
+                        adapter->rx_int_delay = BURST_RDTR;
+                if (adapter->rx_abs_int_delay == DEFAULT_RADV)
+                        adapter->rx_abs_int_delay = BURST_RADV;
+        }
+
         /* set the Receive Delay Timer Register */
         ew32(RDTR, adapter->rx_int_delay);
 
         /* irq moderation */
         ew32(RADV, adapter->rx_abs_int_delay);
-        if (adapter->itr_setting != 0)
+        if ((adapter->itr_setting != 0) && (adapter->itr != 0))
                 ew32(ITR, 1000000000 / (adapter->itr * 256));
 
         ctrl_ext = er32(CTRL_EXT);
@@ -2922,11 +2973,13 @@ static void e1000_configure_rx(struct e1000_adapter *adapter)
          * packet size is equal or larger than the specified value (in 8 byte
          * units), e.g. using jumbo frames when setting to E1000_ERT_2048
          */
-        if (adapter->flags & FLAG_HAS_ERT) {
+        if ((adapter->flags & FLAG_HAS_ERT) ||
+            (adapter->hw.mac.type == e1000_pch2lan)) {
                 if (adapter->netdev->mtu > ETH_DATA_LEN) {
                         u32 rxdctl = er32(RXDCTL(0));
                         ew32(RXDCTL(0), rxdctl | 0x3);
-                        ew32(ERT, E1000_ERT_2048 | (1 << 13));
+                        if (adapter->flags & FLAG_HAS_ERT)
+                                ew32(ERT, E1000_ERT_2048 | (1 << 13));
                         /*
                          * With jumbo frames and early-receive enabled,
                          * excessive C-state transition latencies result in
@@ -3189,9 +3242,35 @@ void e1000e_reset(struct e1000_adapter *adapter)
                 fc->low_water = 0x05048;
                 fc->pause_time = 0x0650;
                 fc->refresh_time = 0x0400;
+                if (adapter->netdev->mtu > ETH_DATA_LEN) {
+                        pba = 14;
+                        ew32(PBA, pba);
+                }
                 break;
         }
 
+        /*
+         * Disable Adaptive Interrupt Moderation if 2 full packets cannot
+         * fit in receive buffer and early-receive not supported.
+         */
+        if (adapter->itr_setting & 0x3) {
+                if (((adapter->max_frame_size * 2) > (pba << 10)) &&
+                    !(adapter->flags & FLAG_HAS_ERT)) {
+                        if (!(adapter->flags2 & FLAG2_DISABLE_AIM)) {
+                                dev_info(&adapter->pdev->dev,
+                                        "Interrupt Throttle Rate turned off\n");
+                                adapter->flags2 |= FLAG2_DISABLE_AIM;
+                                ew32(ITR, 0);
+                        }
+                } else if (adapter->flags2 & FLAG2_DISABLE_AIM) {
+                        dev_info(&adapter->pdev->dev,
+                                 "Interrupt Throttle Rate turned on\n");
+                        adapter->flags2 &= ~FLAG2_DISABLE_AIM;
+                        adapter->itr = 20000;
+                        ew32(ITR, 1000000000 / (adapter->itr * 256));
+                }
+        }
+
         /* Allow time for pending master requests to run */
         mac->ops.reset_hw(hw);
 
@@ -3510,7 +3589,8 @@ static int e1000_open(struct net_device *netdev)
                 e1000_update_mng_vlan(adapter);
 
         /* DMA latency requirement to workaround early-receive/jumbo issue */
-        if (adapter->flags & FLAG_HAS_ERT)
+        if ((adapter->flags & FLAG_HAS_ERT) ||
+            (adapter->hw.mac.type == e1000_pch2lan))
                 pm_qos_add_request(&adapter->netdev->pm_qos_req,
                                    PM_QOS_CPU_DMA_LATENCY,
                                    PM_QOS_DEFAULT_VALUE);
@@ -3619,7 +3699,8 @@ static int e1000_close(struct net_device *netdev)
         if (adapter->flags & FLAG_HAS_AMT)
                 e1000_release_hw_control(adapter);
 
-        if (adapter->flags & FLAG_HAS_ERT)
+        if ((adapter->flags & FLAG_HAS_ERT) ||
+            (adapter->hw.mac.type == e1000_pch2lan))
                 pm_qos_remove_request(&adapter->netdev->pm_qos_req);
 
         pm_runtime_put_sync(&pdev->dev);
@@ -4235,6 +4316,16 @@ link_up:
         /* Force detection of hung controller every watchdog period */
         adapter->detect_tx_hung = 1;
 
+        /* flush partial descriptors to memory before detecting tx hang */
+        if (adapter->flags2 & FLAG2_DMA_BURST) {
+                ew32(TIDV, adapter->tx_int_delay | E1000_TIDV_FPD);
+                ew32(RDTR, adapter->rx_int_delay | E1000_RDTR_FPD);
+                /*
+                 * no need to flush the writes because the timeout code does
+                 * an er32 first thing
+                 */
+        }
+
         /*
          * With 82571 controllers, LAA may be overwritten due to controller
          * reset from the other port. Set the appropriate LAA in RAR[0]
@@ -4709,7 +4800,7 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
         if (e1000_maybe_stop_tx(netdev, count + 2))
                 return NETDEV_TX_BUSY;
 
-        if (adapter->vlgrp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 tx_flags |= E1000_TX_FLAGS_VLAN;
                 tx_flags |= (vlan_tx_tag_get(skb) << E1000_TX_FLAGS_VLAN_SHIFT);
         }
@@ -4813,6 +4904,15 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
                 return -EINVAL;
         }
 
+        /* Jumbo frame workaround on 82579 requires CRC be stripped */
+        if ((adapter->hw.mac.type == e1000_pch2lan) &&
+            !(adapter->flags2 & FLAG2_CRC_STRIPPING) &&
+            (new_mtu > ETH_DATA_LEN)) {
+                e_err("Jumbo Frames not supported on 82579 when CRC "
+                      "stripping is disabled.\n");
+                return -EINVAL;
+        }
+
         /* 82573 Errata 17 */
         if (((adapter->hw.mac.type == e1000_82573) ||
              (adapter->hw.mac.type == e1000_82574)) &&
@@ -5683,8 +5783,10 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         netdev->vlan_features |= NETIF_F_HW_CSUM;
         netdev->vlan_features |= NETIF_F_SG;
 
-        if (pci_using_dac)
+        if (pci_using_dac) {
                 netdev->features |= NETIF_F_HIGHDMA;
+                netdev->vlan_features |= NETIF_F_HIGHDMA;
+        }
 
         if (e1000e_enable_mng_pass_thru(&adapter->hw))
                 adapter->flags |= FLAG_MNG_PT_ENABLED;
diff --git a/drivers/net/e1000e/param.c b/drivers/net/e1000e/param.c
index 34aeec13bb16..3d36911f77f3 100644
--- a/drivers/net/e1000e/param.c
+++ b/drivers/net/e1000e/param.c
@@ -91,7 +91,6 @@ E1000_PARAM(TxAbsIntDelay, "Transmit Absolute Interrupt Delay");
  * Valid Range: 0-65535
  */
 E1000_PARAM(RxIntDelay, "Receive Interrupt Delay");
-#define DEFAULT_RDTR 0
 #define MAX_RXDELAY 0xFFFF
 #define MIN_RXDELAY 0
 
@@ -101,7 +100,6 @@ E1000_PARAM(RxIntDelay, "Receive Interrupt Delay");
  * Valid Range: 0-65535
  */
 E1000_PARAM(RxAbsIntDelay, "Receive Absolute Interrupt Delay");
-#define DEFAULT_RADV 8
 #define MAX_RXABSDELAY 0xFFFF
 #define MIN_RXABSDELAY 0
 
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 1846623c6ae6..1321cb6401cf 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -491,6 +491,8 @@ struct ehea_port {
         u8 full_duplex;
         u8 autoneg;
         u8 num_def_qps;
+        wait_queue_head_t swqe_avail_wq;
+        wait_queue_head_t restart_wq;
 };
 
 struct port_res_cfg {
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 043d99013056..a0d117022be6 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -786,6 +786,7 @@ static void reset_sq_restart_flag(struct ehea_port *port)
                 struct ehea_port_res *pr = &port->port_res[i];
                 pr->sq_restart_flag = 0;
         }
+        wake_up(&port->restart_wq);
 }
 
 static void check_sqs(struct ehea_port *port)
@@ -796,6 +797,7 @@ static void check_sqs(struct ehea_port *port)
 
         for (i = 0; i < port->num_def_qps + port->num_add_tx_qps; i++) {
                 struct ehea_port_res *pr = &port->port_res[i];
+                int ret;
                 k = 0;
                 swqe = ehea_get_swqe(pr->qp, &swqe_index);
                 memset(swqe, 0, SWQE_HEADER_SIZE);
@@ -809,17 +811,16 @@ static void check_sqs(struct ehea_port *port)
 
                 ehea_post_swqe(pr->qp, swqe);
 
-                while (pr->sq_restart_flag == 0) {
-                        msleep(5);
-                        if (++k == 100) {
-                                ehea_error("HW/SW queues out of sync");
-                                ehea_schedule_port_reset(pr->port);
-                                return;
-                        }
+                ret = wait_event_timeout(port->restart_wq,
+                                         pr->sq_restart_flag == 0,
+                                         msecs_to_jiffies(100));
+
+                if (!ret) {
+                        ehea_error("HW/SW queues out of sync");
+                        ehea_schedule_port_reset(pr->port);
+                        return;
                 }
         }
-
-        return;
 }
 
 
@@ -890,6 +891,7 @@ static struct ehea_cqe *ehea_proc_cqes(struct ehea_port_res *pr, int my_quota)
                 pr->queue_stopped = 0;
         }
         spin_unlock_irqrestore(&pr->netif_queue, flags);
+        wake_up(&pr->port->swqe_avail_wq);
 
         return cqe;
 }
@@ -1916,7 +1918,7 @@ static void ehea_promiscuous(struct net_device *dev, int enable)
         struct hcp_ehea_port_cb7 *cb7;
         u64 hret;
 
-        if ((enable && port->promisc) || (!enable && !port->promisc))
+        if (enable == port->promisc)
                 return;
 
         cb7 = (void *)get_zeroed_page(GFP_ATOMIC);
@@ -2270,7 +2272,7 @@ static int ehea_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
         pr->swqe_id_counter += 1;
 
-        if (port->vgrp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 swqe->tx_control |= EHEA_SWQE_VLAN_INSERT;
                 swqe->vlan_tag = vlan_tx_tag_get(skb);
         }
@@ -2654,6 +2656,9 @@ static int ehea_open(struct net_device *dev)
                 netif_start_queue(dev);
         }
 
+        init_waitqueue_head(&port->swqe_avail_wq);
+        init_waitqueue_head(&port->restart_wq);
+
         mutex_unlock(&port->port_lock);
 
         return ret;
@@ -2726,13 +2731,15 @@ static void ehea_flush_sq(struct ehea_port *port)
         for (i = 0; i < port->num_def_qps + port->num_add_tx_qps; i++) {
                 struct ehea_port_res *pr = &port->port_res[i];
                 int swqe_max = pr->sq_skba_size - 2 - pr->swqe_ll_count;
-                int k = 0;
-                while (atomic_read(&pr->swqe_avail) < swqe_max) {
-                        msleep(5);
-                        if (++k == 20) {
-                                ehea_error("WARNING: sq not flushed completely");
-                                break;
-                        }
+                int ret;
+
+                ret = wait_event_timeout(port->swqe_avail_wq,
+                         atomic_read(&pr->swqe_avail) >= swqe_max,
+                         msecs_to_jiffies(100));
+
+                if (!ret) {
+                        ehea_error("WARNING: sq not flushed completely");
+                        break;
                 }
         }
 }
diff --git a/drivers/net/enic/enic.h b/drivers/net/enic/enic.h
index 75869ed7226f..c91d364c5527 100644
--- a/drivers/net/enic/enic.h
+++ b/drivers/net/enic/enic.h
@@ -32,7 +32,7 @@
 
 #define DRV_NAME                "enic"
 #define DRV_DESCRIPTION         "Cisco VIC Ethernet NIC Driver"
-#define DRV_VERSION             "1.4.1.2"
+#define DRV_VERSION             "1.4.1.6"
 #define DRV_COPYRIGHT           "Copyright 2008-2010 Cisco Systems, Inc"
 
 #define ENIC_BARS_MAX           6
@@ -42,25 +42,6 @@
 #define ENIC_CQ_MAX             (ENIC_WQ_MAX + ENIC_RQ_MAX)
 #define ENIC_INTR_MAX           (ENIC_CQ_MAX + 2)
 
-enum enic_cq_index {
-        ENIC_CQ_RQ,
-        ENIC_CQ_WQ,
-};
-
-enum enic_intx_intr_index {
-        ENIC_INTX_WQ_RQ,
-        ENIC_INTX_ERR,
-        ENIC_INTX_NOTIFY,
-};
-
-enum enic_msix_intr_index {
-        ENIC_MSIX_RQ,
-        ENIC_MSIX_WQ,
-        ENIC_MSIX_ERR,
-        ENIC_MSIX_NOTIFY,
-        ENIC_MSIX_MAX,
-};
-
 struct enic_msix_entry {
         int requested;
         char devname[IFNAMSIZ];
@@ -91,8 +72,8 @@ struct enic {
         struct vnic_dev *vdev;
         struct timer_list notify_timer;
         struct work_struct reset;
-        struct msix_entry msix_entry[ENIC_MSIX_MAX];
-        struct enic_msix_entry msix[ENIC_MSIX_MAX];
+        struct msix_entry msix_entry[ENIC_INTR_MAX];
+        struct enic_msix_entry msix[ENIC_INTR_MAX];
         u32 msg_enable;
         spinlock_t devcmd_lock;
         u8 mac_addr[ETH_ALEN];
@@ -119,7 +100,7 @@ struct enic {
         int (*rq_alloc_buf)(struct vnic_rq *rq);
         u64 rq_truncated_pkts;
         u64 rq_bad_fcs;
-        struct napi_struct napi;
+        struct napi_struct napi[ENIC_RQ_MAX];
 
         /* interrupt resource cache line section */
         ____cacheline_aligned struct vnic_intr intr[ENIC_INTR_MAX];
diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c
index 711077a2e345..a466ef91dd43 100644
--- a/drivers/net/enic/enic_main.c
+++ b/drivers/net/enic/enic_main.c
@@ -122,6 +122,51 @@ static int enic_is_dynamic(struct enic *enic)
         return enic->pdev->device == PCI_DEVICE_ID_CISCO_VIC_ENET_DYN;
 }
 
+static inline unsigned int enic_cq_rq(struct enic *enic, unsigned int rq)
+{
+        return rq;
+}
+
+static inline unsigned int enic_cq_wq(struct enic *enic, unsigned int wq)
+{
+        return enic->rq_count + wq;
+}
+
+static inline unsigned int enic_legacy_io_intr(void)
+{
+        return 0;
+}
+
+static inline unsigned int enic_legacy_err_intr(void)
+{
+        return 1;
+}
+
+static inline unsigned int enic_legacy_notify_intr(void)
+{
+        return 2;
+}
+
+static inline unsigned int enic_msix_rq_intr(struct enic *enic, unsigned int rq)
+{
+        return rq;
+}
+
+static inline unsigned int enic_msix_wq_intr(struct enic *enic, unsigned int wq)
+{
+        return enic->rq_count + wq;
+}
+
+static inline unsigned int enic_msix_err_intr(struct enic *enic)
+{
+        return enic->rq_count + enic->wq_count;
+}
+
+static inline unsigned int enic_msix_notify_intr(struct enic *enic)
+{
+        return enic->rq_count + enic->wq_count + 1;
+}
+
 static int enic_get_settings(struct net_device *netdev,
         struct ethtool_cmd *ecmd)
 {
@@ -306,6 +351,7 @@ static int enic_set_coalesce(struct net_device *netdev,
         struct enic *enic = netdev_priv(netdev);
         u32 tx_coalesce_usecs;
         u32 rx_coalesce_usecs;
+        unsigned int i, intr;
 
         tx_coalesce_usecs = min_t(u32,
                 INTR_COALESCE_HW_TO_USEC(VNIC_INTR_TIMER_MAX),
@@ -319,7 +365,8 @@ static int enic_set_coalesce(struct net_device *netdev,
                 if (tx_coalesce_usecs != rx_coalesce_usecs)
                         return -EINVAL;
 
-                vnic_intr_coalescing_timer_set(&enic->intr[ENIC_INTX_WQ_RQ],
+                intr = enic_legacy_io_intr();
+                vnic_intr_coalescing_timer_set(&enic->intr[intr],
                         INTR_COALESCE_USEC_TO_HW(tx_coalesce_usecs));
                 break;
         case VNIC_DEV_INTR_MODE_MSI:
@@ -330,10 +377,18 @@ static int enic_set_coalesce(struct net_device *netdev,
                         INTR_COALESCE_USEC_TO_HW(tx_coalesce_usecs));
                 break;
         case VNIC_DEV_INTR_MODE_MSIX:
-                vnic_intr_coalescing_timer_set(&enic->intr[ENIC_MSIX_WQ],
-                        INTR_COALESCE_USEC_TO_HW(tx_coalesce_usecs));
-                vnic_intr_coalescing_timer_set(&enic->intr[ENIC_MSIX_RQ],
-                        INTR_COALESCE_USEC_TO_HW(rx_coalesce_usecs));
+                for (i = 0; i < enic->wq_count; i++) {
+                        intr = enic_msix_wq_intr(enic, i);
+                        vnic_intr_coalescing_timer_set(&enic->intr[intr],
+                                INTR_COALESCE_USEC_TO_HW(tx_coalesce_usecs));
+                }
+
+                for (i = 0; i < enic->rq_count; i++) {
+                        intr = enic_msix_rq_intr(enic, i);
+                        vnic_intr_coalescing_timer_set(&enic->intr[intr],
+                                INTR_COALESCE_USEC_TO_HW(rx_coalesce_usecs));
+                }
+
                 break;
         default:
                 break;
@@ -482,34 +537,37 @@ static irqreturn_t enic_isr_legacy(int irq, void *data)
 {
         struct net_device *netdev = data;
         struct enic *enic = netdev_priv(netdev);
+        unsigned int io_intr = enic_legacy_io_intr();
+        unsigned int err_intr = enic_legacy_err_intr();
+        unsigned int notify_intr = enic_legacy_notify_intr();
         u32 pba;
 
-        vnic_intr_mask(&enic->intr[ENIC_INTX_WQ_RQ]);
+        vnic_intr_mask(&enic->intr[io_intr]);
 
         pba = vnic_intr_legacy_pba(enic->legacy_pba);
         if (!pba) {
-                vnic_intr_unmask(&enic->intr[ENIC_INTX_WQ_RQ]);
+                vnic_intr_unmask(&enic->intr[io_intr]);
                 return IRQ_NONE;        /* not our interrupt */
         }
 
-        if (ENIC_TEST_INTR(pba, ENIC_INTX_NOTIFY)) {
-                vnic_intr_return_all_credits(&enic->intr[ENIC_INTX_NOTIFY]);
+        if (ENIC_TEST_INTR(pba, notify_intr)) {
+                vnic_intr_return_all_credits(&enic->intr[notify_intr]);
                 enic_notify_check(enic);
         }
 
-        if (ENIC_TEST_INTR(pba, ENIC_INTX_ERR)) {
-                vnic_intr_return_all_credits(&enic->intr[ENIC_INTX_ERR]);
+        if (ENIC_TEST_INTR(pba, err_intr)) {
+                vnic_intr_return_all_credits(&enic->intr[err_intr]);
                 enic_log_q_error(enic);
                 /* schedule recovery from WQ/RQ error */
                 schedule_work(&enic->reset);
                 return IRQ_HANDLED;
         }
 
-        if (ENIC_TEST_INTR(pba, ENIC_INTX_WQ_RQ)) {
-                if (napi_schedule_prep(&enic->napi))
-                        __napi_schedule(&enic->napi);
+        if (ENIC_TEST_INTR(pba, io_intr)) {
+                if (napi_schedule_prep(&enic->napi[0]))
+                        __napi_schedule(&enic->napi[0]);
         } else {
-                vnic_intr_unmask(&enic->intr[ENIC_INTX_WQ_RQ]);
+                vnic_intr_unmask(&enic->intr[io_intr]);
         }
 
         return IRQ_HANDLED;
@@ -535,17 +593,17 @@ static irqreturn_t enic_isr_msi(int irq, void *data)
          * writes).
          */
 
-        napi_schedule(&enic->napi);
+        napi_schedule(&enic->napi[0]);
 
         return IRQ_HANDLED;
 }
 
 static irqreturn_t enic_isr_msix_rq(int irq, void *data)
 {
-        struct enic *enic = data;
+        struct napi_struct *napi = data;
 
         /* schedule NAPI polling for RQ cleanup */
-        napi_schedule(&enic->napi);
+        napi_schedule(napi);
 
         return IRQ_HANDLED;
 }
@@ -553,13 +611,15 @@ static irqreturn_t enic_isr_msix_rq(int irq, void *data)
 static irqreturn_t enic_isr_msix_wq(int irq, void *data)
 {
         struct enic *enic = data;
+        unsigned int cq = enic_cq_wq(enic, 0);
+        unsigned int intr = enic_msix_wq_intr(enic, 0);
         unsigned int wq_work_to_do = -1; /* no limit */
         unsigned int wq_work_done;
 
-        wq_work_done = vnic_cq_service(&enic->cq[ENIC_CQ_WQ],
+        wq_work_done = vnic_cq_service(&enic->cq[cq],
                 wq_work_to_do, enic_wq_service, NULL);
 
-        vnic_intr_return_credits(&enic->intr[ENIC_MSIX_WQ],
+        vnic_intr_return_credits(&enic->intr[intr],
                 wq_work_done,
                 1 /* unmask intr */,
                 1 /* reset intr timer */);
@@ -570,8 +630,9 @@ static irqreturn_t enic_isr_msix_wq(int irq, void *data)
 static irqreturn_t enic_isr_msix_err(int irq, void *data)
 {
         struct enic *enic = data;
+        unsigned int intr = enic_msix_err_intr(enic);
 
-        vnic_intr_return_all_credits(&enic->intr[ENIC_MSIX_ERR]);
+        vnic_intr_return_all_credits(&enic->intr[intr]);
 
         enic_log_q_error(enic);
 
@@ -584,8 +645,9 @@ static irqreturn_t enic_isr_msix_err(int irq, void *data)
 static irqreturn_t enic_isr_msix_notify(int irq, void *data)
 {
         struct enic *enic = data;
+        unsigned int intr = enic_msix_notify_intr(enic);
 
-        vnic_intr_return_all_credits(&enic->intr[ENIC_MSIX_NOTIFY]);
+        vnic_intr_return_all_credits(&enic->intr[intr]);
         enic_notify_check(enic);
 
         return IRQ_HANDLED;
@@ -743,7 +805,7 @@ static inline void enic_queue_wq_skb(struct enic *enic,
         int vlan_tag_insert = 0;
         int loopback = 0;
 
-        if (enic->vlan_group && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 /* VLAN tag from trunking driver */
                 vlan_tag_insert = 1;
                 vlan_tag = vlan_tx_tag_get(skb);
@@ -912,8 +974,19 @@ static int enic_set_mac_address_dynamic(struct net_device *netdev, void *p)
 static int enic_set_mac_address(struct net_device *netdev, void *p)
 {
         struct sockaddr *saddr = p;
+        char *addr = saddr->sa_data;
+        struct enic *enic = netdev_priv(netdev);
+        int err;
+
+        err = enic_dev_del_station_addr(enic);
+        if (err)
+                return err;
 
-        return enic_set_mac_addr(netdev, (char *)saddr->sa_data);
+        err = enic_set_mac_addr(netdev, addr);
+        if (err)
+                return err;
+
+        return enic_dev_add_station_addr(enic);
 }
 
 static int enic_dev_packet_filter(struct enic *enic, int directed,
@@ -1409,8 +1482,8 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
                         (vlan_tci & CQ_ENET_RQ_DESC_VLAN_TCI_VLAN_MASK)) {
 
                         if (netdev->features & NETIF_F_GRO)
-                                vlan_gro_receive(&enic->napi, enic->vlan_group,
-                                        vlan_tci, skb);
+                                vlan_gro_receive(&enic->napi[q_number],
+                                        enic->vlan_group, vlan_tci, skb);
                         else
                                 vlan_hwaccel_receive_skb(skb,
                                         enic->vlan_group, vlan_tci);
@@ -1418,12 +1491,11 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
                 } else {
 
                         if (netdev->features & NETIF_F_GRO)
-                                napi_gro_receive(&enic->napi, skb);
+                                napi_gro_receive(&enic->napi[q_number], skb);
                         else
                                 netif_receive_skb(skb);
 
                 }
-
         } else {
 
                 /* Buffer overflow
@@ -1447,7 +1519,11 @@ static int enic_rq_service(struct vnic_dev *vdev, struct cq_desc *cq_desc,
 
 static int enic_poll(struct napi_struct *napi, int budget)
 {
-        struct enic *enic = container_of(napi, struct enic, napi);
+        struct net_device *netdev = napi->dev;
+        struct enic *enic = netdev_priv(netdev);
+        unsigned int cq_rq = enic_cq_rq(enic, 0);
+        unsigned int cq_wq = enic_cq_wq(enic, 0);
+        unsigned int intr = enic_legacy_io_intr();
         unsigned int rq_work_to_do = budget;
         unsigned int wq_work_to_do = -1; /* no limit */
         unsigned int  work_done, rq_work_done, wq_work_done;
@@ -1456,10 +1532,10 @@ static int enic_poll(struct napi_struct *napi, int budget)
         /* Service RQ (first) and WQ
          */
 
-        rq_work_done = vnic_cq_service(&enic->cq[ENIC_CQ_RQ],
+        rq_work_done = vnic_cq_service(&enic->cq[cq_rq],
                 rq_work_to_do, enic_rq_service, NULL);
 
-        wq_work_done = vnic_cq_service(&enic->cq[ENIC_CQ_WQ],
+        wq_work_done = vnic_cq_service(&enic->cq[cq_wq],
                 wq_work_to_do, enic_wq_service, NULL);
 
         /* Accumulate intr event credits for this polling
@@ -1470,7 +1546,7 @@ static int enic_poll(struct napi_struct *napi, int budget)
         work_done = rq_work_done + wq_work_done;
 
         if (work_done > 0)
-                vnic_intr_return_credits(&enic->intr[ENIC_INTX_WQ_RQ],
+                vnic_intr_return_credits(&enic->intr[intr],
                         work_done,
                         0 /* don't unmask intr */,
                         0 /* don't reset intr timer */);
@@ -1491,7 +1567,7 @@ static int enic_poll(struct napi_struct *napi, int budget)
                  */
 
                 napi_complete(napi);
-                vnic_intr_unmask(&enic->intr[ENIC_INTX_WQ_RQ]);
+                vnic_intr_unmask(&enic->intr[intr]);
         }
 
         return rq_work_done;
@@ -1499,7 +1575,11 @@ static int enic_poll(struct napi_struct *napi, int budget)
 
 static int enic_poll_msix(struct napi_struct *napi, int budget)
 {
-        struct enic *enic = container_of(napi, struct enic, napi);
+        struct net_device *netdev = napi->dev;
+        struct enic *enic = netdev_priv(netdev);
+        unsigned int rq = (napi - &enic->napi[0]);
+        unsigned int cq = enic_cq_rq(enic, rq);
+        unsigned int intr = enic_msix_rq_intr(enic, rq);
         unsigned int work_to_do = budget;
         unsigned int work_done;
         int err;
@@ -1507,7 +1587,7 @@ static int enic_poll_msix(struct napi_struct *napi, int budget)
         /* Service RQ
          */
 
-        work_done = vnic_cq_service(&enic->cq[ENIC_CQ_RQ],
+        work_done = vnic_cq_service(&enic->cq[cq],
                 work_to_do, enic_rq_service, NULL);
 
         /* Return intr event credits for this polling
@@ -1516,12 +1596,12 @@ static int enic_poll_msix(struct napi_struct *napi, int budget)
          */
 
         if (work_done > 0)
-                vnic_intr_return_credits(&enic->intr[ENIC_MSIX_RQ],
+                vnic_intr_return_credits(&enic->intr[intr],
                         work_done,
                         0 /* don't unmask intr */,
                         0 /* don't reset intr timer */);
 
-        err = vnic_rq_fill(&enic->rq[0], enic->rq_alloc_buf);
+        err = vnic_rq_fill(&enic->rq[rq], enic->rq_alloc_buf);
 
         /* Buffer allocation failed. Stay in polling mode
          * so we can try to fill the ring again.
@@ -1537,7 +1617,7 @@ static int enic_poll_msix(struct napi_struct *napi, int budget)
                  */
 
                 napi_complete(napi);
-                vnic_intr_unmask(&enic->intr[ENIC_MSIX_RQ]);
+                vnic_intr_unmask(&enic->intr[intr]);
         }
 
         return work_done;
@@ -1579,7 +1659,7 @@ static void enic_free_intr(struct enic *enic)
 static int enic_request_intr(struct enic *enic)
 {
         struct net_device *netdev = enic->netdev;
-        unsigned int i;
+        unsigned int i, intr;
         int err = 0;
 
         switch (vnic_dev_get_intr_mode(enic->vdev)) {
@@ -1598,27 +1678,38 @@ static int enic_request_intr(struct enic *enic)
 
         case VNIC_DEV_INTR_MODE_MSIX:
 
-                sprintf(enic->msix[ENIC_MSIX_RQ].devname,
-                        "%.11s-rx-0", netdev->name);
-                enic->msix[ENIC_MSIX_RQ].isr = enic_isr_msix_rq;
-                enic->msix[ENIC_MSIX_RQ].devid = enic;
+                for (i = 0; i < enic->rq_count; i++) {
+                        intr = enic_msix_rq_intr(enic, i);
+                        sprintf(enic->msix[intr].devname,
+                                "%.11s-rx-%d", netdev->name, i);
+                        enic->msix[intr].isr = enic_isr_msix_rq;
+                        enic->msix[intr].devid = &enic->napi[i];
+                }
 
-                sprintf(enic->msix[ENIC_MSIX_WQ].devname,
-                        "%.11s-tx-0", netdev->name);
-                enic->msix[ENIC_MSIX_WQ].isr = enic_isr_msix_wq;
-                enic->msix[ENIC_MSIX_WQ].devid = enic;
+                for (i = 0; i < enic->wq_count; i++) {
+                        intr = enic_msix_wq_intr(enic, i);
+                        sprintf(enic->msix[intr].devname,
+                                "%.11s-tx-%d", netdev->name, i);
+                        enic->msix[intr].isr = enic_isr_msix_wq;
+                        enic->msix[intr].devid = enic;
+                }
 
-                sprintf(enic->msix[ENIC_MSIX_ERR].devname,
+                intr = enic_msix_err_intr(enic);
+                sprintf(enic->msix[intr].devname,
                         "%.11s-err", netdev->name);
-                enic->msix[ENIC_MSIX_ERR].isr = enic_isr_msix_err;
-                enic->msix[ENIC_MSIX_ERR].devid = enic;
+                enic->msix[intr].isr = enic_isr_msix_err;
+                enic->msix[intr].devid = enic;
 
-                sprintf(enic->msix[ENIC_MSIX_NOTIFY].devname,
+                intr = enic_msix_notify_intr(enic);
+                sprintf(enic->msix[intr].devname,
                         "%.11s-notify", netdev->name);
-                enic->msix[ENIC_MSIX_NOTIFY].isr = enic_isr_msix_notify;
-                enic->msix[ENIC_MSIX_NOTIFY].devid = enic;
+                enic->msix[intr].isr = enic_isr_msix_notify;
+                enic->msix[intr].devid = enic;
+
+                for (i = 0; i < ARRAY_SIZE(enic->msix); i++)
+                        enic->msix[i].requested = 0;
 
-                for (i = 0; i < ARRAY_SIZE(enic->msix); i++) {
+                for (i = 0; i < enic->intr_count; i++) {
                         err = request_irq(enic->msix_entry[i].vector,
                                 enic->msix[i].isr, 0,
                                 enic->msix[i].devname,
@@ -1664,10 +1755,12 @@ static int enic_dev_notify_set(struct enic *enic)
         spin_lock(&enic->devcmd_lock);
         switch (vnic_dev_get_intr_mode(enic->vdev)) {
         case VNIC_DEV_INTR_MODE_INTX:
-                err = vnic_dev_notify_set(enic->vdev, ENIC_INTX_NOTIFY);
+                err = vnic_dev_notify_set(enic->vdev,
+                        enic_legacy_notify_intr());
                 break;
         case VNIC_DEV_INTR_MODE_MSIX:
-                err = vnic_dev_notify_set(enic->vdev, ENIC_MSIX_NOTIFY);
+                err = vnic_dev_notify_set(enic->vdev,
+                        enic_msix_notify_intr(enic));
                 break;
         default:
                 err = vnic_dev_notify_set(enic->vdev, -1 /* no intr */);
@@ -1694,7 +1787,7 @@ static int enic_dev_enable(struct enic *enic)
         int err;
 
         spin_lock(&enic->devcmd_lock);
-        err = vnic_dev_enable(enic->vdev);
+        err = vnic_dev_enable_wait(enic->vdev);
         spin_unlock(&enic->devcmd_lock);
 
         return err;
@@ -1762,7 +1855,10 @@ static int enic_open(struct net_device *netdev)
         enic_set_multicast_list(netdev);
 
         netif_wake_queue(netdev);
-        napi_enable(&enic->napi);
+
+        for (i = 0; i < enic->rq_count; i++)
+                napi_enable(&enic->napi[i]);
+
         enic_dev_enable(enic);
 
         for (i = 0; i < enic->intr_count; i++)
@@ -1797,7 +1893,10 @@ static int enic_stop(struct net_device *netdev)
         del_timer_sync(&enic->notify_timer);
 
         enic_dev_disable(enic);
-        napi_disable(&enic->napi);
+
+        for (i = 0; i < enic->rq_count; i++)
+                napi_disable(&enic->napi[i]);
+
         netif_carrier_off(netdev);
         netif_tx_disable(netdev);
         enic_dev_del_station_addr(enic);
@@ -1857,11 +1956,16 @@ static void enic_poll_controller(struct net_device *netdev)
 {
         struct enic *enic = netdev_priv(netdev);
         struct vnic_dev *vdev = enic->vdev;
+        unsigned int i, intr;
 
         switch (vnic_dev_get_intr_mode(vdev)) {
         case VNIC_DEV_INTR_MODE_MSIX:
-                enic_isr_msix_rq(enic->pdev->irq, enic);
-                enic_isr_msix_wq(enic->pdev->irq, enic);
+                for (i = 0; i < enic->rq_count; i++) {
+                        intr = enic_msix_rq_intr(enic, i);
+                        enic_isr_msix_rq(enic->msix_entry[intr].vector, enic);
+                }
+                intr = enic_msix_wq_intr(enic, i);
+                enic_isr_msix_wq(enic->msix_entry[intr].vector, enic);
                 break;
         case VNIC_DEV_INTR_MODE_MSI:
                 enic_isr_msi(enic->pdev->irq, enic);
@@ -1936,19 +2040,73 @@ static int enic_dev_hang_reset(struct enic *enic)
         return err;
 }
 
-static int enic_set_niccfg(struct enic *enic)
+static int enic_set_rsskey(struct enic *enic)
+{
+        u64 rss_key_buf_pa;
+        union vnic_rss_key *rss_key_buf_va = NULL;
+        union vnic_rss_key rss_key = {
+                .key[0].b = {85, 67, 83, 97, 119, 101, 115, 111, 109, 101},
+                .key[1].b = {80, 65, 76, 79, 117, 110, 105, 113, 117, 101},
+                .key[2].b = {76, 73, 78, 85, 88, 114, 111, 99, 107, 115},
+                .key[3].b = {69, 78, 73, 67, 105, 115, 99, 111, 111, 108},
+        };
+        int err;
+
+        rss_key_buf_va = pci_alloc_consistent(enic->pdev,
+                sizeof(union vnic_rss_key), &rss_key_buf_pa);
+        if (!rss_key_buf_va)
+                return -ENOMEM;
+
+        memcpy(rss_key_buf_va, &rss_key, sizeof(union vnic_rss_key));
+
+        spin_lock(&enic->devcmd_lock);
+        err = enic_set_rss_key(enic,
+                rss_key_buf_pa,
+                sizeof(union vnic_rss_key));
+        spin_unlock(&enic->devcmd_lock);
+
+        pci_free_consistent(enic->pdev, sizeof(union vnic_rss_key),
+                rss_key_buf_va, rss_key_buf_pa);
+
+        return err;
+}
+
+static int enic_set_rsscpu(struct enic *enic, u8 rss_hash_bits)
+{
+        u64 rss_cpu_buf_pa;
+        union vnic_rss_cpu *rss_cpu_buf_va = NULL;
+        unsigned int i;
+        int err;
+
+        rss_cpu_buf_va = pci_alloc_consistent(enic->pdev,
+                sizeof(union vnic_rss_cpu), &rss_cpu_buf_pa);
+        if (!rss_cpu_buf_va)
+                return -ENOMEM;
+
+        for (i = 0; i < (1 << rss_hash_bits); i++)
+                (*rss_cpu_buf_va).cpu[i/4].b[i%4] = i % enic->rq_count;
+
+        spin_lock(&enic->devcmd_lock);
+        err = enic_set_rss_cpu(enic,
+                rss_cpu_buf_pa,
+                sizeof(union vnic_rss_cpu));
+        spin_unlock(&enic->devcmd_lock);
+
+        pci_free_consistent(enic->pdev, sizeof(union vnic_rss_cpu),
+                rss_cpu_buf_va, rss_cpu_buf_pa);
+
+        return err;
+}
+
+static int enic_set_niccfg(struct enic *enic, u8 rss_default_cpu,
+        u8 rss_hash_type, u8 rss_hash_bits, u8 rss_base_cpu, u8 rss_enable)
 {
-        const u8 rss_default_cpu = 0;
-        const u8 rss_hash_type = 0;
-        const u8 rss_hash_bits = 0;
-        const u8 rss_base_cpu = 0;
-        const u8 rss_enable = 0;
         const u8 tso_ipid_split_en = 0;
         const u8 ig_vlan_strip_en = 1;
         int err;
 
-        /* Enable VLAN tag stripping.  RSS not enabled (yet).
-         */
+        /* Enable VLAN tag stripping.
+        */
 
         spin_lock(&enic->devcmd_lock);
         err = enic_set_nic_cfg(enic,
@@ -1961,6 +2119,35 @@ static int enic_set_niccfg(struct enic *enic)
         return err;
 }
 
+static int enic_set_rss_nic_cfg(struct enic *enic)
+{
+        struct device *dev = enic_get_dev(enic);
+        const u8 rss_default_cpu = 0;
+        const u8 rss_hash_type = NIC_CFG_RSS_HASH_TYPE_IPV4 |
+                NIC_CFG_RSS_HASH_TYPE_TCP_IPV4 |
+                NIC_CFG_RSS_HASH_TYPE_IPV6 |
+                NIC_CFG_RSS_HASH_TYPE_TCP_IPV6;
+        const u8 rss_hash_bits = 7;
+        const u8 rss_base_cpu = 0;
+        u8 rss_enable = ENIC_SETTING(enic, RSS) && (enic->rq_count > 1);
+
+        if (rss_enable) {
+                if (!enic_set_rsskey(enic)) {
+                        if (enic_set_rsscpu(enic, rss_hash_bits)) {
+                                rss_enable = 0;
+                                dev_warn(dev, "RSS disabled, "
+                                        "Failed to set RSS cpu indirection table.");
+                        }
+                } else {
+                        rss_enable = 0;
+                        dev_warn(dev, "RSS disabled, Failed to set RSS key.\n");
+                }
+        }
+
+        return enic_set_niccfg(enic, rss_default_cpu, rss_hash_type,
+                rss_hash_bits, rss_base_cpu, rss_enable);
+}
+
 static int enic_dev_hang_notify(struct enic *enic)
 {
         int err;
@@ -1972,7 +2159,7 @@ static int enic_dev_hang_notify(struct enic *enic)
         return err;
 }
 
-int enic_dev_set_ig_vlan_rewrite_mode(struct enic *enic)
+static int enic_dev_set_ig_vlan_rewrite_mode(struct enic *enic)
 {
         int err;
 
@@ -1998,7 +2185,7 @@ static void enic_reset(struct work_struct *work)
         enic_dev_hang_reset(enic);
         enic_reset_multicast_list(enic);
         enic_init_vnic_resources(enic);
-        enic_set_niccfg(enic);
+        enic_set_rss_nic_cfg(enic);
         enic_dev_set_ig_vlan_rewrite_mode(enic);
         enic_open(enic->netdev);
 
@@ -2007,12 +2194,12 @@ static void enic_reset(struct work_struct *work)
 
 static int enic_set_intr_mode(struct enic *enic)
 {
-        unsigned int n = 1;
+        unsigned int n = min_t(unsigned int, enic->rq_count, ENIC_RQ_MAX);
         unsigned int m = 1;
         unsigned int i;
 
         /* Set interrupt mode (INTx, MSI, MSI-X) depending
-         * system capabilities.
+         * on system capabilities.
          *
          * Try MSI-X first
          *
@@ -2025,21 +2212,47 @@ static int enic_set_intr_mode(struct enic *enic)
         for (i = 0; i < n + m + 2; i++)
                 enic->msix_entry[i].entry = i;
 
-        if (enic->config.intr_mode < 1 &&
+        /* Use multiple RQs if RSS is enabled
+         */
+
+        if (ENIC_SETTING(enic, RSS) &&
+            enic->config.intr_mode < 1 &&
             enic->rq_count >= n &&
             enic->wq_count >= m &&
             enic->cq_count >= n + m &&
-            enic->intr_count >= n + m + 2 &&
-            !pci_enable_msix(enic->pdev, enic->msix_entry, n + m + 2)) {
+            enic->intr_count >= n + m + 2) {
 
-                enic->rq_count = n;
-                enic->wq_count = m;
-                enic->cq_count = n + m;
-                enic->intr_count = n + m + 2;
+                if (!pci_enable_msix(enic->pdev, enic->msix_entry, n + m + 2)) {
 
-                vnic_dev_set_intr_mode(enic->vdev, VNIC_DEV_INTR_MODE_MSIX);
+                        enic->rq_count = n;
+                        enic->wq_count = m;
+                        enic->cq_count = n + m;
+                        enic->intr_count = n + m + 2;
 
-                return 0;
+                        vnic_dev_set_intr_mode(enic->vdev,
+                                VNIC_DEV_INTR_MODE_MSIX);
+
+                        return 0;
+                }
+        }
+
+        if (enic->config.intr_mode < 1 &&
+            enic->rq_count >= 1 &&
+            enic->wq_count >= m &&
+            enic->cq_count >= 1 + m &&
+            enic->intr_count >= 1 + m + 2) {
+                if (!pci_enable_msix(enic->pdev, enic->msix_entry, 1 + m + 2)) {
+
+                        enic->rq_count = 1;
+                        enic->wq_count = m;
+                        enic->cq_count = 1 + m;
+                        enic->intr_count = 1 + m + 2;
+
+                        vnic_dev_set_intr_mode(enic->vdev,
+                                VNIC_DEV_INTR_MODE_MSIX);
+
+                        return 0;
+                }
         }
 
         /* Next try MSI
@@ -2147,17 +2360,22 @@ static const struct net_device_ops enic_netdev_ops = {
 #endif
 };
 
-void enic_dev_deinit(struct enic *enic)
+static void enic_dev_deinit(struct enic *enic)
 {
-        netif_napi_del(&enic->napi);
+        unsigned int i;
+
+        for (i = 0; i < enic->rq_count; i++)
+                netif_napi_del(&enic->napi[i]);
+
         enic_free_vnic_resources(enic);
         enic_clear_intr_mode(enic);
 }
 
-int enic_dev_init(struct enic *enic)
+static int enic_dev_init(struct enic *enic)
 {
         struct device *dev = enic_get_dev(enic);
         struct net_device *netdev = enic->netdev;
+        unsigned int i;
         int err;
 
         /* Get vNIC configuration
@@ -2202,7 +2420,7 @@ int enic_dev_init(struct enic *enic)
                 goto err_out_free_vnic_resources;
         }
 
-        err = enic_set_niccfg(enic);
+        err = enic_set_rss_nic_cfg(enic);
         if (err) {
                 dev_err(dev, "Failed to config nic, aborting\n");
                 goto err_out_free_vnic_resources;
@@ -2210,17 +2428,19 @@ int enic_dev_init(struct enic *enic)
 
         err = enic_dev_set_ig_vlan_rewrite_mode(enic);
         if (err) {
-                netdev_err(netdev,
+                dev_err(dev,
                         "Failed to set ingress vlan rewrite mode, aborting.\n");
                 goto err_out_free_vnic_resources;
         }
 
         switch (vnic_dev_get_intr_mode(enic->vdev)) {
         default:
-                netif_napi_add(netdev, &enic->napi, enic_poll, 64);
+                netif_napi_add(netdev, &enic->napi[0], enic_poll, 64);
                 break;
         case VNIC_DEV_INTR_MODE_MSIX:
-                netif_napi_add(netdev, &enic->napi, enic_poll_msix, 64);
+                for (i = 0; i < enic->rq_count; i++)
+                        netif_napi_add(netdev, &enic->napi[i],
+                                enic_poll_msix, 64);
                 break;
         }
 
diff --git a/drivers/net/enic/enic_res.c b/drivers/net/enic/enic_res.c
index 29ede8a17a2c..f111a37419ce 100644
--- a/drivers/net/enic/enic_res.c
+++ b/drivers/net/enic/enic_res.c
@@ -94,13 +94,14 @@ int enic_get_vnic_config(struct enic *enic)
                 INTR_COALESCE_HW_TO_USEC(VNIC_INTR_TIMER_MAX),
                 c->intr_timer_usec);
 
-        dev_info(enic_get_dev(enic), "vNIC MAC addr %pM wq/rq %d/%d\n",
-                enic->mac_addr, c->wq_desc_count, c->rq_desc_count);
-        dev_info(enic_get_dev(enic), "vNIC mtu %d csum tx/rx %d/%d "
-                "tso/lro %d/%d intr timer %d usec\n",
-                c->mtu, ENIC_SETTING(enic, TXCSUM),
-                ENIC_SETTING(enic, RXCSUM), ENIC_SETTING(enic, TSO),
-                ENIC_SETTING(enic, LRO), c->intr_timer_usec);
+        dev_info(enic_get_dev(enic),
+                "vNIC MAC addr %pM wq/rq %d/%d mtu %d\n",
+                enic->mac_addr, c->wq_desc_count, c->rq_desc_count, c->mtu);
+        dev_info(enic_get_dev(enic), "vNIC csum tx/rx %d/%d "
+                "tso/lro %d/%d intr timer %d usec rss %d\n",
+                ENIC_SETTING(enic, TXCSUM), ENIC_SETTING(enic, RXCSUM),
+                ENIC_SETTING(enic, TSO), ENIC_SETTING(enic, LRO),
+                c->intr_timer_usec, ENIC_SETTING(enic, RSS));
 
         return 0;
 }
@@ -181,18 +182,11 @@ void enic_free_vnic_resources(struct enic *enic)
 
 void enic_get_res_counts(struct enic *enic)
 {
-        enic->wq_count = min_t(int,
-                vnic_dev_get_res_count(enic->vdev, RES_TYPE_WQ),
-                ENIC_WQ_MAX);
-        enic->rq_count = min_t(int,
-                vnic_dev_get_res_count(enic->vdev, RES_TYPE_RQ),
-                ENIC_RQ_MAX);
-        enic->cq_count = min_t(int,
-                vnic_dev_get_res_count(enic->vdev, RES_TYPE_CQ),
-                ENIC_CQ_MAX);
-        enic->intr_count = min_t(int,
-                vnic_dev_get_res_count(enic->vdev, RES_TYPE_INTR_CTRL),
-                ENIC_INTR_MAX);
+        enic->wq_count = vnic_dev_get_res_count(enic->vdev, RES_TYPE_WQ);
+        enic->rq_count = vnic_dev_get_res_count(enic->vdev, RES_TYPE_RQ);
+        enic->cq_count = vnic_dev_get_res_count(enic->vdev, RES_TYPE_CQ);
+        enic->intr_count = vnic_dev_get_res_count(enic->vdev,
+                RES_TYPE_INTR_CTRL);
 
         dev_info(enic_get_dev(enic),
                 "vNIC resources avail: wq %d rq %d cq %d intr %d\n",
diff --git a/drivers/net/enic/enic_res.h b/drivers/net/enic/enic_res.h
index 83bd172c356c..9a103d9ef9e2 100644
--- a/drivers/net/enic/enic_res.h
+++ b/drivers/net/enic/enic_res.h
@@ -30,7 +30,7 @@
 #define ENIC_MIN_RQ_DESCS               64
 #define ENIC_MAX_RQ_DESCS               4096
 
-#define ENIC_MIN_MTU                    576  /* minimum for IPv4 */
+#define ENIC_MIN_MTU                    68
 #define ENIC_MAX_MTU                    9000
 
 #define ENIC_MULTICAST_PERFECT_FILTERS  32
diff --git a/drivers/net/enic/vnic_dev.c b/drivers/net/enic/vnic_dev.c
index 08d5d42da260..fb35d8b17668 100644
--- a/drivers/net/enic/vnic_dev.c
+++ b/drivers/net/enic/vnic_dev.c
@@ -186,22 +186,7 @@ void __iomem *vnic_dev_get_res(struct vnic_dev *vdev, enum vnic_res_type type,
         }
 }
 
-dma_addr_t vnic_dev_get_res_bus_addr(struct vnic_dev *vdev,
-        enum vnic_res_type type, unsigned int index)
-{
-        switch (type) {
-        case RES_TYPE_WQ:
-        case RES_TYPE_RQ:
-        case RES_TYPE_CQ:
-        case RES_TYPE_INTR_CTRL:
-                return vdev->res[type].bus_addr +
-                        index * VNIC_RES_STRIDE;
-        default:
-                return vdev->res[type].bus_addr;
-        }
-}
-
-unsigned int vnic_dev_desc_ring_size(struct vnic_dev_ring *ring,
+static unsigned int vnic_dev_desc_ring_size(struct vnic_dev_ring *ring,
         unsigned int desc_count, unsigned int desc_size)
 {
         /* The base address of the desc rings must be 512 byte aligned.
@@ -384,18 +369,6 @@ static int vnic_dev_cmd_no_proxy(struct vnic_dev *vdev,
         return err;
 }
 
-void vnic_dev_cmd_proxy_by_bdf_start(struct vnic_dev *vdev, u16 bdf)
-{
-        vdev->proxy = PROXY_BY_BDF;
-        vdev->proxy_index = bdf;
-}
-
-void vnic_dev_cmd_proxy_end(struct vnic_dev *vdev)
-{
-        vdev->proxy = PROXY_NONE;
-        vdev->proxy_index = 0;
-}
-
 int vnic_dev_cmd(struct vnic_dev *vdev, enum vnic_devcmd_cmd cmd,
         u64 *a0, u64 *a1, int wait)
 {
@@ -488,13 +461,6 @@ int vnic_dev_spec(struct vnic_dev *vdev, unsigned int offset, unsigned int size,
         return err;
 }
 
-int vnic_dev_stats_clear(struct vnic_dev *vdev)
-{
-        u64 a0 = 0, a1 = 0;
-        int wait = 1000;
-        return vnic_dev_cmd(vdev, CMD_STATS_CLEAR, &a0, &a1, wait);
-}
-
 int vnic_dev_stats_dump(struct vnic_dev *vdev, struct vnic_stats **stats)
 {
         u64 a0, a1;
@@ -521,13 +487,6 @@ int vnic_dev_close(struct vnic_dev *vdev)
         return vnic_dev_cmd(vdev, CMD_CLOSE, &a0, &a1, wait);
 }
 
-int vnic_dev_enable(struct vnic_dev *vdev)
-{
-        u64 a0 = 0, a1 = 0;
-        int wait = 1000;
-        return vnic_dev_cmd(vdev, CMD_ENABLE, &a0, &a1, wait);
-}
-
 int vnic_dev_enable_wait(struct vnic_dev *vdev)
 {
         u64 a0 = 0, a1 = 0;
@@ -572,14 +531,14 @@ int vnic_dev_open_done(struct vnic_dev *vdev, int *done)
         return 0;
 }
 
-int vnic_dev_soft_reset(struct vnic_dev *vdev, int arg)
+static int vnic_dev_soft_reset(struct vnic_dev *vdev, int arg)
 {
         u64 a0 = (u32)arg, a1 = 0;
         int wait = 1000;
         return vnic_dev_cmd(vdev, CMD_SOFT_RESET, &a0, &a1, wait);
 }
 
-int vnic_dev_soft_reset_done(struct vnic_dev *vdev, int *done)
+static int vnic_dev_soft_reset_done(struct vnic_dev *vdev, int *done)
 {
         u64 a0 = 0, a1 = 0;
         int wait = 1000;
@@ -680,26 +639,6 @@ int vnic_dev_packet_filter(struct vnic_dev *vdev, int directed, int multicast,
         return err;
 }
 
-int vnic_dev_packet_filter_all(struct vnic_dev *vdev, int directed,
-        int multicast, int broadcast, int promisc, int allmulti)
-{
-        u64 a0, a1 = 0;
-        int wait = 1000;
-        int err;
-
-        a0 = (directed ? CMD_PFILTER_DIRECTED : 0) |
-             (multicast ? CMD_PFILTER_MULTICAST : 0) |
-             (broadcast ? CMD_PFILTER_BROADCAST : 0) |
-             (promisc ? CMD_PFILTER_PROMISCUOUS : 0) |
-             (allmulti ? CMD_PFILTER_ALL_MULTICAST : 0);
-
-        err = vnic_dev_cmd(vdev, CMD_PACKET_FILTER_ALL, &a0, &a1, wait);
-        if (err)
-                pr_err("Can't set packet filter\n");
-
-        return err;
-}
-
 int vnic_dev_add_addr(struct vnic_dev *vdev, u8 *addr)
 {
         u64 a0 = 0, a1 = 0;
@@ -748,20 +687,7 @@ int vnic_dev_set_ig_vlan_rewrite_mode(struct vnic_dev *vdev,
         return err;
 }
 
-int vnic_dev_raise_intr(struct vnic_dev *vdev, u16 intr)
-{
-        u64 a0 = intr, a1 = 0;
-        int wait = 1000;
-        int err;
-
-        err = vnic_dev_cmd(vdev, CMD_IAR, &a0, &a1, wait);
-        if (err)
-                pr_err("Failed to raise INTR[%d], err %d\n", intr, err);
-
-        return err;
-}
-
-int vnic_dev_notify_setcmd(struct vnic_dev *vdev,
+static int vnic_dev_notify_setcmd(struct vnic_dev *vdev,
         void *notify_addr, dma_addr_t notify_pa, u16 intr)
 {
         u64 a0, a1;
@@ -800,7 +726,7 @@ int vnic_dev_notify_set(struct vnic_dev *vdev, u16 intr)
         return vnic_dev_notify_setcmd(vdev, notify_addr, notify_pa, intr);
 }
 
-int vnic_dev_notify_unsetcmd(struct vnic_dev *vdev)
+static int vnic_dev_notify_unsetcmd(struct vnic_dev *vdev)
 {
         u64 a0, a1;
         int wait = 1000;
@@ -954,30 +880,6 @@ u32 vnic_dev_mtu(struct vnic_dev *vdev)
         return vdev->notify_copy.mtu;
 }
 
-u32 vnic_dev_link_down_cnt(struct vnic_dev *vdev)
-{
-        if (!vnic_dev_notify_ready(vdev))
-                return 0;
-
-        return vdev->notify_copy.link_down_cnt;
-}
-
-u32 vnic_dev_notify_status(struct vnic_dev *vdev)
-{
-        if (!vnic_dev_notify_ready(vdev))
-                return 0;
-
-        return vdev->notify_copy.status;
-}
-
-u32 vnic_dev_uif(struct vnic_dev *vdev)
-{
-        if (!vnic_dev_notify_ready(vdev))
-                return 0;
-
-        return vdev->notify_copy.uif;
-}
-
 void vnic_dev_set_intr_mode(struct vnic_dev *vdev,
         enum vnic_dev_intr_mode intr_mode)
 {
diff --git a/drivers/net/enic/vnic_dev.h b/drivers/net/enic/vnic_dev.h
index 3a61873138b6..05f9a24cd459 100644
--- a/drivers/net/enic/vnic_dev.h
+++ b/drivers/net/enic/vnic_dev.h
@@ -84,10 +84,6 @@ unsigned int vnic_dev_get_res_count(struct vnic_dev *vdev,
         enum vnic_res_type type);
 void __iomem *vnic_dev_get_res(struct vnic_dev *vdev, enum vnic_res_type type,
         unsigned int index);
-dma_addr_t vnic_dev_get_res_bus_addr(struct vnic_dev *vdev,
-        enum vnic_res_type type, unsigned int index);
-unsigned int vnic_dev_desc_ring_size(struct vnic_dev_ring *ring,
-        unsigned int desc_count, unsigned int desc_size);
 void vnic_dev_clear_desc_ring(struct vnic_dev_ring *ring);
 int vnic_dev_alloc_desc_ring(struct vnic_dev *vdev, struct vnic_dev_ring *ring,
         unsigned int desc_count, unsigned int desc_size);
@@ -95,39 +91,26 @@ void vnic_dev_free_desc_ring(struct vnic_dev *vdev,
         struct vnic_dev_ring *ring);
 int vnic_dev_cmd(struct vnic_dev *vdev, enum vnic_devcmd_cmd cmd,
         u64 *a0, u64 *a1, int wait);
-void vnic_dev_cmd_proxy_by_bdf_start(struct vnic_dev *vdev, u16 bdf);
-void vnic_dev_cmd_proxy_end(struct vnic_dev *vdev);
 int vnic_dev_fw_info(struct vnic_dev *vdev,
         struct vnic_devcmd_fw_info **fw_info);
 int vnic_dev_hw_version(struct vnic_dev *vdev,
         enum vnic_dev_hw_version *hw_ver);
 int vnic_dev_spec(struct vnic_dev *vdev, unsigned int offset, unsigned int size,
         void *value);
-int vnic_dev_stats_clear(struct vnic_dev *vdev);
 int vnic_dev_stats_dump(struct vnic_dev *vdev, struct vnic_stats **stats);
 int vnic_dev_hang_notify(struct vnic_dev *vdev);
 int vnic_dev_packet_filter(struct vnic_dev *vdev, int directed, int multicast,
         int broadcast, int promisc, int allmulti);
-int vnic_dev_packet_filter_all(struct vnic_dev *vdev, int directed,
-        int multicast, int broadcast, int promisc, int allmulti);
 int vnic_dev_add_addr(struct vnic_dev *vdev, u8 *addr);
 int vnic_dev_del_addr(struct vnic_dev *vdev, u8 *addr);
 int vnic_dev_mac_addr(struct vnic_dev *vdev, u8 *mac_addr);
-int vnic_dev_raise_intr(struct vnic_dev *vdev, u16 intr);
-int vnic_dev_notify_setcmd(struct vnic_dev *vdev,
-        void *notify_addr, dma_addr_t notify_pa, u16 intr);
 int vnic_dev_notify_set(struct vnic_dev *vdev, u16 intr);
-int vnic_dev_notify_unsetcmd(struct vnic_dev *vdev);
 int vnic_dev_notify_unset(struct vnic_dev *vdev);
 int vnic_dev_link_status(struct vnic_dev *vdev);
 u32 vnic_dev_port_speed(struct vnic_dev *vdev);
 u32 vnic_dev_msg_lvl(struct vnic_dev *vdev);
 u32 vnic_dev_mtu(struct vnic_dev *vdev);
-u32 vnic_dev_link_down_cnt(struct vnic_dev *vdev);
-u32 vnic_dev_notify_status(struct vnic_dev *vdev);
-u32 vnic_dev_uif(struct vnic_dev *vdev);
 int vnic_dev_close(struct vnic_dev *vdev);
-int vnic_dev_enable(struct vnic_dev *vdev);
 int vnic_dev_enable_wait(struct vnic_dev *vdev);
 int vnic_dev_disable(struct vnic_dev *vdev);
 int vnic_dev_open(struct vnic_dev *vdev, int arg);
@@ -136,8 +119,6 @@ int vnic_dev_init(struct vnic_dev *vdev, int arg);
 int vnic_dev_init_done(struct vnic_dev *vdev, int *done, int *err);
 int vnic_dev_init_prov(struct vnic_dev *vdev, u8 *buf, u32 len);
 int vnic_dev_deinit(struct vnic_dev *vdev);
-int vnic_dev_soft_reset(struct vnic_dev *vdev, int arg);
-int vnic_dev_soft_reset_done(struct vnic_dev *vdev, int *done);
 int vnic_dev_hang_reset(struct vnic_dev *vdev, int arg);
 int vnic_dev_hang_reset_done(struct vnic_dev *vdev, int *done);
 void vnic_dev_set_intr_mode(struct vnic_dev *vdev,
diff --git a/drivers/net/enic/vnic_intr.c b/drivers/net/enic/vnic_intr.c
index 52ab61af2750..3873771d75cc 100644
--- a/drivers/net/enic/vnic_intr.c
+++ b/drivers/net/enic/vnic_intr.c
@@ -65,8 +65,3 @@ void vnic_intr_clean(struct vnic_intr *intr)
 {
         iowrite32(0, &intr->ctrl->int_credits);
 }
-
-void vnic_intr_raise(struct vnic_intr *intr)
-{
-        vnic_dev_raise_intr(intr->vdev, (u16)intr->index);
-}
diff --git a/drivers/net/enic/vnic_rq.c b/drivers/net/enic/vnic_rq.c
index b236d7cbc137..34105e0951a5 100644
--- a/drivers/net/enic/vnic_rq.c
+++ b/drivers/net/enic/vnic_rq.c
@@ -115,7 +115,7 @@ int vnic_rq_alloc(struct vnic_dev *vdev, struct vnic_rq *rq, unsigned int index,
         return 0;
 }
 
-void vnic_rq_init_start(struct vnic_rq *rq, unsigned int cq_index,
+static void vnic_rq_init_start(struct vnic_rq *rq, unsigned int cq_index,
         unsigned int fetch_index, unsigned int posted_index,
         unsigned int error_interrupt_enable,
         unsigned int error_interrupt_offset)
diff --git a/drivers/net/enic/vnic_rq.h b/drivers/net/enic/vnic_rq.h
index 2dc48f91abf7..37f08de2454a 100644
--- a/drivers/net/enic/vnic_rq.h
+++ b/drivers/net/enic/vnic_rq.h
@@ -143,7 +143,7 @@ static inline void vnic_rq_post(struct vnic_rq *rq,
 
 static inline int vnic_rq_posting_soon(struct vnic_rq *rq)
 {
-        return ((rq->to_use->index & VNIC_RQ_RETURN_RATE) == 0);
+        return (rq->to_use->index & VNIC_RQ_RETURN_RATE) == 0;
 }
 
 static inline void vnic_rq_return_descs(struct vnic_rq *rq, unsigned int count)
@@ -202,10 +202,6 @@ static inline int vnic_rq_fill(struct vnic_rq *rq,
 void vnic_rq_free(struct vnic_rq *rq);
 int vnic_rq_alloc(struct vnic_dev *vdev, struct vnic_rq *rq, unsigned int index,
         unsigned int desc_count, unsigned int desc_size);
-void vnic_rq_init_start(struct vnic_rq *rq, unsigned int cq_index,
-        unsigned int fetch_index, unsigned int posted_index,
-        unsigned int error_interrupt_enable,
-        unsigned int error_interrupt_offset);
 void vnic_rq_init(struct vnic_rq *rq, unsigned int cq_index,
         unsigned int error_interrupt_enable,
         unsigned int error_interrupt_offset);
diff --git a/drivers/net/enic/vnic_rss.h b/drivers/net/enic/vnic_rss.h
index f62d18719629..fa421baf45b8 100644
--- a/drivers/net/enic/vnic_rss.h
+++ b/drivers/net/enic/vnic_rss.h
@@ -37,9 +37,4 @@ union vnic_rss_cpu {
         u64 raw[32];
 };
 
-void vnic_set_rss_key(union vnic_rss_key *rss_key, u8 *key);
-void vnic_set_rss_cpu(union vnic_rss_cpu *rss_cpu, u8 *cpu);
-void vnic_get_rss_key(union vnic_rss_key *rss_key, u8 *key);
-void vnic_get_rss_cpu(union vnic_rss_cpu *rss_cpu, u8 *cpu);
-
 #endif /* _VNIC_RSS_H_ */
diff --git a/drivers/net/enic/vnic_wq.c b/drivers/net/enic/vnic_wq.c
index 4b2a6c6a569b..df61bd932ea6 100644
--- a/drivers/net/enic/vnic_wq.c
+++ b/drivers/net/enic/vnic_wq.c
@@ -115,7 +115,7 @@ int vnic_wq_alloc(struct vnic_dev *vdev, struct vnic_wq *wq, unsigned int index,
         return 0;
 }
 
-void vnic_wq_init_start(struct vnic_wq *wq, unsigned int cq_index,
+static void vnic_wq_init_start(struct vnic_wq *wq, unsigned int cq_index,
         unsigned int fetch_index, unsigned int posted_index,
         unsigned int error_interrupt_enable,
         unsigned int error_interrupt_offset)
diff --git a/drivers/net/enic/vnic_wq.h b/drivers/net/enic/vnic_wq.h
index 94ac4621acc5..7dd937ac11c2 100644
--- a/drivers/net/enic/vnic_wq.h
+++ b/drivers/net/enic/vnic_wq.h
@@ -153,10 +153,6 @@ static inline void vnic_wq_service(struct vnic_wq *wq,
 void vnic_wq_free(struct vnic_wq *wq);
 int vnic_wq_alloc(struct vnic_dev *vdev, struct vnic_wq *wq, unsigned int index,
         unsigned int desc_count, unsigned int desc_size);
-void vnic_wq_init_start(struct vnic_wq *wq, unsigned int cq_index,
-        unsigned int fetch_index, unsigned int posted_index,
-        unsigned int error_interrupt_enable,
-        unsigned int error_interrupt_offset);
 void vnic_wq_init(struct vnic_wq *wq, unsigned int cq_index,
         unsigned int error_interrupt_enable,
         unsigned int error_interrupt_offset);
diff --git a/drivers/net/eql.c b/drivers/net/eql.c
index dda2c7944da9..0cb1cf9cf4b0 100644
--- a/drivers/net/eql.c
+++ b/drivers/net/eql.c
@@ -555,6 +555,8 @@ static int eql_g_master_cfg(struct net_device *dev, master_config_t __user *mcp)
         equalizer_t *eql;
         master_config_t mc;
 
+        memset(&mc, 0, sizeof(master_config_t));
+
         if (eql_is_master(dev)) {
                 eql = netdev_priv(dev);
                 mc.max_slaves = eql->max_slaves;
diff --git a/drivers/net/eth16i.c b/drivers/net/eth16i.c
index 10e39f2b31c3..fb717be511f6 100644
--- a/drivers/net/eth16i.c
+++ b/drivers/net/eth16i.c
@@ -637,7 +637,9 @@ static void eth16i_initialize(struct net_device *dev, int boot)
 
         /* Set interface port type */
         if(boot) {
-                char *porttype[] = {"BNC", "DIX", "TP", "AUTO", "FROM_EPROM" };
+                static const char * const porttype[] = {
+                        "BNC", "DIX", "TP", "AUTO", "FROM_EPROM"
+                };
 
                 switch(dev->if_port)
                 {
@@ -794,7 +796,7 @@ static int eth16i_receive_probe_packet(int ioaddr)
 
                         if(eth16i_debug > 1)
                                 printk(KERN_DEBUG "RECEIVE_PACKET\n");
-                        return(0); /* Found receive packet */
+                        return 0; /* Found receive packet */
                 }
         }
 
@@ -803,7 +805,7 @@ static int eth16i_receive_probe_packet(int ioaddr)
                 printk(KERN_DEBUG "RX_STATUS_REG = %x\n", inb(ioaddr + RX_STATUS_REG));
         }
 
-        return(0); /* Return success */
+        return 0; /* Return success */
 }
 
 #if 0
@@ -839,7 +841,7 @@ static int __init eth16i_get_irq(int ioaddr)
 
         if( ioaddr < 0x1000) {
                 cbyte = inb(ioaddr + JUMPERLESS_CONFIG);
-                return( eth16i_irqmap[ ((cbyte & 0xC0) >> 6) ] );
+                return eth16i_irqmap[((cbyte & 0xC0) >> 6)];
         } else {  /* Oh..the card is EISA so method getting IRQ different */
                 unsigned short index = 0;
                 cbyte = inb(ioaddr + EISA_IRQ_REG);
@@ -847,7 +849,7 @@ static int __init eth16i_get_irq(int ioaddr)
                         cbyte = cbyte >> 1;
                         index++;
                 }
-                return( eth32i_irqmap[ index ] );
+                return eth32i_irqmap[index];
         }
 }
 
@@ -907,7 +909,7 @@ static int eth16i_read_eeprom(int ioaddr, int offset)
         data = eth16i_read_eeprom_word(ioaddr);
         outb(CS_0 | SK_0, ioaddr + EEPROM_CTRL_REG);
 
-        return(data);
+        return data;
 }
 
 static int eth16i_read_eeprom_word(int ioaddr)
@@ -926,7 +928,7 @@ static int eth16i_read_eeprom_word(int ioaddr)
                 eeprom_slow_io();
         }
 
-        return(data);
+        return data;
 }
 
 static void eth16i_eeprom_cmd(int ioaddr, unsigned char command)
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 768b840aeb6b..e83f67d22fe3 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -1311,6 +1311,9 @@ fec_probe(struct platform_device *pdev)
         if (ret)
                 goto failed_mii_init;
 
+        /* Carrier starts down, phylib will bring it up */
+        netif_carrier_off(ndev);
+
         ret = register_netdev(ndev);
         if (ret)
                 goto failed_register;
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 6a44fe411589..0fa1776563a3 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -2321,14 +2321,11 @@ static netdev_tx_t nv_start_xmit_optimized(struct sk_buff *skb,
                          NV_TX2_CHECKSUM_L3 | NV_TX2_CHECKSUM_L4 : 0;
 
         /* vlan tag */
-        if (likely(!np->vlangrp)) {
+        if (vlan_tx_tag_present(skb))
+                start_tx->txvlan = cpu_to_le32(NV_TX3_VLAN_TAG_PRESENT |
+                                        vlan_tx_tag_get(skb));
+        else
                 start_tx->txvlan = 0;
-        } else {
-                if (vlan_tx_tag_present(skb))
-                        start_tx->txvlan = cpu_to_le32(NV_TX3_VLAN_TAG_PRESENT | vlan_tx_tag_get(skb));
-                else
-                        start_tx->txvlan = 0;
-        }
 
         spin_lock_irqsave(&np->lock, flags);
 
@@ -4620,7 +4617,7 @@ static int nv_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam*
 static u32 nv_get_rx_csum(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
-        return (np->rx_csum) != 0;
+        return np->rx_csum != 0;
 }
 
 static int nv_set_rx_csum(struct net_device *dev, u32 data)
diff --git a/drivers/net/fsl_pq_mdio.c b/drivers/net/fsl_pq_mdio.c
index d4bf91aac25f..8d3a2ccbc953 100644
--- a/drivers/net/fsl_pq_mdio.c
+++ b/drivers/net/fsl_pq_mdio.c
@@ -125,7 +125,7 @@ int fsl_pq_mdio_write(struct mii_bus *bus, int mii_id, int regnum, u16 value)
         struct fsl_pq_mdio __iomem *regs = fsl_pq_mdio_get_regs(bus);
 
         /* Write to the local MII regs */
-        return(fsl_pq_local_mdio_write(regs, mii_id, regnum, value));
+        return fsl_pq_local_mdio_write(regs, mii_id, regnum, value);
 }
 
 /*
@@ -137,7 +137,7 @@ int fsl_pq_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
         struct fsl_pq_mdio __iomem *regs = fsl_pq_mdio_get_regs(bus);
 
         /* Read the local MII regs */
-        return(fsl_pq_local_mdio_read(regs, mii_id, regnum));
+        return fsl_pq_local_mdio_read(regs, mii_id, regnum);
 }
 
 /* Reset the MIIM registers, and wait for the bus to free */
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index f30adbf86bb2..4c4cc80ec0a1 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -654,9 +654,8 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
         priv->node = ofdev->dev.of_node;
         priv->ndev = dev;
 
-        dev->num_tx_queues = num_tx_qs;
-        dev->real_num_tx_queues = num_tx_qs;
         priv->num_tx_queues = num_tx_qs;
+        netif_set_real_num_rx_queues(dev, num_rx_qs);
         priv->num_rx_queues = num_rx_qs;
         priv->num_grps = 0x0;
 
@@ -2076,7 +2075,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* make space for additional header when fcb is needed */
         if (((skb->ip_summed == CHECKSUM_PARTIAL) ||
-                        (priv->vlgrp && vlan_tx_tag_present(skb)) ||
+                        vlan_tx_tag_present(skb) ||
                         unlikely(do_tstamp)) &&
                         (skb_headroom(skb) < GMAC_FCB_LEN)) {
                 struct sk_buff *skb_new;
@@ -2162,7 +2161,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 gfar_tx_checksum(skb, fcb);
         }
 
-        if (priv->vlgrp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 if (unlikely(NULL == fcb)) {
                         fcb = gfar_add_fcb(skb);
                         lstatus |= BD_LFLAG(TXBD_TOE);
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 9bda023c0235..ae8e5d3c6c1f 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -254,7 +254,7 @@ static unsigned int gfar_usecs2ticks(struct gfar_private *priv, unsigned int use
 
         /* Make sure we return a number greater than 0
          * if usecs > 0 */
-        return ((usecs * 1000 + count - 1) / count);
+        return (usecs * 1000 + count - 1) / count;
 }
 
 /* Convert ethernet clock ticks to microseconds */
@@ -278,7 +278,7 @@ static unsigned int gfar_ticks2usecs(struct gfar_private *priv, unsigned int tic
 
         /* Make sure we return a number greater than 0 */
         /* if ticks is > 0 */
-        return ((ticks * count) / 1000);
+        return (ticks * count) / 1000;
 }
 
 /* Get the coalescing parameters, and put them in the cvals
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index 14f01d156db9..ac1d323c5eb5 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -168,7 +168,7 @@ static inline struct net_device *bpq_get_ax25_dev(struct net_device *dev)
 
 static inline int dev_is_ethdev(struct net_device *dev)
 {
-        return (dev->type == ARPHRD_ETHER && strncmp(dev->name, "dummy", 5));
+        return dev->type == ARPHRD_ETHER && strncmp(dev->name, "dummy", 5);
 }
 
 /* ------------------------------------------------------------------------ */
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index b8bdf9d51cd4..5b37579e84b7 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -110,7 +110,7 @@ static int calc_crc_ccitt(const unsigned char *buf, int cnt)
         for (; cnt > 0; cnt--)
                 crc = (crc >> 8) ^ crc_ccitt_table[(crc ^ *buf++) & 0xff];
         crc ^= 0xffff;
-        return (crc & 0xffff);
+        return crc & 0xffff;
 }
 #endif
 
diff --git a/drivers/net/hp100.c b/drivers/net/hp100.c
index 095b17ecf609..8e2c4601b5f5 100644
--- a/drivers/net/hp100.c
+++ b/drivers/net/hp100.c
@@ -1312,7 +1312,7 @@ static int hp100_build_rx_pdl(hp100_ring_t * ringptr,
                 for (p = (ringptr->pdl); p < (ringptr->pdl + 5); p++)
                         printk("hp100: %s: Adr 0x%.8x = 0x%.8x\n", dev->name, (u_int) p, (u_int) * p);
 #endif
-                return (1);
+                return 1;
         }
         /* else: */
         /* alloc_skb failed (no memory) -> still can receive the header
@@ -1325,7 +1325,7 @@ static int hp100_build_rx_pdl(hp100_ring_t * ringptr,
 
         ringptr->pdl[0] = 0x00010000;   /* PDH: Count=1 Fragment */
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -2752,7 +2752,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin)
                 hp100_outw(HP100_MISC_ERROR, IRQ_STATUS);
 
                 if (val & HP100_LINK_UP_ST)
-                        return (0);     /* login was ok */
+                        return 0;       /* login was ok */
                 else {
                         printk("hp100: %s: Training failed.\n", dev->name);
                         hp100_down_vg_link(dev);
diff --git a/drivers/net/ibm_newemac/core.c b/drivers/net/ibm_newemac/core.c
index 3506fd6ad726..385dc3204cb7 100644
--- a/drivers/net/ibm_newemac/core.c
+++ b/drivers/net/ibm_newemac/core.c
@@ -2095,11 +2095,11 @@ static void *emac_dump_regs(struct emac_instance *dev, void *buf)
         if (emac_has_feature(dev, EMAC_FTR_EMAC4)) {
                 hdr->version = EMAC4_ETHTOOL_REGS_VER;
                 memcpy_fromio(hdr + 1, dev->emacp, EMAC4_ETHTOOL_REGS_SIZE(dev));
-                return ((void *)(hdr + 1) + EMAC4_ETHTOOL_REGS_SIZE(dev));
+                return (void *)(hdr + 1) + EMAC4_ETHTOOL_REGS_SIZE(dev);
         } else {
                 hdr->version = EMAC_ETHTOOL_REGS_VER;
                 memcpy_fromio(hdr + 1, dev->emacp, EMAC_ETHTOOL_REGS_SIZE(dev));
-                return ((void *)(hdr + 1) + EMAC_ETHTOOL_REGS_SIZE(dev));
+                return (void *)(hdr + 1) + EMAC_ETHTOOL_REGS_SIZE(dev);
         }
 }
 
@@ -2293,7 +2293,7 @@ static int __devinit emac_check_deps(struct emac_instance *dev,
                 if (deps[i].drvdata != NULL)
                         there++;
         }
-        return (there == EMAC_DEP_COUNT);
+        return there == EMAC_DEP_COUNT;
 }
 
 static void emac_put_deps(struct emac_instance *dev)
@@ -2928,7 +2928,7 @@ static int __devinit emac_probe(struct platform_device *ofdev,
         if (dev->emac_irq != NO_IRQ)
                 irq_dispose_mapping(dev->emac_irq);
  err_free:
-        kfree(ndev);
+        free_netdev(ndev);
  err_gone:
         /* if we were on the bootlist, remove us as we won't show up and
          * wake up all waiters to notify them in case they were waiting
@@ -2971,7 +2971,7 @@ static int __devexit emac_remove(struct platform_device *ofdev)
         if (dev->emac_irq != NO_IRQ)
                 irq_dispose_mapping(dev->emac_irq);
 
-        kfree(dev->ndev);
+        free_netdev(dev->ndev);
 
         return 0;
 }
diff --git a/drivers/net/ibm_newemac/core.h b/drivers/net/ibm_newemac/core.h
index 9e37e3d9c51d..4fec0844d59d 100644
--- a/drivers/net/ibm_newemac/core.h
+++ b/drivers/net/ibm_newemac/core.h
@@ -410,7 +410,7 @@ static inline u32 *emac_xaht_base(struct emac_instance *dev)
         else
                 offset = offsetof(struct emac_regs, u0.emac4.iaht1);
 
-        return ((u32 *)((ptrdiff_t)p + offset));
+        return (u32 *)((ptrdiff_t)p + offset);
 }
 
 static inline u32 *emac_gaht_base(struct emac_instance *dev)
@@ -418,7 +418,7 @@ static inline u32 *emac_gaht_base(struct emac_instance *dev)
         /* GAHT registers always come after an identical number of
          * IAHT registers.
          */
-        return (emac_xaht_base(dev) + EMAC_XAHT_REGS(dev));
+        return emac_xaht_base(dev) + EMAC_XAHT_REGS(dev);
 }
 
 static inline u32 *emac_iaht_base(struct emac_instance *dev)
@@ -426,7 +426,7 @@ static inline u32 *emac_iaht_base(struct emac_instance *dev)
         /* IAHT registers always come before an identical number of
          * GAHT registers.
          */
-        return (emac_xaht_base(dev));
+        return emac_xaht_base(dev);
 }
 
 /* Ethtool get_regs complex data.
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index b3e157ed6776..c454b45ca7ec 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -546,9 +546,8 @@ static int ibmveth_open(struct net_device *netdev)
         if (!adapter->buffer_list_addr || !adapter->filter_list_addr) {
                 netdev_err(netdev, "unable to allocate filter or buffer list "
                            "pages\n");
-                ibmveth_cleanup(adapter);
-                napi_disable(&adapter->napi);
-                return -ENOMEM;
+                rc = -ENOMEM;
+                goto err_out;
         }
 
         adapter->rx_queue.queue_len = sizeof(struct ibmveth_rx_q_entry) *
@@ -558,9 +557,8 @@ static int ibmveth_open(struct net_device *netdev)
 
         if (!adapter->rx_queue.queue_addr) {
                 netdev_err(netdev, "unable to allocate rx queue pages\n");
-                ibmveth_cleanup(adapter);
-                napi_disable(&adapter->napi);
-                return -ENOMEM;
+                rc = -ENOMEM;
+                goto err_out;
         }
 
         dev = &adapter->vdev->dev;
@@ -578,9 +576,8 @@ static int ibmveth_open(struct net_device *netdev)
             (dma_mapping_error(dev, adapter->rx_queue.queue_dma))) {
                 netdev_err(netdev, "unable to map filter or buffer list "
                            "pages\n");
-                ibmveth_cleanup(adapter);
-                napi_disable(&adapter->napi);
-                return -ENOMEM;
+                rc = -ENOMEM;
+                goto err_out;
         }
 
         adapter->rx_queue.index = 0;
@@ -611,9 +608,8 @@ static int ibmveth_open(struct net_device *netdev)
                                      adapter->filter_list_dma,
                                      rxq_desc.desc,
                                      mac_address);
-                ibmveth_cleanup(adapter);
-                napi_disable(&adapter->napi);
-                return -ENONET;
+                rc = -ENONET;
+                goto err_out;
         }
 
         for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) {
@@ -622,9 +618,8 @@ static int ibmveth_open(struct net_device *netdev)
                 if (ibmveth_alloc_buffer_pool(&adapter->rx_buff_pool[i])) {
                         netdev_err(netdev, "unable to alloc pool\n");
                         adapter->rx_buff_pool[i].active = 0;
-                        ibmveth_cleanup(adapter);
-                        napi_disable(&adapter->napi);
-                        return -ENOMEM ;
+                        rc = -ENOMEM;
+                        goto err_out;
                 }
         }
 
@@ -638,27 +633,23 @@ static int ibmveth_open(struct net_device *netdev)
                         rc = h_free_logical_lan(adapter->vdev->unit_address);
                 } while (H_IS_LONG_BUSY(rc) || (rc == H_BUSY));
 
-                ibmveth_cleanup(adapter);
-                napi_disable(&adapter->napi);
-                return rc;
+                goto err_out;
         }
 
         adapter->bounce_buffer =
             kmalloc(netdev->mtu + IBMVETH_BUFF_OH, GFP_KERNEL);
         if (!adapter->bounce_buffer) {
                 netdev_err(netdev, "unable to allocate bounce buffer\n");
-                ibmveth_cleanup(adapter);
-                napi_disable(&adapter->napi);
-                return -ENOMEM;
+                rc = -ENOMEM;
+                goto err_out_free_irq;
         }
         adapter->bounce_buffer_dma =
             dma_map_single(&adapter->vdev->dev, adapter->bounce_buffer,
                            netdev->mtu + IBMVETH_BUFF_OH, DMA_BIDIRECTIONAL);
         if (dma_mapping_error(dev, adapter->bounce_buffer_dma)) {
                 netdev_err(netdev, "unable to map bounce buffer\n");
-                ibmveth_cleanup(adapter);
-                napi_disable(&adapter->napi);
-                return -ENOMEM;
+                rc = -ENOMEM;
+                goto err_out_free_irq;
         }
 
         netdev_dbg(netdev, "initial replenish cycle\n");
@@ -669,6 +660,13 @@ static int ibmveth_open(struct net_device *netdev)
         netdev_dbg(netdev, "open complete\n");
 
         return 0;
+
+err_out_free_irq:
+        free_irq(netdev->irq, netdev);
+err_out:
+        ibmveth_cleanup(adapter);
+        napi_disable(&adapter->napi);
+        return rc;
 }
 
 static int ibmveth_close(struct net_device *netdev)
diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
index 187622f1c816..bc183f5487cb 100644
--- a/drivers/net/igb/e1000_82575.c
+++ b/drivers/net/igb/e1000_82575.c
@@ -132,6 +132,8 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
         case E1000_DEV_ID_82580_SERDES:
         case E1000_DEV_ID_82580_SGMII:
         case E1000_DEV_ID_82580_COPPER_DUAL:
+        case E1000_DEV_ID_DH89XXCC_SGMII:
+        case E1000_DEV_ID_DH89XXCC_SERDES:
                 mac->type = e1000_82580;
                 break;
         case E1000_DEV_ID_I350_COPPER:
@@ -282,10 +284,18 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
 
         /* Verify phy id and set remaining function pointers */
         switch (phy->id) {
+        case I347AT4_E_PHY_ID:
+        case M88E1112_E_PHY_ID:
         case M88E1111_I_PHY_ID:
                 phy->type                   = e1000_phy_m88;
                 phy->ops.get_phy_info       = igb_get_phy_info_m88;
-                phy->ops.get_cable_length   = igb_get_cable_length_m88;
+
+                if (phy->id == I347AT4_E_PHY_ID ||
+                    phy->id == M88E1112_E_PHY_ID)
+                        phy->ops.get_cable_length = igb_get_cable_length_m88_gen2;
+                else
+                        phy->ops.get_cable_length = igb_get_cable_length_m88;
+
                 phy->ops.force_speed_duplex = igb_phy_force_speed_duplex_m88;
                 break;
         case IGP03E1000_E_PHY_ID:
@@ -1058,7 +1068,11 @@ static s32 igb_setup_copper_link_82575(struct e1000_hw *hw)
         }
         switch (hw->phy.type) {
         case e1000_phy_m88:
-                ret_val = igb_copper_link_setup_m88(hw);
+                if (hw->phy.id == I347AT4_E_PHY_ID ||
+                    hw->phy.id == M88E1112_E_PHY_ID)
+                        ret_val = igb_copper_link_setup_m88_gen2(hw);
+                else
+                        ret_val = igb_copper_link_setup_m88(hw);
                 break;
         case e1000_phy_igp_3:
                 ret_val = igb_copper_link_setup_igp(hw);
diff --git a/drivers/net/igb/e1000_defines.h b/drivers/net/igb/e1000_defines.h
index bbd2ec308eb0..62222796a8b3 100644
--- a/drivers/net/igb/e1000_defines.h
+++ b/drivers/net/igb/e1000_defines.h
@@ -634,6 +634,8 @@
  * E = External
  */
 #define M88E1111_I_PHY_ID    0x01410CC0
+#define M88E1112_E_PHY_ID    0x01410C90
+#define I347AT4_E_PHY_ID     0x01410DC0
 #define IGP03E1000_E_PHY_ID  0x02A80390
 #define I82580_I_PHY_ID      0x015403A0
 #define I350_I_PHY_ID        0x015403B0
@@ -702,6 +704,35 @@
 #define M88E1000_EPSCR_SLAVE_DOWNSHIFT_1X    0x0100
 #define M88E1000_EPSCR_TX_CLK_25      0x0070 /* 25  MHz TX_CLK */
 
+/* Intel i347-AT4 Registers */
+
+#define I347AT4_PCDL                   0x10 /* PHY Cable Diagnostics Length */
+#define I347AT4_PCDC                   0x15 /* PHY Cable Diagnostics Control */
+#define I347AT4_PAGE_SELECT            0x16
+
+/* i347-AT4 Extended PHY Specific Control Register */
+
+/*
+ *  Number of times we will attempt to autonegotiate before downshifting if we
+ *  are the master
+ */
+#define I347AT4_PSCR_DOWNSHIFT_ENABLE 0x0800
+#define I347AT4_PSCR_DOWNSHIFT_MASK   0x7000
+#define I347AT4_PSCR_DOWNSHIFT_1X     0x0000
+#define I347AT4_PSCR_DOWNSHIFT_2X     0x1000
+#define I347AT4_PSCR_DOWNSHIFT_3X     0x2000
+#define I347AT4_PSCR_DOWNSHIFT_4X     0x3000
+#define I347AT4_PSCR_DOWNSHIFT_5X     0x4000
+#define I347AT4_PSCR_DOWNSHIFT_6X     0x5000
+#define I347AT4_PSCR_DOWNSHIFT_7X     0x6000
+#define I347AT4_PSCR_DOWNSHIFT_8X     0x7000
+
+/* i347-AT4 PHY Cable Diagnostics Control */
+#define I347AT4_PCDC_CABLE_LENGTH_UNIT 0x0400 /* 0=cm 1=meters */
+
+/* Marvell 1112 only registers */
+#define M88E1112_VCT_DSP_DISTANCE       0x001A
+
 /* M88EC018 Rev 2 specific DownShift settings */
 #define M88EC018_EPSCR_DOWNSHIFT_COUNTER_MASK  0x0E00
 #define M88EC018_EPSCR_DOWNSHIFT_COUNTER_5X    0x0800
diff --git a/drivers/net/igb/e1000_hw.h b/drivers/net/igb/e1000_hw.h
index cb8db78b1a05..c0b017f8d782 100644
--- a/drivers/net/igb/e1000_hw.h
+++ b/drivers/net/igb/e1000_hw.h
@@ -54,6 +54,8 @@ struct e1000_hw;
 #define E1000_DEV_ID_82580_SERDES             0x1510
 #define E1000_DEV_ID_82580_SGMII              0x1511
 #define E1000_DEV_ID_82580_COPPER_DUAL        0x1516
+#define E1000_DEV_ID_DH89XXCC_SGMII           0x0436
+#define E1000_DEV_ID_DH89XXCC_SERDES          0x0438
 #define E1000_DEV_ID_I350_COPPER              0x1521
 #define E1000_DEV_ID_I350_FIBER               0x1522
 #define E1000_DEV_ID_I350_SERDES              0x1523
diff --git a/drivers/net/igb/e1000_phy.c b/drivers/net/igb/e1000_phy.c
index cf1f32300923..ddd036a78999 100644
--- a/drivers/net/igb/e1000_phy.c
+++ b/drivers/net/igb/e1000_phy.c
@@ -570,6 +570,89 @@ out:
 }
 
 /**
+ *  igb_copper_link_setup_m88_gen2 - Setup m88 PHY's for copper link
+ *  @hw: pointer to the HW structure
+ *
+ *  Sets up MDI/MDI-X and polarity for i347-AT4, m88e1322 and m88e1112 PHY's.
+ *  Also enables and sets the downshift parameters.
+ **/
+s32 igb_copper_link_setup_m88_gen2(struct e1000_hw *hw)
+{
+        struct e1000_phy_info *phy = &hw->phy;
+        s32 ret_val;
+        u16 phy_data;
+
+        if (phy->reset_disable) {
+                ret_val = 0;
+                goto out;
+        }
+
+        /* Enable CRS on Tx. This must be set for half-duplex operation. */
+        ret_val = phy->ops.read_reg(hw, M88E1000_PHY_SPEC_CTRL, &phy_data);
+        if (ret_val)
+                goto out;
+
+        /*
+         * Options:
+         *   MDI/MDI-X = 0 (default)
+         *   0 - Auto for all speeds
+         *   1 - MDI mode
+         *   2 - MDI-X mode
+         *   3 - Auto for 1000Base-T only (MDI-X for 10/100Base-T modes)
+         */
+        phy_data &= ~M88E1000_PSCR_AUTO_X_MODE;
+
+        switch (phy->mdix) {
+        case 1:
+                phy_data |= M88E1000_PSCR_MDI_MANUAL_MODE;
+                break;
+        case 2:
+                phy_data |= M88E1000_PSCR_MDIX_MANUAL_MODE;
+                break;
+        case 3:
+                /* M88E1112 does not support this mode) */
+                if (phy->id != M88E1112_E_PHY_ID) {
+                        phy_data |= M88E1000_PSCR_AUTO_X_1000T;
+                        break;
+                }
+        case 0:
+        default:
+                phy_data |= M88E1000_PSCR_AUTO_X_MODE;
+                break;
+        }
+
+        /*
+         * Options:
+         *   disable_polarity_correction = 0 (default)
+         *       Automatic Correction for Reversed Cable Polarity
+         *   0 - Disabled
+         *   1 - Enabled
+         */
+        phy_data &= ~M88E1000_PSCR_POLARITY_REVERSAL;
+        if (phy->disable_polarity_correction == 1)
+                phy_data |= M88E1000_PSCR_POLARITY_REVERSAL;
+
+        /* Enable downshift and setting it to X6 */
+        phy_data &= ~I347AT4_PSCR_DOWNSHIFT_MASK;
+        phy_data |= I347AT4_PSCR_DOWNSHIFT_6X;
+        phy_data |= I347AT4_PSCR_DOWNSHIFT_ENABLE;
+
+        ret_val = phy->ops.write_reg(hw, M88E1000_PHY_SPEC_CTRL, phy_data);
+        if (ret_val)
+                goto out;
+
+        /* Commit the changes. */
+        ret_val = igb_phy_sw_reset(hw);
+        if (ret_val) {
+                hw_dbg("Error committing the PHY changes\n");
+                goto out;
+        }
+
+out:
+        return ret_val;
+}
+
+/**
  *  igb_copper_link_setup_igp - Setup igp PHY's for copper link
  *  @hw: pointer to the HW structure
  *
@@ -1124,18 +1207,25 @@ s32 igb_phy_force_speed_duplex_m88(struct e1000_hw *hw)
                         goto out;
 
                 if (!link) {
-                        /*
-                         * We didn't get link.
-                         * Reset the DSP and cross our fingers.
-                         */
-                        ret_val = phy->ops.write_reg(hw,
-                                                     M88E1000_PHY_PAGE_SELECT,
-                                                     0x001d);
-                        if (ret_val)
-                                goto out;
-                        ret_val = igb_phy_reset_dsp(hw);
-                        if (ret_val)
-                                goto out;
+                        if (hw->phy.type != e1000_phy_m88 ||
+                            hw->phy.id == I347AT4_E_PHY_ID ||
+                            hw->phy.id == M88E1112_E_PHY_ID) {
+                                hw_dbg("Link taking longer than expected.\n");
+                        } else {
+
+                                /*
+                                 * We didn't get link.
+                                 * Reset the DSP and cross our fingers.
+                                 */
+                                ret_val = phy->ops.write_reg(hw,
+                                                             M88E1000_PHY_PAGE_SELECT,
+                                                             0x001d);
+                                if (ret_val)
+                                        goto out;
+                                ret_val = igb_phy_reset_dsp(hw);
+                                if (ret_val)
+                                        goto out;
+                        }
                 }
 
                 /* Try once more */
@@ -1145,6 +1235,11 @@ s32 igb_phy_force_speed_duplex_m88(struct e1000_hw *hw)
                         goto out;
         }
 
+        if (hw->phy.type != e1000_phy_m88 ||
+            hw->phy.id == I347AT4_E_PHY_ID ||
+            hw->phy.id == M88E1112_E_PHY_ID)
+                goto out;
+
         ret_val = phy->ops.read_reg(hw, M88E1000_EXT_PHY_SPEC_CTRL, &phy_data);
         if (ret_val)
                 goto out;
@@ -1557,6 +1652,93 @@ out:
         return ret_val;
 }
 
+s32 igb_get_cable_length_m88_gen2(struct e1000_hw *hw)
+{
+        struct e1000_phy_info *phy = &hw->phy;
+        s32 ret_val;
+        u16 phy_data, phy_data2, index, default_page, is_cm;
+
+        switch (hw->phy.id) {
+        case I347AT4_E_PHY_ID:
+                /* Remember the original page select and set it to 7 */
+                ret_val = phy->ops.read_reg(hw, I347AT4_PAGE_SELECT,
+                                            &default_page);
+                if (ret_val)
+                        goto out;
+
+                ret_val = phy->ops.write_reg(hw, I347AT4_PAGE_SELECT, 0x07);
+                if (ret_val)
+                        goto out;
+
+                /* Get cable length from PHY Cable Diagnostics Control Reg */
+                ret_val = phy->ops.read_reg(hw, (I347AT4_PCDL + phy->addr),
+                                            &phy_data);
+                if (ret_val)
+                        goto out;
+
+                /* Check if the unit of cable length is meters or cm */
+                ret_val = phy->ops.read_reg(hw, I347AT4_PCDC, &phy_data2);
+                if (ret_val)
+                        goto out;
+
+                is_cm = !(phy_data & I347AT4_PCDC_CABLE_LENGTH_UNIT);
+
+                /* Populate the phy structure with cable length in meters */
+                phy->min_cable_length = phy_data / (is_cm ? 100 : 1);
+                phy->max_cable_length = phy_data / (is_cm ? 100 : 1);
+                phy->cable_length = phy_data / (is_cm ? 100 : 1);
+
+                /* Reset the page selec to its original value */
+                ret_val = phy->ops.write_reg(hw, I347AT4_PAGE_SELECT,
+                                             default_page);
+                if (ret_val)
+                        goto out;
+                break;
+        case M88E1112_E_PHY_ID:
+                /* Remember the original page select and set it to 5 */
+                ret_val = phy->ops.read_reg(hw, I347AT4_PAGE_SELECT,
+                                            &default_page);
+                if (ret_val)
+                        goto out;
+
+                ret_val = phy->ops.write_reg(hw, I347AT4_PAGE_SELECT, 0x05);
+                if (ret_val)
+                        goto out;
+
+                ret_val = phy->ops.read_reg(hw, M88E1112_VCT_DSP_DISTANCE,
+                                            &phy_data);
+                if (ret_val)
+                        goto out;
+
+                index = (phy_data & M88E1000_PSSR_CABLE_LENGTH) >>
+                        M88E1000_PSSR_CABLE_LENGTH_SHIFT;
+                if (index >= M88E1000_CABLE_LENGTH_TABLE_SIZE - 1) {
+                        ret_val = -E1000_ERR_PHY;
+                        goto out;
+                }
+
+                phy->min_cable_length = e1000_m88_cable_length_table[index];
+                phy->max_cable_length = e1000_m88_cable_length_table[index + 1];
+
+                phy->cable_length = (phy->min_cable_length +
+                                     phy->max_cable_length) / 2;
+
+                /* Reset the page select to its original value */
+                ret_val = phy->ops.write_reg(hw, I347AT4_PAGE_SELECT,
+                                             default_page);
+                if (ret_val)
+                        goto out;
+
+                break;
+        default:
+                ret_val = -E1000_ERR_PHY;
+                goto out;
+        }
+
+out:
+        return ret_val;
+}
+
 /**
  *  igb_get_cable_length_igp_2 - Determine cable length for igp2 PHY
  *  @hw: pointer to the HW structure
diff --git a/drivers/net/igb/e1000_phy.h b/drivers/net/igb/e1000_phy.h
index 565a6dbb3714..2cc117705a31 100644
--- a/drivers/net/igb/e1000_phy.h
+++ b/drivers/net/igb/e1000_phy.h
@@ -45,9 +45,11 @@ s32  igb_check_downshift(struct e1000_hw *hw);
 s32  igb_check_reset_block(struct e1000_hw *hw);
 s32  igb_copper_link_setup_igp(struct e1000_hw *hw);
 s32  igb_copper_link_setup_m88(struct e1000_hw *hw);
+s32  igb_copper_link_setup_m88_gen2(struct e1000_hw *hw);
 s32  igb_phy_force_speed_duplex_igp(struct e1000_hw *hw);
 s32  igb_phy_force_speed_duplex_m88(struct e1000_hw *hw);
 s32  igb_get_cable_length_m88(struct e1000_hw *hw);
+s32  igb_get_cable_length_m88_gen2(struct e1000_hw *hw);
 s32  igb_get_cable_length_igp_2(struct e1000_hw *hw);
 s32  igb_get_phy_id(struct e1000_hw *hw);
 s32  igb_get_phy_info_igp(struct e1000_hw *hw);
diff --git a/drivers/net/igb/igb.h b/drivers/net/igb/igb.h
index 44e0ff1494e0..edab9c442399 100644
--- a/drivers/net/igb/igb.h
+++ b/drivers/net/igb/igb.h
@@ -159,6 +159,7 @@ struct igb_tx_queue_stats {
         u64 packets;
         u64 bytes;
         u64 restart_queue;
+        u64 restart_queue2;
 };
 
 struct igb_rx_queue_stats {
@@ -210,11 +211,14 @@ struct igb_ring {
                 /* TX */
                 struct {
                         struct igb_tx_queue_stats tx_stats;
+                        struct u64_stats_sync tx_syncp;
+                        struct u64_stats_sync tx_syncp2;
                         bool detect_tx_hung;
                 };
                 /* RX */
                 struct {
                         struct igb_rx_queue_stats rx_stats;
+                        struct u64_stats_sync rx_syncp;
                         u32 rx_buffer_len;
                 };
         };
@@ -288,6 +292,9 @@ struct igb_adapter {
         struct timecompare compare;
         struct hwtstamp_config hwtstamp_config;
 
+        spinlock_t stats64_lock;
+        struct rtnl_link_stats64 stats64;
+
         /* structs defined in e1000_hw.h */
         struct e1000_hw hw;
         struct e1000_hw_stats stats;
@@ -357,7 +364,7 @@ extern netdev_tx_t igb_xmit_frame_ring_adv(struct sk_buff *, struct igb_ring *);
 extern void igb_unmap_and_free_tx_resource(struct igb_ring *,
                                            struct igb_buffer *);
 extern void igb_alloc_rx_buffers_adv(struct igb_ring *, int);
-extern void igb_update_stats(struct igb_adapter *);
+extern void igb_update_stats(struct igb_adapter *, struct rtnl_link_stats64 *);
 extern bool igb_has_link(struct igb_adapter *adapter);
 extern void igb_set_ethtool_ops(struct net_device *);
 extern void igb_power_up_link(struct igb_adapter *);
diff --git a/drivers/net/igb/igb_ethtool.c b/drivers/net/igb/igb_ethtool.c
index 26bf6a13d1c1..a70e16bcfa7e 100644
--- a/drivers/net/igb/igb_ethtool.c
+++ b/drivers/net/igb/igb_ethtool.c
@@ -90,8 +90,8 @@ static const struct igb_stats igb_gstrings_stats[] = {
 
 #define IGB_NETDEV_STAT(_net_stat) { \
         .stat_string = __stringify(_net_stat), \
-        .sizeof_stat = FIELD_SIZEOF(struct net_device_stats, _net_stat), \
-        .stat_offset = offsetof(struct net_device_stats, _net_stat) \
+        .sizeof_stat = FIELD_SIZEOF(struct rtnl_link_stats64, _net_stat), \
+        .stat_offset = offsetof(struct rtnl_link_stats64, _net_stat) \
 }
 static const struct igb_stats igb_gstrings_net_stats[] = {
         IGB_NETDEV_STAT(rx_errors),
@@ -111,8 +111,9 @@ static const struct igb_stats igb_gstrings_net_stats[] = {
         (sizeof(igb_gstrings_net_stats) / sizeof(struct igb_stats))
 #define IGB_RX_QUEUE_STATS_LEN \
         (sizeof(struct igb_rx_queue_stats) / sizeof(u64))
-#define IGB_TX_QUEUE_STATS_LEN \
-        (sizeof(struct igb_tx_queue_stats) / sizeof(u64))
+
+#define IGB_TX_QUEUE_STATS_LEN 3 /* packets, bytes, restart_queue */
+
 #define IGB_QUEUE_STATS_LEN \
         ((((struct igb_adapter *)netdev_priv(netdev))->num_rx_queues * \
           IGB_RX_QUEUE_STATS_LEN) + \
@@ -2070,12 +2071,14 @@ static void igb_get_ethtool_stats(struct net_device *netdev,
                                   struct ethtool_stats *stats, u64 *data)
 {
         struct igb_adapter *adapter = netdev_priv(netdev);
-        struct net_device_stats *net_stats = &netdev->stats;
-        u64 *queue_stat;
-        int i, j, k;
+        struct rtnl_link_stats64 *net_stats = &adapter->stats64;
+        unsigned int start;
+        struct igb_ring *ring;
+        int i, j;
         char *p;
 
-        igb_update_stats(adapter);
+        spin_lock(&adapter->stats64_lock);
+        igb_update_stats(adapter, net_stats);
 
         for (i = 0; i < IGB_GLOBAL_STATS_LEN; i++) {
                 p = (char *)adapter + igb_gstrings_stats[i].stat_offset;
@@ -2088,15 +2091,36 @@ static void igb_get_ethtool_stats(struct net_device *netdev,
                         sizeof(u64)) ? *(u64 *)p : *(u32 *)p;
         }
         for (j = 0; j < adapter->num_tx_queues; j++) {
-                queue_stat = (u64 *)&adapter->tx_ring[j]->tx_stats;
-                for (k = 0; k < IGB_TX_QUEUE_STATS_LEN; k++, i++)
-                        data[i] = queue_stat[k];
+                u64     restart2;
+
+                ring = adapter->tx_ring[j];
+                do {
+                        start = u64_stats_fetch_begin_bh(&ring->tx_syncp);
+                        data[i]   = ring->tx_stats.packets;
+                        data[i+1] = ring->tx_stats.bytes;
+                        data[i+2] = ring->tx_stats.restart_queue;
+                } while (u64_stats_fetch_retry_bh(&ring->tx_syncp, start));
+                do {
+                        start = u64_stats_fetch_begin_bh(&ring->tx_syncp2);
+                        restart2  = ring->tx_stats.restart_queue2;
+                } while (u64_stats_fetch_retry_bh(&ring->tx_syncp2, start));
+                data[i+2] += restart2;
+
+                i += IGB_TX_QUEUE_STATS_LEN;
         }
         for (j = 0; j < adapter->num_rx_queues; j++) {
-                queue_stat = (u64 *)&adapter->rx_ring[j]->rx_stats;
-                for (k = 0; k < IGB_RX_QUEUE_STATS_LEN; k++, i++)
-                        data[i] = queue_stat[k];
+                ring = adapter->rx_ring[j];
+                do {
+                        start = u64_stats_fetch_begin_bh(&ring->rx_syncp);
+                        data[i]   = ring->rx_stats.packets;
+                        data[i+1] = ring->rx_stats.bytes;
+                        data[i+2] = ring->rx_stats.drops;
+                        data[i+3] = ring->rx_stats.csum_err;
+                        data[i+4] = ring->rx_stats.alloc_failed;
+                } while (u64_stats_fetch_retry_bh(&ring->rx_syncp, start));
+                i += IGB_RX_QUEUE_STATS_LEN;
         }
+        spin_unlock(&adapter->stats64_lock);
 }
 
 static void igb_get_strings(struct net_device *netdev, u32 stringset, u8 *data)
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index c4d861b557ca..75155a27fdde 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -71,6 +71,8 @@ static DEFINE_PCI_DEVICE_TABLE(igb_pci_tbl) = {
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82580_SERDES), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82580_SGMII), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82580_COPPER_DUAL), board_82575 },
+        { PCI_VDEVICE(INTEL, E1000_DEV_ID_DH89XXCC_SGMII), board_82575 },
+        { PCI_VDEVICE(INTEL, E1000_DEV_ID_DH89XXCC_SERDES), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_NS), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_NS_SERDES), board_82575 },
@@ -94,7 +96,6 @@ static int igb_setup_all_rx_resources(struct igb_adapter *);
 static void igb_free_all_tx_resources(struct igb_adapter *);
 static void igb_free_all_rx_resources(struct igb_adapter *);
 static void igb_setup_mrqc(struct igb_adapter *);
-void igb_update_stats(struct igb_adapter *);
 static int igb_probe(struct pci_dev *, const struct pci_device_id *);
 static void __devexit igb_remove(struct pci_dev *pdev);
 static int igb_sw_init(struct igb_adapter *);
@@ -111,7 +112,8 @@ static void igb_update_phy_info(unsigned long);
 static void igb_watchdog(unsigned long);
 static void igb_watchdog_task(struct work_struct *);
 static netdev_tx_t igb_xmit_frame_adv(struct sk_buff *skb, struct net_device *);
-static struct net_device_stats *igb_get_stats(struct net_device *);
+static struct rtnl_link_stats64 *igb_get_stats64(struct net_device *dev,
+                                                 struct rtnl_link_stats64 *stats);
 static int igb_change_mtu(struct net_device *, int);
 static int igb_set_mac(struct net_device *, void *);
 static void igb_set_uta(struct igb_adapter *adapter);
@@ -986,7 +988,7 @@ static void igb_clear_interrupt_scheme(struct igb_adapter *adapter)
  * Attempt to configure interrupts using the best available
  * capabilities of the hardware and kernel.
  **/
-static void igb_set_interrupt_capability(struct igb_adapter *adapter)
+static int igb_set_interrupt_capability(struct igb_adapter *adapter)
 {
         int err;
         int numvecs, i;
@@ -1052,8 +1054,10 @@ msi_only:
         if (!pci_enable_msi(adapter->pdev))
                 adapter->flags |= IGB_FLAG_HAS_MSI;
 out:
-        /* Notify the stack of the (possibly) reduced Tx Queue count. */
-        adapter->netdev->real_num_tx_queues = adapter->num_tx_queues;
+        /* Notify the stack of the (possibly) reduced queue counts. */
+        netif_set_real_num_tx_queues(adapter->netdev, adapter->num_tx_queues);
+        return netif_set_real_num_rx_queues(adapter->netdev,
+                                            adapter->num_rx_queues);
 }
 
 /**
@@ -1152,7 +1156,9 @@ static int igb_init_interrupt_scheme(struct igb_adapter *adapter)
         struct pci_dev *pdev = adapter->pdev;
         int err;
 
-        igb_set_interrupt_capability(adapter);
+        err = igb_set_interrupt_capability(adapter);
+        if (err)
+                return err;
 
         err = igb_alloc_q_vectors(adapter);
         if (err) {
@@ -1530,7 +1536,9 @@ void igb_down(struct igb_adapter *adapter)
         netif_carrier_off(netdev);
 
         /* record the stats before reset*/
-        igb_update_stats(adapter);
+        spin_lock(&adapter->stats64_lock);
+        igb_update_stats(adapter, &adapter->stats64);
+        spin_unlock(&adapter->stats64_lock);
 
         adapter->link_speed = 0;
         adapter->link_duplex = 0;
@@ -1683,7 +1691,7 @@ static const struct net_device_ops igb_netdev_ops = {
         .ndo_open               = igb_open,
         .ndo_stop               = igb_close,
         .ndo_start_xmit         = igb_xmit_frame_adv,
-        .ndo_get_stats          = igb_get_stats,
+        .ndo_get_stats64        = igb_get_stats64,
         .ndo_set_rx_mode        = igb_set_rx_mode,
         .ndo_set_multicast_list = igb_set_rx_mode,
         .ndo_set_mac_address    = igb_set_mac,
@@ -1856,8 +1864,10 @@ static int __devinit igb_probe(struct pci_dev *pdev,
         netdev->vlan_features |= NETIF_F_IPV6_CSUM;
         netdev->vlan_features |= NETIF_F_SG;
 
-        if (pci_using_dac)
+        if (pci_using_dac) {
                 netdev->features |= NETIF_F_HIGHDMA;
+                netdev->vlan_features |= NETIF_F_HIGHDMA;
+        }
 
         if (hw->mac.type >= e1000_82576)
                 netdev->features |= NETIF_F_SCTP_CSUM;
@@ -2268,6 +2278,7 @@ static int __devinit igb_sw_init(struct igb_adapter *adapter)
         adapter->max_frame_size = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
         adapter->min_frame_size = ETH_ZLEN + ETH_FCS_LEN;
 
+        spin_lock_init(&adapter->stats64_lock);
 #ifdef CONFIG_PCI_IOV
         if (hw->mac.type == e1000_82576)
                 adapter->vfs_allocated_count = (max_vfs > 7) ? 7 : max_vfs;
@@ -3475,7 +3486,9 @@ static void igb_watchdog_task(struct work_struct *work)
                 }
         }
 
-        igb_update_stats(adapter);
+        spin_lock(&adapter->stats64_lock);
+        igb_update_stats(adapter, &adapter->stats64);
+        spin_unlock(&adapter->stats64_lock);
 
         for (i = 0; i < adapter->num_tx_queues; i++) {
                 struct igb_ring *tx_ring = adapter->tx_ring[i];
@@ -3542,6 +3555,8 @@ static void igb_update_ring_itr(struct igb_q_vector *q_vector)
         int new_val = q_vector->itr_val;
         int avg_wire_size = 0;
         struct igb_adapter *adapter = q_vector->adapter;
+        struct igb_ring *ring;
+        unsigned int packets;
 
         /* For non-gigabit speeds, just fix the interrupt rate at 4000
          * ints/sec - ITR timer value of 120 ticks.
@@ -3551,16 +3566,21 @@ static void igb_update_ring_itr(struct igb_q_vector *q_vector)
                 goto set_itr_val;
         }
 
-        if (q_vector->rx_ring && q_vector->rx_ring->total_packets) {
-                struct igb_ring *ring = q_vector->rx_ring;
-                avg_wire_size = ring->total_bytes / ring->total_packets;
+        ring = q_vector->rx_ring;
+        if (ring) {
+                packets = ACCESS_ONCE(ring->total_packets);
+
+                if (packets)
+                        avg_wire_size = ring->total_bytes / packets;
         }
 
-        if (q_vector->tx_ring && q_vector->tx_ring->total_packets) {
-                struct igb_ring *ring = q_vector->tx_ring;
-                avg_wire_size = max_t(u32, avg_wire_size,
-                                      (ring->total_bytes /
-                                       ring->total_packets));
+        ring = q_vector->tx_ring;
+        if (ring) {
+                packets = ACCESS_ONCE(ring->total_packets);
+
+                if (packets)
+                        avg_wire_size = max_t(u32, avg_wire_size,
+                                              ring->total_bytes / packets);
         }
 
         /* if avg_wire_size isn't set no work was done */
@@ -4069,7 +4089,11 @@ static int __igb_maybe_stop_tx(struct igb_ring *tx_ring, int size)
 
         /* A reprieve! */
         netif_wake_subqueue(netdev, tx_ring->queue_index);
-        tx_ring->tx_stats.restart_queue++;
+
+        u64_stats_update_begin(&tx_ring->tx_syncp2);
+        tx_ring->tx_stats.restart_queue2++;
+        u64_stats_update_end(&tx_ring->tx_syncp2);
+
         return 0;
 }
 
@@ -4104,7 +4128,7 @@ netdev_tx_t igb_xmit_frame_ring_adv(struct sk_buff *skb,
                 tx_flags |= IGB_TX_FLAGS_TSTAMP;
         }
 
-        if (vlan_tx_tag_present(skb) && adapter->vlgrp) {
+        if (vlan_tx_tag_present(skb)) {
                 tx_flags |= IGB_TX_FLAGS_VLAN;
                 tx_flags |= (vlan_tx_tag_get(skb) << IGB_TX_FLAGS_VLAN_SHIFT);
         }
@@ -4206,16 +4230,22 @@ static void igb_reset_task(struct work_struct *work)
 }
 
 /**
- * igb_get_stats - Get System Network Statistics
+ * igb_get_stats64 - Get System Network Statistics
  * @netdev: network interface device structure
+ * @stats: rtnl_link_stats64 pointer
  *
- * Returns the address of the device statistics structure.
- * The statistics are actually updated from the timer callback.
  **/
-static struct net_device_stats *igb_get_stats(struct net_device *netdev)
+static struct rtnl_link_stats64 *igb_get_stats64(struct net_device *netdev,
+                                                 struct rtnl_link_stats64 *stats)
 {
-        /* only return the current stats */
-        return &netdev->stats;
+        struct igb_adapter *adapter = netdev_priv(netdev);
+
+        spin_lock(&adapter->stats64_lock);
+        igb_update_stats(adapter, &adapter->stats64);
+        memcpy(stats, &adapter->stats64, sizeof(*stats));
+        spin_unlock(&adapter->stats64_lock);
+
+        return stats;
 }
 
 /**
@@ -4297,15 +4327,17 @@ static int igb_change_mtu(struct net_device *netdev, int new_mtu)
  * @adapter: board private structure
  **/
 
-void igb_update_stats(struct igb_adapter *adapter)
+void igb_update_stats(struct igb_adapter *adapter,
+                      struct rtnl_link_stats64 *net_stats)
 {
-        struct net_device_stats *net_stats = igb_get_stats(adapter->netdev);
         struct e1000_hw *hw = &adapter->hw;
         struct pci_dev *pdev = adapter->pdev;
         u32 reg, mpc;
         u16 phy_tmp;
         int i;
         u64 bytes, packets;
+        unsigned int start;
+        u64 _bytes, _packets;
 
 #define PHY_IDLE_ERROR_COUNT_MASK 0x00FF
 
@@ -4323,10 +4355,17 @@ void igb_update_stats(struct igb_adapter *adapter)
         for (i = 0; i < adapter->num_rx_queues; i++) {
                 u32 rqdpc_tmp = rd32(E1000_RQDPC(i)) & 0x0FFF;
                 struct igb_ring *ring = adapter->rx_ring[i];
+
                 ring->rx_stats.drops += rqdpc_tmp;
                 net_stats->rx_fifo_errors += rqdpc_tmp;
-                bytes += ring->rx_stats.bytes;
-                packets += ring->rx_stats.packets;
+
+                do {
+                        start = u64_stats_fetch_begin_bh(&ring->rx_syncp);
+                        _bytes = ring->rx_stats.bytes;
+                        _packets = ring->rx_stats.packets;
+                } while (u64_stats_fetch_retry_bh(&ring->rx_syncp, start));
+                bytes += _bytes;
+                packets += _packets;
         }
 
         net_stats->rx_bytes = bytes;
@@ -4336,8 +4375,13 @@ void igb_update_stats(struct igb_adapter *adapter)
         packets = 0;
         for (i = 0; i < adapter->num_tx_queues; i++) {
                 struct igb_ring *ring = adapter->tx_ring[i];
-                bytes += ring->tx_stats.bytes;
-                packets += ring->tx_stats.packets;
+                do {
+                        start = u64_stats_fetch_begin_bh(&ring->tx_syncp);
+                        _bytes = ring->tx_stats.bytes;
+                        _packets = ring->tx_stats.packets;
+                } while (u64_stats_fetch_retry_bh(&ring->tx_syncp, start));
+                bytes += _bytes;
+                packets += _packets;
         }
         net_stats->tx_bytes = bytes;
         net_stats->tx_packets = packets;
@@ -4659,12 +4703,13 @@ static int igb_set_vf_promisc(struct igb_adapter *adapter, u32 *msgbuf, u32 vf)
         u32 vmolr = rd32(E1000_VMOLR(vf));
         struct vf_data_storage *vf_data = &adapter->vf_data[vf];
 
-        vf_data->flags |= ~(IGB_VF_FLAG_UNI_PROMISC |
+        vf_data->flags &= ~(IGB_VF_FLAG_UNI_PROMISC |
                             IGB_VF_FLAG_MULTI_PROMISC);
         vmolr &= ~(E1000_VMOLR_ROPE | E1000_VMOLR_ROMPE | E1000_VMOLR_MPME);
 
         if (*msgbuf & E1000_VF_SET_PROMISC_MULTICAST) {
                 vmolr |= E1000_VMOLR_MPME;
+                vf_data->flags |= IGB_VF_FLAG_MULTI_PROMISC;
                 *msgbuf &= ~E1000_VF_SET_PROMISC_MULTICAST;
         } else {
                 /*
@@ -5388,7 +5433,10 @@ static bool igb_clean_tx_irq(struct igb_q_vector *q_vector)
                 if (__netif_subqueue_stopped(netdev, tx_ring->queue_index) &&
                     !(test_bit(__IGB_DOWN, &adapter->state))) {
                         netif_wake_subqueue(netdev, tx_ring->queue_index);
+
+                        u64_stats_update_begin(&tx_ring->tx_syncp);
                         tx_ring->tx_stats.restart_queue++;
+                        u64_stats_update_end(&tx_ring->tx_syncp);
                 }
         }
 
@@ -5428,9 +5476,11 @@ static bool igb_clean_tx_irq(struct igb_q_vector *q_vector)
         }
         tx_ring->total_bytes += total_bytes;
         tx_ring->total_packets += total_packets;
+        u64_stats_update_begin(&tx_ring->tx_syncp);
         tx_ring->tx_stats.bytes += total_bytes;
         tx_ring->tx_stats.packets += total_packets;
-        return (count < tx_ring->count);
+        u64_stats_update_end(&tx_ring->tx_syncp);
+        return count < tx_ring->count;
 }
 
 /**
@@ -5471,9 +5521,11 @@ static inline void igb_rx_checksum_adv(struct igb_ring *ring,
                  * packets, (aka let the stack check the crc32c)
                  */
                 if ((skb->len == 60) &&
-                    (ring->flags & IGB_RING_FLAG_RX_SCTP_CSUM))
+                    (ring->flags & IGB_RING_FLAG_RX_SCTP_CSUM)) {
+                        u64_stats_update_begin(&ring->rx_syncp);
                         ring->rx_stats.csum_err++;
-
+                        u64_stats_update_end(&ring->rx_syncp);
+                }
                 /* let the stack verify checksum errors */
                 return;
         }
@@ -5660,8 +5712,10 @@ next_desc:
 
         rx_ring->total_packets += total_packets;
         rx_ring->total_bytes += total_bytes;
+        u64_stats_update_begin(&rx_ring->rx_syncp);
         rx_ring->rx_stats.packets += total_packets;
         rx_ring->rx_stats.bytes += total_bytes;
+        u64_stats_update_end(&rx_ring->rx_syncp);
         return cleaned;
 }
 
@@ -5689,8 +5743,10 @@ void igb_alloc_rx_buffers_adv(struct igb_ring *rx_ring, int cleaned_count)
                 if ((bufsz < IGB_RXBUFFER_1024) && !buffer_info->page_dma) {
                         if (!buffer_info->page) {
                                 buffer_info->page = netdev_alloc_page(netdev);
-                                if (!buffer_info->page) {
+                                if (unlikely(!buffer_info->page)) {
+                                        u64_stats_update_begin(&rx_ring->rx_syncp);
                                         rx_ring->rx_stats.alloc_failed++;
+                                        u64_stats_update_end(&rx_ring->rx_syncp);
                                         goto no_buffers;
                                 }
                                 buffer_info->page_offset = 0;
@@ -5705,7 +5761,9 @@ void igb_alloc_rx_buffers_adv(struct igb_ring *rx_ring, int cleaned_count)
                         if (dma_mapping_error(rx_ring->dev,
                                               buffer_info->page_dma)) {
                                 buffer_info->page_dma = 0;
+                                u64_stats_update_begin(&rx_ring->rx_syncp);
                                 rx_ring->rx_stats.alloc_failed++;
+                                u64_stats_update_end(&rx_ring->rx_syncp);
                                 goto no_buffers;
                         }
                 }
@@ -5713,8 +5771,10 @@ void igb_alloc_rx_buffers_adv(struct igb_ring *rx_ring, int cleaned_count)
                 skb = buffer_info->skb;
                 if (!skb) {
                         skb = netdev_alloc_skb_ip_align(netdev, bufsz);
-                        if (!skb) {
+                        if (unlikely(!skb)) {
+                                u64_stats_update_begin(&rx_ring->rx_syncp);
                                 rx_ring->rx_stats.alloc_failed++;
+                                u64_stats_update_end(&rx_ring->rx_syncp);
                                 goto no_buffers;
                         }
 
@@ -5728,7 +5788,9 @@ void igb_alloc_rx_buffers_adv(struct igb_ring *rx_ring, int cleaned_count)
                         if (dma_mapping_error(rx_ring->dev,
                                               buffer_info->dma)) {
                                 buffer_info->dma = 0;
+                                u64_stats_update_begin(&rx_ring->rx_syncp);
                                 rx_ring->rx_stats.alloc_failed++;
+                                u64_stats_update_end(&rx_ring->rx_syncp);
                                 goto no_buffers;
                         }
                 }
@@ -6091,7 +6153,7 @@ static void igb_restore_vlan(struct igb_adapter *adapter)
 
         if (adapter->vlgrp) {
                 u16 vid;
-                for (vid = 0; vid < VLAN_GROUP_ARRAY_LEN; vid++) {
+                for (vid = 0; vid < VLAN_N_VID; vid++) {
                         if (!vlan_group_get_device(adapter->vlgrp, vid))
                                 continue;
                         igb_vlan_rx_add_vid(adapter->netdev, vid);
@@ -6106,6 +6168,13 @@ int igb_set_spd_dplx(struct igb_adapter *adapter, u16 spddplx)
 
         mac->autoneg = 0;
 
+        /* Fiber NIC's only allow 1000 Gbps Full duplex */
+        if ((adapter->hw.phy.media_type == e1000_media_type_internal_serdes) &&
+                spddplx != (SPEED_1000 + DUPLEX_FULL)) {
+                dev_err(&pdev->dev, "Unsupported Speed/Duplex configuration\n");
+                return -EINVAL;
+        }
+
         switch (spddplx) {
         case SPEED_10 + DUPLEX_HALF:
                 mac->forced_speed_duplex = ADVERTISE_10_HALF;
diff --git a/drivers/net/igbvf/ethtool.c b/drivers/net/igbvf/ethtool.c
index 103b3aa1afc2..33add708bcbe 100644
--- a/drivers/net/igbvf/ethtool.c
+++ b/drivers/net/igbvf/ethtool.c
@@ -153,7 +153,7 @@ static int igbvf_set_rx_csum(struct net_device *netdev, u32 data)
 
 static u32 igbvf_get_tx_csum(struct net_device *netdev)
 {
-        return ((netdev->features & NETIF_F_IP_CSUM) != 0);
+        return (netdev->features & NETIF_F_IP_CSUM) != 0;
 }
 
 static int igbvf_set_tx_csum(struct net_device *netdev, u32 data)
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index c7fab80d2490..ebfaa68ee630 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -41,14 +41,12 @@
 #include <linux/mii.h>
 #include <linux/ethtool.h>
 #include <linux/if_vlan.h>
-#include <linux/pm_qos_params.h>
 
 #include "igbvf.h"
 
 #define DRV_VERSION "1.0.0-k0"
 char igbvf_driver_name[] = "igbvf";
 const char igbvf_driver_version[] = DRV_VERSION;
-static struct pm_qos_request_list igbvf_driver_pm_qos_req;
 static const char igbvf_driver_string[] =
                                 "Intel(R) Virtual Function Network Driver";
 static const char igbvf_copyright[] = "Copyright (c) 2009 Intel Corporation.";
@@ -845,7 +843,7 @@ static bool igbvf_clean_tx_irq(struct igbvf_ring *tx_ring)
         }
         adapter->net_stats.tx_bytes += total_bytes;
         adapter->net_stats.tx_packets += total_packets;
-        return (count < tx_ring->count);
+        return count < tx_ring->count;
 }
 
 static irqreturn_t igbvf_msix_other(int irq, void *data)
@@ -1256,7 +1254,7 @@ static void igbvf_restore_vlan(struct igbvf_adapter *adapter)
         if (!adapter->vlgrp)
                 return;
 
-        for (vid = 0; vid < VLAN_GROUP_ARRAY_LEN; vid++) {
+        for (vid = 0; vid < VLAN_N_VID; vid++) {
                 if (!vlan_group_get_device(adapter->vlgrp, vid))
                         continue;
                 igbvf_vlan_rx_add_vid(adapter->netdev, vid);
@@ -2904,8 +2902,6 @@ static int __init igbvf_init_module(void)
         printk(KERN_INFO "%s\n", igbvf_copyright);
 
         ret = pci_register_driver(&igbvf_driver);
-        pm_qos_add_request(&igbvf_driver_pm_qos_req, PM_QOS_CPU_DMA_LATENCY,
-                           PM_QOS_DEFAULT_VALUE);
 
         return ret;
 }
@@ -2920,7 +2916,6 @@ module_init(igbvf_init_module);
 static void __exit igbvf_exit_module(void)
 {
         pci_unregister_driver(&igbvf_driver);
-        pm_qos_remove_request(&igbvf_driver_pm_qos_req);
 }
 module_exit(igbvf_exit_module);
 
diff --git a/drivers/net/irda/donauboe.c b/drivers/net/irda/donauboe.c
index 48bd5ec9f29b..b626cccbccd1 100644
--- a/drivers/net/irda/donauboe.c
+++ b/drivers/net/irda/donauboe.c
@@ -217,7 +217,7 @@ toshoboe_checkfcs (unsigned char *buf, int len)
   for (i = 0; i < len; ++i)
     fcs.value = irda_fcs (fcs.value, *(buf++));
 
-  return (fcs.value == GOOD_FCS);
+  return fcs.value == GOOD_FCS;
 }
 
 /***********************************************************************/
@@ -759,7 +759,7 @@ toshoboe_maketestpacket (unsigned char *buf, int badcrc, int fir)
   if (fir)
     {
       memset (buf, 0, TT_LEN);
-      return (TT_LEN);
+      return TT_LEN;
     }
 
   fcs.value = INIT_FCS;
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 4441fa3389c2..e4ea61944c22 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1124,11 +1124,11 @@ static int stir421x_patch_device(struct irda_usb_cb *self)
                  * The actual image starts after the "STMP" keyword
                  * so forward to the firmware header tag
                  */
-                for (i = 0; (fw->data[i] != STIR421X_PATCH_END_OF_HDR_TAG) &&
-                             (i < fw->size); i++) ;
+                for (i = 0; i < fw->size && fw->data[i] !=
+                             STIR421X_PATCH_END_OF_HDR_TAG; i++) ;
                 /* here we check for the out of buffer case */
-                if ((STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) &&
-                    (i < STIR421X_PATCH_CODE_OFFSET)) {
+                if (i < STIR421X_PATCH_CODE_OFFSET && i < fw->size &&
+                                STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) {
                         if (!memcmp(fw->data + i + 1, STIR421X_PATCH_STMP_TAG,
                                     sizeof(STIR421X_PATCH_STMP_TAG) - 1)) {
 
@@ -1514,7 +1514,7 @@ static inline int irda_usb_parse_endpoints(struct irda_usb_cb *self, struct usb_
         IRDA_DEBUG(0, "%s(), And our endpoints are : in=%02X, out=%02X (%d), int=%02X\n",
                 __func__, self->bulk_in_ep, self->bulk_out_ep, self->bulk_out_mtu, self->bulk_int_ep);
 
-        return((self->bulk_in_ep != 0) && (self->bulk_out_ep != 0));
+        return (self->bulk_in_ep != 0) && (self->bulk_out_ep != 0);
 }
 
 #ifdef IU_DUMP_CLASS_DESC
diff --git a/drivers/net/irda/nsc-ircc.c b/drivers/net/irda/nsc-ircc.c
index e30cdbb14745..559fe854d76d 100644
--- a/drivers/net/irda/nsc-ircc.c
+++ b/drivers/net/irda/nsc-ircc.c
@@ -1348,7 +1348,7 @@ static __u8 nsc_ircc_change_speed(struct nsc_ircc_cb *self, __u32 speed)
         outb(bank, iobase+BSR);
 
         /* Make sure interrupt handlers keep the proper interrupt mask */
-        return(ier);
+        return ier;
 }
 
 /*
diff --git a/drivers/net/irda/sir_dev.c b/drivers/net/irda/sir_dev.c
index 1b051dab7b29..39d6e6f15d4f 100644
--- a/drivers/net/irda/sir_dev.c
+++ b/drivers/net/irda/sir_dev.c
@@ -336,7 +336,7 @@ static int sirdev_is_receiving(struct sir_dev *dev)
         if (!atomic_read(&dev->enable_rx))
                 return 0;
 
-        return (dev->rx_buff.state != OUTSIDE_FRAME);
+        return dev->rx_buff.state != OUTSIDE_FRAME;
 }
 
 int sirdev_set_dongle(struct sir_dev *dev, IRDA_DONGLE type)
diff --git a/drivers/net/irda/smsc-ircc2.c b/drivers/net/irda/smsc-ircc2.c
index 850ca1c5ee19..8c57bfb5f098 100644
--- a/drivers/net/irda/smsc-ircc2.c
+++ b/drivers/net/irda/smsc-ircc2.c
@@ -2051,7 +2051,7 @@ static int smsc_ircc_sir_write(int iobase, int fifo_size, __u8 *buf, int len)
  */
 static int smsc_ircc_is_receiving(struct smsc_ircc_cb *self)
 {
-        return (self->rx_buff.state != OUTSIDE_FRAME);
+        return self->rx_buff.state != OUTSIDE_FRAME;
 }
 
 
diff --git a/drivers/net/irda/stir4200.c b/drivers/net/irda/stir4200.c
index e5698fa30a4f..41c96b3d8152 100644
--- a/drivers/net/irda/stir4200.c
+++ b/drivers/net/irda/stir4200.c
@@ -219,7 +219,7 @@ static inline int read_reg(struct stir_cb *stir, __u16 reg,
 
 static inline int isfir(u32 speed)
 {
-        return (speed == 4000000);
+        return speed == 4000000;
 }
 
 /*
diff --git a/drivers/net/irda/via-ircc.h b/drivers/net/irda/via-ircc.h
index 5a84822b5a43..c6f58482b769 100644
--- a/drivers/net/irda/via-ircc.h
+++ b/drivers/net/irda/via-ircc.h
@@ -238,7 +238,7 @@ static void WriteLPCReg(int iRegNum, unsigned char iVal)
 
 static __u8 ReadReg(unsigned int BaseAddr, int iRegNum)
 {
-        return ((__u8) inb(BaseAddr + iRegNum));
+        return (__u8) inb(BaseAddr + iRegNum);
 }
 
 static void WriteReg(unsigned int BaseAddr, int iRegNum, unsigned char iVal)
diff --git a/drivers/net/irda/vlsi_ir.h b/drivers/net/irda/vlsi_ir.h
index 3f24a1f33022..d66fab854bf1 100644
--- a/drivers/net/irda/vlsi_ir.h
+++ b/drivers/net/irda/vlsi_ir.h
@@ -595,7 +595,7 @@ struct ring_descr {
 
 static inline int rd_is_active(struct ring_descr *rd)
 {
-        return ((rd->hw->rd_status & RD_ACTIVE) != 0);
+        return (rd->hw->rd_status & RD_ACTIVE) != 0;
 }
 
 static inline void rd_activate(struct ring_descr *rd)
diff --git a/drivers/net/ixgb/ixgb_ee.c b/drivers/net/ixgb/ixgb_ee.c
index 813993f9c65c..c982ab9f9005 100644
--- a/drivers/net/ixgb/ixgb_ee.c
+++ b/drivers/net/ixgb/ixgb_ee.c
@@ -296,12 +296,12 @@ ixgb_wait_eeprom_command(struct ixgb_hw *hw)
                 eecd_reg = IXGB_READ_REG(hw, EECD);
 
                 if (eecd_reg & IXGB_EECD_DO)
-                        return (true);
+                        return true;
 
                 udelay(50);
         }
         ASSERT(0);
-        return (false);
+        return false;
 }
 
 /******************************************************************************
@@ -327,9 +327,9 @@ ixgb_validate_eeprom_checksum(struct ixgb_hw *hw)
                 checksum += ixgb_read_eeprom(hw, i);
 
         if (checksum == (u16) EEPROM_SUM)
-                return (true);
+                return true;
         else
-                return (false);
+                return false;
 }
 
 /******************************************************************************
@@ -439,7 +439,7 @@ ixgb_read_eeprom(struct ixgb_hw *hw,
         /*  End this read operation  */
         ixgb_standby_eeprom(hw);
 
-        return (data);
+        return data;
 }
 
 /******************************************************************************
@@ -476,16 +476,16 @@ ixgb_get_eeprom_data(struct ixgb_hw *hw)
                 /* clear the init_ctrl_reg_1 to signify that the cache is
                  * invalidated */
                 ee_map->init_ctrl_reg_1 = cpu_to_le16(EEPROM_ICW1_SIGNATURE_CLEAR);
-                return (false);
+                return false;
         }
 
         if ((ee_map->init_ctrl_reg_1 & cpu_to_le16(EEPROM_ICW1_SIGNATURE_MASK))
                  != cpu_to_le16(EEPROM_ICW1_SIGNATURE_VALID)) {
                 pr_debug("Signature invalid\n");
-                return(false);
+                return false;
         }
 
-        return(true);
+        return true;
 }
 
 /******************************************************************************
@@ -505,7 +505,7 @@ ixgb_check_and_get_eeprom_data (struct ixgb_hw* hw)
 
         if ((ee_map->init_ctrl_reg_1 & cpu_to_le16(EEPROM_ICW1_SIGNATURE_MASK))
             == cpu_to_le16(EEPROM_ICW1_SIGNATURE_VALID)) {
-                return (true);
+                return true;
         } else {
                 return ixgb_get_eeprom_data(hw);
         }
@@ -526,10 +526,10 @@ ixgb_get_eeprom_word(struct ixgb_hw *hw, u16 index)
 
         if ((index < IXGB_EEPROM_SIZE) &&
                 (ixgb_check_and_get_eeprom_data(hw) == true)) {
-           return(hw->eeprom[index]);
+           return hw->eeprom[index];
         }
 
-        return(0);
+        return 0;
 }
 
 /******************************************************************************
@@ -570,10 +570,10 @@ u32
 ixgb_get_ee_pba_number(struct ixgb_hw *hw)
 {
         if (ixgb_check_and_get_eeprom_data(hw) == true)
-                return (le16_to_cpu(hw->eeprom[EEPROM_PBA_1_2_REG])
-                        | (le16_to_cpu(hw->eeprom[EEPROM_PBA_3_4_REG])<<16));
+                return le16_to_cpu(hw->eeprom[EEPROM_PBA_1_2_REG])
+                        | (le16_to_cpu(hw->eeprom[EEPROM_PBA_3_4_REG])<<16);
 
-        return(0);
+        return 0;
 }
 
 
@@ -591,8 +591,8 @@ ixgb_get_ee_device_id(struct ixgb_hw *hw)
         struct ixgb_ee_map_type *ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
 
         if (ixgb_check_and_get_eeprom_data(hw) == true)
-                return (le16_to_cpu(ee_map->device_id));
+                return le16_to_cpu(ee_map->device_id);
 
-        return (0);
+        return 0;
 }
 
diff --git a/drivers/net/ixgb/ixgb_ethtool.c b/drivers/net/ixgb/ixgb_ethtool.c
index a4ed96caae69..43994c199991 100644
--- a/drivers/net/ixgb/ixgb_ethtool.c
+++ b/drivers/net/ixgb/ixgb_ethtool.c
@@ -410,7 +410,7 @@ static int
 ixgb_get_eeprom_len(struct net_device *netdev)
 {
         /* return size in bytes */
-        return (IXGB_EEPROM_SIZE << 1);
+        return IXGB_EEPROM_SIZE << 1;
 }
 
 static int
diff --git a/drivers/net/ixgb/ixgb_hw.c b/drivers/net/ixgb/ixgb_hw.c
index 397acabccab6..6cb2e42ff4c1 100644
--- a/drivers/net/ixgb/ixgb_hw.c
+++ b/drivers/net/ixgb/ixgb_hw.c
@@ -167,7 +167,7 @@ ixgb_adapter_stop(struct ixgb_hw *hw)
         /* Clear any pending interrupt events. */
         icr_reg = IXGB_READ_REG(hw, ICR);
 
-        return (ctrl_reg & IXGB_CTRL0_RST);
+        return ctrl_reg & IXGB_CTRL0_RST;
 }
 
 
@@ -209,7 +209,7 @@ ixgb_identify_xpak_vendor(struct ixgb_hw *hw)
                 xpak_vendor = ixgb_xpak_vendor_infineon;
         }
 
-        return (xpak_vendor);
+        return xpak_vendor;
 }
 
 /******************************************************************************
@@ -273,7 +273,7 @@ ixgb_identify_phy(struct ixgb_hw *hw)
         if (hw->subsystem_vendor_id == SUN_SUBVENDOR_ID)
                 phy_type = ixgb_phy_type_bcm;
 
-        return (phy_type);
+        return phy_type;
 }
 
 /******************************************************************************
@@ -366,7 +366,7 @@ ixgb_init_hw(struct ixgb_hw *hw)
         /* 82597EX errata: Call check-for-link in case lane deskew is locked */
         ixgb_check_for_link(hw);
 
-        return (status);
+        return status;
 }
 
 /******************************************************************************
@@ -531,7 +531,7 @@ ixgb_hash_mc_addr(struct ixgb_hw *hw,
         }
 
         hash_value &= 0xFFF;
-        return (hash_value);
+        return hash_value;
 }
 
 /******************************************************************************
@@ -715,7 +715,7 @@ ixgb_setup_fc(struct ixgb_hw *hw)
                 }
                 IXGB_WRITE_REG(hw, FCRTH, hw->fc.high_water);
         }
-        return (status);
+        return status;
 }
 
 /******************************************************************************
@@ -1140,7 +1140,7 @@ mac_addr_valid(u8 *mac_addr)
                 pr_debug("MAC address is all zeros\n");
                 is_valid = false;
         }
-        return (is_valid);
+        return is_valid;
 }
 
 /******************************************************************************
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index c2f6e71e1181..666207a9c039 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -446,8 +446,10 @@ ixgb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                            NETIF_F_HW_VLAN_FILTER;
         netdev->features |= NETIF_F_TSO;
 
-        if (pci_using_dac)
+        if (pci_using_dac) {
                 netdev->features |= NETIF_F_HIGHDMA;
+                netdev->vlan_features |= NETIF_F_HIGHDMA;
+        }
 
         /* make sure the EEPROM is good */
 
@@ -2221,7 +2223,7 @@ ixgb_restore_vlan(struct ixgb_adapter *adapter)
 
         if (adapter->vlgrp) {
                 u16 vid;
-                for (vid = 0; vid < VLAN_GROUP_ARRAY_LEN; vid++) {
+                for (vid = 0; vid < VLAN_N_VID; vid++) {
                         if (!vlan_group_get_device(adapter->vlgrp, vid))
                                 continue;
                         ixgb_vlan_rx_add_vid(adapter->netdev, vid);
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index 5cebc3755b64..ed8703cfffb7 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -28,10 +28,13 @@
 #ifndef _IXGBE_H_
 #define _IXGBE_H_
 
+#include <linux/bitops.h>
 #include <linux/types.h>
 #include <linux/pci.h>
 #include <linux/netdevice.h>
+#include <linux/cpumask.h>
 #include <linux/aer.h>
+#include <linux/if_vlan.h>
 
 #include "ixgbe_type.h"
 #include "ixgbe_common.h"
@@ -179,8 +182,9 @@ struct ixgbe_ring {
                                          */
 
         struct ixgbe_queue_stats stats;
-        unsigned long reinit_state;
+        struct u64_stats_sync syncp;
         int numa_node;
+        unsigned long reinit_state;
         u64 rsc_count;                  /* stat for coalesced packets */
         u64 rsc_flush;                  /* stats for flushed packets */
         u32 restart_queue;              /* track tx queue restarts */
@@ -241,6 +245,7 @@ struct ixgbe_q_vector {
         u8 tx_itr;
         u8 rx_itr;
         u32 eitr;
+        cpumask_var_t affinity_mask;
 };
 
 /* Helper macros to switch between ints/sec and what the register uses.
@@ -285,7 +290,7 @@ struct ixgbe_q_vector {
 /* board specific private data structure */
 struct ixgbe_adapter {
         struct timer_list watchdog_timer;
-        struct vlan_group *vlgrp;
+        unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
         u16 bd_number;
         struct work_struct reset_task;
         struct ixgbe_q_vector *q_vector[MAX_MSIX_Q_VECTORS];
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index 3e06a61da921..0bd8fbb5bfd0 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -39,20 +39,20 @@
 #define IXGBE_82599_MC_TBL_SIZE   128
 #define IXGBE_82599_VFT_TBL_SIZE  128
 
-void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
-void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
-void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
-s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
-                                          ixgbe_link_speed speed,
-                                          bool autoneg,
-                                          bool autoneg_wait_to_complete);
+static void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
+static void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
+static void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
+static s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
+                                                 ixgbe_link_speed speed,
+                                                 bool autoneg,
+                                                 bool autoneg_wait_to_complete);
 static s32 ixgbe_setup_mac_link_smartspeed(struct ixgbe_hw *hw,
                                            ixgbe_link_speed speed,
                                            bool autoneg,
                                            bool autoneg_wait_to_complete);
-s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
-                               bool autoneg_wait_to_complete);
-s32 ixgbe_setup_mac_link_82599(struct ixgbe_hw *hw,
+static s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
+                                      bool autoneg_wait_to_complete);
+static s32 ixgbe_setup_mac_link_82599(struct ixgbe_hw *hw,
                                ixgbe_link_speed speed,
                                bool autoneg,
                                bool autoneg_wait_to_complete);
@@ -369,7 +369,7 @@ out:
  *  Configures link settings based on values in the ixgbe_hw struct.
  *  Restarts the link.  Performs autonegotiation if needed.
  **/
-s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
+static s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
                                bool autoneg_wait_to_complete)
 {
         u32 autoc_reg;
@@ -418,7 +418,7 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
   *  PHY states.  This includes selectively shutting down the Tx
   *  laser on the PHY, effectively halting physical link.
   **/
-void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+static void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
 {
         u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
 
@@ -437,7 +437,7 @@ void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
  *  PHY states.  This includes selectively turning on the Tx
  *  laser on the PHY, effectively starting physical link.
  **/
-void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+static void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
 {
         u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
 
@@ -460,7 +460,7 @@ void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
  *  end.  This is consistent with true clause 37 autoneg, which also
  *  involves a loss of signal.
  **/
-void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+static void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
 {
         hw_dbg(hw, "ixgbe_flap_tx_laser_multispeed_fiber\n");
 
@@ -729,7 +729,7 @@ out:
  *
  *  Set the link speed in the AUTOC register and restarts link.
  **/
-s32 ixgbe_setup_mac_link_82599(struct ixgbe_hw *hw,
+static s32 ixgbe_setup_mac_link_82599(struct ixgbe_hw *hw,
                                ixgbe_link_speed speed, bool autoneg,
                                bool autoneg_wait_to_complete)
 {
@@ -1415,92 +1415,6 @@ s32 ixgbe_atr_set_dst_ipv4_82599(struct ixgbe_atr_input *input, u32 dst_addr)
 }
 
 /**
- *  ixgbe_atr_set_src_ipv6_82599 - Sets the source IPv6 address
- *  @input: input stream to modify
- *  @src_addr_1: the first 4 bytes of the IP address to load
- *  @src_addr_2: the second 4 bytes of the IP address to load
- *  @src_addr_3: the third 4 bytes of the IP address to load
- *  @src_addr_4: the fourth 4 bytes of the IP address to load
- **/
-s32 ixgbe_atr_set_src_ipv6_82599(struct ixgbe_atr_input *input,
-                                 u32 src_addr_1, u32 src_addr_2,
-                                 u32 src_addr_3, u32 src_addr_4)
-{
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET] = src_addr_4 & 0xff;
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 1] =
-                                                       (src_addr_4 >> 8) & 0xff;
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 2] =
-                                                      (src_addr_4 >> 16) & 0xff;
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 3] = src_addr_4 >> 24;
-
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 4] = src_addr_3 & 0xff;
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 5] =
-                                                       (src_addr_3 >> 8) & 0xff;
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 6] =
-                                                      (src_addr_3 >> 16) & 0xff;
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 7] = src_addr_3 >> 24;
-
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 8] = src_addr_2 & 0xff;
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 9] =
-                                                       (src_addr_2 >> 8) & 0xff;
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 10] =
-                                                      (src_addr_2 >> 16) & 0xff;
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 11] = src_addr_2 >> 24;
-
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 12] = src_addr_1 & 0xff;
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 13] =
-                                                       (src_addr_1 >> 8) & 0xff;
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 14] =
-                                                      (src_addr_1 >> 16) & 0xff;
-        input->byte_stream[IXGBE_ATR_SRC_IPV6_OFFSET + 15] = src_addr_1 >> 24;
-
-        return 0;
-}
-
-/**
- *  ixgbe_atr_set_dst_ipv6_82599 - Sets the destination IPv6 address
- *  @input: input stream to modify
- *  @dst_addr_1: the first 4 bytes of the IP address to load
- *  @dst_addr_2: the second 4 bytes of the IP address to load
- *  @dst_addr_3: the third 4 bytes of the IP address to load
- *  @dst_addr_4: the fourth 4 bytes of the IP address to load
- **/
-s32 ixgbe_atr_set_dst_ipv6_82599(struct ixgbe_atr_input *input,
-                                 u32 dst_addr_1, u32 dst_addr_2,
-                                 u32 dst_addr_3, u32 dst_addr_4)
-{
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET] = dst_addr_4 & 0xff;
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 1] =
-                                                       (dst_addr_4 >> 8) & 0xff;
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 2] =
-                                                      (dst_addr_4 >> 16) & 0xff;
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 3] = dst_addr_4 >> 24;
-
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 4] = dst_addr_3 & 0xff;
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 5] =
-                                                       (dst_addr_3 >> 8) & 0xff;
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 6] =
-                                                      (dst_addr_3 >> 16) & 0xff;
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 7] = dst_addr_3 >> 24;
-
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 8] = dst_addr_2 & 0xff;
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 9] =
-                                                       (dst_addr_2 >> 8) & 0xff;
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 10] =
-                                                      (dst_addr_2 >> 16) & 0xff;
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 11] = dst_addr_2 >> 24;
-
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 12] = dst_addr_1 & 0xff;
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 13] =
-                                                       (dst_addr_1 >> 8) & 0xff;
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 14] =
-                                                      (dst_addr_1 >> 16) & 0xff;
-        input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 15] = dst_addr_1 >> 24;
-
-        return 0;
-}
-
-/**
  *  ixgbe_atr_set_src_port_82599 - Sets the source port
  *  @input: input stream to modify
  *  @src_port: the source port to load
@@ -1540,19 +1454,6 @@ s32 ixgbe_atr_set_flex_byte_82599(struct ixgbe_atr_input *input, u16 flex_byte)
 }
 
 /**
- *  ixgbe_atr_set_vm_pool_82599 - Sets the Virtual Machine pool
- *  @input: input stream to modify
- *  @vm_pool: the Virtual Machine pool to load
- **/
-s32 ixgbe_atr_set_vm_pool_82599(struct ixgbe_atr_input *input,
-                                u8 vm_pool)
-{
-        input->byte_stream[IXGBE_ATR_VM_POOL_OFFSET] = vm_pool;
-
-        return 0;
-}
-
-/**
  *  ixgbe_atr_set_l4type_82599 - Sets the layer 4 packet type
  *  @input: input stream to modify
  *  @l4type: the layer 4 type value to load
@@ -1645,41 +1546,6 @@ static s32 ixgbe_atr_get_src_ipv6_82599(struct ixgbe_atr_input *input,
 }
 
 /**
- *  ixgbe_atr_get_dst_ipv6_82599 - Gets the destination IPv6 address
- *  @input: input stream to search
- *  @dst_addr_1: the first 4 bytes of the IP address to load
- *  @dst_addr_2: the second 4 bytes of the IP address to load
- *  @dst_addr_3: the third 4 bytes of the IP address to load
- *  @dst_addr_4: the fourth 4 bytes of the IP address to load
- **/
-s32 ixgbe_atr_get_dst_ipv6_82599(struct ixgbe_atr_input *input,
-                                        u32 *dst_addr_1, u32 *dst_addr_2,
-                                        u32 *dst_addr_3, u32 *dst_addr_4)
-{
-        *dst_addr_1 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 12];
-        *dst_addr_1 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 13] << 8;
-        *dst_addr_1 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 14] << 16;
-        *dst_addr_1 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 15] << 24;
-
-        *dst_addr_2 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 8];
-        *dst_addr_2 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 9] << 8;
-        *dst_addr_2 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 10] << 16;
-        *dst_addr_2 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 11] << 24;
-
-        *dst_addr_3 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 4];
-        *dst_addr_3 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 5] << 8;
-        *dst_addr_3 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 6] << 16;
-        *dst_addr_3 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 7] << 24;
-
-        *dst_addr_4 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET];
-        *dst_addr_4 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 1] << 8;
-        *dst_addr_4 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 2] << 16;
-        *dst_addr_4 = input->byte_stream[IXGBE_ATR_DST_IPV6_OFFSET + 3] << 24;
-
-        return 0;
-}
-
-/**
  *  ixgbe_atr_get_src_port_82599 - Gets the source port
  *  @input: input stream to modify
  *  @src_port: the source port to load
@@ -1732,19 +1598,6 @@ static s32 ixgbe_atr_get_flex_byte_82599(struct ixgbe_atr_input *input,
 }
 
 /**
- *  ixgbe_atr_get_vm_pool_82599 - Gets the Virtual Machine pool
- *  @input: input stream to modify
- *  @vm_pool: the Virtual Machine pool to load
- **/
-s32 ixgbe_atr_get_vm_pool_82599(struct ixgbe_atr_input *input,
-                                       u8 *vm_pool)
-{
-        *vm_pool = input->byte_stream[IXGBE_ATR_VM_POOL_OFFSET];
-
-        return 0;
-}
-
-/**
  *  ixgbe_atr_get_l4type_82599 - Gets the layer 4 packet type
  *  @input: input stream to modify
  *  @l4type: the layer 4 type value to load
@@ -1910,56 +1763,27 @@ s32 ixgbe_fdir_add_perfect_filter_82599(struct ixgbe_hw *hw,
                       (dst_port << IXGBE_FDIRPORT_DESTINATION_SHIFT)));
 
         /*
-         * Program the relevant mask registers.  If src/dst_port or src/dst_addr
-         * are zero, then assume a full mask for that field.  Also assume that
-         * a VLAN of 0 is unspecified, so mask that out as well.  L4type
-         * cannot be masked out in this implementation.
+         * Program the relevant mask registers.  L4type cannot be
+         * masked out in this implementation.
          *
          * This also assumes IPv4 only.  IPv6 masking isn't supported at this
          * point in time.
          */
-        if (src_ipv4 == 0)
-                IXGBE_WRITE_REG(hw, IXGBE_FDIRSIP4M, 0xffffffff);
-        else
-                IXGBE_WRITE_REG(hw, IXGBE_FDIRSIP4M, input_masks->src_ip_mask);
-
-        if (dst_ipv4 == 0)
-                IXGBE_WRITE_REG(hw, IXGBE_FDIRDIP4M, 0xffffffff);
-        else
-                IXGBE_WRITE_REG(hw, IXGBE_FDIRDIP4M, input_masks->dst_ip_mask);
+        IXGBE_WRITE_REG(hw, IXGBE_FDIRSIP4M, input_masks->src_ip_mask);
+        IXGBE_WRITE_REG(hw, IXGBE_FDIRDIP4M, input_masks->dst_ip_mask);
 
         switch (l4type & IXGBE_ATR_L4TYPE_MASK) {
         case IXGBE_ATR_L4TYPE_TCP:
-                if (src_port == 0)
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRTCPM, 0xffff);
-                else
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRTCPM,
-                                        input_masks->src_port_mask);
-
-                if (dst_port == 0)
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRTCPM,
-                                       (IXGBE_READ_REG(hw, IXGBE_FDIRTCPM) |
-                                        (0xffff << 16)));
-                else
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRTCPM,
-                                       (IXGBE_READ_REG(hw, IXGBE_FDIRTCPM) |
-                                        (input_masks->dst_port_mask << 16)));
+                IXGBE_WRITE_REG(hw, IXGBE_FDIRTCPM, input_masks->src_port_mask);
+                IXGBE_WRITE_REG(hw, IXGBE_FDIRTCPM,
+                                (IXGBE_READ_REG(hw, IXGBE_FDIRTCPM) |
+                                 (input_masks->dst_port_mask << 16)));
                 break;
         case IXGBE_ATR_L4TYPE_UDP:
-                if (src_port == 0)
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRUDPM, 0xffff);
-                else
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRUDPM,
-                                        input_masks->src_port_mask);
-
-                if (dst_port == 0)
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRUDPM,
-                                       (IXGBE_READ_REG(hw, IXGBE_FDIRUDPM) |
-                                        (0xffff << 16)));
-                else
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRUDPM,
-                                       (IXGBE_READ_REG(hw, IXGBE_FDIRUDPM) |
-                                        (input_masks->src_port_mask << 16)));
+                IXGBE_WRITE_REG(hw, IXGBE_FDIRUDPM, input_masks->src_port_mask);
+                IXGBE_WRITE_REG(hw, IXGBE_FDIRUDPM,
+                                (IXGBE_READ_REG(hw, IXGBE_FDIRUDPM) |
+                                 (input_masks->src_port_mask << 16)));
                 break;
         default:
                 /* this already would have failed above */
@@ -1967,11 +1791,11 @@ s32 ixgbe_fdir_add_perfect_filter_82599(struct ixgbe_hw *hw,
         }
 
         /* Program the last mask register, FDIRM */
-        if (input_masks->vlan_id_mask || !vlan_id)
+        if (input_masks->vlan_id_mask)
                 /* Mask both VLAN and VLANP - bits 0 and 1 */
                 fdirm |= 0x3;
 
-        if (input_masks->data_mask || !flex_bytes)
+        if (input_masks->data_mask)
                 /* Flex bytes need masking, so mask the whole thing - bit 4 */
                 fdirm |= 0x10;
 
diff --git a/drivers/net/ixgbe/ixgbe_common.c b/drivers/net/ixgbe/ixgbe_common.c
index 9595b1bfb8dd..e3eca1316389 100644
--- a/drivers/net/ixgbe/ixgbe_common.c
+++ b/drivers/net/ixgbe/ixgbe_common.c
@@ -52,6 +52,7 @@ static void ixgbe_disable_rar(struct ixgbe_hw *hw, u32 index);
 static s32 ixgbe_mta_vector(struct ixgbe_hw *hw, u8 *mc_addr);
 static void ixgbe_add_uc_addr(struct ixgbe_hw *hw, u8 *addr, u32 vmdq);
 static s32 ixgbe_setup_fc(struct ixgbe_hw *hw, s32 packetbuf_num);
+static s32 ixgbe_poll_eerd_eewr_done(struct ixgbe_hw *hw, u32 ee_reg);
 
 /**
  *  ixgbe_start_hw_generic - Prepare hardware for Tx/Rx
@@ -637,7 +638,7 @@ out:
  *  Polls the status bit (bit 1) of the EERD or EEWR to determine when the
  *  read or write is done respectively.
  **/
-s32 ixgbe_poll_eerd_eewr_done(struct ixgbe_hw *hw, u32 ee_reg)
+static s32 ixgbe_poll_eerd_eewr_done(struct ixgbe_hw *hw, u32 ee_reg)
 {
         u32 i;
         u32 reg;
@@ -2449,7 +2450,7 @@ s32 ixgbe_init_uta_tables_generic(struct ixgbe_hw *hw)
  *  return the VLVF index where this VLAN id should be placed
  *
  **/
-s32 ixgbe_find_vlvf_slot(struct ixgbe_hw *hw, u32 vlan)
+static s32 ixgbe_find_vlvf_slot(struct ixgbe_hw *hw, u32 vlan)
 {
         u32 bits = 0;
         u32 first_empty_slot = 0;
@@ -2704,48 +2705,3 @@ s32 ixgbe_check_mac_link_generic(struct ixgbe_hw *hw, ixgbe_link_speed *speed,
 
         return 0;
 }
-
-/**
- *  ixgbe_get_wwn_prefix_generic - Get alternative WWNN/WWPN prefix from
- *  the EEPROM
- *  @hw: pointer to hardware structure
- *  @wwnn_prefix: the alternative WWNN prefix
- *  @wwpn_prefix: the alternative WWPN prefix
- *
- *  This function will read the EEPROM from the alternative SAN MAC address
- *  block to check the support for the alternative WWNN/WWPN prefix support.
- **/
-s32 ixgbe_get_wwn_prefix_generic(struct ixgbe_hw *hw, u16 *wwnn_prefix,
-                                 u16 *wwpn_prefix)
-{
-        u16 offset, caps;
-        u16 alt_san_mac_blk_offset;
-
-        /* clear output first */
-        *wwnn_prefix = 0xFFFF;
-        *wwpn_prefix = 0xFFFF;
-
-        /* check if alternative SAN MAC is supported */
-        hw->eeprom.ops.read(hw, IXGBE_ALT_SAN_MAC_ADDR_BLK_PTR,
-                            &alt_san_mac_blk_offset);
-
-        if ((alt_san_mac_blk_offset == 0) ||
-            (alt_san_mac_blk_offset == 0xFFFF))
-                goto wwn_prefix_out;
-
-        /* check capability in alternative san mac address block */
-        offset = alt_san_mac_blk_offset + IXGBE_ALT_SAN_MAC_ADDR_CAPS_OFFSET;
-        hw->eeprom.ops.read(hw, offset, &caps);
-        if (!(caps & IXGBE_ALT_SAN_MAC_ADDR_CAPS_ALTWWN))
-                goto wwn_prefix_out;
-
-        /* get the corresponding prefix for WWNN/WWPN */
-        offset = alt_san_mac_blk_offset + IXGBE_ALT_SAN_MAC_ADDR_WWNN_OFFSET;
-        hw->eeprom.ops.read(hw, offset, wwnn_prefix);
-
-        offset = alt_san_mac_blk_offset + IXGBE_ALT_SAN_MAC_ADDR_WWPN_OFFSET;
-        hw->eeprom.ops.read(hw, offset, wwpn_prefix);
-
-wwn_prefix_out:
-        return 0;
-}
diff --git a/drivers/net/ixgbe/ixgbe_common.h b/drivers/net/ixgbe/ixgbe_common.h
index 5cf15aa11cac..424c223437dc 100644
--- a/drivers/net/ixgbe/ixgbe_common.h
+++ b/drivers/net/ixgbe/ixgbe_common.h
@@ -52,7 +52,6 @@ s32 ixgbe_read_eeprom_bit_bang_generic(struct ixgbe_hw *hw, u16 offset,
 s32 ixgbe_validate_eeprom_checksum_generic(struct ixgbe_hw *hw,
                                            u16 *checksum_val);
 s32 ixgbe_update_eeprom_checksum_generic(struct ixgbe_hw *hw);
-s32 ixgbe_poll_eerd_eewr_done(struct ixgbe_hw *hw, u32 ee_reg);
 
 s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq,
                           u32 enable_addr);
diff --git a/drivers/net/ixgbe/ixgbe_dcb.c b/drivers/net/ixgbe/ixgbe_dcb.c
index 9aea4f04bbd2..8bb9ddb6dffe 100644
--- a/drivers/net/ixgbe/ixgbe_dcb.c
+++ b/drivers/net/ixgbe/ixgbe_dcb.c
@@ -34,98 +34,6 @@
 #include "ixgbe_dcb_82599.h"
 
 /**
- * ixgbe_dcb_config - Struct containing DCB settings.
- * @dcb_config: Pointer to DCB config structure
- *
- * This function checks DCB rules for DCB settings.
- * The following rules are checked:
- * 1. The sum of bandwidth percentages of all Bandwidth Groups must total 100%.
- * 2. The sum of bandwidth percentages of all Traffic Classes within a Bandwidth
- *    Group must total 100.
- * 3. A Traffic Class should not be set to both Link Strict Priority
- *    and Group Strict Priority.
- * 4. Link strict Bandwidth Groups can only have link strict traffic classes
- *    with zero bandwidth.
- */
-s32 ixgbe_dcb_check_config(struct ixgbe_dcb_config *dcb_config)
-{
-        struct tc_bw_alloc *p;
-        s32 ret_val = 0;
-        u8 i, j, bw = 0, bw_id;
-        u8 bw_sum[2][MAX_BW_GROUP];
-        bool link_strict[2][MAX_BW_GROUP];
-
-        memset(bw_sum, 0, sizeof(bw_sum));
-        memset(link_strict, 0, sizeof(link_strict));
-
-        /* First Tx, then Rx */
-        for (i = 0; i < 2; i++) {
-                /* Check each traffic class for rule violation */
-                for (j = 0; j < MAX_TRAFFIC_CLASS; j++) {
-                        p = &dcb_config->tc_config[j].path[i];
-
-                        bw = p->bwg_percent;
-                        bw_id = p->bwg_id;
-
-                        if (bw_id >= MAX_BW_GROUP) {
-                                ret_val = DCB_ERR_CONFIG;
-                                goto err_config;
-                        }
-                        if (p->prio_type == prio_link) {
-                                link_strict[i][bw_id] = true;
-                                /* Link strict should have zero bandwidth */
-                                if (bw) {
-                                        ret_val = DCB_ERR_LS_BW_NONZERO;
-                                        goto err_config;
-                                }
-                        } else if (!bw) {
-                                /*
-                                 * Traffic classes without link strict
-                                 * should have non-zero bandwidth.
-                                 */
-                                ret_val = DCB_ERR_TC_BW_ZERO;
-                                goto err_config;
-                        }
-                        bw_sum[i][bw_id] += bw;
-                }
-
-                bw = 0;
-
-                /* Check each bandwidth group for rule violation */
-                for (j = 0; j < MAX_BW_GROUP; j++) {
-                        bw += dcb_config->bw_percentage[i][j];
-                        /*
-                         * Sum of bandwidth percentages of all traffic classes
-                         * within a Bandwidth Group must total 100 except for
-                         * link strict group (zero bandwidth).
-                         */
-                        if (link_strict[i][j]) {
-                                if (bw_sum[i][j]) {
-                                        /*
-                                         * Link strict group should have zero
-                                         * bandwidth.
-                                         */
-                                        ret_val = DCB_ERR_LS_BWG_NONZERO;
-                                        goto err_config;
-                                }
-                        } else if (bw_sum[i][j] != BW_PERCENT &&
-                                   bw_sum[i][j] != 0) {
-                                ret_val = DCB_ERR_TC_BW;
-                                goto err_config;
-                        }
-                }
-
-                if (bw != BW_PERCENT) {
-                        ret_val = DCB_ERR_BW_GROUP;
-                        goto err_config;
-                }
-        }
-
-err_config:
-        return ret_val;
-}
-
-/**
  * ixgbe_dcb_calculate_tc_credits - Calculates traffic class credits
  * @ixgbe_dcb_config: Struct containing DCB settings.
  * @direction: Configuring either Tx or Rx.
@@ -203,133 +111,6 @@ out:
 }
 
 /**
- * ixgbe_dcb_get_tc_stats - Returns status of each traffic class
- * @hw: pointer to hardware structure
- * @stats: pointer to statistics structure
- * @tc_count:  Number of elements in bwg_array.
- *
- * This function returns the status data for each of the Traffic Classes in use.
- */
-s32 ixgbe_dcb_get_tc_stats(struct ixgbe_hw *hw, struct ixgbe_hw_stats *stats,
-                           u8 tc_count)
-{
-        s32 ret = 0;
-        if (hw->mac.type == ixgbe_mac_82598EB)
-                ret = ixgbe_dcb_get_tc_stats_82598(hw, stats, tc_count);
-        else if (hw->mac.type == ixgbe_mac_82599EB)
-                ret = ixgbe_dcb_get_tc_stats_82599(hw, stats, tc_count);
-        return ret;
-}
-
-/**
- * ixgbe_dcb_get_pfc_stats - Returns CBFC status of each traffic class
- * hw - pointer to hardware structure
- * stats - pointer to statistics structure
- * tc_count -  Number of elements in bwg_array.
- *
- * This function returns the CBFC status data for each of the Traffic Classes.
- */
-s32 ixgbe_dcb_get_pfc_stats(struct ixgbe_hw *hw, struct ixgbe_hw_stats *stats,
-                            u8 tc_count)
-{
-        s32 ret = 0;
-        if (hw->mac.type == ixgbe_mac_82598EB)
-                ret = ixgbe_dcb_get_pfc_stats_82598(hw, stats, tc_count);
-        else if (hw->mac.type == ixgbe_mac_82599EB)
-                ret = ixgbe_dcb_get_pfc_stats_82599(hw, stats, tc_count);
-        return ret;
-}
-
-/**
- * ixgbe_dcb_config_rx_arbiter - Config Rx arbiter
- * @hw: pointer to hardware structure
- * @dcb_config: pointer to ixgbe_dcb_config structure
- *
- * Configure Rx Data Arbiter and credits for each traffic class.
- */
-s32 ixgbe_dcb_config_rx_arbiter(struct ixgbe_hw *hw,
-                                struct ixgbe_dcb_config *dcb_config)
-{
-        s32 ret = 0;
-        if (hw->mac.type == ixgbe_mac_82598EB)
-                ret = ixgbe_dcb_config_rx_arbiter_82598(hw, dcb_config);
-        else if (hw->mac.type == ixgbe_mac_82599EB)
-                ret = ixgbe_dcb_config_rx_arbiter_82599(hw, dcb_config);
-        return ret;
-}
-
-/**
- * ixgbe_dcb_config_tx_desc_arbiter - Config Tx Desc arbiter
- * @hw: pointer to hardware structure
- * @dcb_config: pointer to ixgbe_dcb_config structure
- *
- * Configure Tx Descriptor Arbiter and credits for each traffic class.
- */
-s32 ixgbe_dcb_config_tx_desc_arbiter(struct ixgbe_hw *hw,
-                                     struct ixgbe_dcb_config *dcb_config)
-{
-        s32 ret = 0;
-        if (hw->mac.type == ixgbe_mac_82598EB)
-                ret = ixgbe_dcb_config_tx_desc_arbiter_82598(hw, dcb_config);
-        else if (hw->mac.type == ixgbe_mac_82599EB)
-                ret = ixgbe_dcb_config_tx_desc_arbiter_82599(hw, dcb_config);
-        return ret;
-}
-
-/**
- * ixgbe_dcb_config_tx_data_arbiter - Config Tx data arbiter
- * @hw: pointer to hardware structure
- * @dcb_config: pointer to ixgbe_dcb_config structure
- *
- * Configure Tx Data Arbiter and credits for each traffic class.
- */
-s32 ixgbe_dcb_config_tx_data_arbiter(struct ixgbe_hw *hw,
-                                     struct ixgbe_dcb_config *dcb_config)
-{
-        s32 ret = 0;
-        if (hw->mac.type == ixgbe_mac_82598EB)
-                ret = ixgbe_dcb_config_tx_data_arbiter_82598(hw, dcb_config);
-        else if (hw->mac.type == ixgbe_mac_82599EB)
-                ret = ixgbe_dcb_config_tx_data_arbiter_82599(hw, dcb_config);
-        return ret;
-}
-
-/**
- * ixgbe_dcb_config_pfc - Config priority flow control
- * @hw: pointer to hardware structure
- * @dcb_config: pointer to ixgbe_dcb_config structure
- *
- * Configure Priority Flow Control for each traffic class.
- */
-s32 ixgbe_dcb_config_pfc(struct ixgbe_hw *hw,
-                         struct ixgbe_dcb_config *dcb_config)
-{
-        s32 ret = 0;
-        if (hw->mac.type == ixgbe_mac_82598EB)
-                ret = ixgbe_dcb_config_pfc_82598(hw, dcb_config);
-        else if (hw->mac.type == ixgbe_mac_82599EB)
-                ret = ixgbe_dcb_config_pfc_82599(hw, dcb_config);
-        return ret;
-}
-
-/**
- * ixgbe_dcb_config_tc_stats - Config traffic class statistics
- * @hw: pointer to hardware structure
- *
- * Configure queue statistics registers, all queues belonging to same traffic
- * class uses a single set of queue statistics counters.
- */
-s32 ixgbe_dcb_config_tc_stats(struct ixgbe_hw *hw)
-{
-        s32 ret = 0;
-        if (hw->mac.type == ixgbe_mac_82598EB)
-                ret = ixgbe_dcb_config_tc_stats_82598(hw);
-        else if (hw->mac.type == ixgbe_mac_82599EB)
-                ret = ixgbe_dcb_config_tc_stats_82599(hw);
-        return ret;
-}
-
-/**
  * ixgbe_dcb_hw_config - Config and enable DCB
  * @hw: pointer to hardware structure
  * @dcb_config: pointer to ixgbe_dcb_config structure
diff --git a/drivers/net/ixgbe/ixgbe_dcb.h b/drivers/net/ixgbe/ixgbe_dcb.h
index 5caafd4afbc3..eb1059f09da0 100644
--- a/drivers/net/ixgbe/ixgbe_dcb.h
+++ b/drivers/net/ixgbe/ixgbe_dcb.h
@@ -149,27 +149,9 @@ struct ixgbe_dcb_config {
 
 /* DCB driver APIs */
 
-/* DCB rule checking function.*/
-s32 ixgbe_dcb_check_config(struct ixgbe_dcb_config *config);
-
 /* DCB credits calculation */
 s32 ixgbe_dcb_calculate_tc_credits(struct ixgbe_dcb_config *, u8);
 
-/* DCB PFC functions */
-s32 ixgbe_dcb_config_pfc(struct ixgbe_hw *, struct ixgbe_dcb_config *g);
-s32 ixgbe_dcb_get_pfc_stats(struct ixgbe_hw *, struct ixgbe_hw_stats *, u8);
-
-/* DCB traffic class stats */
-s32 ixgbe_dcb_config_tc_stats(struct ixgbe_hw *);
-s32 ixgbe_dcb_get_tc_stats(struct ixgbe_hw *, struct ixgbe_hw_stats *, u8);
-
-/* DCB config arbiters */
-s32 ixgbe_dcb_config_tx_desc_arbiter(struct ixgbe_hw *,
-                                     struct ixgbe_dcb_config *);
-s32 ixgbe_dcb_config_tx_data_arbiter(struct ixgbe_hw *,
-                                     struct ixgbe_dcb_config *);
-s32 ixgbe_dcb_config_rx_arbiter(struct ixgbe_hw *, struct ixgbe_dcb_config *);
-
 /* DCB hw initialization */
 s32 ixgbe_dcb_hw_config(struct ixgbe_hw *, struct ixgbe_dcb_config *);
 
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ixgbe/ixgbe_dcb_82598.c
index f0e9279d4669..50288bcadc59 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82598.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_82598.c
@@ -32,65 +32,6 @@
 #include "ixgbe_dcb_82598.h"
 
 /**
- * ixgbe_dcb_get_tc_stats_82598 - Return status data for each traffic class
- * @hw: pointer to hardware structure
- * @stats: pointer to statistics structure
- * @tc_count:  Number of elements in bwg_array.
- *
- * This function returns the status data for each of the Traffic Classes in use.
- */
-s32 ixgbe_dcb_get_tc_stats_82598(struct ixgbe_hw *hw,
-                                 struct ixgbe_hw_stats *stats,
-                                 u8 tc_count)
-{
-        int tc;
-
-        if (tc_count > MAX_TRAFFIC_CLASS)
-                return DCB_ERR_PARAM;
-
-        /* Statistics pertaining to each traffic class */
-        for (tc = 0; tc < tc_count; tc++) {
-                /* Transmitted Packets */
-                stats->qptc[tc] += IXGBE_READ_REG(hw, IXGBE_QPTC(tc));
-                /* Transmitted Bytes */
-                stats->qbtc[tc] += IXGBE_READ_REG(hw, IXGBE_QBTC(tc));
-                /* Received Packets */
-                stats->qprc[tc] += IXGBE_READ_REG(hw, IXGBE_QPRC(tc));
-                /* Received Bytes */
-                stats->qbrc[tc] += IXGBE_READ_REG(hw, IXGBE_QBRC(tc));
-        }
-
-        return 0;
-}
-
-/**
- * ixgbe_dcb_get_pfc_stats_82598 - Returns CBFC status data
- * @hw: pointer to hardware structure
- * @stats: pointer to statistics structure
- * @tc_count:  Number of elements in bwg_array.
- *
- * This function returns the CBFC status data for each of the Traffic Classes.
- */
-s32 ixgbe_dcb_get_pfc_stats_82598(struct ixgbe_hw *hw,
-                                  struct ixgbe_hw_stats *stats,
-                                  u8 tc_count)
-{
-        int tc;
-
-        if (tc_count > MAX_TRAFFIC_CLASS)
-                return DCB_ERR_PARAM;
-
-        for (tc = 0; tc < tc_count; tc++) {
-                /* Priority XOFF Transmitted */
-                stats->pxofftxc[tc] += IXGBE_READ_REG(hw, IXGBE_PXOFFTXC(tc));
-                /* Priority XOFF Received */
-                stats->pxoffrxc[tc] += IXGBE_READ_REG(hw, IXGBE_PXOFFRXC(tc));
-        }
-
-        return 0;
-}
-
-/**
  * ixgbe_dcb_config_packet_buffers_82598 - Configure packet buffers
  * @hw: pointer to hardware structure
  * @dcb_config: pointer to ixgbe_dcb_config structure
@@ -137,7 +78,7 @@ static s32 ixgbe_dcb_config_packet_buffers_82598(struct ixgbe_hw *hw,
  *
  * Configure Rx Data Arbiter and credits for each traffic class.
  */
-s32 ixgbe_dcb_config_rx_arbiter_82598(struct ixgbe_hw *hw,
+static s32 ixgbe_dcb_config_rx_arbiter_82598(struct ixgbe_hw *hw,
                                       struct ixgbe_dcb_config *dcb_config)
 {
         struct tc_bw_alloc    *p;
@@ -194,7 +135,7 @@ s32 ixgbe_dcb_config_rx_arbiter_82598(struct ixgbe_hw *hw,
  *
  * Configure Tx Descriptor Arbiter and credits for each traffic class.
  */
-s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw,
+static s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw,
                                            struct ixgbe_dcb_config *dcb_config)
 {
         struct tc_bw_alloc *p;
@@ -242,7 +183,7 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw,
  *
  * Configure Tx Data Arbiter and credits for each traffic class.
  */
-s32 ixgbe_dcb_config_tx_data_arbiter_82598(struct ixgbe_hw *hw,
+static s32 ixgbe_dcb_config_tx_data_arbiter_82598(struct ixgbe_hw *hw,
                                            struct ixgbe_dcb_config *dcb_config)
 {
         struct tc_bw_alloc *p;
@@ -355,7 +296,7 @@ out:
  * Configure queue statistics registers, all queues belonging to same traffic
  * class uses a single set of queue statistics counters.
  */
-s32 ixgbe_dcb_config_tc_stats_82598(struct ixgbe_hw *hw)
+static s32 ixgbe_dcb_config_tc_stats_82598(struct ixgbe_hw *hw)
 {
         u32 reg = 0;
         u8  i   = 0;
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82598.h b/drivers/net/ixgbe/ixgbe_dcb_82598.h
index cc728fa092e2..abc03ccfa088 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82598.h
+++ b/drivers/net/ixgbe/ixgbe_dcb_82598.h
@@ -72,21 +72,6 @@
 
 /* DCB PFC functions */
 s32 ixgbe_dcb_config_pfc_82598(struct ixgbe_hw *, struct ixgbe_dcb_config *);
-s32 ixgbe_dcb_get_pfc_stats_82598(struct ixgbe_hw *, struct ixgbe_hw_stats *,
-                                  u8);
-
-/* DCB traffic class stats */
-s32 ixgbe_dcb_config_tc_stats_82598(struct ixgbe_hw *);
-s32 ixgbe_dcb_get_tc_stats_82598(struct ixgbe_hw *, struct ixgbe_hw_stats *,
-                                 u8);
-
-/* DCB config arbiters */
-s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *,
-                                           struct ixgbe_dcb_config *);
-s32 ixgbe_dcb_config_tx_data_arbiter_82598(struct ixgbe_hw *,
-                                           struct ixgbe_dcb_config *);
-s32 ixgbe_dcb_config_rx_arbiter_82598(struct ixgbe_hw *,
-                                      struct ixgbe_dcb_config *);
 
 /* DCB hw initialization */
 s32 ixgbe_dcb_hw_config_82598(struct ixgbe_hw *, struct ixgbe_dcb_config *);
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82599.c b/drivers/net/ixgbe/ixgbe_dcb_82599.c
index 25b02fb425ac..67c219f86c3a 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82599.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_82599.c
@@ -31,70 +31,13 @@
 #include "ixgbe_dcb_82599.h"
 
 /**
- * ixgbe_dcb_get_tc_stats_82599 - Returns status for each traffic class
- * @hw: pointer to hardware structure
- * @stats: pointer to statistics structure
- * @tc_count:  Number of elements in bwg_array.
- *
- * This function returns the status data for each of the Traffic Classes in use.
- */
-s32 ixgbe_dcb_get_tc_stats_82599(struct ixgbe_hw *hw,
-                                 struct ixgbe_hw_stats *stats,
-                                 u8 tc_count)
-{
-        int tc;
-
-        if (tc_count > MAX_TRAFFIC_CLASS)
-                return DCB_ERR_PARAM;
-        /* Statistics pertaining to each traffic class */
-        for (tc = 0; tc < tc_count; tc++) {
-                /* Transmitted Packets */
-                stats->qptc[tc] += IXGBE_READ_REG(hw, IXGBE_QPTC(tc));
-                /* Transmitted Bytes */
-                stats->qbtc[tc] += IXGBE_READ_REG(hw, IXGBE_QBTC(tc));
-                /* Received Packets */
-                stats->qprc[tc] += IXGBE_READ_REG(hw, IXGBE_QPRC(tc));
-                /* Received Bytes */
-                stats->qbrc[tc] += IXGBE_READ_REG(hw, IXGBE_QBRC(tc));
-        }
-
-        return 0;
-}
-
-/**
- * ixgbe_dcb_get_pfc_stats_82599 - Return CBFC status data
- * @hw: pointer to hardware structure
- * @stats: pointer to statistics structure
- * @tc_count:  Number of elements in bwg_array.
- *
- * This function returns the CBFC status data for each of the Traffic Classes.
- */
-s32 ixgbe_dcb_get_pfc_stats_82599(struct ixgbe_hw *hw,
-                                  struct ixgbe_hw_stats *stats,
-                                  u8 tc_count)
-{
-        int tc;
-
-        if (tc_count > MAX_TRAFFIC_CLASS)
-                return DCB_ERR_PARAM;
-        for (tc = 0; tc < tc_count; tc++) {
-                /* Priority XOFF Transmitted */
-                stats->pxofftxc[tc] += IXGBE_READ_REG(hw, IXGBE_PXOFFTXC(tc));
-                /* Priority XOFF Received */
-                stats->pxoffrxc[tc] += IXGBE_READ_REG(hw, IXGBE_PXOFFRXCNT(tc));
-        }
-
-        return 0;
-}
-
-/**
  * ixgbe_dcb_config_packet_buffers_82599 - Configure DCB packet buffers
  * @hw: pointer to hardware structure
  * @dcb_config: pointer to ixgbe_dcb_config structure
  *
  * Configure packet buffers for DCB mode.
  */
-s32 ixgbe_dcb_config_packet_buffers_82599(struct ixgbe_hw *hw,
+static s32 ixgbe_dcb_config_packet_buffers_82599(struct ixgbe_hw *hw,
                                           struct ixgbe_dcb_config *dcb_config)
 {
         s32 ret_val = 0;
@@ -136,7 +79,7 @@ s32 ixgbe_dcb_config_packet_buffers_82599(struct ixgbe_hw *hw,
  *
  * Configure Rx Packet Arbiter and credits for each traffic class.
  */
-s32 ixgbe_dcb_config_rx_arbiter_82599(struct ixgbe_hw *hw,
+static s32 ixgbe_dcb_config_rx_arbiter_82599(struct ixgbe_hw *hw,
                                       struct ixgbe_dcb_config *dcb_config)
 {
         struct tc_bw_alloc    *p;
@@ -191,7 +134,7 @@ s32 ixgbe_dcb_config_rx_arbiter_82599(struct ixgbe_hw *hw,
  *
  * Configure Tx Descriptor Arbiter and credits for each traffic class.
  */
-s32 ixgbe_dcb_config_tx_desc_arbiter_82599(struct ixgbe_hw *hw,
+static s32 ixgbe_dcb_config_tx_desc_arbiter_82599(struct ixgbe_hw *hw,
                                            struct ixgbe_dcb_config *dcb_config)
 {
         struct tc_bw_alloc *p;
@@ -238,7 +181,7 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_82599(struct ixgbe_hw *hw,
  *
  * Configure Tx Packet Arbiter and credits for each traffic class.
  */
-s32 ixgbe_dcb_config_tx_data_arbiter_82599(struct ixgbe_hw *hw,
+static s32 ixgbe_dcb_config_tx_data_arbiter_82599(struct ixgbe_hw *hw,
                                            struct ixgbe_dcb_config *dcb_config)
 {
         struct tc_bw_alloc *p;
@@ -359,7 +302,7 @@ out:
  * Configure queue statistics registers, all queues belonging to same traffic
  * class uses a single set of queue statistics counters.
  */
-s32 ixgbe_dcb_config_tc_stats_82599(struct ixgbe_hw *hw)
+static s32 ixgbe_dcb_config_tc_stats_82599(struct ixgbe_hw *hw)
 {
         u32 reg = 0;
         u8  i   = 0;
@@ -412,7 +355,7 @@ s32 ixgbe_dcb_config_tc_stats_82599(struct ixgbe_hw *hw)
  *
  * Configure general DCB parameters.
  */
-s32 ixgbe_dcb_config_82599(struct ixgbe_hw *hw)
+static s32 ixgbe_dcb_config_82599(struct ixgbe_hw *hw)
 {
         u32 reg;
         u32 q;
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82599.h b/drivers/net/ixgbe/ixgbe_dcb_82599.h
index 0f3f791e1e1d..18d7fbf6c292 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82599.h
+++ b/drivers/net/ixgbe/ixgbe_dcb_82599.h
@@ -101,24 +101,6 @@
 /* DCB PFC functions */
 s32 ixgbe_dcb_config_pfc_82599(struct ixgbe_hw *hw,
                                struct ixgbe_dcb_config *dcb_config);
-s32 ixgbe_dcb_get_pfc_stats_82599(struct ixgbe_hw *hw,
-                                  struct ixgbe_hw_stats *stats,
-                                  u8 tc_count);
-
-/* DCB traffic class stats */
-s32 ixgbe_dcb_config_tc_stats_82599(struct ixgbe_hw *hw);
-s32 ixgbe_dcb_get_tc_stats_82599(struct ixgbe_hw *hw,
-                                 struct ixgbe_hw_stats *stats,
-                                 u8 tc_count);
-
-/* DCB config arbiters */
-s32 ixgbe_dcb_config_tx_desc_arbiter_82599(struct ixgbe_hw *hw,
-                                           struct ixgbe_dcb_config *dcb_config);
-s32 ixgbe_dcb_config_tx_data_arbiter_82599(struct ixgbe_hw *hw,
-                                           struct ixgbe_dcb_config *dcb_config);
-s32 ixgbe_dcb_config_rx_arbiter_82599(struct ixgbe_hw *hw,
-                                      struct ixgbe_dcb_config *dcb_config);
-
 
 /* DCB hw initialization */
 s32 ixgbe_dcb_hw_config_82599(struct ixgbe_hw *hw,
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 25ef8b197373..3dc731c22ff2 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -401,7 +401,7 @@ static int ixgbe_set_pauseparam(struct net_device *netdev,
 static u32 ixgbe_get_rx_csum(struct net_device *netdev)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
-        return (adapter->flags & IXGBE_FLAG_RX_CSUM_ENABLED);
+        return adapter->flags & IXGBE_FLAG_RX_CSUM_ENABLED;
 }
 
 static int ixgbe_set_rx_csum(struct net_device *netdev, u32 data)
@@ -988,8 +988,8 @@ static int ixgbe_get_sset_count(struct net_device *netdev, int sset)
         case ETH_SS_STATS:
                 return IXGBE_STATS_LEN;
         case ETH_SS_NTUPLE_FILTERS:
-                return (ETHTOOL_MAX_NTUPLE_LIST_ENTRY *
-                        ETHTOOL_MAX_NTUPLE_STRING_PER_ENTRY);
+                return ETHTOOL_MAX_NTUPLE_LIST_ENTRY *
+                       ETHTOOL_MAX_NTUPLE_STRING_PER_ENTRY;
         default:
                 return -EOPNOTSUPP;
         }
@@ -999,12 +999,11 @@ static void ixgbe_get_ethtool_stats(struct net_device *netdev,
                                     struct ethtool_stats *stats, u64 *data)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
-        u64 *queue_stat;
-        int stat_count = sizeof(struct ixgbe_queue_stats) / sizeof(u64);
         struct rtnl_link_stats64 temp;
         const struct rtnl_link_stats64 *net_stats;
-        int j, k;
-        int i;
+        unsigned int start;
+        struct ixgbe_ring *ring;
+        int i, j;
         char *p = NULL;
 
         ixgbe_update_stats(adapter);
@@ -1025,16 +1024,22 @@ static void ixgbe_get_ethtool_stats(struct net_device *netdev,
                            sizeof(u64)) ? *(u64 *)p : *(u32 *)p;
         }
         for (j = 0; j < adapter->num_tx_queues; j++) {
-                queue_stat = (u64 *)&adapter->tx_ring[j]->stats;
-                for (k = 0; k < stat_count; k++)
-                        data[i + k] = queue_stat[k];
-                i += k;
+                ring = adapter->tx_ring[j];
+                do {
+                        start = u64_stats_fetch_begin_bh(&ring->syncp);
+                        data[i]   = ring->stats.packets;
+                        data[i+1] = ring->stats.bytes;
+                } while (u64_stats_fetch_retry_bh(&ring->syncp, start));
+                i += 2;
         }
         for (j = 0; j < adapter->num_rx_queues; j++) {
-                queue_stat = (u64 *)&adapter->rx_ring[j]->stats;
-                for (k = 0; k < stat_count; k++)
-                        data[i + k] = queue_stat[k];
-                i += k;
+                ring = adapter->rx_ring[j];
+                do {
+                        start = u64_stats_fetch_begin_bh(&ring->syncp);
+                        data[i]   = ring->stats.packets;
+                        data[i+1] = ring->stats.bytes;
+                } while (u64_stats_fetch_retry_bh(&ring->syncp, start));
+                i += 2;
         }
         if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
                 for (j = 0; j < MAX_TX_PACKET_BUFFERS; j++) {
@@ -2113,7 +2118,17 @@ static int ixgbe_set_flags(struct net_device *netdev, u32 data)
         bool need_reset = false;
         int rc;
 
-        rc = ethtool_op_set_flags(netdev, data, ETH_FLAG_LRO | ETH_FLAG_NTUPLE);
+#ifdef CONFIG_IXGBE_DCB
+        if ((adapter->flags & IXGBE_FLAG_DCB_ENABLED) &&
+            !(data & ETH_FLAG_RXVLAN))
+                return -EINVAL;
+#endif
+
+        need_reset = (data & ETH_FLAG_RXVLAN) !=
+                     (netdev->features & NETIF_F_HW_VLAN_RX);
+
+        rc = ethtool_op_set_flags(netdev, data, ETH_FLAG_LRO |
+                                        ETH_FLAG_RXVLAN | ETH_FLAG_TXVLAN);
         if (rc)
                 return rc;
 
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index 2f1de8b90f9e..05efa6a8ce8e 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -604,11 +604,13 @@ int ixgbe_fcoe_enable(struct net_device *netdev)
 {
         int rc = -EINVAL;
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_fcoe *fcoe = &adapter->fcoe;
 
 
         if (!(adapter->flags & IXGBE_FLAG_FCOE_CAPABLE))
                 goto out_enable;
 
+        atomic_inc(&fcoe->refcnt);
         if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED)
                 goto out_enable;
 
@@ -648,6 +650,7 @@ int ixgbe_fcoe_disable(struct net_device *netdev)
 {
         int rc = -EINVAL;
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_fcoe *fcoe = &adapter->fcoe;
 
         if (!(adapter->flags & IXGBE_FLAG_FCOE_CAPABLE))
                 goto out_disable;
@@ -655,6 +658,9 @@ int ixgbe_fcoe_disable(struct net_device *netdev)
         if (!(adapter->flags & IXGBE_FLAG_FCOE_ENABLED))
                 goto out_disable;
 
+        if (!atomic_dec_and_test(&fcoe->refcnt))
+                goto out_disable;
+
         e_info(drv, "Disabling FCoE offload features.\n");
         netdev->features &= ~NETIF_F_FCOE_CRC;
         netdev->features &= ~NETIF_F_FSO;
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.h b/drivers/net/ixgbe/ixgbe_fcoe.h
index abf4b2b3f252..4bc2c551c8db 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.h
+++ b/drivers/net/ixgbe/ixgbe_fcoe.h
@@ -66,6 +66,7 @@ struct ixgbe_fcoe {
         u8 tc;
         u8 up;
 #endif
+        atomic_t refcnt;
         spinlock_t lock;
         struct pci_pool *pool;
         struct ixgbe_fcoe_ddp ddp[IXGBE_FCOE_DDP_MAX];
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index d03eef96c0ba..f85631263af8 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -824,9 +824,11 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
 
         tx_ring->total_bytes += total_bytes;
         tx_ring->total_packets += total_packets;
+        u64_stats_update_begin(&tx_ring->syncp);
         tx_ring->stats.packets += total_packets;
         tx_ring->stats.bytes += total_bytes;
-        return (count < tx_ring->work_limit);
+        u64_stats_update_end(&tx_ring->syncp);
+        return count < tx_ring->work_limit;
 }
 
 #ifdef CONFIG_IXGBE_DCA
@@ -954,17 +956,13 @@ static void ixgbe_receive_skb(struct ixgbe_q_vector *q_vector,
         bool is_vlan = (status & IXGBE_RXD_STAT_VP);
         u16 tag = le16_to_cpu(rx_desc->wb.upper.vlan);
 
-        if (!(adapter->flags & IXGBE_FLAG_IN_NETPOLL)) {
-                if (adapter->vlgrp && is_vlan && (tag & VLAN_VID_MASK))
-                        vlan_gro_receive(napi, adapter->vlgrp, tag, skb);
-                else
-                        napi_gro_receive(napi, skb);
-        } else {
-                if (adapter->vlgrp && is_vlan && (tag & VLAN_VID_MASK))
-                        vlan_hwaccel_rx(skb, adapter->vlgrp, tag);
-                else
-                        netif_rx(skb);
-        }
+        if (is_vlan && (tag & VLAN_VID_MASK))
+                __vlan_hwaccel_put_tag(skb, tag);
+
+        if (!(adapter->flags & IXGBE_FLAG_IN_NETPOLL))
+                napi_gro_receive(napi, skb);
+        else
+                netif_rx(skb);
 }
 
 /**
@@ -1172,7 +1170,6 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                                int *work_done, int work_to_do)
 {
         struct ixgbe_adapter *adapter = q_vector->adapter;
-        struct net_device *netdev = adapter->netdev;
         struct pci_dev *pdev = adapter->pdev;
         union ixgbe_adv_rx_desc *rx_desc, *next_rxd;
         struct ixgbe_rx_buffer *rx_buffer_info, *next_buffer;
@@ -1298,8 +1295,10 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                                         rx_ring->rsc_count++;
                                 rx_ring->rsc_flush++;
                         }
+                        u64_stats_update_begin(&rx_ring->syncp);
                         rx_ring->stats.packets++;
                         rx_ring->stats.bytes += skb->len;
+                        u64_stats_update_end(&rx_ring->syncp);
                 } else {
                         if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                                 rx_buffer_info->skb = next_buffer->skb;
@@ -1375,8 +1374,6 @@ next_desc:
 
         rx_ring->total_packets += total_rx_packets;
         rx_ring->total_bytes += total_rx_bytes;
-        netdev->stats.rx_bytes += total_rx_bytes;
-        netdev->stats.rx_packets += total_rx_packets;
 
         return cleaned;
 }
@@ -1433,6 +1430,21 @@ static void ixgbe_configure_msix(struct ixgbe_adapter *adapter)
                         q_vector->eitr = adapter->rx_eitr_param;
 
                 ixgbe_write_eitr(q_vector);
+                /* If Flow Director is enabled, set interrupt affinity */
+                if ((adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE) ||
+                    (adapter->flags & IXGBE_FLAG_FDIR_PERFECT_CAPABLE)) {
+                        /*
+                         * Allocate the affinity_hint cpumask, assign the mask
+                         * for this vector, and set our affinity_hint for
+                         * this irq.
+                         */
+                        if (!alloc_cpumask_var(&q_vector->affinity_mask,
+                                               GFP_KERNEL))
+                                return;
+                        cpumask_set_cpu(v_idx, q_vector->affinity_mask);
+                        irq_set_affinity_hint(adapter->msix_entries[v_idx].vector,
+                                              q_vector->affinity_mask);
+                }
         }
 
         if (adapter->hw.mac.type == ixgbe_mac_82598EB)
@@ -2233,7 +2245,8 @@ static void ixgbe_set_itr(struct ixgbe_adapter *adapter)
  * ixgbe_irq_enable - Enable default interrupt generation settings
  * @adapter: board private structure
  **/
-static inline void ixgbe_irq_enable(struct ixgbe_adapter *adapter)
+static inline void ixgbe_irq_enable(struct ixgbe_adapter *adapter, bool queues,
+                                    bool flush)
 {
         u32 mask;
 
@@ -2254,8 +2267,10 @@ static inline void ixgbe_irq_enable(struct ixgbe_adapter *adapter)
                 mask |= IXGBE_EIMS_FLOW_DIR;
 
         IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMS, mask);
-        ixgbe_irq_enable_queues(adapter, ~0);
-        IXGBE_WRITE_FLUSH(&adapter->hw);
+        if (queues)
+                ixgbe_irq_enable_queues(adapter, ~0);
+        if (flush)
+                IXGBE_WRITE_FLUSH(&adapter->hw);
 
         if (adapter->num_vfs > 32) {
                 u32 eitrsel = (1 << (adapter->num_vfs - 32)) - 1;
@@ -2277,7 +2292,7 @@ static irqreturn_t ixgbe_intr(int irq, void *data)
         u32 eicr;
 
         /*
-         * Workaround for silicon errata.  Mask the interrupts
+         * Workaround for silicon errata on 82598.  Mask the interrupts
          * before the read of EICR.
          */
         IXGBE_WRITE_REG(hw, IXGBE_EIMC, IXGBE_IRQ_CLEAR_MASK);
@@ -2286,10 +2301,15 @@ static irqreturn_t ixgbe_intr(int irq, void *data)
          * therefore no explict interrupt disable is necessary */
         eicr = IXGBE_READ_REG(hw, IXGBE_EICR);
         if (!eicr) {
-                /* shared interrupt alert!
+                /*
+                 * shared interrupt alert!
                  * make sure interrupts are enabled because the read will
-                 * have disabled interrupts due to EIAM */
-                ixgbe_irq_enable(adapter);
+                 * have disabled interrupts due to EIAM
+                 * finish the workaround of silicon errata on 82598.  Unmask
+                 * the interrupt that we masked before the EICR read.
+                 */
+                if (!test_bit(__IXGBE_DOWN, &adapter->state))
+                        ixgbe_irq_enable(adapter, true, true);
                 return IRQ_NONE;        /* Not our interrupt */
         }
 
@@ -2313,6 +2333,14 @@ static irqreturn_t ixgbe_intr(int irq, void *data)
                 __napi_schedule(&(q_vector->napi));
         }
 
+        /*
+         * re-enable link(maybe) and non-queue interrupts, no flush.
+         * ixgbe_poll will re-enable the queue interrupts
+         */
+
+        if (!test_bit(__IXGBE_DOWN, &adapter->state))
+                ixgbe_irq_enable(adapter, false, false);
+
         return IRQ_HANDLED;
 }
 
@@ -3034,6 +3062,7 @@ static void ixgbe_vlan_rx_add_vid(struct net_device *netdev, u16 vid)
 
         /* add VID to filter table */
         hw->mac.ops.set_vfta(&adapter->hw, vid, pool_ndx, true);
+        set_bit(vid, adapter->active_vlans);
 }
 
 static void ixgbe_vlan_rx_kill_vid(struct net_device *netdev, u16 vid)
@@ -3042,16 +3071,9 @@ static void ixgbe_vlan_rx_kill_vid(struct net_device *netdev, u16 vid)
         struct ixgbe_hw *hw = &adapter->hw;
         int pool_ndx = adapter->num_vfs;
 
-        if (!test_bit(__IXGBE_DOWN, &adapter->state))
-                ixgbe_irq_disable(adapter);
-
-        vlan_group_set_device(adapter->vlgrp, vid, NULL);
-
-        if (!test_bit(__IXGBE_DOWN, &adapter->state))
-                ixgbe_irq_enable(adapter);
-
         /* remove VID from filter table */
         hw->mac.ops.set_vfta(&adapter->hw, vid, pool_ndx, false);
+        clear_bit(vid, adapter->active_vlans);
 }
 
 /**
@@ -3061,27 +3083,45 @@ static void ixgbe_vlan_rx_kill_vid(struct net_device *netdev, u16 vid)
 static void ixgbe_vlan_filter_disable(struct ixgbe_adapter *adapter)
 {
         struct ixgbe_hw *hw = &adapter->hw;
-        u32 vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+        u32 vlnctrl;
+
+        vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+        vlnctrl &= ~(IXGBE_VLNCTRL_VFE | IXGBE_VLNCTRL_CFIEN);
+        IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
+}
+
+/**
+ * ixgbe_vlan_filter_enable - helper to enable hw vlan filtering
+ * @adapter: driver data
+ */
+static void ixgbe_vlan_filter_enable(struct ixgbe_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        u32 vlnctrl;
+
+        vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+        vlnctrl |= IXGBE_VLNCTRL_VFE;
+        vlnctrl &= ~IXGBE_VLNCTRL_CFIEN;
+        IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
+}
+
+/**
+ * ixgbe_vlan_strip_disable - helper to disable hw vlan stripping
+ * @adapter: driver data
+ */
+static void ixgbe_vlan_strip_disable(struct ixgbe_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        u32 vlnctrl;
         int i, j;
 
         switch (hw->mac.type) {
         case ixgbe_mac_82598EB:
-                vlnctrl &= ~IXGBE_VLNCTRL_VFE;
-#ifdef CONFIG_IXGBE_DCB
-                if (!(adapter->flags & IXGBE_FLAG_DCB_ENABLED))
-                        vlnctrl &= ~IXGBE_VLNCTRL_VME;
-#endif
-                vlnctrl &= ~IXGBE_VLNCTRL_CFIEN;
+                vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+                vlnctrl &= ~IXGBE_VLNCTRL_VME;
                 IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
                 break;
         case ixgbe_mac_82599EB:
-                vlnctrl &= ~IXGBE_VLNCTRL_VFE;
-                vlnctrl &= ~IXGBE_VLNCTRL_CFIEN;
-                IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
-#ifdef CONFIG_IXGBE_DCB
-                if (adapter->flags & IXGBE_FLAG_DCB_ENABLED)
-                        break;
-#endif
                 for (i = 0; i < adapter->num_rx_queues; i++) {
                         j = adapter->rx_ring[i]->reg_idx;
                         vlnctrl = IXGBE_READ_REG(hw, IXGBE_RXDCTL(j));
@@ -3095,25 +3135,22 @@ static void ixgbe_vlan_filter_disable(struct ixgbe_adapter *adapter)
 }
 
 /**
- * ixgbe_vlan_filter_enable - helper to enable hw vlan filtering
+ * ixgbe_vlan_strip_enable - helper to enable hw vlan stripping
  * @adapter: driver data
  */
-static void ixgbe_vlan_filter_enable(struct ixgbe_adapter *adapter)
+static void ixgbe_vlan_strip_enable(struct ixgbe_adapter *adapter)
 {
         struct ixgbe_hw *hw = &adapter->hw;
-        u32 vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+        u32 vlnctrl;
         int i, j;
 
         switch (hw->mac.type) {
         case ixgbe_mac_82598EB:
-                vlnctrl |= IXGBE_VLNCTRL_VME | IXGBE_VLNCTRL_VFE;
-                vlnctrl &= ~IXGBE_VLNCTRL_CFIEN;
+                vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+                vlnctrl |= IXGBE_VLNCTRL_VME;
                 IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
                 break;
         case ixgbe_mac_82599EB:
-                vlnctrl |= IXGBE_VLNCTRL_VFE;
-                vlnctrl &= ~IXGBE_VLNCTRL_CFIEN;
-                IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
                 for (i = 0; i < adapter->num_rx_queues; i++) {
                         j = adapter->rx_ring[i]->reg_idx;
                         vlnctrl = IXGBE_READ_REG(hw, IXGBE_RXDCTL(j));
@@ -3126,40 +3163,14 @@ static void ixgbe_vlan_filter_enable(struct ixgbe_adapter *adapter)
         }
 }
 
-static void ixgbe_vlan_rx_register(struct net_device *netdev,
-                                   struct vlan_group *grp)
-{
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
-
-        if (!test_bit(__IXGBE_DOWN, &adapter->state))
-                ixgbe_irq_disable(adapter);
-        adapter->vlgrp = grp;
-
-        /*
-         * For a DCB driver, always enable VLAN tag stripping so we can
-         * still receive traffic from a DCB-enabled host even if we're
-         * not in DCB mode.
-         */
-        ixgbe_vlan_filter_enable(adapter);
-
-        ixgbe_vlan_rx_add_vid(netdev, 0);
-
-        if (!test_bit(__IXGBE_DOWN, &adapter->state))
-                ixgbe_irq_enable(adapter);
-}
-
 static void ixgbe_restore_vlan(struct ixgbe_adapter *adapter)
 {
-        ixgbe_vlan_rx_register(adapter->netdev, adapter->vlgrp);
+        u16 vid;
 
-        if (adapter->vlgrp) {
-                u16 vid;
-                for (vid = 0; vid < VLAN_GROUP_ARRAY_LEN; vid++) {
-                        if (!vlan_group_get_device(adapter->vlgrp, vid))
-                                continue;
-                        ixgbe_vlan_rx_add_vid(adapter->netdev, vid);
-                }
-        }
+        ixgbe_vlan_rx_add_vid(adapter->netdev, 0);
+
+        for_each_set_bit(vid, adapter->active_vlans, VLAN_N_VID)
+                ixgbe_vlan_rx_add_vid(adapter->netdev, vid);
 }
 
 /**
@@ -3274,6 +3285,11 @@ void ixgbe_set_rx_mode(struct net_device *netdev)
         }
 
         IXGBE_WRITE_REG(hw, IXGBE_FCTRL, fctrl);
+
+        if (netdev->features & NETIF_F_HW_VLAN_RX)
+                ixgbe_vlan_strip_enable(adapter);
+        else
+                ixgbe_vlan_strip_disable(adapter);
 }
 
 static void ixgbe_napi_enable_all(struct ixgbe_adapter *adapter)
@@ -3343,7 +3359,6 @@ static void ixgbe_configure_dcb(struct ixgbe_adapter *adapter)
         if (hw->mac.type == ixgbe_mac_82598EB)
                 netif_set_gso_max_size(adapter->netdev, 32768);
 
-        ixgbe_dcb_check_config(&adapter->dcb_cfg);
         ixgbe_dcb_calculate_tc_credits(&adapter->dcb_cfg, DCB_TX_CONFIG);
         ixgbe_dcb_calculate_tc_credits(&adapter->dcb_cfg, DCB_RX_CONFIG);
 
@@ -3358,7 +3373,7 @@ static void ixgbe_configure_dcb(struct ixgbe_adapter *adapter)
                 IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(j), txdctl);
         }
         /* Enable VLAN tag insert/strip */
-        ixgbe_vlan_filter_enable(adapter);
+        adapter->netdev->features |= NETIF_F_HW_VLAN_RX;
 
         hw->mac.ops.set_vfta(&adapter->hw, 0, 0, true);
 }
@@ -3370,13 +3385,13 @@ static void ixgbe_configure(struct ixgbe_adapter *adapter)
         struct ixgbe_hw *hw = &adapter->hw;
         int i;
 
-        ixgbe_set_rx_mode(netdev);
-
-        ixgbe_restore_vlan(adapter);
 #ifdef CONFIG_IXGBE_DCB
         ixgbe_configure_dcb(adapter);
 #endif
 
+        ixgbe_set_rx_mode(netdev);
+        ixgbe_restore_vlan(adapter);
+
 #ifdef IXGBE_FCOE
         if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED)
                 ixgbe_configure_fcoe(adapter);
@@ -3546,7 +3561,7 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
 
         /* clear any pending interrupts, may auto mask */
         IXGBE_READ_REG(hw, IXGBE_EICR);
-        ixgbe_irq_enable(adapter);
+        ixgbe_irq_enable(adapter, true, true);
 
         /*
          * If this adapter has a fan, check to see if we had a failure
@@ -3800,6 +3815,7 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
         u32 rxctrl;
         u32 txdctl;
         int i, j;
+        int num_q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
 
         /* signal that we are down to the interrupt handler */
         set_bit(__IXGBE_DOWN, &adapter->state);
@@ -3838,6 +3854,15 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
 
         ixgbe_napi_disable_all(adapter);
 
+        /* Cleanup the affinity_hint CPU mask memory and callback */
+        for (i = 0; i < num_q_vectors; i++) {
+                struct ixgbe_q_vector *q_vector = adapter->q_vector[i];
+                /* clear the affinity_mask in the IRQ descriptor */
+                irq_set_affinity_hint(adapter->msix_entries[i]. vector, NULL);
+                /* release the CPU mask memory */
+                free_cpumask_var(q_vector->affinity_mask);
+        }
+
         if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE ||
             adapter->flags & IXGBE_FLAG_FDIR_PERFECT_CAPABLE)
                 cancel_work_sync(&adapter->fdir_reinit_task);
@@ -4088,7 +4113,7 @@ static inline bool ixgbe_set_sriov_queues(struct ixgbe_adapter *adapter)
  * fallthrough conditions.
  *
  **/
-static void ixgbe_set_num_queues(struct ixgbe_adapter *adapter)
+static int ixgbe_set_num_queues(struct ixgbe_adapter *adapter)
 {
         /* Start with base case */
         adapter->num_rx_queues = 1;
@@ -4097,7 +4122,7 @@ static void ixgbe_set_num_queues(struct ixgbe_adapter *adapter)
         adapter->num_rx_queues_per_pool = 1;
 
         if (ixgbe_set_sriov_queues(adapter))
-                return;
+                goto done;
 
 #ifdef IXGBE_FCOE
         if (ixgbe_set_fcoe_queues(adapter))
@@ -4120,8 +4145,10 @@ static void ixgbe_set_num_queues(struct ixgbe_adapter *adapter)
         adapter->num_tx_queues = 1;
 
 done:
-        /* Notify the stack of the (possibly) reduced Tx Queue count. */
+        /* Notify the stack of the (possibly) reduced queue counts. */
         netif_set_real_num_tx_queues(adapter->netdev, adapter->num_tx_queues);
+        return netif_set_real_num_rx_queues(adapter->netdev,
+                                            adapter->num_rx_queues);
 }
 
 static void ixgbe_acquire_msix_vectors(struct ixgbe_adapter *adapter,
@@ -4550,7 +4577,9 @@ static int ixgbe_set_interrupt_capability(struct ixgbe_adapter *adapter)
         if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED)
                 ixgbe_disable_sriov(adapter);
 
-        ixgbe_set_num_queues(adapter);
+        err = ixgbe_set_num_queues(adapter);
+        if (err)
+                return err;
 
         err = pci_enable_msi(adapter->pdev);
         if (!err) {
@@ -4675,7 +4704,9 @@ int ixgbe_init_interrupt_scheme(struct ixgbe_adapter *adapter)
         int err;
 
         /* Number of supported queues */
-        ixgbe_set_num_queues(adapter);
+        err = ixgbe_set_num_queues(adapter);
+        if (err)
+                return err;
 
         err = ixgbe_set_interrupt_capability(adapter);
         if (err) {
@@ -6265,7 +6296,7 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, struct net_device *netdev
         int count = 0;
         unsigned int f;
 
-        if (adapter->vlgrp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 tx_flags |= vlan_tx_tag_get(skb);
                 if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
                         tx_flags &= ~IXGBE_TX_FLAGS_VLAN_PRIO_MASK;
@@ -6512,6 +6543,38 @@ static void ixgbe_netpoll(struct net_device *netdev)
 }
 #endif
 
+static struct rtnl_link_stats64 *ixgbe_get_stats64(struct net_device *netdev,
+                                                   struct rtnl_link_stats64 *stats)
+{
+        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        int i;
+
+        /* accurate rx/tx bytes/packets stats */
+        dev_txq_stats_fold(netdev, stats);
+        for (i = 0; i < adapter->num_rx_queues; i++) {
+                struct ixgbe_ring *ring = adapter->rx_ring[i];
+                u64 bytes, packets;
+                unsigned int start;
+
+                do {
+                        start = u64_stats_fetch_begin_bh(&ring->syncp);
+                        packets = ring->stats.packets;
+                        bytes   = ring->stats.bytes;
+                } while (u64_stats_fetch_retry_bh(&ring->syncp, start));
+                stats->rx_packets += packets;
+                stats->rx_bytes   += bytes;
+        }
+
+        /* following stats updated by ixgbe_watchdog_task() */
+        stats->multicast        = netdev->stats.multicast;
+        stats->rx_errors        = netdev->stats.rx_errors;
+        stats->rx_length_errors = netdev->stats.rx_length_errors;
+        stats->rx_crc_errors    = netdev->stats.rx_crc_errors;
+        stats->rx_missed_errors = netdev->stats.rx_missed_errors;
+        return stats;
+}
+
+
 static const struct net_device_ops ixgbe_netdev_ops = {
         .ndo_open               = ixgbe_open,
         .ndo_stop               = ixgbe_close,
@@ -6523,7 +6586,6 @@ static const struct net_device_ops ixgbe_netdev_ops = {
         .ndo_set_mac_address    = ixgbe_set_mac,
         .ndo_change_mtu         = ixgbe_change_mtu,
         .ndo_tx_timeout         = ixgbe_tx_timeout,
-        .ndo_vlan_rx_register   = ixgbe_vlan_rx_register,
         .ndo_vlan_rx_add_vid    = ixgbe_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = ixgbe_vlan_rx_kill_vid,
         .ndo_do_ioctl           = ixgbe_ioctl,
@@ -6531,6 +6593,7 @@ static const struct net_device_ops ixgbe_netdev_ops = {
         .ndo_set_vf_vlan        = ixgbe_ndo_set_vf_vlan,
         .ndo_set_vf_tx_rate     = ixgbe_ndo_set_vf_bw,
         .ndo_get_vf_config      = ixgbe_ndo_get_vf_config,
+        .ndo_get_stats64        = ixgbe_get_stats64,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = ixgbe_netpoll,
 #endif
@@ -6842,8 +6905,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 netdev->vlan_features |= NETIF_F_FCOE_MTU;
         }
 #endif /* IXGBE_FCOE */
-        if (pci_using_dac)
+        if (pci_using_dac) {
                 netdev->features |= NETIF_F_HIGHDMA;
+                netdev->vlan_features |= NETIF_F_HIGHDMA;
+        }
 
         if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
                 netdev->features |= NETIF_F_LRO;
diff --git a/drivers/net/ixgbe/ixgbe_mbx.c b/drivers/net/ixgbe/ixgbe_mbx.c
index d75f9148eb1f..471f0f2cdb98 100644
--- a/drivers/net/ixgbe/ixgbe_mbx.c
+++ b/drivers/net/ixgbe/ixgbe_mbx.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -200,7 +200,8 @@ out:
  *  returns SUCCESS if it successfully received a message notification and
  *  copied it into the receive buffer.
  **/
-s32 ixgbe_read_posted_mbx(struct ixgbe_hw *hw, u32 *msg, u16 size, u16 mbx_id)
+static s32 ixgbe_read_posted_mbx(struct ixgbe_hw *hw, u32 *msg, u16 size,
+                                 u16 mbx_id)
 {
         struct ixgbe_mbx_info *mbx = &hw->mbx;
         s32 ret_val = IXGBE_ERR_MBX;
@@ -227,7 +228,7 @@ out:
  *  returns SUCCESS if it successfully copied message into the buffer and
  *  received an ack to that message within delay * timeout period
  **/
-s32 ixgbe_write_posted_mbx(struct ixgbe_hw *hw, u32 *msg, u16 size,
+static s32 ixgbe_write_posted_mbx(struct ixgbe_hw *hw, u32 *msg, u16 size,
                            u16 mbx_id)
 {
         struct ixgbe_mbx_info *mbx = &hw->mbx;
@@ -247,20 +248,6 @@ out:
         return ret_val;
 }
 
-/**
- *  ixgbe_init_mbx_ops_generic - Initialize MB function pointers
- *  @hw: pointer to the HW structure
- *
- *  Setup the mailbox read and write message function pointers
- **/
-void ixgbe_init_mbx_ops_generic(struct ixgbe_hw *hw)
-{
-        struct ixgbe_mbx_info *mbx = &hw->mbx;
-
-        mbx->ops.read_posted = ixgbe_read_posted_mbx;
-        mbx->ops.write_posted = ixgbe_write_posted_mbx;
-}
-
 static s32 ixgbe_check_for_bit_pf(struct ixgbe_hw *hw, u32 mask, s32 index)
 {
         u32 mbvficr = IXGBE_READ_REG(hw, IXGBE_MBVFICR(index));
diff --git a/drivers/net/ixgbe/ixgbe_mbx.h b/drivers/net/ixgbe/ixgbe_mbx.h
index be7ab3309ab7..7e0d08ff5b53 100644
--- a/drivers/net/ixgbe/ixgbe_mbx.h
+++ b/drivers/net/ixgbe/ixgbe_mbx.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -83,12 +83,9 @@
 
 s32 ixgbe_read_mbx(struct ixgbe_hw *, u32 *, u16, u16);
 s32 ixgbe_write_mbx(struct ixgbe_hw *, u32 *, u16, u16);
-s32 ixgbe_read_posted_mbx(struct ixgbe_hw *, u32 *, u16, u16);
-s32 ixgbe_write_posted_mbx(struct ixgbe_hw *, u32 *, u16, u16);
 s32 ixgbe_check_for_msg(struct ixgbe_hw *, u16);
 s32 ixgbe_check_for_ack(struct ixgbe_hw *, u16);
 s32 ixgbe_check_for_rst(struct ixgbe_hw *, u16);
-void ixgbe_init_mbx_ops_generic(struct ixgbe_hw *hw);
 void ixgbe_init_mbx_params_pf(struct ixgbe_hw *);
 
 extern struct ixgbe_mbx_operations mbx_ops_82599;
diff --git a/drivers/net/ixgbe/ixgbe_sriov.c b/drivers/net/ixgbe/ixgbe_sriov.c
index 49661a138e22..5428153af8f3 100644
--- a/drivers/net/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ixgbe/ixgbe_sriov.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -43,8 +43,8 @@
 
 #include "ixgbe_sriov.h"
 
-int ixgbe_set_vf_multicasts(struct ixgbe_adapter *adapter,
-                            int entries, u16 *hash_list, u32 vf)
+static int ixgbe_set_vf_multicasts(struct ixgbe_adapter *adapter,
+                                   int entries, u16 *hash_list, u32 vf)
 {
         struct vf_data_storage *vfinfo = &adapter->vfinfo[vf];
         struct ixgbe_hw *hw = &adapter->hw;
@@ -104,13 +104,14 @@ void ixgbe_restore_vf_multicasts(struct ixgbe_adapter *adapter)
         }
 }
 
-int ixgbe_set_vf_vlan(struct ixgbe_adapter *adapter, int add, int vid, u32 vf)
+static int ixgbe_set_vf_vlan(struct ixgbe_adapter *adapter, int add, int vid,
+                             u32 vf)
 {
         return adapter->hw.mac.ops.set_vfta(&adapter->hw, vid, vf, (bool)add);
 }
 
 
-void ixgbe_set_vmolr(struct ixgbe_hw *hw, u32 vf, bool aupe)
+static void ixgbe_set_vmolr(struct ixgbe_hw *hw, u32 vf, bool aupe)
 {
         u32 vmolr = IXGBE_READ_REG(hw, IXGBE_VMOLR(vf));
         vmolr |= (IXGBE_VMOLR_ROMPE |
@@ -134,7 +135,7 @@ static void ixgbe_set_vmvir(struct ixgbe_adapter *adapter, u32 vid, u32 vf)
                 IXGBE_WRITE_REG(hw, IXGBE_VMVIR(vf), 0);
 }
 
-inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
+static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
 {
         struct ixgbe_hw *hw = &adapter->hw;
         int rar_entry = hw->mac.num_rar_entries - (vf + 1);
@@ -162,8 +163,8 @@ inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
         hw->mac.ops.clear_rar(hw, rar_entry);
 }
 
-int ixgbe_set_vf_mac(struct ixgbe_adapter *adapter,
-                          int vf, unsigned char *mac_addr)
+static int ixgbe_set_vf_mac(struct ixgbe_adapter *adapter,
+                            int vf, unsigned char *mac_addr)
 {
         struct ixgbe_hw *hw = &adapter->hw;
         int rar_entry = hw->mac.num_rar_entries - (vf + 1);
@@ -197,7 +198,7 @@ int ixgbe_vf_configuration(struct pci_dev *pdev, unsigned int event_mask)
         return 0;
 }
 
-inline void ixgbe_vf_reset_msg(struct ixgbe_adapter *adapter, u32 vf)
+static inline void ixgbe_vf_reset_msg(struct ixgbe_adapter *adapter, u32 vf)
 {
         struct ixgbe_hw *hw = &adapter->hw;
         u32 reg;
diff --git a/drivers/net/ixgbe/ixgbe_sriov.h b/drivers/net/ixgbe/ixgbe_sriov.h
index 184730ecdfb6..49dc14debef7 100644
--- a/drivers/net/ixgbe/ixgbe_sriov.h
+++ b/drivers/net/ixgbe/ixgbe_sriov.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -28,16 +28,8 @@
 #ifndef _IXGBE_SRIOV_H_
 #define _IXGBE_SRIOV_H_
 
-int ixgbe_set_vf_multicasts(struct ixgbe_adapter *adapter,
-                            int entries, u16 *hash_list, u32 vf);
 void ixgbe_restore_vf_multicasts(struct ixgbe_adapter *adapter);
-int ixgbe_set_vf_vlan(struct ixgbe_adapter *adapter, int add, int vid, u32 vf);
-void ixgbe_set_vmolr(struct ixgbe_hw *hw, u32 vf, bool aupe);
-void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf);
-void ixgbe_vf_reset_msg(struct ixgbe_adapter *adapter, u32 vf);
 void ixgbe_msg_task(struct ixgbe_adapter *adapter);
-int ixgbe_set_vf_mac(struct ixgbe_adapter *adapter,
-                     int vf, unsigned char *mac_addr);
 int ixgbe_vf_configuration(struct pci_dev *pdev, unsigned int event_mask);
 void ixgbe_disable_tx_rx(struct ixgbe_adapter *adapter);
 void ixgbe_ping_all_vfs(struct ixgbe_adapter *adapter);
diff --git a/drivers/net/ixgbevf/ethtool.c b/drivers/net/ixgbevf/ethtool.c
index 4680b069b84f..4cc817acfb62 100644
--- a/drivers/net/ixgbevf/ethtool.c
+++ b/drivers/net/ixgbevf/ethtool.c
@@ -330,10 +330,8 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
 {
         struct ixgbevf_adapter *adapter = netdev_priv(netdev);
         struct ixgbevf_ring *tx_ring = NULL, *rx_ring = NULL;
-        int i, err;
+        int i, err = 0;
         u32 new_rx_count, new_tx_count;
-        bool need_tx_update = false;
-        bool need_rx_update = false;
 
         if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
                 return -EINVAL;
@@ -355,89 +353,96 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
         while (test_and_set_bit(__IXGBEVF_RESETTING, &adapter->state))
                 msleep(1);
 
-        if (new_tx_count != adapter->tx_ring_count) {
-                tx_ring = kcalloc(adapter->num_tx_queues,
-                                  sizeof(struct ixgbevf_ring), GFP_KERNEL);
-                if (!tx_ring) {
-                        err = -ENOMEM;
-                        goto err_setup;
-                }
-                memcpy(tx_ring, adapter->tx_ring,
-                       adapter->num_tx_queues * sizeof(struct ixgbevf_ring));
-                for (i = 0; i < adapter->num_tx_queues; i++) {
-                        tx_ring[i].count = new_tx_count;
-                        err = ixgbevf_setup_tx_resources(adapter,
-                                                         &tx_ring[i]);
-                        if (err) {
-                                while (i) {
-                                        i--;
-                                        ixgbevf_free_tx_resources(adapter,
-                                                                  &tx_ring[i]);
-                                }
-                                kfree(tx_ring);
-                                goto err_setup;
-                        }
-                        tx_ring[i].v_idx = adapter->tx_ring[i].v_idx;
-                }
-                need_tx_update = true;
+        /*
+         * If the adapter isn't up and running then just set the
+         * new parameters and scurry for the exits.
+         */
+        if (!netif_running(adapter->netdev)) {
+                for (i = 0; i < adapter->num_tx_queues; i++)
+                        adapter->tx_ring[i].count = new_tx_count;
+                for (i = 0; i < adapter->num_rx_queues; i++)
+                        adapter->rx_ring[i].count = new_rx_count;
+                adapter->tx_ring_count = new_tx_count;
+                adapter->rx_ring_count = new_rx_count;
+                goto clear_reset;
         }
 
-        if (new_rx_count != adapter->rx_ring_count) {
-                rx_ring = kcalloc(adapter->num_rx_queues,
-                                  sizeof(struct ixgbevf_ring), GFP_KERNEL);
-                if ((!rx_ring) && (need_tx_update)) {
-                        err = -ENOMEM;
-                        goto err_rx_setup;
-                }
-                memcpy(rx_ring, adapter->rx_ring,
-                       adapter->num_rx_queues * sizeof(struct ixgbevf_ring));
-                for (i = 0; i < adapter->num_rx_queues; i++) {
-                        rx_ring[i].count = new_rx_count;
-                        err = ixgbevf_setup_rx_resources(adapter,
-                                                         &rx_ring[i]);
-                        if (err) {
-                                while (i) {
-                                        i--;
-                                        ixgbevf_free_rx_resources(adapter,
-                                                                  &rx_ring[i]);
-                                }
-                                kfree(rx_ring);
-                                goto err_rx_setup;
-                        }
-                        rx_ring[i].v_idx = adapter->rx_ring[i].v_idx;
-                }
-                need_rx_update = true;
+        tx_ring = kcalloc(adapter->num_tx_queues,
+                          sizeof(struct ixgbevf_ring), GFP_KERNEL);
+        if (!tx_ring) {
+                err = -ENOMEM;
+                goto clear_reset;
         }
 
-err_rx_setup:
-        /* if rings need to be updated, here's the place to do it in one shot */
-        if (need_tx_update || need_rx_update) {
-                if (netif_running(netdev))
-                        ixgbevf_down(adapter);
+        rx_ring = kcalloc(adapter->num_rx_queues,
+                          sizeof(struct ixgbevf_ring), GFP_KERNEL);
+        if (!rx_ring) {
+                err = -ENOMEM;
+                goto err_rx_setup;
         }
 
-        /* tx */
-        if (need_tx_update) {
-                kfree(adapter->tx_ring);
-                adapter->tx_ring = tx_ring;
-                tx_ring = NULL;
-                adapter->tx_ring_count = new_tx_count;
+        ixgbevf_down(adapter);
+
+        memcpy(tx_ring, adapter->tx_ring,
+               adapter->num_tx_queues * sizeof(struct ixgbevf_ring));
+        for (i = 0; i < adapter->num_tx_queues; i++) {
+                tx_ring[i].count = new_tx_count;
+                err = ixgbevf_setup_tx_resources(adapter, &tx_ring[i]);
+                if (err) {
+                        while (i) {
+                                i--;
+                                ixgbevf_free_tx_resources(adapter,
+                                                          &tx_ring[i]);
+                        }
+                        goto err_tx_ring_setup;
+                }
+                tx_ring[i].v_idx = adapter->tx_ring[i].v_idx;
         }
 
-        /* rx */
-        if (need_rx_update) {
-                kfree(adapter->rx_ring);
-                adapter->rx_ring = rx_ring;
-                rx_ring = NULL;
-                adapter->rx_ring_count = new_rx_count;
+        memcpy(rx_ring, adapter->rx_ring,
+               adapter->num_rx_queues * sizeof(struct ixgbevf_ring));
+        for (i = 0; i < adapter->num_rx_queues; i++) {
+                rx_ring[i].count = new_rx_count;
+                err = ixgbevf_setup_rx_resources(adapter, &rx_ring[i]);
+                if (err) {
+                        while (i) {
+                                i--;
+                                ixgbevf_free_rx_resources(adapter,
+                                                          &rx_ring[i]);
+                        }
+                                goto err_rx_ring_setup;
+                }
+                rx_ring[i].v_idx = adapter->rx_ring[i].v_idx;
         }
 
+        /*
+         * Only switch to new rings if all the prior allocations
+         * and ring setups have succeeded.
+         */
+        kfree(adapter->tx_ring);
+        adapter->tx_ring = tx_ring;
+        adapter->tx_ring_count = new_tx_count;
+
+        kfree(adapter->rx_ring);
+        adapter->rx_ring = rx_ring;
+        adapter->rx_ring_count = new_rx_count;
+
         /* success! */
-        err = 0;
-        if (netif_running(netdev))
-                ixgbevf_up(adapter);
+        ixgbevf_up(adapter);
+
+        goto clear_reset;
+
+err_rx_ring_setup:
+        for(i = 0; i < adapter->num_tx_queues; i++)
+                ixgbevf_free_tx_resources(adapter, &tx_ring[i]);
+
+err_tx_ring_setup:
+        kfree(rx_ring);
+
+err_rx_setup:
+        kfree(tx_ring);
 
-err_setup:
+clear_reset:
         clear_bit(__IXGBEVF_RESETTING, &adapter->state);
         return err;
 }
diff --git a/drivers/net/ixgbevf/ixgbevf_main.c b/drivers/net/ixgbevf/ixgbevf_main.c
index 3eda1bdbbb7a..dc03c9652389 100644
--- a/drivers/net/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ixgbevf/ixgbevf_main.c
@@ -311,7 +311,7 @@ static bool ixgbevf_clean_tx_irq(struct ixgbevf_adapter *adapter,
         netdev->stats.tx_bytes += total_bytes;
         netdev->stats.tx_packets += total_packets;
 
-        return (count < tx_ring->work_limit);
+        return count < tx_ring->work_limit;
 }
 
 /**
@@ -1495,7 +1495,7 @@ static void ixgbevf_restore_vlan(struct ixgbevf_adapter *adapter)
 
         if (adapter->vlgrp) {
                 u16 vid;
-                for (vid = 0; vid < VLAN_GROUP_ARRAY_LEN; vid++) {
+                for (vid = 0; vid < VLAN_N_VID; vid++) {
                         if (!vlan_group_get_device(adapter->vlgrp, vid))
                                 continue;
                         ixgbevf_vlan_rx_add_vid(adapter->netdev, vid);
@@ -3134,7 +3134,7 @@ static int ixgbevf_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 
         tx_ring = &adapter->tx_ring[r_idx];
 
-        if (adapter->vlgrp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 tx_flags |= vlan_tx_tag_get(skb);
                 tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
                 tx_flags |= IXGBE_TX_FLAGS_VLAN;
diff --git a/drivers/net/ixgbevf/mbx.c b/drivers/net/ixgbevf/mbx.c
index b8143501e6fc..84ac486f4a65 100644
--- a/drivers/net/ixgbevf/mbx.c
+++ b/drivers/net/ixgbevf/mbx.c
@@ -308,7 +308,7 @@ out_no_read:
  *
  *  Initializes the hw->mbx struct to correct values for vf mailbox
  */
-s32 ixgbevf_init_mbx_params_vf(struct ixgbe_hw *hw)
+static s32 ixgbevf_init_mbx_params_vf(struct ixgbe_hw *hw)
 {
         struct ixgbe_mbx_info *mbx = &hw->mbx;
 
diff --git a/drivers/net/ixgbevf/mbx.h b/drivers/net/ixgbevf/mbx.h
index 1b0e0bf4c0f5..8c063bebee7f 100644
--- a/drivers/net/ixgbevf/mbx.h
+++ b/drivers/net/ixgbevf/mbx.h
@@ -95,6 +95,4 @@
 /* forward declaration of the HW struct */
 struct ixgbe_hw;
 
-s32 ixgbevf_init_mbx_params_vf(struct ixgbe_hw *);
-
 #endif /* _IXGBE_MBX_H_ */
diff --git a/drivers/net/ixgbevf/vf.c b/drivers/net/ixgbevf/vf.c
index f6f929958ba0..bfe42c1fcfaf 100644
--- a/drivers/net/ixgbevf/vf.c
+++ b/drivers/net/ixgbevf/vf.c
@@ -368,7 +368,7 @@ static s32 ixgbevf_check_mac_link_vf(struct ixgbe_hw *hw,
         return 0;
 }
 
-struct ixgbe_mac_operations ixgbevf_mac_ops = {
+static struct ixgbe_mac_operations ixgbevf_mac_ops = {
         .init_hw             = ixgbevf_init_hw_vf,
         .reset_hw            = ixgbevf_reset_hw_vf,
         .start_hw            = ixgbevf_start_hw_vf,
diff --git a/drivers/net/jme.c b/drivers/net/jme.c
index c04c096bc6a9..d7a975ee2add 100644
--- a/drivers/net/jme.c
+++ b/drivers/net/jme.c
@@ -3,6 +3,7 @@
  *
  * Copyright 2008 JMicron Technology Corporation
  * http://www.jmicron.com/
+ * Copyright (c) 2009 - 2010 Guo-Fu Tseng <cooldavid@cooldavid.org>
  *
  * Author: Guo-Fu Tseng <cooldavid@cooldavid.org>
  *
@@ -989,6 +990,7 @@ jme_process_receive(struct jme_adapter *jme, int limit)
                         goto out;
                 --limit;
 
+                rmb();
                 desccnt = rxdesc->descwb.desccnt & RXWBDCNT_DCNT;
 
                 if (unlikely(desccnt > 1 ||
@@ -1574,6 +1576,16 @@ jme_free_irq(struct jme_adapter *jme)
         }
 }
 
+static inline void
+jme_phy_on(struct jme_adapter *jme)
+{
+        u32 bmcr;
+
+        bmcr = jme_mdio_read(jme->dev, jme->mii_if.phy_id, MII_BMCR);
+        bmcr &= ~BMCR_PDOWN;
+        jme_mdio_write(jme->dev, jme->mii_if.phy_id, MII_BMCR, bmcr);
+}
+
 static int
 jme_open(struct net_device *netdev)
 {
@@ -1594,10 +1606,12 @@ jme_open(struct net_device *netdev)
 
         jme_start_irq(jme);
 
-        if (test_bit(JME_FLAG_SSET, &jme->flags))
+        if (test_bit(JME_FLAG_SSET, &jme->flags)) {
+                jme_phy_on(jme);
                 jme_set_settings(netdev, &jme->old_ecmd);
-        else
+        } else {
                 jme_reset_phy_processor(jme);
+        }
 
         jme_reset_link(jme);
 
@@ -2382,6 +2396,10 @@ jme_set_settings(struct net_device *netdev,
         if (ecmd->speed == SPEED_1000 && ecmd->autoneg != AUTONEG_ENABLE)
                 return -EINVAL;
 
+        /*
+         * Check If user changed duplex only while force_media.
+         * Hardware would not generate link change interrupt.
+         */
         if (jme->mii_if.force_media &&
         ecmd->autoneg != AUTONEG_ENABLE &&
         (jme->mii_if.full_duplex != ecmd->duplex))
@@ -2391,12 +2409,40 @@ jme_set_settings(struct net_device *netdev,
         rc = mii_ethtool_sset(&(jme->mii_if), ecmd);
         spin_unlock_bh(&jme->phy_lock);
 
-        if (!rc && fdc)
-                jme_reset_link(jme);
-
         if (!rc) {
-                set_bit(JME_FLAG_SSET, &jme->flags);
+                if (fdc)
+                        jme_reset_link(jme);
                 jme->old_ecmd = *ecmd;
+                set_bit(JME_FLAG_SSET, &jme->flags);
+        }
+
+        return rc;
+}
+
+static int
+jme_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd)
+{
+        int rc;
+        struct jme_adapter *jme = netdev_priv(netdev);
+        struct mii_ioctl_data *mii_data = if_mii(rq);
+        unsigned int duplex_chg;
+
+        if (cmd == SIOCSMIIREG) {
+                u16 val = mii_data->val_in;
+                if (!(val & (BMCR_RESET|BMCR_ANENABLE)) &&
+                    (val & BMCR_SPEED1000))
+                        return -EINVAL;
+        }
+
+        spin_lock_bh(&jme->phy_lock);
+        rc = generic_mii_ioctl(&jme->mii_if, mii_data, cmd, &duplex_chg);
+        spin_unlock_bh(&jme->phy_lock);
+
+        if (!rc && (cmd == SIOCSMIIREG)) {
+                if (duplex_chg)
+                        jme_reset_link(jme);
+                jme_get_settings(netdev, &jme->old_ecmd);
+                set_bit(JME_FLAG_SSET, &jme->flags);
         }
 
         return rc;
@@ -2676,6 +2722,7 @@ static const struct net_device_ops jme_netdev_ops = {
         .ndo_open               = jme_open,
         .ndo_stop               = jme_close,
         .ndo_validate_addr      = eth_validate_addr,
+        .ndo_do_ioctl           = jme_ioctl,
         .ndo_start_xmit         = jme_start_xmit,
         .ndo_set_mac_address    = jme_set_macaddr,
         .ndo_set_multicast_list = jme_set_multi,
@@ -2867,6 +2914,8 @@ jme_init_one(struct pci_dev *pdev,
                 jme->mii_if.supports_gmii = true;
         else
                 jme->mii_if.supports_gmii = false;
+        jme->mii_if.phy_id_mask = 0x1F;
+        jme->mii_if.reg_num_mask = 0x1F;
         jme->mii_if.mdio_read = jme_mdio_read;
         jme->mii_if.mdio_write = jme_mdio_write;
 
@@ -3005,10 +3054,12 @@ jme_resume(struct pci_dev *pdev)
         jme_clear_pm(jme);
         pci_restore_state(pdev);
 
-        if (test_bit(JME_FLAG_SSET, &jme->flags))
+        if (test_bit(JME_FLAG_SSET, &jme->flags)) {
+                jme_phy_on(jme);
                 jme_set_settings(netdev, &jme->old_ecmd);
-        else
+        } else {
                 jme_reset_phy_processor(jme);
+        }
 
         jme_start_irq(jme);
         netif_device_attach(netdev);
diff --git a/drivers/net/jme.h b/drivers/net/jme.h
index 1360f68861b8..eac09264bf2a 100644
--- a/drivers/net/jme.h
+++ b/drivers/net/jme.h
@@ -3,6 +3,7 @@
  *
  * Copyright 2008 JMicron Technology Corporation
  * http://www.jmicron.com/
+ * Copyright (c) 2009 - 2010 Guo-Fu Tseng <cooldavid@cooldavid.org>
  *
  * Author: Guo-Fu Tseng <cooldavid@cooldavid.org>
  *
@@ -25,7 +26,7 @@
 #define __JME_H_INCLUDED__
 
 #define DRV_NAME        "jme"
-#define DRV_VERSION     "1.0.6"
+#define DRV_VERSION     "1.0.7"
 #define PFX             DRV_NAME ": "
 
 #define PCI_DEVICE_ID_JMICRON_JMC250    0x0250
diff --git a/drivers/net/ll_temac_main.c b/drivers/net/ll_temac_main.c
index 874ee01e8d9d..9f8e7027b0b3 100644
--- a/drivers/net/ll_temac_main.c
+++ b/drivers/net/ll_temac_main.c
@@ -38,6 +38,7 @@
 #include <linux/of_device.h>
 #include <linux/of_mdio.h>
 #include <linux/of_platform.h>
+#include <linux/of_address.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
 #include <linux/tcp.h>      /* needed for sizeof(tcphdr) */
@@ -494,7 +495,7 @@ static u32 temac_setoptions(struct net_device *ndev, u32 options)
         lp->options |= options;
         mutex_unlock(&lp->indirect_mutex);
 
-        return (0);
+        return 0;
 }
 
 /* Initialize temac */
diff --git a/drivers/net/ll_temac_mdio.c b/drivers/net/ll_temac_mdio.c
index 5ae28c975b38..8cf9d4f56bb2 100644
--- a/drivers/net/ll_temac_mdio.c
+++ b/drivers/net/ll_temac_mdio.c
@@ -10,6 +10,7 @@
 #include <linux/phy.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
+#include <linux/of_address.h>
 #include <linux/slab.h>
 #include <linux/of_mdio.h>
 
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 9a0996795321..2d9663a1c54d 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -64,7 +64,6 @@ struct pcpu_lstats {
         u64                     packets;
         u64                     bytes;
         struct u64_stats_sync   syncp;
-        unsigned long           drops;
 };
 
 /*
@@ -74,7 +73,6 @@ struct pcpu_lstats {
 static netdev_tx_t loopback_xmit(struct sk_buff *skb,
                                  struct net_device *dev)
 {
-        struct pcpu_lstats __percpu *pcpu_lstats;
         struct pcpu_lstats *lb_stats;
         int len;
 
@@ -83,8 +81,7 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
         skb->protocol = eth_type_trans(skb, dev);
 
         /* it's OK to use per_cpu_ptr() because BHs are off */
-        pcpu_lstats = (void __percpu __force *)dev->ml_priv;
-        lb_stats = this_cpu_ptr(pcpu_lstats);
+        lb_stats = this_cpu_ptr(dev->lstats);
 
         len = skb->len;
         if (likely(netif_rx(skb) == NET_RX_SUCCESS)) {
@@ -92,8 +89,7 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
                 lb_stats->bytes += len;
                 lb_stats->packets++;
                 u64_stats_update_end(&lb_stats->syncp);
-        } else
-                lb_stats->drops++;
+        }
 
         return NETDEV_TX_OK;
 }
@@ -101,32 +97,26 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
 static struct rtnl_link_stats64 *loopback_get_stats64(struct net_device *dev,
                                                       struct rtnl_link_stats64 *stats)
 {
-        const struct pcpu_lstats __percpu *pcpu_lstats;
         u64 bytes = 0;
         u64 packets = 0;
-        u64 drops = 0;
         int i;
 
-        pcpu_lstats = (void __percpu __force *)dev->ml_priv;
         for_each_possible_cpu(i) {
                 const struct pcpu_lstats *lb_stats;
                 u64 tbytes, tpackets;
                 unsigned int start;
 
-                lb_stats = per_cpu_ptr(pcpu_lstats, i);
+                lb_stats = per_cpu_ptr(dev->lstats, i);
                 do {
                         start = u64_stats_fetch_begin(&lb_stats->syncp);
                         tbytes = lb_stats->bytes;
                         tpackets = lb_stats->packets;
                 } while (u64_stats_fetch_retry(&lb_stats->syncp, start));
-                drops   += lb_stats->drops;
                 bytes   += tbytes;
                 packets += tpackets;
         }
         stats->rx_packets = packets;
         stats->tx_packets = packets;
-        stats->rx_dropped = drops;
-        stats->rx_errors  = drops;
         stats->rx_bytes   = bytes;
         stats->tx_bytes   = bytes;
         return stats;
@@ -147,22 +137,16 @@ static const struct ethtool_ops loopback_ethtool_ops = {
 
 static int loopback_dev_init(struct net_device *dev)
 {
-        struct pcpu_lstats __percpu *lstats;
-
-        lstats = alloc_percpu(struct pcpu_lstats);
-        if (!lstats)
+        dev->lstats = alloc_percpu(struct pcpu_lstats);
+        if (!dev->lstats)
                 return -ENOMEM;
 
-        dev->ml_priv = (void __force *)lstats;
         return 0;
 }
 
 static void loopback_dev_free(struct net_device *dev)
 {
-        struct pcpu_lstats __percpu *lstats =
-                (void __percpu __force *)dev->ml_priv;
-
-        free_percpu(lstats);
+        free_percpu(dev->lstats);
         free_netdev(dev);
 }
 
diff --git a/drivers/net/lp486e.c b/drivers/net/lp486e.c
index 3df046a58b1d..3698824744cb 100644
--- a/drivers/net/lp486e.c
+++ b/drivers/net/lp486e.c
@@ -460,7 +460,7 @@ init_rx_bufs(struct net_device *dev, int num) {
         }
         lp->rbd_tail->next = rfd->rbd;
 #endif
-        return (i);
+        return i;
 }
 
 static inline void
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 0ef0eb0db945..0fc9dc7f20db 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -788,6 +788,10 @@ static int macvlan_device_event(struct notifier_block *unused,
                 }
                 break;
         case NETDEV_UNREGISTER:
+                /* twiddle thumbs on netns device moves */
+                if (dev->reg_state != NETREG_UNREGISTERING)
+                        break;
+
                 list_for_each_entry_safe(vlan, next, &port->vlans, list)
                         vlan->dev->rtnl_link_ops->dellink(vlan->dev, NULL);
                 break;
diff --git a/drivers/net/meth.c b/drivers/net/meth.c
index 42e3294671d7..60135aa55802 100644
--- a/drivers/net/meth.c
+++ b/drivers/net/meth.c
@@ -461,7 +461,7 @@ static int meth_tx_full(struct net_device *dev)
 {
         struct meth_private *priv = netdev_priv(dev);
 
-        return (priv->tx_count >= TX_RING_ENTRIES - 1);
+        return priv->tx_count >= TX_RING_ENTRIES - 1;
 }
 
 static void meth_tx_cleanup(struct net_device* dev, unsigned long int_status)
diff --git a/drivers/net/mlx4/en_netdev.c b/drivers/net/mlx4/en_netdev.c
index 411bda581c04..79478bd4211a 100644
--- a/drivers/net/mlx4/en_netdev.c
+++ b/drivers/net/mlx4/en_netdev.c
@@ -1025,7 +1025,8 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
          */
         dev->netdev_ops = &mlx4_netdev_ops;
         dev->watchdog_timeo = MLX4_EN_WATCHDOG_TIMEOUT;
-        dev->real_num_tx_queues = MLX4_EN_NUM_TX_RINGS;
+        netif_set_real_num_tx_queues(dev, priv->tx_ring_num);
+        netif_set_real_num_rx_queues(dev, priv->rx_ring_num);
 
         SET_ETHTOOL_OPS(dev, &mlx4_en_ethtool_ops);
 
diff --git a/drivers/net/mlx4/en_selftest.c b/drivers/net/mlx4/en_selftest.c
index 43357d35616a..9c91a92da705 100644
--- a/drivers/net/mlx4/en_selftest.c
+++ b/drivers/net/mlx4/en_selftest.c
@@ -107,7 +107,7 @@ static int mlx4_en_test_loopback(struct mlx4_en_priv *priv)
 mlx4_en_test_loopback_exit:
 
         priv->validate_loopback = 0;
-        return (!loopback_ok);
+        return !loopback_ok;
 }
 
 
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index 98dd620042a8..a680cd4a5ab6 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -583,7 +583,7 @@ u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb)
         /* If we support per priority flow control and the packet contains
          * a vlan tag, send the packet to the TX ring assigned to that priority
          */
-        if (priv->prof->rx_ppp && priv->vlgrp && vlan_tx_tag_present(skb)) {
+        if (priv->prof->rx_ppp && vlan_tx_tag_present(skb)) {
                 vlan_tag = vlan_tx_tag_get(skb);
                 return MLX4_EN_NUM_TX_RINGS + (vlan_tag >> 13);
         }
@@ -634,7 +634,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tx_ind = skb->queue_mapping;
         ring = &priv->tx_ring[tx_ind];
-        if (priv->vlgrp && vlan_tx_tag_present(skb))
+        if (vlan_tx_tag_present(skb))
                 vlan_tag = vlan_tx_tag_get(skb);
 
         /* Check available TXBBs And 2K spare for prefetch */
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 2d488abcf62d..dd2b6a71c6d7 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -2901,7 +2901,8 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
         mp->dev = dev;
 
         set_params(mp, pd);
-        dev->real_num_tx_queues = mp->txq_count;
+        netif_set_real_num_tx_queues(dev, mp->txq_count);
+        netif_set_real_num_rx_queues(dev, mp->rxq_count);
 
         if (pd->phy_addr != MV643XX_ETH_PHY_NONE)
                 mp->phy = phy_scan(mp, pd->phy_addr);
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index 24ab8a43c777..8524cc40ec57 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -225,6 +225,7 @@ struct myri10ge_priv {
         struct msix_entry *msix_vectors;
 #ifdef CONFIG_MYRI10GE_DCA
         int dca_enabled;
+        int relaxed_order;
 #endif
         u32 link_state;
         unsigned int rdma_tags_available;
@@ -990,7 +991,7 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
                  * RX queues, so if we get an error, first retry using a
                  * single TX queue before giving up */
                 if (status != 0 && mgp->dev->real_num_tx_queues > 1) {
-                        mgp->dev->real_num_tx_queues = 1;
+                        netif_set_real_num_tx_queues(mgp->dev, 1);
                         cmd.data0 = mgp->num_slices;
                         cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE;
                         status = myri10ge_send_cmd(mgp,
@@ -1074,10 +1075,28 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
 }
 
 #ifdef CONFIG_MYRI10GE_DCA
+static int myri10ge_toggle_relaxed(struct pci_dev *pdev, int on)
+{
+        int ret, cap, err;
+        u16 ctl;
+
+        cap = pci_find_capability(pdev, PCI_CAP_ID_EXP);
+        if (!cap)
+                return 0;
+
+        err = pci_read_config_word(pdev, cap + PCI_EXP_DEVCTL, &ctl);
+        ret = (ctl & PCI_EXP_DEVCTL_RELAX_EN) >> 4;
+        if (ret != on) {
+                ctl &= ~PCI_EXP_DEVCTL_RELAX_EN;
+                ctl |= (on << 4);
+                pci_write_config_word(pdev, cap + PCI_EXP_DEVCTL, ctl);
+        }
+        return ret;
+}
+
 static void
 myri10ge_write_dca(struct myri10ge_slice_state *ss, int cpu, int tag)
 {
-        ss->cpu = cpu;
         ss->cached_dca_tag = tag;
         put_be32(htonl(tag), ss->dca_tag);
 }
@@ -1088,9 +1107,10 @@ static inline void myri10ge_update_dca(struct myri10ge_slice_state *ss)
         int tag;
 
         if (cpu != ss->cpu) {
-                tag = dca_get_tag(cpu);
+                tag = dca3_get_tag(&ss->mgp->pdev->dev, cpu);
                 if (ss->cached_dca_tag != tag)
                         myri10ge_write_dca(ss, cpu, tag);
+                ss->cpu = cpu;
         }
         put_cpu();
 }
@@ -1113,9 +1133,13 @@ static void myri10ge_setup_dca(struct myri10ge_priv *mgp)
                                 "dca_add_requester() failed, err=%d\n", err);
                 return;
         }
+        mgp->relaxed_order = myri10ge_toggle_relaxed(pdev, 0);
         mgp->dca_enabled = 1;
-        for (i = 0; i < mgp->num_slices; i++)
-                myri10ge_write_dca(&mgp->ss[i], -1, 0);
+        for (i = 0; i < mgp->num_slices; i++) {
+                mgp->ss[i].cpu = -1;
+                mgp->ss[i].cached_dca_tag = -1;
+                myri10ge_update_dca(&mgp->ss[i]);
+         }
 }
 
 static void myri10ge_teardown_dca(struct myri10ge_priv *mgp)
@@ -1126,6 +1150,8 @@ static void myri10ge_teardown_dca(struct myri10ge_priv *mgp)
         if (!mgp->dca_enabled)
                 return;
         mgp->dca_enabled = 0;
+        if (mgp->relaxed_order)
+                myri10ge_toggle_relaxed(pdev, 1);
         err = dca_remove_requester(&pdev->dev);
 }
 
@@ -1555,12 +1581,12 @@ static irqreturn_t myri10ge_intr(int irq, void *arg)
          * valid  since MSI-X irqs are not shared */
         if ((mgp->dev->real_num_tx_queues == 1) && (ss != mgp->ss)) {
                 napi_schedule(&ss->napi);
-                return (IRQ_HANDLED);
+                return IRQ_HANDLED;
         }
 
         /* make sure it is our IRQ, and that the DMA has finished */
         if (unlikely(!stats->valid))
-                return (IRQ_NONE);
+                return IRQ_NONE;
 
         /* low bit indicates receives are present, so schedule
          * napi poll handler */
@@ -1599,7 +1625,7 @@ static irqreturn_t myri10ge_intr(int irq, void *arg)
                 myri10ge_check_statblock(mgp);
 
         put_be32(htonl(3), ss->irq_claim + 1);
-        return (IRQ_HANDLED);
+        return IRQ_HANDLED;
 }
 
 static int
@@ -3923,7 +3949,8 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 dev_err(&pdev->dev, "failed to alloc slice state\n");
                 goto abort_with_firmware;
         }
-        netdev->real_num_tx_queues = mgp->num_slices;
+        netif_set_real_num_tx_queues(netdev, mgp->num_slices);
+        netif_set_real_num_rx_queues(netdev, mgp->num_slices);
         status = myri10ge_reset(mgp);
         if (status != 0) {
                 dev_err(&pdev->dev, "failed reset\n");
diff --git a/drivers/net/myri_sbus.c b/drivers/net/myri_sbus.c
index 617f898ba5f0..4846e131a04e 100644
--- a/drivers/net/myri_sbus.c
+++ b/drivers/net/myri_sbus.c
@@ -735,7 +735,7 @@ static int myri_header(struct sk_buff *skb, struct net_device *dev,
                 int i;
                 for (i = 0; i < dev->addr_len; i++)
                         eth->h_dest[i] = 0;
-                return(dev->hard_header_len);
+                return dev->hard_header_len;
         }
 
         if (daddr) {
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index ca142c47b2e4..94255f09093d 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -678,7 +678,14 @@ static int netconsole_netdev_event(struct notifier_block *this,
                                 strlcpy(nt->np.dev_name, dev->name, IFNAMSIZ);
                                 break;
                         case NETDEV_UNREGISTER:
-                                netpoll_cleanup(&nt->np);
+                                /*
+                                 * rtnl_lock already held
+                                 */
+                                if (nt->np.dev) {
+                                        __netpoll_cleanup(&nt->np);
+                                        dev_put(nt->np.dev);
+                                        nt->np.dev = NULL;
+                                }
                                 /* Fall through */
                         case NETDEV_GOING_DOWN:
                         case NETDEV_BONDING_DESLAVE:
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index 6dca3574e355..8e8a97839cb0 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -175,7 +175,10 @@
 #define MAX_NUM_CARDS           4
 
 #define MAX_BUFFERS_PER_CMD     32
-#define TX_STOP_THRESH          ((MAX_SKB_FRAGS >> 2) + 4)
+#define MAX_TSO_HEADER_DESC     2
+#define MGMT_CMD_DESC_RESV      4
+#define TX_STOP_THRESH          ((MAX_SKB_FRAGS >> 2) + MAX_TSO_HEADER_DESC \
+                                                        + MGMT_CMD_DESC_RESV)
 #define NX_MAX_TX_TIMEOUTS      2
 
 /*
@@ -1253,19 +1256,9 @@ struct netxen_adapter {
         const struct firmware *fw;
 };
 
-int netxen_niu_xg_init_port(struct netxen_adapter *adapter, int port);
-int netxen_niu_disable_xg_port(struct netxen_adapter *adapter);
-
 int nx_fw_cmd_query_phy(struct netxen_adapter *adapter, u32 reg, u32 *val);
 int nx_fw_cmd_set_phy(struct netxen_adapter *adapter, u32 reg, u32 val);
 
-/* Functions available from netxen_nic_hw.c */
-int netxen_nic_set_mtu_xgb(struct netxen_adapter *adapter, int new_mtu);
-int netxen_nic_set_mtu_gb(struct netxen_adapter *adapter, int new_mtu);
-
-int netxen_p2_nic_set_mac_addr(struct netxen_adapter *adapter, u8 *addr);
-int netxen_p3_nic_set_mac_addr(struct netxen_adapter *adapter, u8 *addr);
-
 #define NXRD32(adapter, off) \
         (adapter->crb_read(adapter, off))
 #define NXWR32(adapter, off, val) \
@@ -1345,11 +1338,8 @@ void netxen_post_rx_buffers(struct netxen_adapter *adapter, u32 ringid,
                 struct nx_host_rds_ring *rds_ring);
 int netxen_process_cmd_ring(struct netxen_adapter *adapter);
 int netxen_process_rcv_ring(struct nx_host_sds_ring *sds_ring, int max);
-void netxen_p2_nic_set_multi(struct net_device *netdev);
-void netxen_p3_nic_set_multi(struct net_device *netdev);
+
 void netxen_p3_free_mac_list(struct netxen_adapter *adapter);
-int netxen_p2_nic_set_promisc(struct netxen_adapter *adapter, u32 mode);
-int netxen_p3_nic_set_promisc(struct netxen_adapter *adapter, u32);
 int netxen_config_intr_coalesce(struct netxen_adapter *adapter);
 int netxen_config_rss(struct netxen_adapter *adapter, int enable);
 int netxen_config_ipaddr(struct netxen_adapter *adapter, u32 ip, int cmd);
@@ -1364,9 +1354,6 @@ int netxen_config_hw_lro(struct netxen_adapter *adapter, int enable);
 int netxen_config_bridged_mode(struct netxen_adapter *adapter, int enable);
 int netxen_send_lro_cleanup(struct netxen_adapter *adapter);
 
-int netxen_nic_set_mac(struct net_device *netdev, void *p);
-struct net_device_stats *netxen_nic_get_stats(struct net_device *netdev);
-
 void netxen_nic_update_cmd_producer(struct netxen_adapter *adapter,
                 struct nx_host_tx_ring *tx_ring);
 
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index 29d7b93d0493..37d3ebd65be8 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -319,6 +319,8 @@ static unsigned crb_hub_agt[64] =
 
 #define NETXEN_PCIE_SEM_TIMEOUT 10000
 
+static int netxen_nic_set_mtu_xgb(struct netxen_adapter *adapter, int new_mtu);
+
 int
 netxen_pcie_sem_lock(struct netxen_adapter *adapter, int sem, u32 id_reg)
 {
@@ -345,7 +347,7 @@ netxen_pcie_sem_unlock(struct netxen_adapter *adapter, int sem)
         NXRD32(adapter, NETXEN_PCIE_REG(PCIE_SEM_UNLOCK(sem)));
 }
 
-int netxen_niu_xg_init_port(struct netxen_adapter *adapter, int port)
+static int netxen_niu_xg_init_port(struct netxen_adapter *adapter, int port)
 {
         if (NX_IS_REVISION_P2(adapter->ahw.revision_id)) {
                 NXWR32(adapter, NETXEN_NIU_XGE_CONFIG_1+(0x10000*port), 0x1447);
@@ -356,7 +358,7 @@ int netxen_niu_xg_init_port(struct netxen_adapter *adapter, int port)
 }
 
 /* Disable an XG interface */
-int netxen_niu_disable_xg_port(struct netxen_adapter *adapter)
+static int netxen_niu_disable_xg_port(struct netxen_adapter *adapter)
 {
         __u32 mac_cfg;
         u32 port = adapter->physical_port;
@@ -383,7 +385,7 @@ int netxen_niu_disable_xg_port(struct netxen_adapter *adapter)
 #define MAC_LO(addr) \
         ((addr[5] << 16) | (addr[4] << 8) | (addr[3]))
 
-int netxen_p2_nic_set_promisc(struct netxen_adapter *adapter, u32 mode)
+static int netxen_p2_nic_set_promisc(struct netxen_adapter *adapter, u32 mode)
 {
         u32 mac_cfg;
         u32 cnt = 0;
@@ -434,7 +436,7 @@ int netxen_p2_nic_set_promisc(struct netxen_adapter *adapter, u32 mode)
         return 0;
 }
 
-int netxen_p2_nic_set_mac_addr(struct netxen_adapter *adapter, u8 *addr)
+static int netxen_p2_nic_set_mac_addr(struct netxen_adapter *adapter, u8 *addr)
 {
         u32 mac_hi, mac_lo;
         u32 reg_hi, reg_lo;
@@ -531,7 +533,7 @@ netxen_nic_set_mcast_addr(struct netxen_adapter *adapter,
         return 0;
 }
 
-void netxen_p2_nic_set_multi(struct net_device *netdev)
+static void netxen_p2_nic_set_multi(struct net_device *netdev)
 {
         struct netxen_adapter *adapter = netdev_priv(netdev);
         struct netdev_hw_addr *ha;
@@ -598,8 +600,14 @@ netxen_send_cmd_descs(struct netxen_adapter *adapter,
 
         if (nr_desc >= netxen_tx_avail(tx_ring)) {
                 netif_tx_stop_queue(tx_ring->txq);
-                __netif_tx_unlock_bh(tx_ring->txq);
-                return -EBUSY;
+                smp_mb();
+                if (netxen_tx_avail(tx_ring) > nr_desc) {
+                        if (netxen_tx_avail(tx_ring) > TX_STOP_THRESH)
+                                netif_tx_wake_queue(tx_ring->txq);
+                } else {
+                        __netif_tx_unlock_bh(tx_ring->txq);
+                        return -EBUSY;
+                }
         }
 
         do {
@@ -674,7 +682,7 @@ static int nx_p3_nic_add_mac(struct netxen_adapter *adapter,
                                 cur->mac_addr, NETXEN_MAC_ADD);
 }
 
-void netxen_p3_nic_set_multi(struct net_device *netdev)
+static void netxen_p3_nic_set_multi(struct net_device *netdev)
 {
         struct netxen_adapter *adapter = netdev_priv(netdev);
         struct netdev_hw_addr *ha;
@@ -721,7 +729,7 @@ send_fw_cmd:
         }
 }
 
-int netxen_p3_nic_set_promisc(struct netxen_adapter *adapter, u32 mode)
+static int netxen_p3_nic_set_promisc(struct netxen_adapter *adapter, u32 mode)
 {
         nx_nic_req_t req;
         u64 word;
@@ -754,7 +762,7 @@ void netxen_p3_free_mac_list(struct netxen_adapter *adapter)
         }
 }
 
-int netxen_p3_nic_set_mac_addr(struct netxen_adapter *adapter, u8 *addr)
+static int netxen_p3_nic_set_mac_addr(struct netxen_adapter *adapter, u8 *addr)
 {
         /* assuming caller has already copied new addr to netdev */
         netxen_p3_nic_set_multi(adapter->netdev);
@@ -1816,14 +1824,14 @@ int netxen_nic_get_board_info(struct netxen_adapter *adapter)
         if (netxen_rom_fast_read(adapter, offset, &board_type))
                 return -EIO;
 
-        adapter->ahw.board_type = board_type;
-
         if (board_type == NETXEN_BRDTYPE_P3_4_GB_MM) {
                 u32 gpio = NXRD32(adapter, NETXEN_ROMUSB_GLB_PAD_GPIO_I);
                 if ((gpio & 0x8000) == 0)
                         board_type = NETXEN_BRDTYPE_P3_10G_TP;
         }
 
+        adapter->ahw.board_type = board_type;
+
         switch (board_type) {
         case NETXEN_BRDTYPE_P2_SB35_4G:
                 adapter->ahw.port_type = NETXEN_NIC_GBE;
@@ -1867,16 +1875,7 @@ int netxen_nic_get_board_info(struct netxen_adapter *adapter)
 }
 
 /* NIU access sections */
-
-int netxen_nic_set_mtu_gb(struct netxen_adapter *adapter, int new_mtu)
-{
-        new_mtu += MTU_FUDGE_FACTOR;
-        NXWR32(adapter, NETXEN_NIU_GB_MAX_FRAME_SIZE(adapter->physical_port),
-                new_mtu);
-        return 0;
-}
-
-int netxen_nic_set_mtu_xgb(struct netxen_adapter *adapter, int new_mtu)
+static int netxen_nic_set_mtu_xgb(struct netxen_adapter *adapter, int new_mtu)
 {
         new_mtu += MTU_FUDGE_FACTOR;
         if (adapter->physical_port == 0)
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index cabae7bb1fc6..95fe552aa279 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -346,7 +346,7 @@ static u32 netxen_decode_crb_addr(u32 addr)
         if (pci_base == NETXEN_ADDR_ERROR)
                 return pci_base;
         else
-                return (pci_base + offset);
+                return pci_base + offset;
 }
 
 #define NETXEN_MAX_ROM_WAIT_USEC        100
@@ -1540,7 +1540,6 @@ netxen_process_rcv(struct netxen_adapter *adapter,
         if (pkt_offset)
                 skb_pull(skb, pkt_offset);
 
-        skb->truesize = skb->len + sizeof(struct sk_buff);
         skb->protocol = eth_type_trans(skb, netdev);
 
         napi_gro_receive(&sds_ring->napi, skb);
@@ -1602,8 +1601,6 @@ netxen_process_lro(struct netxen_adapter *adapter,
 
         skb_put(skb, lro_length + data_offset);
 
-        skb->truesize = skb->len + sizeof(struct sk_buff) + skb_headroom(skb);
-
         skb_pull(skb, l2_hdr_offset);
         skb->protocol = eth_type_trans(skb, netdev);
 
@@ -1766,14 +1763,10 @@ int netxen_process_cmd_ring(struct netxen_adapter *adapter)
 
                 smp_mb();
 
-                if (netif_queue_stopped(netdev) && netif_carrier_ok(netdev)) {
-                        __netif_tx_lock(tx_ring->txq, smp_processor_id());
-                        if (netxen_tx_avail(tx_ring) > TX_STOP_THRESH) {
+                if (netif_queue_stopped(netdev) && netif_carrier_ok(netdev))
+                        if (netxen_tx_avail(tx_ring) > TX_STOP_THRESH)
                                 netif_wake_queue(netdev);
-                                adapter->tx_timeo_cnt = 0;
-                        }
-                        __netif_tx_unlock(tx_ring->txq);
-                }
+                adapter->tx_timeo_cnt = 0;
         }
         /*
          * If everything is freed up to consumer then check if the ring is full
@@ -1792,7 +1785,7 @@ int netxen_process_cmd_ring(struct netxen_adapter *adapter)
         done = (sw_consumer == hw_consumer);
         spin_unlock(&adapter->tx_clean_lock);
 
-        return (done);
+        return done;
 }
 
 void
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 73d314592230..50820beac3aa 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -95,6 +95,8 @@ static irqreturn_t netxen_msi_intr(int irq, void *data);
 static irqreturn_t netxen_msix_intr(int irq, void *data);
 
 static void netxen_config_indev_addr(struct net_device *dev, unsigned long);
+static struct net_device_stats *netxen_nic_get_stats(struct net_device *netdev);
+static int netxen_nic_set_mac(struct net_device *netdev, void *p);
 
 /*  PCI Device ID Table  */
 #define ENTRY(device) \
@@ -125,11 +127,6 @@ netxen_nic_update_cmd_producer(struct netxen_adapter *adapter,
                 struct nx_host_tx_ring *tx_ring)
 {
         NXWRIO(adapter, tx_ring->crb_cmd_producer, tx_ring->producer);
-
-        if (netxen_tx_avail(tx_ring) <= TX_STOP_THRESH) {
-                netif_stop_queue(adapter->netdev);
-                smp_mb();
-        }
 }
 
 static uint32_t crb_cmd_consumer[4] = {
@@ -177,7 +174,7 @@ netxen_alloc_sds_rings(struct netxen_recv_context *recv_ctx, int count)
 
         recv_ctx->sds_rings = kzalloc(size, GFP_KERNEL);
 
-        return (recv_ctx->sds_rings == NULL);
+        return recv_ctx->sds_rings == NULL;
 }
 
 static void
@@ -460,7 +457,7 @@ netxen_read_mac_addr(struct netxen_adapter *adapter)
         return 0;
 }
 
-int netxen_nic_set_mac(struct net_device *netdev, void *p)
+static int netxen_nic_set_mac(struct net_device *netdev, void *p)
 {
         struct netxen_adapter *adapter = netdev_priv(netdev);
         struct sockaddr *addr = p;
@@ -1209,7 +1206,7 @@ netxen_setup_netdev(struct netxen_adapter *adapter,
                 adapter->max_mc_count = 16;
 
         netdev->netdev_ops         = &netxen_netdev_ops;
-        netdev->watchdog_timeo     = 2*HZ;
+        netdev->watchdog_timeo     = 5*HZ;
 
         netxen_nic_change_mtu(netdev, netdev->mtu);
 
@@ -1254,6 +1251,28 @@ netxen_setup_netdev(struct netxen_adapter *adapter,
         return 0;
 }
 
+#ifdef CONFIG_PCIEAER
+static void netxen_mask_aer_correctable(struct netxen_adapter *adapter)
+{
+        struct pci_dev *pdev = adapter->pdev;
+        struct pci_dev *root = pdev->bus->self;
+        u32 aer_pos;
+
+        if (adapter->ahw.board_type != NETXEN_BRDTYPE_P3_4_GB_MM &&
+                adapter->ahw.board_type != NETXEN_BRDTYPE_P3_10G_TP)
+                return;
+
+        if (root->pcie_type != PCI_EXP_TYPE_ROOT_PORT)
+                return;
+
+        aer_pos = pci_find_ext_capability(root, PCI_EXT_CAP_ID_ERR);
+        if (!aer_pos)
+                return;
+
+        pci_write_config_dword(root, aer_pos + PCI_ERR_COR_MASK, 0xffff);
+}
+#endif
+
 static int __devinit
 netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
@@ -1322,6 +1341,10 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_out_iounmap;
         }
 
+#ifdef CONFIG_PCIEAER
+        netxen_mask_aer_correctable(adapter);
+#endif
+
         /* Mezz cards have PCI function 0,2,3 enabled */
         switch (adapter->ahw.board_type) {
         case NETXEN_BRDTYPE_P2_SB31_10G_IMEZ:
@@ -1825,9 +1848,13 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         /* 4 fragments per cmd des */
         no_of_desc = (frag_count + 3) >> 2;
 
-        if (unlikely(no_of_desc + 2 > netxen_tx_avail(tx_ring))) {
+        if (unlikely(netxen_tx_avail(tx_ring) <= TX_STOP_THRESH)) {
                 netif_stop_queue(netdev);
-                return NETDEV_TX_BUSY;
+                smp_mb();
+                if (netxen_tx_avail(tx_ring) > TX_STOP_THRESH)
+                        netif_start_queue(netdev);
+                else
+                        return NETDEV_TX_BUSY;
         }
 
         producer = tx_ring->producer;
@@ -2027,7 +2054,7 @@ request_reset:
         clear_bit(__NX_RESETTING, &adapter->state);
 }
 
-struct net_device_stats *netxen_nic_get_stats(struct net_device *netdev)
+static struct net_device_stats *netxen_nic_get_stats(struct net_device *netdev)
 {
         struct netxen_adapter *adapter = netdev_priv(netdev);
         struct net_device_stats *stats = &netdev->stats;
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index 8e1859c801a4..781e368329f9 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -283,7 +283,7 @@ static int niu_enable_interrupts(struct niu *np, int on)
 
 static u32 phy_encode(u32 type, int port)
 {
-        return (type << (port * 2));
+        return type << (port * 2);
 }
 
 static u32 phy_decode(u32 val, int port)
@@ -3043,8 +3043,7 @@ static int tcam_flush_all(struct niu *np)
 
 static u64 hash_addr_regval(unsigned long index, unsigned long num_entries)
 {
-        return ((u64)index | (num_entries == 1 ?
-                              HASH_TBL_ADDR_AUTOINC : 0));
+        return (u64)index | (num_entries == 1 ? HASH_TBL_ADDR_AUTOINC : 0);
 }
 
 #if 0
@@ -3276,7 +3275,7 @@ static u16 tcam_get_index(struct niu *np, u16 idx)
         /* One entry reserved for IP fragment rule */
         if (idx >= (np->clas.tcam_sz - 1))
                 idx = 0;
-        return (np->clas.tcam_top + ((idx+1) * np->parent->num_ports));
+        return np->clas.tcam_top + ((idx+1) * np->parent->num_ports);
 }
 
 static u16 tcam_get_size(struct niu *np)
@@ -3313,7 +3312,7 @@ static unsigned int niu_hash_rxaddr(struct rx_ring_info *rp, u64 a)
         a >>= PAGE_SHIFT;
         a ^= (a >> ilog2(MAX_RBR_RING_SIZE));
 
-        return (a & (MAX_RBR_RING_SIZE - 1));
+        return a & (MAX_RBR_RING_SIZE - 1);
 }
 
 static struct page *niu_find_rxpage(struct rx_ring_info *rp, u64 addr,
@@ -4502,7 +4501,8 @@ static int niu_alloc_channels(struct niu *np)
         np->num_rx_rings = parent->rxchan_per_port[port];
         np->num_tx_rings = parent->txchan_per_port[port];
 
-        np->dev->real_num_tx_queues = np->num_tx_rings;
+        netif_set_real_num_rx_queues(np->dev, np->num_rx_rings);
+        netif_set_real_num_tx_queues(np->dev, np->num_tx_rings);
 
         np->rx_rings = kcalloc(np->num_rx_rings, sizeof(struct rx_ring_info),
                                GFP_KERNEL);
@@ -7090,24 +7090,20 @@ static int niu_get_hash_opts(struct niu *np, struct ethtool_rxnfc *nfc)
 static void niu_get_ip4fs_from_tcam_key(struct niu_tcam_entry *tp,
                                         struct ethtool_rx_flow_spec *fsp)
 {
+        u32 tmp;
+        u16 prt;
 
-        fsp->h_u.tcp_ip4_spec.ip4src = (tp->key[3] & TCAM_V4KEY3_SADDR) >>
-                TCAM_V4KEY3_SADDR_SHIFT;
-        fsp->h_u.tcp_ip4_spec.ip4dst = (tp->key[3] & TCAM_V4KEY3_DADDR) >>
-                TCAM_V4KEY3_DADDR_SHIFT;
-        fsp->m_u.tcp_ip4_spec.ip4src = (tp->key_mask[3] & TCAM_V4KEY3_SADDR) >>
-                TCAM_V4KEY3_SADDR_SHIFT;
-        fsp->m_u.tcp_ip4_spec.ip4dst = (tp->key_mask[3] & TCAM_V4KEY3_DADDR) >>
-                TCAM_V4KEY3_DADDR_SHIFT;
-
-        fsp->h_u.tcp_ip4_spec.ip4src =
-                cpu_to_be32(fsp->h_u.tcp_ip4_spec.ip4src);
-        fsp->m_u.tcp_ip4_spec.ip4src =
-                cpu_to_be32(fsp->m_u.tcp_ip4_spec.ip4src);
-        fsp->h_u.tcp_ip4_spec.ip4dst =
-                cpu_to_be32(fsp->h_u.tcp_ip4_spec.ip4dst);
-        fsp->m_u.tcp_ip4_spec.ip4dst =
-                cpu_to_be32(fsp->m_u.tcp_ip4_spec.ip4dst);
+        tmp = (tp->key[3] & TCAM_V4KEY3_SADDR) >> TCAM_V4KEY3_SADDR_SHIFT;
+        fsp->h_u.tcp_ip4_spec.ip4src = cpu_to_be32(tmp);
+
+        tmp = (tp->key[3] & TCAM_V4KEY3_DADDR) >> TCAM_V4KEY3_DADDR_SHIFT;
+        fsp->h_u.tcp_ip4_spec.ip4dst = cpu_to_be32(tmp);
+
+        tmp = (tp->key_mask[3] & TCAM_V4KEY3_SADDR) >> TCAM_V4KEY3_SADDR_SHIFT;
+        fsp->m_u.tcp_ip4_spec.ip4src = cpu_to_be32(tmp);
+
+        tmp = (tp->key_mask[3] & TCAM_V4KEY3_DADDR) >> TCAM_V4KEY3_DADDR_SHIFT;
+        fsp->m_u.tcp_ip4_spec.ip4dst = cpu_to_be32(tmp);
 
         fsp->h_u.tcp_ip4_spec.tos = (tp->key[2] & TCAM_V4KEY2_TOS) >>
                 TCAM_V4KEY2_TOS_SHIFT;
@@ -7118,54 +7114,40 @@ static void niu_get_ip4fs_from_tcam_key(struct niu_tcam_entry *tp,
         case TCP_V4_FLOW:
         case UDP_V4_FLOW:
         case SCTP_V4_FLOW:
-                fsp->h_u.tcp_ip4_spec.psrc =
-                        ((tp->key[2] & TCAM_V4KEY2_PORT_SPI) >>
-                         TCAM_V4KEY2_PORT_SPI_SHIFT) >> 16;
-                fsp->h_u.tcp_ip4_spec.pdst =
-                        ((tp->key[2] & TCAM_V4KEY2_PORT_SPI) >>
-                         TCAM_V4KEY2_PORT_SPI_SHIFT) & 0xffff;
-                fsp->m_u.tcp_ip4_spec.psrc =
-                        ((tp->key_mask[2] & TCAM_V4KEY2_PORT_SPI) >>
-                         TCAM_V4KEY2_PORT_SPI_SHIFT) >> 16;
-                fsp->m_u.tcp_ip4_spec.pdst =
-                        ((tp->key_mask[2] & TCAM_V4KEY2_PORT_SPI) >>
-                         TCAM_V4KEY2_PORT_SPI_SHIFT) & 0xffff;
+                prt = ((tp->key[2] & TCAM_V4KEY2_PORT_SPI) >>
+                        TCAM_V4KEY2_PORT_SPI_SHIFT) >> 16;
+                fsp->h_u.tcp_ip4_spec.psrc = cpu_to_be16(prt);
 
-                fsp->h_u.tcp_ip4_spec.psrc =
-                        cpu_to_be16(fsp->h_u.tcp_ip4_spec.psrc);
-                fsp->h_u.tcp_ip4_spec.pdst =
-                        cpu_to_be16(fsp->h_u.tcp_ip4_spec.pdst);
-                fsp->m_u.tcp_ip4_spec.psrc =
-                        cpu_to_be16(fsp->m_u.tcp_ip4_spec.psrc);
-                fsp->m_u.tcp_ip4_spec.pdst =
-                        cpu_to_be16(fsp->m_u.tcp_ip4_spec.pdst);
+                prt = ((tp->key[2] & TCAM_V4KEY2_PORT_SPI) >>
+                        TCAM_V4KEY2_PORT_SPI_SHIFT) & 0xffff;
+                fsp->h_u.tcp_ip4_spec.pdst = cpu_to_be16(prt);
+
+                prt = ((tp->key_mask[2] & TCAM_V4KEY2_PORT_SPI) >>
+                        TCAM_V4KEY2_PORT_SPI_SHIFT) >> 16;
+                fsp->m_u.tcp_ip4_spec.psrc = cpu_to_be16(prt);
+
+                prt = ((tp->key_mask[2] & TCAM_V4KEY2_PORT_SPI) >>
+                         TCAM_V4KEY2_PORT_SPI_SHIFT) & 0xffff;
+                fsp->m_u.tcp_ip4_spec.pdst = cpu_to_be16(prt);
                 break;
         case AH_V4_FLOW:
         case ESP_V4_FLOW:
-                fsp->h_u.ah_ip4_spec.spi =
-                        (tp->key[2] & TCAM_V4KEY2_PORT_SPI) >>
-                        TCAM_V4KEY2_PORT_SPI_SHIFT;
-                fsp->m_u.ah_ip4_spec.spi =
-                        (tp->key_mask[2] & TCAM_V4KEY2_PORT_SPI) >>
+                tmp = (tp->key[2] & TCAM_V4KEY2_PORT_SPI) >>
                         TCAM_V4KEY2_PORT_SPI_SHIFT;
+                fsp->h_u.ah_ip4_spec.spi = cpu_to_be32(tmp);
 
-                fsp->h_u.ah_ip4_spec.spi =
-                        cpu_to_be32(fsp->h_u.ah_ip4_spec.spi);
-                fsp->m_u.ah_ip4_spec.spi =
-                        cpu_to_be32(fsp->m_u.ah_ip4_spec.spi);
+                tmp = (tp->key_mask[2] & TCAM_V4KEY2_PORT_SPI) >>
+                        TCAM_V4KEY2_PORT_SPI_SHIFT;
+                fsp->m_u.ah_ip4_spec.spi = cpu_to_be32(tmp);
                 break;
         case IP_USER_FLOW:
-                fsp->h_u.usr_ip4_spec.l4_4_bytes =
-                        (tp->key[2] & TCAM_V4KEY2_PORT_SPI) >>
-                        TCAM_V4KEY2_PORT_SPI_SHIFT;
-                fsp->m_u.usr_ip4_spec.l4_4_bytes =
-                        (tp->key_mask[2] & TCAM_V4KEY2_PORT_SPI) >>
+                tmp = (tp->key[2] & TCAM_V4KEY2_PORT_SPI) >>
                         TCAM_V4KEY2_PORT_SPI_SHIFT;
+                fsp->h_u.usr_ip4_spec.l4_4_bytes = cpu_to_be32(tmp);
 
-                fsp->h_u.usr_ip4_spec.l4_4_bytes =
-                        cpu_to_be32(fsp->h_u.usr_ip4_spec.l4_4_bytes);
-                fsp->m_u.usr_ip4_spec.l4_4_bytes =
-                        cpu_to_be32(fsp->m_u.usr_ip4_spec.l4_4_bytes);
+                tmp = (tp->key_mask[2] & TCAM_V4KEY2_PORT_SPI) >>
+                        TCAM_V4KEY2_PORT_SPI_SHIFT;
+                fsp->m_u.usr_ip4_spec.l4_4_bytes = cpu_to_be32(tmp);
 
                 fsp->h_u.usr_ip4_spec.proto =
                         (tp->key[2] & TCAM_V4KEY2_PROTO) >>
@@ -7462,10 +7444,12 @@ static int niu_add_ethtool_tcam_entry(struct niu *np,
         if (fsp->flow_type == IP_USER_FLOW) {
                 int i;
                 int add_usr_cls = 0;
-                int ipv6 = 0;
                 struct ethtool_usrip4_spec *uspec = &fsp->h_u.usr_ip4_spec;
                 struct ethtool_usrip4_spec *umask = &fsp->m_u.usr_ip4_spec;
 
+                if (uspec->ip_ver != ETH_RX_NFC_IP4)
+                        return -EINVAL;
+
                 niu_lock_parent(np, flags);
 
                 for (i = 0; i < NIU_L3_PROG_CLS; i++) {
@@ -7494,9 +7478,7 @@ static int niu_add_ethtool_tcam_entry(struct niu *np,
                                 default:
                                         break;
                                 }
-                                if (uspec->ip_ver == ETH_RX_NFC_IP6)
-                                        ipv6 = 1;
-                                ret = tcam_user_ip_class_set(np, class, ipv6,
+                                ret = tcam_user_ip_class_set(np, class, 0,
                                                              uspec->proto,
                                                              uspec->tos,
                                                              umask->tos);
@@ -7553,16 +7535,7 @@ static int niu_add_ethtool_tcam_entry(struct niu *np,
                 ret = -EINVAL;
                 goto out;
         case IP_USER_FLOW:
-                if (fsp->h_u.usr_ip4_spec.ip_ver == ETH_RX_NFC_IP4) {
-                        niu_get_tcamkey_from_ip4fs(fsp, tp, l2_rdc_table,
-                                                   class);
-                } else {
-                        /* Not yet implemented */
-                        netdev_info(np->dev, "niu%d: In %s(): usr flow for IPv6 not implemented\n",
-                                    parent->index, __func__);
-                        ret = -EINVAL;
-                        goto out;
-                }
+                niu_get_tcamkey_from_ip4fs(fsp, tp, l2_rdc_table, class);
                 break;
         default:
                 netdev_info(np->dev, "niu%d: In %s(): Unknown flow type %d\n",
@@ -7805,11 +7778,11 @@ static int niu_get_sset_count(struct net_device *dev, int stringset)
         if (stringset != ETH_SS_STATS)
                 return -EINVAL;
 
-        return ((np->flags & NIU_FLAGS_XMAC ?
+        return (np->flags & NIU_FLAGS_XMAC ?
                  NUM_XMAC_STAT_KEYS :
                  NUM_BMAC_STAT_KEYS) +
                 (np->num_rx_rings * NUM_RXCHAN_STAT_KEYS) +
-                (np->num_tx_rings * NUM_TXCHAN_STAT_KEYS));
+                (np->num_tx_rings * NUM_TXCHAN_STAT_KEYS);
 }
 
 static void niu_get_ethtool_stats(struct net_device *dev,
diff --git a/drivers/net/ns83820.c b/drivers/net/ns83820.c
index 3bbd0aab17e8..84134c766f3a 100644
--- a/drivers/net/ns83820.c
+++ b/drivers/net/ns83820.c
@@ -772,7 +772,7 @@ static int ns83820_setup_rx(struct net_device *ndev)
                 phy_intr(ndev);
 
                 /* Okay, let it rip */
-                spin_lock_irq(&dev->misc_lock);
+                spin_lock(&dev->misc_lock);
                 dev->IMR_cache |= ISR_PHY;
                 dev->IMR_cache |= ISR_RXRCMP;
                 //dev->IMR_cache |= ISR_RXERR;
diff --git a/drivers/net/pch_gbe/Makefile b/drivers/net/pch_gbe/Makefile
new file mode 100644
index 000000000000..31288d4ad248
--- /dev/null
+++ b/drivers/net/pch_gbe/Makefile
@@ -0,0 +1,4 @@
+obj-$(CONFIG_PCH_GBE) += pch_gbe.o
+
+pch_gbe-y := pch_gbe_phy.o pch_gbe_ethtool.o pch_gbe_param.o
+pch_gbe-y += pch_gbe_api.o pch_gbe_main.o
diff --git a/drivers/net/pch_gbe/pch_gbe.h b/drivers/net/pch_gbe/pch_gbe.h
new file mode 100644
index 000000000000..a0c26a99520f
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe.h
@@ -0,0 +1,659 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#ifndef _PCH_GBE_H_
+#define _PCH_GBE_H_
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/mii.h>
+#include <linux/delay.h>
+#include <linux/pci.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/vmalloc.h>
+#include <net/ip.h>
+#include <net/tcp.h>
+#include <net/udp.h>
+
+/**
+ * pch_gbe_regs_mac_adr - Structure holding values of mac address registers
+ * @high        Denotes the 1st to 4th byte from the initial of MAC address
+ * @low         Denotes the 5th to 6th byte from the initial of MAC address
+ */
+struct pch_gbe_regs_mac_adr {
+        u32 high;
+        u32 low;
+};
+/**
+ * pch_udc_regs - Structure holding values of MAC registers
+ */
+struct pch_gbe_regs {
+        u32 INT_ST;
+        u32 INT_EN;
+        u32 MODE;
+        u32 RESET;
+        u32 TCPIP_ACC;
+        u32 EX_LIST;
+        u32 INT_ST_HOLD;
+        u32 PHY_INT_CTRL;
+        u32 MAC_RX_EN;
+        u32 RX_FCTRL;
+        u32 PAUSE_REQ;
+        u32 RX_MODE;
+        u32 TX_MODE;
+        u32 RX_FIFO_ST;
+        u32 TX_FIFO_ST;
+        u32 TX_FID;
+        u32 TX_RESULT;
+        u32 PAUSE_PKT1;
+        u32 PAUSE_PKT2;
+        u32 PAUSE_PKT3;
+        u32 PAUSE_PKT4;
+        u32 PAUSE_PKT5;
+        u32 reserve[2];
+        struct pch_gbe_regs_mac_adr mac_adr[16];
+        u32 ADDR_MASK;
+        u32 MIIM;
+        u32 reserve2;
+        u32 RGMII_ST;
+        u32 RGMII_CTRL;
+        u32 reserve3[3];
+        u32 DMA_CTRL;
+        u32 reserve4[3];
+        u32 RX_DSC_BASE;
+        u32 RX_DSC_SIZE;
+        u32 RX_DSC_HW_P;
+        u32 RX_DSC_HW_P_HLD;
+        u32 RX_DSC_SW_P;
+        u32 reserve5[3];
+        u32 TX_DSC_BASE;
+        u32 TX_DSC_SIZE;
+        u32 TX_DSC_HW_P;
+        u32 TX_DSC_HW_P_HLD;
+        u32 TX_DSC_SW_P;
+        u32 reserve6[3];
+        u32 RX_DMA_ST;
+        u32 TX_DMA_ST;
+        u32 reserve7[2];
+        u32 WOL_ST;
+        u32 WOL_CTRL;
+        u32 WOL_ADDR_MASK;
+};
+
+/* Interrupt Status */
+/* Interrupt Status Hold */
+/* Interrupt Enable */
+#define PCH_GBE_INT_RX_DMA_CMPLT  0x00000001 /* Receive DMA Transfer Complete */
+#define PCH_GBE_INT_RX_VALID      0x00000002 /* MAC Normal Receive Complete */
+#define PCH_GBE_INT_RX_FRAME_ERR  0x00000004 /* Receive frame error */
+#define PCH_GBE_INT_RX_FIFO_ERR   0x00000008 /* Receive FIFO Overflow */
+#define PCH_GBE_INT_RX_DMA_ERR    0x00000010 /* Receive DMA Transfer Error */
+#define PCH_GBE_INT_RX_DSC_EMP    0x00000020 /* Receive Descriptor Empty */
+#define PCH_GBE_INT_TX_CMPLT      0x00000100 /* MAC Transmission Complete */
+#define PCH_GBE_INT_TX_DMA_CMPLT  0x00000200 /* DMA Transfer Complete */
+#define PCH_GBE_INT_TX_FIFO_ERR   0x00000400 /* Transmission FIFO underflow. */
+#define PCH_GBE_INT_TX_DMA_ERR    0x00000800 /* Transmission DMA Error */
+#define PCH_GBE_INT_PAUSE_CMPLT   0x00001000 /* Pause Transmission complete */
+#define PCH_GBE_INT_MIIM_CMPLT    0x00010000 /* MIIM I/F Read completion */
+#define PCH_GBE_INT_PHY_INT       0x00100000 /* Interruption from PHY */
+#define PCH_GBE_INT_WOL_DET       0x01000000 /* Wake On LAN Event detection. */
+#define PCH_GBE_INT_TCPIP_ERR     0x10000000 /* TCP/IP Accelerator Error */
+
+/* Mode */
+#define PCH_GBE_MODE_MII_ETHER      0x00000000  /* GIGA Ethernet Mode [MII] */
+#define PCH_GBE_MODE_GMII_ETHER     0x80000000  /* GIGA Ethernet Mode [GMII] */
+#define PCH_GBE_MODE_HALF_DUPLEX    0x00000000  /* Duplex Mode [half duplex] */
+#define PCH_GBE_MODE_FULL_DUPLEX    0x40000000  /* Duplex Mode [full duplex] */
+#define PCH_GBE_MODE_FR_BST         0x04000000  /* Frame bursting is done */
+
+/* Reset */
+#define PCH_GBE_ALL_RST         0x80000000  /* All reset */
+#define PCH_GBE_TX_RST          0x40000000  /* TX MAC, TX FIFO, TX DMA reset */
+#define PCH_GBE_RX_RST          0x04000000  /* RX MAC, RX FIFO, RX DMA reset */
+
+/* TCP/IP Accelerator Control */
+#define PCH_GBE_EX_LIST_EN      0x00000008  /* External List Enable */
+#define PCH_GBE_RX_TCPIPACC_OFF 0x00000004  /* RX TCP/IP ACC Disabled */
+#define PCH_GBE_TX_TCPIPACC_EN  0x00000002  /* TX TCP/IP ACC Enable */
+#define PCH_GBE_RX_TCPIPACC_EN  0x00000001  /* RX TCP/IP ACC Enable */
+
+/* MAC RX Enable */
+#define PCH_GBE_MRE_MAC_RX_EN   0x00000001      /* MAC Receive Enable */
+
+/* RX Flow Control */
+#define PCH_GBE_FL_CTRL_EN      0x80000000  /* Pause packet is enabled */
+
+/* Pause Packet Request */
+#define PCH_GBE_PS_PKT_RQ       0x80000000  /* Pause packet Request */
+
+/* RX Mode */
+#define PCH_GBE_ADD_FIL_EN      0x80000000  /* Address Filtering Enable */
+/* Multicast Filtering Enable */
+#define PCH_GBE_MLT_FIL_EN      0x40000000
+/* Receive Almost Empty Threshold */
+#define PCH_GBE_RH_ALM_EMP_4    0x00000000      /* 4 words */
+#define PCH_GBE_RH_ALM_EMP_8    0x00004000      /* 8 words */
+#define PCH_GBE_RH_ALM_EMP_16   0x00008000      /* 16 words */
+#define PCH_GBE_RH_ALM_EMP_32   0x0000C000      /* 32 words */
+/* Receive Almost Full Threshold */
+#define PCH_GBE_RH_ALM_FULL_4   0x00000000      /* 4 words */
+#define PCH_GBE_RH_ALM_FULL_8   0x00001000      /* 8 words */
+#define PCH_GBE_RH_ALM_FULL_16  0x00002000      /* 16 words */
+#define PCH_GBE_RH_ALM_FULL_32  0x00003000      /* 32 words */
+/* RX FIFO Read Triger Threshold */
+#define PCH_GBE_RH_RD_TRG_4     0x00000000      /* 4 words */
+#define PCH_GBE_RH_RD_TRG_8     0x00000200      /* 8 words */
+#define PCH_GBE_RH_RD_TRG_16    0x00000400      /* 16 words */
+#define PCH_GBE_RH_RD_TRG_32    0x00000600      /* 32 words */
+#define PCH_GBE_RH_RD_TRG_64    0x00000800      /* 64 words */
+#define PCH_GBE_RH_RD_TRG_128   0x00000A00      /* 128 words */
+#define PCH_GBE_RH_RD_TRG_256   0x00000C00      /* 256 words */
+#define PCH_GBE_RH_RD_TRG_512   0x00000E00      /* 512 words */
+
+/* Receive Descriptor bit definitions */
+#define PCH_GBE_RXD_ACC_STAT_BCAST          0x00000400
+#define PCH_GBE_RXD_ACC_STAT_MCAST          0x00000200
+#define PCH_GBE_RXD_ACC_STAT_UCAST          0x00000100
+#define PCH_GBE_RXD_ACC_STAT_TCPIPOK        0x000000C0
+#define PCH_GBE_RXD_ACC_STAT_IPOK           0x00000080
+#define PCH_GBE_RXD_ACC_STAT_TCPOK          0x00000040
+#define PCH_GBE_RXD_ACC_STAT_IP6ERR         0x00000020
+#define PCH_GBE_RXD_ACC_STAT_OFLIST         0x00000010
+#define PCH_GBE_RXD_ACC_STAT_TYPEIP         0x00000008
+#define PCH_GBE_RXD_ACC_STAT_MACL           0x00000004
+#define PCH_GBE_RXD_ACC_STAT_PPPOE          0x00000002
+#define PCH_GBE_RXD_ACC_STAT_VTAGT          0x00000001
+#define PCH_GBE_RXD_GMAC_STAT_PAUSE         0x0200
+#define PCH_GBE_RXD_GMAC_STAT_MARBR         0x0100
+#define PCH_GBE_RXD_GMAC_STAT_MARMLT        0x0080
+#define PCH_GBE_RXD_GMAC_STAT_MARIND        0x0040
+#define PCH_GBE_RXD_GMAC_STAT_MARNOTMT      0x0020
+#define PCH_GBE_RXD_GMAC_STAT_TLONG         0x0010
+#define PCH_GBE_RXD_GMAC_STAT_TSHRT         0x0008
+#define PCH_GBE_RXD_GMAC_STAT_NOTOCTAL      0x0004
+#define PCH_GBE_RXD_GMAC_STAT_NBLERR        0x0002
+#define PCH_GBE_RXD_GMAC_STAT_CRCERR        0x0001
+
+/* Transmit Descriptor bit definitions */
+#define PCH_GBE_TXD_CTRL_TCPIP_ACC_OFF      0x0008
+#define PCH_GBE_TXD_CTRL_ITAG               0x0004
+#define PCH_GBE_TXD_CTRL_ICRC               0x0002
+#define PCH_GBE_TXD_CTRL_APAD               0x0001
+#define PCH_GBE_TXD_WORDS_SHIFT             2
+#define PCH_GBE_TXD_GMAC_STAT_CMPLT         0x2000
+#define PCH_GBE_TXD_GMAC_STAT_ABT           0x1000
+#define PCH_GBE_TXD_GMAC_STAT_EXCOL         0x0800
+#define PCH_GBE_TXD_GMAC_STAT_SNGCOL        0x0400
+#define PCH_GBE_TXD_GMAC_STAT_MLTCOL        0x0200
+#define PCH_GBE_TXD_GMAC_STAT_CRSER         0x0100
+#define PCH_GBE_TXD_GMAC_STAT_TLNG          0x0080
+#define PCH_GBE_TXD_GMAC_STAT_TSHRT         0x0040
+#define PCH_GBE_TXD_GMAC_STAT_LTCOL         0x0020
+#define PCH_GBE_TXD_GMAC_STAT_TFUNDFLW      0x0010
+#define PCH_GBE_TXD_GMAC_STAT_RTYCNT_MASK   0x000F
+
+/* TX Mode */
+#define PCH_GBE_TM_NO_RTRY     0x80000000 /* No Retransmission */
+#define PCH_GBE_TM_LONG_PKT    0x40000000 /* Long Packt TX Enable */
+#define PCH_GBE_TM_ST_AND_FD   0x20000000 /* Stare and Forward */
+#define PCH_GBE_TM_SHORT_PKT   0x10000000 /* Short Packet TX Enable */
+#define PCH_GBE_TM_LTCOL_RETX  0x08000000 /* Retransmission at Late Collision */
+/* Frame Start Threshold */
+#define PCH_GBE_TM_TH_TX_STRT_4    0x00000000    /* 4 words */
+#define PCH_GBE_TM_TH_TX_STRT_8    0x00004000    /* 8 words */
+#define PCH_GBE_TM_TH_TX_STRT_16   0x00008000    /* 16 words */
+#define PCH_GBE_TM_TH_TX_STRT_32   0x0000C000    /* 32 words */
+/* Transmit Almost Empty Threshold */
+#define PCH_GBE_TM_TH_ALM_EMP_4    0x00000000    /* 4 words */
+#define PCH_GBE_TM_TH_ALM_EMP_8    0x00000800    /* 8 words */
+#define PCH_GBE_TM_TH_ALM_EMP_16   0x00001000    /* 16 words */
+#define PCH_GBE_TM_TH_ALM_EMP_32   0x00001800    /* 32 words */
+#define PCH_GBE_TM_TH_ALM_EMP_64   0x00002000    /* 64 words */
+#define PCH_GBE_TM_TH_ALM_EMP_128  0x00002800    /* 128 words */
+#define PCH_GBE_TM_TH_ALM_EMP_256  0x00003000    /* 256 words */
+#define PCH_GBE_TM_TH_ALM_EMP_512  0x00003800    /* 512 words */
+/* Transmit Almost Full Threshold */
+#define PCH_GBE_TM_TH_ALM_FULL_4   0x00000000    /* 4 words */
+#define PCH_GBE_TM_TH_ALM_FULL_8   0x00000200    /* 8 words */
+#define PCH_GBE_TM_TH_ALM_FULL_16  0x00000400    /* 16 words */
+#define PCH_GBE_TM_TH_ALM_FULL_32  0x00000600    /* 32 words */
+
+/* RX FIFO Status */
+#define PCH_GBE_RF_ALM_FULL     0x80000000  /* RX FIFO is almost full. */
+#define PCH_GBE_RF_ALM_EMP      0x40000000  /* RX FIFO is almost empty. */
+#define PCH_GBE_RF_RD_TRG       0x20000000  /* Become more than RH_RD_TRG. */
+#define PCH_GBE_RF_STRWD        0x1FFE0000  /* The word count of RX FIFO. */
+#define PCH_GBE_RF_RCVING       0x00010000  /* Stored in RX FIFO. */
+
+/* MAC Address Mask */
+#define PCH_GBE_BUSY                0x80000000
+
+/* MIIM  */
+#define PCH_GBE_MIIM_OPER_WRITE     0x04000000
+#define PCH_GBE_MIIM_OPER_READ      0x00000000
+#define PCH_GBE_MIIM_OPER_READY     0x04000000
+#define PCH_GBE_MIIM_PHY_ADDR_SHIFT 21
+#define PCH_GBE_MIIM_REG_ADDR_SHIFT 16
+
+/* RGMII Status */
+#define PCH_GBE_LINK_UP             0x80000008
+#define PCH_GBE_RXC_SPEED_MSK       0x00000006
+#define PCH_GBE_RXC_SPEED_2_5M      0x00000000    /* 2.5MHz */
+#define PCH_GBE_RXC_SPEED_25M       0x00000002    /* 25MHz  */
+#define PCH_GBE_RXC_SPEED_125M      0x00000004    /* 100MHz */
+#define PCH_GBE_DUPLEX_FULL         0x00000001
+
+/* RGMII Control */
+#define PCH_GBE_CRS_SEL             0x00000010
+#define PCH_GBE_RGMII_RATE_125M     0x00000000
+#define PCH_GBE_RGMII_RATE_25M      0x00000008
+#define PCH_GBE_RGMII_RATE_2_5M     0x0000000C
+#define PCH_GBE_RGMII_MODE_GMII     0x00000000
+#define PCH_GBE_RGMII_MODE_RGMII    0x00000002
+#define PCH_GBE_CHIP_TYPE_EXTERNAL  0x00000000
+#define PCH_GBE_CHIP_TYPE_INTERNAL  0x00000001
+
+/* DMA Control */
+#define PCH_GBE_RX_DMA_EN       0x00000002   /* Enables Receive DMA */
+#define PCH_GBE_TX_DMA_EN       0x00000001   /* Enables Transmission DMA */
+
+/* Wake On LAN Status */
+#define PCH_GBE_WLS_BR          0x00000008 /* Broadcas Address */
+#define PCH_GBE_WLS_MLT         0x00000004 /* Multicast Address */
+
+/* The Frame registered in Address Recognizer */
+#define PCH_GBE_WLS_IND         0x00000002
+#define PCH_GBE_WLS_MP          0x00000001 /* Magic packet Address */
+
+/* Wake On LAN Control */
+#define PCH_GBE_WLC_WOL_MODE    0x00010000
+#define PCH_GBE_WLC_IGN_TLONG   0x00000100
+#define PCH_GBE_WLC_IGN_TSHRT   0x00000080
+#define PCH_GBE_WLC_IGN_OCTER   0x00000040
+#define PCH_GBE_WLC_IGN_NBLER   0x00000020
+#define PCH_GBE_WLC_IGN_CRCER   0x00000010
+#define PCH_GBE_WLC_BR          0x00000008
+#define PCH_GBE_WLC_MLT         0x00000004
+#define PCH_GBE_WLC_IND         0x00000002
+#define PCH_GBE_WLC_MP          0x00000001
+
+/* Wake On LAN Address Mask */
+#define PCH_GBE_WLA_BUSY        0x80000000
+
+
+
+/* TX/RX descriptor defines */
+#define PCH_GBE_MAX_TXD                     4096
+#define PCH_GBE_DEFAULT_TXD                  256
+#define PCH_GBE_MIN_TXD                        8
+#define PCH_GBE_MAX_RXD                     4096
+#define PCH_GBE_DEFAULT_RXD                  256
+#define PCH_GBE_MIN_RXD                        8
+
+/* Number of Transmit and Receive Descriptors must be a multiple of 8 */
+#define PCH_GBE_TX_DESC_MULTIPLE               8
+#define PCH_GBE_RX_DESC_MULTIPLE               8
+
+/* Read/Write operation is done through MII Management IF */
+#define PCH_GBE_HAL_MIIM_READ          ((u32)0x00000000)
+#define PCH_GBE_HAL_MIIM_WRITE         ((u32)0x04000000)
+
+/* flow control values */
+#define PCH_GBE_FC_NONE                 0
+#define PCH_GBE_FC_RX_PAUSE             1
+#define PCH_GBE_FC_TX_PAUSE             2
+#define PCH_GBE_FC_FULL                 3
+#define PCH_GBE_FC_DEFAULT              PCH_GBE_FC_FULL
+
+
+struct pch_gbe_hw;
+/**
+ * struct  pch_gbe_functions - HAL APi function pointer
+ * @get_bus_info:       for pch_gbe_hal_get_bus_info
+ * @init_hw:            for pch_gbe_hal_init_hw
+ * @read_phy_reg:       for pch_gbe_hal_read_phy_reg
+ * @write_phy_reg:      for pch_gbe_hal_write_phy_reg
+ * @reset_phy:          for pch_gbe_hal_phy_hw_reset
+ * @sw_reset_phy:       for pch_gbe_hal_phy_sw_reset
+ * @power_up_phy:       for pch_gbe_hal_power_up_phy
+ * @power_down_phy:     for pch_gbe_hal_power_down_phy
+ * @read_mac_addr:      for pch_gbe_hal_read_mac_addr
+ */
+struct pch_gbe_functions {
+        void (*get_bus_info) (struct pch_gbe_hw *);
+        s32 (*init_hw) (struct pch_gbe_hw *);
+        s32 (*read_phy_reg) (struct pch_gbe_hw *, u32, u16 *);
+        s32 (*write_phy_reg) (struct pch_gbe_hw *, u32, u16);
+        void (*reset_phy) (struct pch_gbe_hw *);
+        void (*sw_reset_phy) (struct pch_gbe_hw *);
+        void (*power_up_phy) (struct pch_gbe_hw *hw);
+        void (*power_down_phy) (struct pch_gbe_hw *hw);
+        s32 (*read_mac_addr) (struct pch_gbe_hw *);
+};
+
+/**
+ * struct pch_gbe_mac_info - MAC infomation
+ * @addr[6]:            Store the MAC address
+ * @fc:                 Mode of flow control
+ * @fc_autoneg:         Auto negotiation enable for flow control setting
+ * @tx_fc_enable:       Enable flag of Transmit flow control
+ * @max_frame_size:     Max transmit frame size
+ * @min_frame_size:     Min transmit frame size
+ * @autoneg:            Auto negotiation enable
+ * @link_speed:         Link speed
+ * @link_duplex:        Link duplex
+ */
+struct pch_gbe_mac_info {
+        u8 addr[6];
+        u8 fc;
+        u8 fc_autoneg;
+        u8 tx_fc_enable;
+        u32 max_frame_size;
+        u32 min_frame_size;
+        u8 autoneg;
+        u16 link_speed;
+        u16 link_duplex;
+};
+
+/**
+ * struct pch_gbe_phy_info - PHY infomation
+ * @addr:               PHY address
+ * @id:                 PHY's identifier
+ * @revision:           PHY's revision
+ * @reset_delay_us:     HW reset delay time[us]
+ * @autoneg_advertised: Autoneg advertised
+ */
+struct pch_gbe_phy_info {
+        u32 addr;
+        u32 id;
+        u32 revision;
+        u32 reset_delay_us;
+        u16 autoneg_advertised;
+};
+
+/*!
+ * @ingroup Gigabit Ether driver Layer
+ * @struct  pch_gbe_bus_info
+ * @brief   Bus infomation
+ */
+struct pch_gbe_bus_info {
+        u8 type;
+        u8 speed;
+        u8 width;
+};
+
+/*!
+ * @ingroup Gigabit Ether driver Layer
+ * @struct  pch_gbe_hw
+ * @brief   Hardware infomation
+ */
+struct pch_gbe_hw {
+        void *back;
+
+        struct pch_gbe_regs  __iomem *reg;
+        spinlock_t miim_lock;
+
+        const struct pch_gbe_functions *func;
+        struct pch_gbe_mac_info mac;
+        struct pch_gbe_phy_info phy;
+        struct pch_gbe_bus_info bus;
+};
+
+/**
+ * struct pch_gbe_rx_desc - Receive Descriptor
+ * @buffer_addr:        RX Frame Buffer Address
+ * @tcp_ip_status:      TCP/IP Accelerator Status
+ * @rx_words_eob:       RX word count and Byte position
+ * @gbec_status:        GMAC Status
+ * @dma_status:         DMA Status
+ * @reserved1:          Reserved
+ * @reserved2:          Reserved
+ */
+struct pch_gbe_rx_desc {
+        u32 buffer_addr;
+        u32 tcp_ip_status;
+        u16 rx_words_eob;
+        u16 gbec_status;
+        u8 dma_status;
+        u8 reserved1;
+        u16 reserved2;
+};
+
+/**
+ * struct pch_gbe_tx_desc - Transmit Descriptor
+ * @buffer_addr:        TX Frame Buffer Address
+ * @length:             Data buffer length
+ * @reserved1:          Reserved
+ * @tx_words_eob:       TX word count and Byte position
+ * @tx_frame_ctrl:      TX Frame Control
+ * @dma_status:         DMA Status
+ * @reserved2:          Reserved
+ * @gbec_status:        GMAC Status
+ */
+struct pch_gbe_tx_desc {
+        u32 buffer_addr;
+        u16 length;
+        u16 reserved1;
+        u16 tx_words_eob;
+        u16 tx_frame_ctrl;
+        u8 dma_status;
+        u8 reserved2;
+        u16 gbec_status;
+};
+
+
+/**
+ * struct pch_gbe_buffer - Buffer infomation
+ * @skb:        pointer to a socket buffer
+ * @dma:        DMA address
+ * @time_stamp: time stamp
+ * @length:     data size
+ */
+struct pch_gbe_buffer {
+        struct sk_buff *skb;
+        dma_addr_t dma;
+        unsigned long time_stamp;
+        u16 length;
+        bool mapped;
+};
+
+/**
+ * struct pch_gbe_tx_ring - tx ring infomation
+ * @tx_lock:    spinlock structs
+ * @desc:       pointer to the descriptor ring memory
+ * @dma:        physical address of the descriptor ring
+ * @size:       length of descriptor ring in bytes
+ * @count:      number of descriptors in the ring
+ * @next_to_use:        next descriptor to associate a buffer with
+ * @next_to_clean:      next descriptor to check for DD status bit
+ * @buffer_info:        array of buffer information structs
+ */
+struct pch_gbe_tx_ring {
+        spinlock_t tx_lock;
+        struct pch_gbe_tx_desc *desc;
+        dma_addr_t dma;
+        unsigned int size;
+        unsigned int count;
+        unsigned int next_to_use;
+        unsigned int next_to_clean;
+        struct pch_gbe_buffer *buffer_info;
+};
+
+/**
+ * struct pch_gbe_rx_ring - rx ring infomation
+ * @desc:       pointer to the descriptor ring memory
+ * @dma:        physical address of the descriptor ring
+ * @size:       length of descriptor ring in bytes
+ * @count:      number of descriptors in the ring
+ * @next_to_use:        next descriptor to associate a buffer with
+ * @next_to_clean:      next descriptor to check for DD status bit
+ * @buffer_info:        array of buffer information structs
+ */
+struct pch_gbe_rx_ring {
+        struct pch_gbe_rx_desc *desc;
+        dma_addr_t dma;
+        unsigned int size;
+        unsigned int count;
+        unsigned int next_to_use;
+        unsigned int next_to_clean;
+        struct pch_gbe_buffer *buffer_info;
+};
+
+/**
+ * struct pch_gbe_hw_stats - Statistics counters collected by the MAC
+ * @rx_packets:             total packets received
+ * @tx_packets:             total packets transmitted
+ * @rx_bytes:               total bytes received
+ * @tx_bytes:               total bytes transmitted
+ * @rx_errors:              bad packets received
+ * @tx_errors:              packet transmit problems
+ * @rx_dropped:             no space in Linux buffers
+ * @tx_dropped:             no space available in Linux
+ * @multicast:              multicast packets received
+ * @collisions:             collisions
+ * @rx_crc_errors:          received packet with crc error
+ * @rx_frame_errors:        received frame alignment error
+ * @rx_alloc_buff_failed:   allocate failure of a receive buffer
+ * @tx_length_errors:       transmit length error
+ * @tx_aborted_errors:      transmit aborted error
+ * @tx_carrier_errors:      transmit carrier error
+ * @tx_timeout_count:       Number of transmit timeout
+ * @tx_restart_count:       Number of transmit restert
+ * @intr_rx_dsc_empty_count:    Interrupt count of receive descriptor empty
+ * @intr_rx_frame_err_count:    Interrupt count of receive frame error
+ * @intr_rx_fifo_err_count:     Interrupt count of receive FIFO error
+ * @intr_rx_dma_err_count:      Interrupt count of receive DMA error
+ * @intr_tx_fifo_err_count:     Interrupt count of transmit FIFO error
+ * @intr_tx_dma_err_count:      Interrupt count of transmit DMA error
+ * @intr_tcpip_err_count:       Interrupt count of TCP/IP Accelerator
+ */
+struct pch_gbe_hw_stats {
+        u32 rx_packets;
+        u32 tx_packets;
+        u32 rx_bytes;
+        u32 tx_bytes;
+        u32 rx_errors;
+        u32 tx_errors;
+        u32 rx_dropped;
+        u32 tx_dropped;
+        u32 multicast;
+        u32 collisions;
+        u32 rx_crc_errors;
+        u32 rx_frame_errors;
+        u32 rx_alloc_buff_failed;
+        u32 tx_length_errors;
+        u32 tx_aborted_errors;
+        u32 tx_carrier_errors;
+        u32 tx_timeout_count;
+        u32 tx_restart_count;
+        u32 intr_rx_dsc_empty_count;
+        u32 intr_rx_frame_err_count;
+        u32 intr_rx_fifo_err_count;
+        u32 intr_rx_dma_err_count;
+        u32 intr_tx_fifo_err_count;
+        u32 intr_tx_dma_err_count;
+        u32 intr_tcpip_err_count;
+};
+
+/**
+ * struct pch_gbe_adapter - board specific private data structure
+ * @stats_lock: Spinlock structure for status
+ * @tx_queue_lock:      Spinlock structure for transmit
+ * @ethtool_lock:       Spinlock structure for ethtool
+ * @irq_sem:            Semaphore for interrupt
+ * @netdev:             Pointer of network device structure
+ * @pdev:               Pointer of pci device structure
+ * @polling_netdev:     Pointer of polling network device structure
+ * @napi:               NAPI structure
+ * @hw:                 Pointer of hardware structure
+ * @stats:              Hardware status
+ * @reset_task:         Reset task
+ * @mii:                MII information structure
+ * @watchdog_timer:     Watchdog timer list
+ * @wake_up_evt:        Wake up event
+ * @config_space:       Configuration space
+ * @msg_enable:         Driver message level
+ * @led_status:         LED status
+ * @tx_ring:            Pointer of Tx descriptor ring structure
+ * @rx_ring:            Pointer of Rx descriptor ring structure
+ * @rx_buffer_len:      Receive buffer length
+ * @tx_queue_len:       Transmit queue length
+ * @rx_csum:            Receive TCP/IP checksum enable/disable
+ * @tx_csum:            Transmit TCP/IP checksum enable/disable
+ * @have_msi:           PCI MSI mode flag
+ */
+
+struct pch_gbe_adapter {
+        spinlock_t stats_lock;
+        spinlock_t tx_queue_lock;
+        spinlock_t ethtool_lock;
+        atomic_t irq_sem;
+        struct net_device *netdev;
+        struct pci_dev *pdev;
+        struct net_device *polling_netdev;
+        struct napi_struct napi;
+        struct pch_gbe_hw hw;
+        struct pch_gbe_hw_stats stats;
+        struct work_struct reset_task;
+        struct mii_if_info mii;
+        struct timer_list watchdog_timer;
+        u32 wake_up_evt;
+        u32 *config_space;
+        unsigned long led_status;
+        struct pch_gbe_tx_ring *tx_ring;
+        struct pch_gbe_rx_ring *rx_ring;
+        unsigned long rx_buffer_len;
+        unsigned long tx_queue_len;
+        bool rx_csum;
+        bool tx_csum;
+        bool have_msi;
+};
+
+extern const char pch_driver_version[];
+
+/* pch_gbe_main.c */
+extern int pch_gbe_up(struct pch_gbe_adapter *adapter);
+extern void pch_gbe_down(struct pch_gbe_adapter *adapter);
+extern void pch_gbe_reinit_locked(struct pch_gbe_adapter *adapter);
+extern void pch_gbe_reset(struct pch_gbe_adapter *adapter);
+extern int pch_gbe_setup_tx_resources(struct pch_gbe_adapter *adapter,
+                                       struct pch_gbe_tx_ring *txdr);
+extern int pch_gbe_setup_rx_resources(struct pch_gbe_adapter *adapter,
+                                       struct pch_gbe_rx_ring *rxdr);
+extern void pch_gbe_free_tx_resources(struct pch_gbe_adapter *adapter,
+                                       struct pch_gbe_tx_ring *tx_ring);
+extern void pch_gbe_free_rx_resources(struct pch_gbe_adapter *adapter,
+                                       struct pch_gbe_rx_ring *rx_ring);
+extern void pch_gbe_update_stats(struct pch_gbe_adapter *adapter);
+
+/* pch_gbe_param.c */
+extern void pch_gbe_check_options(struct pch_gbe_adapter *adapter);
+
+/* pch_gbe_ethtool.c */
+extern void pch_gbe_set_ethtool_ops(struct net_device *netdev);
+
+/* pch_gbe_mac.c */
+extern s32 pch_gbe_mac_force_mac_fc(struct pch_gbe_hw *hw);
+extern s32 pch_gbe_mac_read_mac_addr(struct pch_gbe_hw *hw);
+extern u16 pch_gbe_mac_ctrl_miim(struct pch_gbe_hw *hw,
+                                  u32 addr, u32 dir, u32 reg, u16 data);
+#endif /* _PCH_GBE_H_ */
diff --git a/drivers/net/pch_gbe/pch_gbe_api.c b/drivers/net/pch_gbe/pch_gbe_api.c
new file mode 100644
index 000000000000..e48f084ad226
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_api.c
@@ -0,0 +1,245 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+#include "pch_gbe.h"
+#include "pch_gbe_phy.h"
+
+/* bus type values */
+#define pch_gbe_bus_type_unknown        0
+#define pch_gbe_bus_type_pci            1
+#define pch_gbe_bus_type_pcix           2
+#define pch_gbe_bus_type_pci_express    3
+#define pch_gbe_bus_type_reserved       4
+
+/* bus speed values */
+#define pch_gbe_bus_speed_unknown       0
+#define pch_gbe_bus_speed_33            1
+#define pch_gbe_bus_speed_66            2
+#define pch_gbe_bus_speed_100           3
+#define pch_gbe_bus_speed_120           4
+#define pch_gbe_bus_speed_133           5
+#define pch_gbe_bus_speed_2500          6
+#define pch_gbe_bus_speed_reserved      7
+
+/* bus width values */
+#define pch_gbe_bus_width_unknown       0
+#define pch_gbe_bus_width_pcie_x1       1
+#define pch_gbe_bus_width_pcie_x2       2
+#define pch_gbe_bus_width_pcie_x4       4
+#define pch_gbe_bus_width_32            5
+#define pch_gbe_bus_width_64            6
+#define pch_gbe_bus_width_reserved      7
+
+/**
+ * pch_gbe_plat_get_bus_info - Obtain bus information for adapter
+ * @hw: Pointer to the HW structure
+ */
+static void pch_gbe_plat_get_bus_info(struct pch_gbe_hw *hw)
+{
+        hw->bus.type  = pch_gbe_bus_type_pci_express;
+        hw->bus.speed = pch_gbe_bus_speed_2500;
+        hw->bus.width = pch_gbe_bus_width_pcie_x1;
+}
+
+/**
+ * pch_gbe_plat_init_hw - Initialize hardware
+ * @hw: Pointer to the HW structure
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed-EBUSY
+ */
+static s32 pch_gbe_plat_init_hw(struct pch_gbe_hw *hw)
+{
+        s32 ret_val;
+
+        ret_val = pch_gbe_phy_get_id(hw);
+        if (ret_val) {
+                pr_err("pch_gbe_phy_get_id error\n");
+                return ret_val;
+        }
+        pch_gbe_phy_init_setting(hw);
+        /* Setup Mac interface option RGMII */
+#ifdef PCH_GBE_MAC_IFOP_RGMII
+        pch_gbe_phy_set_rgmii(hw);
+#endif
+        return ret_val;
+}
+
+static const struct pch_gbe_functions pch_gbe_ops = {
+        .get_bus_info      = pch_gbe_plat_get_bus_info,
+        .init_hw           = pch_gbe_plat_init_hw,
+        .read_phy_reg      = pch_gbe_phy_read_reg_miic,
+        .write_phy_reg     = pch_gbe_phy_write_reg_miic,
+        .reset_phy         = pch_gbe_phy_hw_reset,
+        .sw_reset_phy      = pch_gbe_phy_sw_reset,
+        .power_up_phy      = pch_gbe_phy_power_up,
+        .power_down_phy    = pch_gbe_phy_power_down,
+        .read_mac_addr     = pch_gbe_mac_read_mac_addr
+};
+
+/**
+ * pch_gbe_plat_init_function_pointers - Init func ptrs
+ * @hw: Pointer to the HW structure
+ */
+static void pch_gbe_plat_init_function_pointers(struct pch_gbe_hw *hw)
+{
+        /* Set PHY parameter */
+        hw->phy.reset_delay_us     = PCH_GBE_PHY_RESET_DELAY_US;
+        /* Set function pointers */
+        hw->func = &pch_gbe_ops;
+}
+
+/**
+ * pch_gbe_hal_setup_init_funcs - Initializes function pointers
+ * @hw: Pointer to the HW structure
+ * Returns
+ *      0:      Successfully
+ *      ENOSYS: Function is not registered
+ */
+inline s32 pch_gbe_hal_setup_init_funcs(struct pch_gbe_hw *hw)
+{
+        if (!hw->reg) {
+                pr_err("ERROR: Registers not mapped\n");
+                return -ENOSYS;
+        }
+        pch_gbe_plat_init_function_pointers(hw);
+        return 0;
+}
+
+/**
+ * pch_gbe_hal_get_bus_info - Obtain bus information for adapter
+ * @hw: Pointer to the HW structure
+ */
+inline void pch_gbe_hal_get_bus_info(struct pch_gbe_hw *hw)
+{
+        if (!hw->func->get_bus_info)
+                pr_err("ERROR: configuration\n");
+        else
+                hw->func->get_bus_info(hw);
+}
+
+/**
+ * pch_gbe_hal_init_hw - Initialize hardware
+ * @hw: Pointer to the HW structure
+ * Returns
+ *      0:      Successfully
+ *      ENOSYS: Function is not registered
+ */
+inline s32 pch_gbe_hal_init_hw(struct pch_gbe_hw *hw)
+{
+        if (!hw->func->init_hw) {
+                pr_err("ERROR: configuration\n");
+                return -ENOSYS;
+        }
+        return hw->func->init_hw(hw);
+}
+
+/**
+ * pch_gbe_hal_read_phy_reg - Reads PHY register
+ * @hw:     Pointer to the HW structure
+ * @offset: The register to read
+ * @data:   The buffer to store the 16-bit read.
+ * Returns
+ *      0:      Successfully
+ *      Negative value: Failed
+ */
+inline s32 pch_gbe_hal_read_phy_reg(struct pch_gbe_hw *hw, u32 offset,
+                                        u16 *data)
+{
+        if (!hw->func->read_phy_reg)
+                return 0;
+        return hw->func->read_phy_reg(hw, offset, data);
+}
+
+/**
+ * pch_gbe_hal_write_phy_reg - Writes PHY register
+ * @hw:     Pointer to the HW structure
+ * @offset: The register to read
+ * @data:   The value to write.
+ * Returns
+ *      0:      Successfully
+ *      Negative value: Failed
+ */
+inline s32 pch_gbe_hal_write_phy_reg(struct pch_gbe_hw *hw, u32 offset,
+                                        u16 data)
+{
+        if (!hw->func->write_phy_reg)
+                return 0;
+        return hw->func->write_phy_reg(hw, offset, data);
+}
+
+/**
+ * pch_gbe_hal_phy_hw_reset - Hard PHY reset
+ * @hw:     Pointer to the HW structure
+ */
+inline void pch_gbe_hal_phy_hw_reset(struct pch_gbe_hw *hw)
+{
+        if (!hw->func->reset_phy)
+                pr_err("ERROR: configuration\n");
+        else
+                hw->func->reset_phy(hw);
+}
+
+/**
+ * pch_gbe_hal_phy_sw_reset - Soft PHY reset
+ * @hw:     Pointer to the HW structure
+ */
+inline void pch_gbe_hal_phy_sw_reset(struct pch_gbe_hw *hw)
+{
+        if (!hw->func->sw_reset_phy)
+                pr_err("ERROR: configuration\n");
+        else
+                hw->func->sw_reset_phy(hw);
+}
+
+/**
+ * pch_gbe_hal_read_mac_addr - Reads MAC address
+ * @hw: Pointer to the HW structure
+ * Returns
+ *      0:      Successfully
+ *      ENOSYS: Function is not registered
+ */
+inline s32 pch_gbe_hal_read_mac_addr(struct pch_gbe_hw *hw)
+{
+        if (!hw->func->read_mac_addr) {
+                pr_err("ERROR: configuration\n");
+                return -ENOSYS;
+        }
+        return hw->func->read_mac_addr(hw);
+}
+
+/**
+ * pch_gbe_hal_power_up_phy - Power up PHY
+ * @hw: Pointer to the HW structure
+ */
+inline void pch_gbe_hal_power_up_phy(struct pch_gbe_hw *hw)
+{
+        if (hw->func->power_up_phy)
+                hw->func->power_up_phy(hw);
+}
+
+/**
+ * pch_gbe_hal_power_down_phy - Power down PHY
+ * @hw: Pointer to the HW structure
+ */
+inline void pch_gbe_hal_power_down_phy(struct pch_gbe_hw *hw)
+{
+        if (hw->func->power_down_phy)
+                hw->func->power_down_phy(hw);
+}
diff --git a/drivers/net/pch_gbe/pch_gbe_api.h b/drivers/net/pch_gbe/pch_gbe_api.h
new file mode 100644
index 000000000000..94aaac5b057b
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_api.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+#ifndef _PCH_GBE_API_H_
+#define _PCH_GBE_API_H_
+
+#include "pch_gbe_phy.h"
+
+s32 pch_gbe_hal_setup_init_funcs(struct pch_gbe_hw *hw);
+void pch_gbe_hal_get_bus_info(struct pch_gbe_hw *hw);
+s32 pch_gbe_hal_init_hw(struct pch_gbe_hw *hw);
+s32 pch_gbe_hal_read_phy_reg(struct pch_gbe_hw *hw, u32 offset, u16 *data);
+s32 pch_gbe_hal_write_phy_reg(struct pch_gbe_hw *hw, u32 offset, u16 data);
+void pch_gbe_hal_phy_hw_reset(struct pch_gbe_hw *hw);
+void pch_gbe_hal_phy_sw_reset(struct pch_gbe_hw *hw);
+s32 pch_gbe_hal_read_mac_addr(struct pch_gbe_hw *hw);
+void pch_gbe_hal_power_up_phy(struct pch_gbe_hw *hw);
+void pch_gbe_hal_power_down_phy(struct pch_gbe_hw *hw);
+
+#endif
diff --git a/drivers/net/pch_gbe/pch_gbe_ethtool.c b/drivers/net/pch_gbe/pch_gbe_ethtool.c
new file mode 100644
index 000000000000..c8cc32c0edc9
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_ethtool.c
@@ -0,0 +1,585 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+#include "pch_gbe.h"
+#include "pch_gbe_api.h"
+
+/**
+ * pch_gbe_stats - Stats item infomation
+ */
+struct pch_gbe_stats {
+        char string[ETH_GSTRING_LEN];
+        size_t size;
+        size_t offset;
+};
+
+#define PCH_GBE_STAT(m)                                         \
+{                                                               \
+        .string = #m,                                           \
+        .size = FIELD_SIZEOF(struct pch_gbe_hw_stats, m),       \
+        .offset = offsetof(struct pch_gbe_hw_stats, m),         \
+}
+
+/**
+ * pch_gbe_gstrings_stats - ethtool information status name list
+ */
+static const struct pch_gbe_stats pch_gbe_gstrings_stats[] = {
+        PCH_GBE_STAT(rx_packets),
+        PCH_GBE_STAT(tx_packets),
+        PCH_GBE_STAT(rx_bytes),
+        PCH_GBE_STAT(tx_bytes),
+        PCH_GBE_STAT(rx_errors),
+        PCH_GBE_STAT(tx_errors),
+        PCH_GBE_STAT(rx_dropped),
+        PCH_GBE_STAT(tx_dropped),
+        PCH_GBE_STAT(multicast),
+        PCH_GBE_STAT(collisions),
+        PCH_GBE_STAT(rx_crc_errors),
+        PCH_GBE_STAT(rx_frame_errors),
+        PCH_GBE_STAT(rx_alloc_buff_failed),
+        PCH_GBE_STAT(tx_length_errors),
+        PCH_GBE_STAT(tx_aborted_errors),
+        PCH_GBE_STAT(tx_carrier_errors),
+        PCH_GBE_STAT(tx_timeout_count),
+        PCH_GBE_STAT(tx_restart_count),
+        PCH_GBE_STAT(intr_rx_dsc_empty_count),
+        PCH_GBE_STAT(intr_rx_frame_err_count),
+        PCH_GBE_STAT(intr_rx_fifo_err_count),
+        PCH_GBE_STAT(intr_rx_dma_err_count),
+        PCH_GBE_STAT(intr_tx_fifo_err_count),
+        PCH_GBE_STAT(intr_tx_dma_err_count),
+        PCH_GBE_STAT(intr_tcpip_err_count)
+};
+
+#define PCH_GBE_QUEUE_STATS_LEN 0
+#define PCH_GBE_GLOBAL_STATS_LEN        ARRAY_SIZE(pch_gbe_gstrings_stats)
+#define PCH_GBE_STATS_LEN (PCH_GBE_GLOBAL_STATS_LEN + PCH_GBE_QUEUE_STATS_LEN)
+
+#define PCH_GBE_MAC_REGS_LEN    (sizeof(struct pch_gbe_regs) / 4)
+#define PCH_GBE_REGS_LEN        (PCH_GBE_MAC_REGS_LEN + PCH_GBE_PHY_REGS_LEN)
+/**
+ * pch_gbe_get_settings - Get device-specific settings
+ * @netdev: Network interface device structure
+ * @ecmd:   Ethtool command
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_get_settings(struct net_device *netdev,
+                                 struct ethtool_cmd *ecmd)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        int ret;
+
+        ret = mii_ethtool_gset(&adapter->mii, ecmd);
+        ecmd->supported &= ~(SUPPORTED_TP | SUPPORTED_1000baseT_Half);
+        ecmd->advertising &= ~(ADVERTISED_TP | ADVERTISED_1000baseT_Half);
+
+        if (!netif_carrier_ok(adapter->netdev))
+                ecmd->speed = -1;
+        return ret;
+}
+
+/**
+ * pch_gbe_set_settings - Set device-specific settings
+ * @netdev: Network interface device structure
+ * @ecmd:   Ethtool command
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_set_settings(struct net_device *netdev,
+                                 struct ethtool_cmd *ecmd)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        int ret;
+
+        pch_gbe_hal_write_phy_reg(hw, MII_BMCR, BMCR_RESET);
+
+        if (ecmd->speed == USHRT_MAX) {
+                ecmd->speed = SPEED_1000;
+                ecmd->duplex = DUPLEX_FULL;
+        }
+        ret = mii_ethtool_sset(&adapter->mii, ecmd);
+        if (ret) {
+                pr_err("Error: mii_ethtool_sset\n");
+                return ret;
+        }
+        hw->mac.link_speed = ecmd->speed;
+        hw->mac.link_duplex = ecmd->duplex;
+        hw->phy.autoneg_advertised = ecmd->advertising;
+        hw->mac.autoneg = ecmd->autoneg;
+        pch_gbe_hal_phy_sw_reset(hw);
+
+        /* reset the link */
+        if (netif_running(adapter->netdev)) {
+                pch_gbe_down(adapter);
+                ret = pch_gbe_up(adapter);
+        } else {
+                pch_gbe_reset(adapter);
+        }
+        return ret;
+}
+
+/**
+ * pch_gbe_get_regs_len - Report the size of device registers
+ * @netdev: Network interface device structure
+ * Returns: the size of device registers.
+ */
+static int pch_gbe_get_regs_len(struct net_device *netdev)
+{
+        return PCH_GBE_REGS_LEN * (int)sizeof(u32);
+}
+
+/**
+ * pch_gbe_get_drvinfo - Report driver information
+ * @netdev:  Network interface device structure
+ * @drvinfo: Driver information structure
+ */
+static void pch_gbe_get_drvinfo(struct net_device *netdev,
+                                 struct ethtool_drvinfo *drvinfo)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        strcpy(drvinfo->driver, KBUILD_MODNAME);
+        strcpy(drvinfo->version, pch_driver_version);
+        strcpy(drvinfo->fw_version, "N/A");
+        strcpy(drvinfo->bus_info, pci_name(adapter->pdev));
+        drvinfo->regdump_len = pch_gbe_get_regs_len(netdev);
+}
+
+/**
+ * pch_gbe_get_regs - Get device registers
+ * @netdev: Network interface device structure
+ * @regs:   Ethtool register structure
+ * @p:      Buffer pointer of read device register date
+ */
+static void pch_gbe_get_regs(struct net_device *netdev,
+                                struct ethtool_regs *regs, void *p)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct pci_dev *pdev = adapter->pdev;
+        u32 *regs_buff = p;
+        u16 i, tmp;
+
+        regs->version = 0x1000000 | (__u32)pdev->revision << 16 | pdev->device;
+        for (i = 0; i < PCH_GBE_MAC_REGS_LEN; i++)
+                *regs_buff++ = ioread32(&hw->reg->INT_ST + i);
+        /* PHY register */
+        for (i = 0; i < PCH_GBE_PHY_REGS_LEN; i++) {
+                pch_gbe_hal_read_phy_reg(&adapter->hw, i, &tmp);
+                *regs_buff++ = tmp;
+        }
+}
+
+/**
+ * pch_gbe_get_wol - Report whether Wake-on-Lan is enabled
+ * @netdev: Network interface device structure
+ * @wol:    Wake-on-Lan information
+ */
+static void pch_gbe_get_wol(struct net_device *netdev,
+                                struct ethtool_wolinfo *wol)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        wol->supported = WAKE_UCAST | WAKE_MCAST | WAKE_BCAST | WAKE_MAGIC;
+        wol->wolopts = 0;
+
+        if ((adapter->wake_up_evt & PCH_GBE_WLC_IND))
+                wol->wolopts |= WAKE_UCAST;
+        if ((adapter->wake_up_evt & PCH_GBE_WLC_MLT))
+                wol->wolopts |= WAKE_MCAST;
+        if ((adapter->wake_up_evt & PCH_GBE_WLC_BR))
+                wol->wolopts |= WAKE_BCAST;
+        if ((adapter->wake_up_evt & PCH_GBE_WLC_MP))
+                wol->wolopts |= WAKE_MAGIC;
+}
+
+/**
+ * pch_gbe_set_wol - Turn Wake-on-Lan on or off
+ * @netdev: Network interface device structure
+ * @wol:    Pointer of wake-on-Lan information straucture
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_set_wol(struct net_device *netdev,
+                                struct ethtool_wolinfo *wol)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        if ((wol->wolopts & (WAKE_PHY | WAKE_ARP | WAKE_MAGICSECURE)))
+                return -EOPNOTSUPP;
+        /* these settings will always override what we currently have */
+        adapter->wake_up_evt = 0;
+
+        if ((wol->wolopts & WAKE_UCAST))
+                adapter->wake_up_evt |= PCH_GBE_WLC_IND;
+        if ((wol->wolopts & WAKE_MCAST))
+                adapter->wake_up_evt |= PCH_GBE_WLC_MLT;
+        if ((wol->wolopts & WAKE_BCAST))
+                adapter->wake_up_evt |= PCH_GBE_WLC_BR;
+        if ((wol->wolopts & WAKE_MAGIC))
+                adapter->wake_up_evt |= PCH_GBE_WLC_MP;
+        return 0;
+}
+
+/**
+ * pch_gbe_nway_reset - Restart autonegotiation
+ * @netdev: Network interface device structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_nway_reset(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        return mii_nway_restart(&adapter->mii);
+}
+
+/**
+ * pch_gbe_get_ringparam - Report ring sizes
+ * @netdev:  Network interface device structure
+ * @ring:    Ring param structure
+ */
+static void pch_gbe_get_ringparam(struct net_device *netdev,
+                                        struct ethtool_ringparam *ring)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_tx_ring *txdr = adapter->tx_ring;
+        struct pch_gbe_rx_ring *rxdr = adapter->rx_ring;
+
+        ring->rx_max_pending = PCH_GBE_MAX_RXD;
+        ring->tx_max_pending = PCH_GBE_MAX_TXD;
+        ring->rx_mini_max_pending = 0;
+        ring->rx_jumbo_max_pending = 0;
+        ring->rx_pending = rxdr->count;
+        ring->tx_pending = txdr->count;
+        ring->rx_mini_pending = 0;
+        ring->rx_jumbo_pending = 0;
+}
+
+/**
+ * pch_gbe_set_ringparam - Set ring sizes
+ * @netdev:  Network interface device structure
+ * @ring:    Ring param structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_set_ringparam(struct net_device *netdev,
+                                        struct ethtool_ringparam *ring)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_tx_ring *txdr, *tx_old;
+        struct pch_gbe_rx_ring *rxdr, *rx_old;
+        int tx_ring_size, rx_ring_size;
+        int err = 0;
+
+        if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
+                return -EINVAL;
+        tx_ring_size = (int)sizeof(struct pch_gbe_tx_ring);
+        rx_ring_size = (int)sizeof(struct pch_gbe_rx_ring);
+
+        if ((netif_running(adapter->netdev)))
+                pch_gbe_down(adapter);
+        tx_old = adapter->tx_ring;
+        rx_old = adapter->rx_ring;
+
+        txdr = kzalloc(tx_ring_size, GFP_KERNEL);
+        if (!txdr) {
+                err = -ENOMEM;
+                goto err_alloc_tx;
+        }
+        rxdr = kzalloc(rx_ring_size, GFP_KERNEL);
+        if (!rxdr) {
+                err = -ENOMEM;
+                goto err_alloc_rx;
+        }
+        adapter->tx_ring = txdr;
+        adapter->rx_ring = rxdr;
+
+        rxdr->count =
+                clamp_val(ring->rx_pending, PCH_GBE_MIN_RXD, PCH_GBE_MAX_RXD);
+        rxdr->count = roundup(rxdr->count, PCH_GBE_RX_DESC_MULTIPLE);
+
+        txdr->count =
+                clamp_val(ring->tx_pending, PCH_GBE_MIN_RXD, PCH_GBE_MAX_RXD);
+        txdr->count = roundup(txdr->count, PCH_GBE_TX_DESC_MULTIPLE);
+
+        if ((netif_running(adapter->netdev))) {
+                /* Try to get new resources before deleting old */
+                err = pch_gbe_setup_rx_resources(adapter, adapter->rx_ring);
+                if (err)
+                        goto err_setup_rx;
+                err = pch_gbe_setup_tx_resources(adapter, adapter->tx_ring);
+                if (err)
+                        goto err_setup_tx;
+                /* save the new, restore the old in order to free it,
+                 * then restore the new back again */
+#ifdef RINGFREE
+                adapter->rx_ring = rx_old;
+                adapter->tx_ring = tx_old;
+                pch_gbe_free_rx_resources(adapter, adapter->rx_ring);
+                pch_gbe_free_tx_resources(adapter, adapter->tx_ring);
+                kfree(tx_old);
+                kfree(rx_old);
+                adapter->rx_ring = rxdr;
+                adapter->tx_ring = txdr;
+#else
+                pch_gbe_free_rx_resources(adapter, rx_old);
+                pch_gbe_free_tx_resources(adapter, tx_old);
+                kfree(tx_old);
+                kfree(rx_old);
+                adapter->rx_ring = rxdr;
+                adapter->tx_ring = txdr;
+#endif
+                err = pch_gbe_up(adapter);
+        }
+        return err;
+
+err_setup_tx:
+        pch_gbe_free_rx_resources(adapter, adapter->rx_ring);
+err_setup_rx:
+        adapter->rx_ring = rx_old;
+        adapter->tx_ring = tx_old;
+        kfree(rxdr);
+err_alloc_rx:
+        kfree(txdr);
+err_alloc_tx:
+        if (netif_running(adapter->netdev))
+                pch_gbe_up(adapter);
+        return err;
+}
+
+/**
+ * pch_gbe_get_pauseparam - Report pause parameters
+ * @netdev:  Network interface device structure
+ * @pause:   Pause parameters structure
+ */
+static void pch_gbe_get_pauseparam(struct net_device *netdev,
+                                       struct ethtool_pauseparam *pause)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        pause->autoneg =
+            ((hw->mac.fc_autoneg) ? AUTONEG_ENABLE : AUTONEG_DISABLE);
+
+        if (hw->mac.fc == PCH_GBE_FC_RX_PAUSE) {
+                pause->rx_pause = 1;
+        } else if (hw->mac.fc == PCH_GBE_FC_TX_PAUSE) {
+                pause->tx_pause = 1;
+        } else if (hw->mac.fc == PCH_GBE_FC_FULL) {
+                pause->rx_pause = 1;
+                pause->tx_pause = 1;
+        }
+}
+
+/**
+ * pch_gbe_set_pauseparam - Set pause paramters
+ * @netdev:  Network interface device structure
+ * @pause:   Pause parameters structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_set_pauseparam(struct net_device *netdev,
+                                       struct ethtool_pauseparam *pause)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        int ret = 0;
+
+        hw->mac.fc_autoneg = pause->autoneg;
+        if ((pause->rx_pause) && (pause->tx_pause))
+                hw->mac.fc = PCH_GBE_FC_FULL;
+        else if ((pause->rx_pause) && (!pause->tx_pause))
+                hw->mac.fc = PCH_GBE_FC_RX_PAUSE;
+        else if ((!pause->rx_pause) && (pause->tx_pause))
+                hw->mac.fc = PCH_GBE_FC_TX_PAUSE;
+        else if ((!pause->rx_pause) && (!pause->tx_pause))
+                hw->mac.fc = PCH_GBE_FC_NONE;
+
+        if (hw->mac.fc_autoneg == AUTONEG_ENABLE) {
+                if ((netif_running(adapter->netdev))) {
+                        pch_gbe_down(adapter);
+                        ret = pch_gbe_up(adapter);
+                } else {
+                        pch_gbe_reset(adapter);
+                }
+        } else {
+                ret = pch_gbe_mac_force_mac_fc(hw);
+        }
+        return ret;
+}
+
+/**
+ * pch_gbe_get_rx_csum - Report whether receive checksums are turned on or off
+ * @netdev:  Network interface device structure
+ * Returns
+ *      true(1):  Checksum On
+ *      false(0): Checksum Off
+ */
+static u32 pch_gbe_get_rx_csum(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        return adapter->rx_csum;
+}
+
+/**
+ * pch_gbe_set_rx_csum - Turn receive checksum on or off
+ * @netdev:  Network interface device structure
+ * @data:    Checksum On[true] or Off[false]
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_set_rx_csum(struct net_device *netdev, u32 data)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        adapter->rx_csum = data;
+        if ((netif_running(netdev)))
+                pch_gbe_reinit_locked(adapter);
+        else
+                pch_gbe_reset(adapter);
+
+        return 0;
+}
+
+/**
+ * pch_gbe_get_tx_csum - Report whether transmit checksums are turned on or off
+ * @netdev:  Network interface device structure
+ * Returns
+ *      true(1):  Checksum On
+ *      false(0): Checksum Off
+ */
+static u32 pch_gbe_get_tx_csum(struct net_device *netdev)
+{
+        return (netdev->features & NETIF_F_HW_CSUM) != 0;
+}
+
+/**
+ * pch_gbe_set_tx_csum - Turn transmit checksums on or off
+ * @netdev: Network interface device structure
+ * @data:   Checksum on[true] or off[false]
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_set_tx_csum(struct net_device *netdev, u32 data)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        adapter->tx_csum = data;
+        if (data)
+                netdev->features |= NETIF_F_HW_CSUM;
+        else
+                netdev->features &= ~NETIF_F_HW_CSUM;
+        return 0;
+}
+
+/**
+ * pch_gbe_get_strings - Return a set of strings that describe the requested
+ *                       objects
+ * @netdev:    Network interface device structure
+ * @stringset: Select the stringset. [ETH_SS_TEST] [ETH_SS_STATS]
+ * @data:      Pointer of read string data.
+ */
+static void pch_gbe_get_strings(struct net_device *netdev, u32 stringset,
+                                        u8 *data)
+{
+        u8 *p = data;
+        int i;
+
+        switch (stringset) {
+        case (u32) ETH_SS_STATS:
+                for (i = 0; i < PCH_GBE_GLOBAL_STATS_LEN; i++) {
+                        memcpy(p, pch_gbe_gstrings_stats[i].string,
+                               ETH_GSTRING_LEN);
+                        p += ETH_GSTRING_LEN;
+                }
+                break;
+        }
+}
+
+/**
+ * pch_gbe_get_ethtool_stats - Return statistics about the device
+ * @netdev: Network interface device structure
+ * @stats:  Ethtool statue structure
+ * @data:   Pointer of read status area
+ */
+static void pch_gbe_get_ethtool_stats(struct net_device *netdev,
+                                  struct ethtool_stats *stats, u64 *data)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        int i;
+        const struct pch_gbe_stats *gstats = pch_gbe_gstrings_stats;
+        char *hw_stats = (char *)&adapter->stats;
+
+        pch_gbe_update_stats(adapter);
+        for (i = 0; i < PCH_GBE_GLOBAL_STATS_LEN; i++) {
+                char *p = hw_stats + gstats->offset;
+                data[i] = gstats->size == sizeof(u64) ? *(u64 *)p:(*(u32 *)p);
+                gstats++;
+        }
+}
+
+static int pch_gbe_get_sset_count(struct net_device *netdev, int sset)
+{
+        switch (sset) {
+        case ETH_SS_STATS:
+                return PCH_GBE_STATS_LEN;
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
+static const struct ethtool_ops pch_gbe_ethtool_ops = {
+        .get_settings = pch_gbe_get_settings,
+        .set_settings = pch_gbe_set_settings,
+        .get_drvinfo = pch_gbe_get_drvinfo,
+        .get_regs_len = pch_gbe_get_regs_len,
+        .get_regs = pch_gbe_get_regs,
+        .get_wol = pch_gbe_get_wol,
+        .set_wol = pch_gbe_set_wol,
+        .nway_reset = pch_gbe_nway_reset,
+        .get_link = ethtool_op_get_link,
+        .get_ringparam = pch_gbe_get_ringparam,
+        .set_ringparam = pch_gbe_set_ringparam,
+        .get_pauseparam = pch_gbe_get_pauseparam,
+        .set_pauseparam = pch_gbe_set_pauseparam,
+        .get_rx_csum = pch_gbe_get_rx_csum,
+        .set_rx_csum = pch_gbe_set_rx_csum,
+        .get_tx_csum = pch_gbe_get_tx_csum,
+        .set_tx_csum = pch_gbe_set_tx_csum,
+        .get_strings = pch_gbe_get_strings,
+        .get_ethtool_stats = pch_gbe_get_ethtool_stats,
+        .get_sset_count = pch_gbe_get_sset_count,
+};
+
+void pch_gbe_set_ethtool_ops(struct net_device *netdev)
+{
+        SET_ETHTOOL_OPS(netdev, &pch_gbe_ethtool_ops);
+}
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
new file mode 100644
index 000000000000..472056b47440
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -0,0 +1,2477 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include "pch_gbe.h"
+#include "pch_gbe_api.h"
+
+#define DRV_VERSION     "1.00"
+const char pch_driver_version[] = DRV_VERSION;
+
+#define PCI_DEVICE_ID_INTEL_IOH1_GBE    0x8802          /* Pci device ID */
+#define PCH_GBE_MAR_ENTRIES             16
+#define PCH_GBE_SHORT_PKT               64
+#define DSC_INIT16                      0xC000
+#define PCH_GBE_DMA_ALIGN               0
+#define PCH_GBE_WATCHDOG_PERIOD         (1 * HZ)        /* watchdog time */
+#define PCH_GBE_COPYBREAK_DEFAULT       256
+#define PCH_GBE_PCI_BAR                 1
+
+#define PCH_GBE_TX_WEIGHT         64
+#define PCH_GBE_RX_WEIGHT         64
+#define PCH_GBE_RX_BUFFER_WRITE   16
+
+/* Initialize the wake-on-LAN settings */
+#define PCH_GBE_WL_INIT_SETTING    (PCH_GBE_WLC_MP)
+
+#define PCH_GBE_MAC_RGMII_CTRL_SETTING ( \
+        PCH_GBE_CHIP_TYPE_INTERNAL | \
+        PCH_GBE_RGMII_MODE_RGMII   | \
+        PCH_GBE_CRS_SEL              \
+        )
+
+/* Ethertype field values */
+#define PCH_GBE_MAX_JUMBO_FRAME_SIZE    10318
+#define PCH_GBE_FRAME_SIZE_2048         2048
+#define PCH_GBE_FRAME_SIZE_4096         4096
+#define PCH_GBE_FRAME_SIZE_8192         8192
+
+#define PCH_GBE_GET_DESC(R, i, type)    (&(((struct type *)((R).desc))[i]))
+#define PCH_GBE_RX_DESC(R, i)           PCH_GBE_GET_DESC(R, i, pch_gbe_rx_desc)
+#define PCH_GBE_TX_DESC(R, i)           PCH_GBE_GET_DESC(R, i, pch_gbe_tx_desc)
+#define PCH_GBE_DESC_UNUSED(R) \
+        ((((R)->next_to_clean > (R)->next_to_use) ? 0 : (R)->count) + \
+        (R)->next_to_clean - (R)->next_to_use - 1)
+
+/* Pause packet value */
+#define PCH_GBE_PAUSE_PKT1_VALUE    0x00C28001
+#define PCH_GBE_PAUSE_PKT2_VALUE    0x00000100
+#define PCH_GBE_PAUSE_PKT4_VALUE    0x01000888
+#define PCH_GBE_PAUSE_PKT5_VALUE    0x0000FFFF
+
+#define PCH_GBE_ETH_ALEN            6
+
+/* This defines the bits that are set in the Interrupt Mask
+ * Set/Read Register.  Each bit is documented below:
+ *   o RXT0   = Receiver Timer Interrupt (ring 0)
+ *   o TXDW   = Transmit Descriptor Written Back
+ *   o RXDMT0 = Receive Descriptor Minimum Threshold hit (ring 0)
+ *   o RXSEQ  = Receive Sequence Error
+ *   o LSC    = Link Status Change
+ */
+#define PCH_GBE_INT_ENABLE_MASK ( \
+        PCH_GBE_INT_RX_DMA_CMPLT |    \
+        PCH_GBE_INT_RX_DSC_EMP   |    \
+        PCH_GBE_INT_WOL_DET      |    \
+        PCH_GBE_INT_TX_CMPLT          \
+        )
+
+
+static unsigned int copybreak __read_mostly = PCH_GBE_COPYBREAK_DEFAULT;
+
+static int pch_gbe_mdio_read(struct net_device *netdev, int addr, int reg);
+static void pch_gbe_mdio_write(struct net_device *netdev, int addr, int reg,
+                               int data);
+/**
+ * pch_gbe_mac_read_mac_addr - Read MAC address
+ * @hw:             Pointer to the HW structure
+ * Returns
+ *      0:                      Successful.
+ */
+s32 pch_gbe_mac_read_mac_addr(struct pch_gbe_hw *hw)
+{
+        u32  adr1a, adr1b;
+
+        adr1a = ioread32(&hw->reg->mac_adr[0].high);
+        adr1b = ioread32(&hw->reg->mac_adr[0].low);
+
+        hw->mac.addr[0] = (u8)(adr1a & 0xFF);
+        hw->mac.addr[1] = (u8)((adr1a >> 8) & 0xFF);
+        hw->mac.addr[2] = (u8)((adr1a >> 16) & 0xFF);
+        hw->mac.addr[3] = (u8)((adr1a >> 24) & 0xFF);
+        hw->mac.addr[4] = (u8)(adr1b & 0xFF);
+        hw->mac.addr[5] = (u8)((adr1b >> 8) & 0xFF);
+
+        pr_debug("hw->mac.addr : %pM\n", hw->mac.addr);
+        return 0;
+}
+
+/**
+ * pch_gbe_wait_clr_bit - Wait to clear a bit
+ * @reg:        Pointer of register
+ * @busy:       Busy bit
+ */
+static void pch_gbe_wait_clr_bit(void *reg, u32 bit)
+{
+        u32 tmp;
+        /* wait busy */
+        tmp = 1000;
+        while ((ioread32(reg) & bit) && --tmp)
+                cpu_relax();
+        if (!tmp)
+                pr_err("Error: busy bit is not cleared\n");
+}
+/**
+ * pch_gbe_mac_mar_set - Set MAC address register
+ * @hw:     Pointer to the HW structure
+ * @addr:   Pointer to the MAC address
+ * @index:  MAC address array register
+ */
+static void pch_gbe_mac_mar_set(struct pch_gbe_hw *hw, u8 * addr, u32 index)
+{
+        u32 mar_low, mar_high, adrmask;
+
+        pr_debug("index : 0x%x\n", index);
+
+        /*
+         * HW expects these in little endian so we reverse the byte order
+         * from network order (big endian) to little endian
+         */
+        mar_high = ((u32) addr[0] | ((u32) addr[1] << 8) |
+                   ((u32) addr[2] << 16) | ((u32) addr[3] << 24));
+        mar_low = ((u32) addr[4] | ((u32) addr[5] << 8));
+        /* Stop the MAC Address of index. */
+        adrmask = ioread32(&hw->reg->ADDR_MASK);
+        iowrite32((adrmask | (0x0001 << index)), &hw->reg->ADDR_MASK);
+        /* wait busy */
+        pch_gbe_wait_clr_bit(&hw->reg->ADDR_MASK, PCH_GBE_BUSY);
+        /* Set the MAC address to the MAC address 1A/1B register */
+        iowrite32(mar_high, &hw->reg->mac_adr[index].high);
+        iowrite32(mar_low, &hw->reg->mac_adr[index].low);
+        /* Start the MAC address of index */
+        iowrite32((adrmask & ~(0x0001 << index)), &hw->reg->ADDR_MASK);
+        /* wait busy */
+        pch_gbe_wait_clr_bit(&hw->reg->ADDR_MASK, PCH_GBE_BUSY);
+}
+
+/**
+ * pch_gbe_mac_reset_hw - Reset hardware
+ * @hw: Pointer to the HW structure
+ */
+static void pch_gbe_mac_reset_hw(struct pch_gbe_hw *hw)
+{
+        /* Read the MAC address. and store to the private data */
+        pch_gbe_mac_read_mac_addr(hw);
+        iowrite32(PCH_GBE_ALL_RST, &hw->reg->RESET);
+#ifdef PCH_GBE_MAC_IFOP_RGMII
+        iowrite32(PCH_GBE_MODE_GMII_ETHER, &hw->reg->MODE);
+#endif
+        pch_gbe_wait_clr_bit(&hw->reg->RESET, PCH_GBE_ALL_RST);
+        /* Setup the receive address */
+        pch_gbe_mac_mar_set(hw, hw->mac.addr, 0);
+        return;
+}
+
+/**
+ * pch_gbe_mac_init_rx_addrs - Initialize receive address's
+ * @hw: Pointer to the HW structure
+ * @mar_count: Receive address registers
+ */
+static void pch_gbe_mac_init_rx_addrs(struct pch_gbe_hw *hw, u16 mar_count)
+{
+        u32 i;
+
+        /* Setup the receive address */
+        pch_gbe_mac_mar_set(hw, hw->mac.addr, 0);
+
+        /* Zero out the other receive addresses */
+        for (i = 1; i < mar_count; i++) {
+                iowrite32(0, &hw->reg->mac_adr[i].high);
+                iowrite32(0, &hw->reg->mac_adr[i].low);
+        }
+        iowrite32(0xFFFE, &hw->reg->ADDR_MASK);
+        /* wait busy */
+        pch_gbe_wait_clr_bit(&hw->reg->ADDR_MASK, PCH_GBE_BUSY);
+}
+
+
+/**
+ * pch_gbe_mac_mc_addr_list_update - Update Multicast addresses
+ * @hw:             Pointer to the HW structure
+ * @mc_addr_list:   Array of multicast addresses to program
+ * @mc_addr_count:  Number of multicast addresses to program
+ * @mar_used_count: The first MAC Address register free to program
+ * @mar_total_num:  Total number of supported MAC Address Registers
+ */
+static void pch_gbe_mac_mc_addr_list_update(struct pch_gbe_hw *hw,
+                                            u8 *mc_addr_list, u32 mc_addr_count,
+                                            u32 mar_used_count, u32 mar_total_num)
+{
+        u32 i, adrmask;
+
+        /* Load the first set of multicast addresses into the exact
+         * filters (RAR).  If there are not enough to fill the RAR
+         * array, clear the filters.
+         */
+        for (i = mar_used_count; i < mar_total_num; i++) {
+                if (mc_addr_count) {
+                        pch_gbe_mac_mar_set(hw, mc_addr_list, i);
+                        mc_addr_count--;
+                        mc_addr_list += PCH_GBE_ETH_ALEN;
+                } else {
+                        /* Clear MAC address mask */
+                        adrmask = ioread32(&hw->reg->ADDR_MASK);
+                        iowrite32((adrmask | (0x0001 << i)),
+                                        &hw->reg->ADDR_MASK);
+                        /* wait busy */
+                        pch_gbe_wait_clr_bit(&hw->reg->ADDR_MASK, PCH_GBE_BUSY);
+                        /* Clear MAC address */
+                        iowrite32(0, &hw->reg->mac_adr[i].high);
+                        iowrite32(0, &hw->reg->mac_adr[i].low);
+                }
+        }
+}
+
+/**
+ * pch_gbe_mac_force_mac_fc - Force the MAC's flow control settings
+ * @hw:             Pointer to the HW structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+s32 pch_gbe_mac_force_mac_fc(struct pch_gbe_hw *hw)
+{
+        struct pch_gbe_mac_info *mac = &hw->mac;
+        u32 rx_fctrl;
+
+        pr_debug("mac->fc = %u\n", mac->fc);
+
+        rx_fctrl = ioread32(&hw->reg->RX_FCTRL);
+
+        switch (mac->fc) {
+        case PCH_GBE_FC_NONE:
+                rx_fctrl &= ~PCH_GBE_FL_CTRL_EN;
+                mac->tx_fc_enable = false;
+                break;
+        case PCH_GBE_FC_RX_PAUSE:
+                rx_fctrl |= PCH_GBE_FL_CTRL_EN;
+                mac->tx_fc_enable = false;
+                break;
+        case PCH_GBE_FC_TX_PAUSE:
+                rx_fctrl &= ~PCH_GBE_FL_CTRL_EN;
+                mac->tx_fc_enable = true;
+                break;
+        case PCH_GBE_FC_FULL:
+                rx_fctrl |= PCH_GBE_FL_CTRL_EN;
+                mac->tx_fc_enable = true;
+                break;
+        default:
+                pr_err("Flow control param set incorrectly\n");
+                return -EINVAL;
+        }
+        if (mac->link_duplex == DUPLEX_HALF)
+                rx_fctrl &= ~PCH_GBE_FL_CTRL_EN;
+        iowrite32(rx_fctrl, &hw->reg->RX_FCTRL);
+        pr_debug("RX_FCTRL reg : 0x%08x  mac->tx_fc_enable : %d\n",
+                 ioread32(&hw->reg->RX_FCTRL), mac->tx_fc_enable);
+        return 0;
+}
+
+/**
+ * pch_gbe_mac_set_wol_event - Set wake-on-lan event
+ * @hw:     Pointer to the HW structure
+ * @wu_evt: Wake up event
+ */
+static void pch_gbe_mac_set_wol_event(struct pch_gbe_hw *hw, u32 wu_evt)
+{
+        u32 addr_mask;
+
+        pr_debug("wu_evt : 0x%08x  ADDR_MASK reg : 0x%08x\n",
+                 wu_evt, ioread32(&hw->reg->ADDR_MASK));
+
+        if (wu_evt) {
+                /* Set Wake-On-Lan address mask */
+                addr_mask = ioread32(&hw->reg->ADDR_MASK);
+                iowrite32(addr_mask, &hw->reg->WOL_ADDR_MASK);
+                /* wait busy */
+                pch_gbe_wait_clr_bit(&hw->reg->WOL_ADDR_MASK, PCH_GBE_WLA_BUSY);
+                iowrite32(0, &hw->reg->WOL_ST);
+                iowrite32((wu_evt | PCH_GBE_WLC_WOL_MODE), &hw->reg->WOL_CTRL);
+                iowrite32(0x02, &hw->reg->TCPIP_ACC);
+                iowrite32(PCH_GBE_INT_ENABLE_MASK, &hw->reg->INT_EN);
+        } else {
+                iowrite32(0, &hw->reg->WOL_CTRL);
+                iowrite32(0, &hw->reg->WOL_ST);
+        }
+        return;
+}
+
+/**
+ * pch_gbe_mac_ctrl_miim - Control MIIM interface
+ * @hw:   Pointer to the HW structure
+ * @addr: Address of PHY
+ * @dir:  Operetion. (Write or Read)
+ * @reg:  Access register of PHY
+ * @data: Write data.
+ *
+ * Returns: Read date.
+ */
+u16 pch_gbe_mac_ctrl_miim(struct pch_gbe_hw *hw, u32 addr, u32 dir, u32 reg,
+                        u16 data)
+{
+        u32 data_out = 0;
+        unsigned int i;
+        unsigned long flags;
+
+        spin_lock_irqsave(&hw->miim_lock, flags);
+
+        for (i = 100; i; --i) {
+                if ((ioread32(&hw->reg->MIIM) & PCH_GBE_MIIM_OPER_READY))
+                        break;
+                udelay(20);
+        }
+        if (i == 0) {
+                pr_err("pch-gbe.miim won't go Ready\n");
+                spin_unlock_irqrestore(&hw->miim_lock, flags);
+                return 0;       /* No way to indicate timeout error */
+        }
+        iowrite32(((reg << PCH_GBE_MIIM_REG_ADDR_SHIFT) |
+                  (addr << PCH_GBE_MIIM_PHY_ADDR_SHIFT) |
+                  dir | data), &hw->reg->MIIM);
+        for (i = 0; i < 100; i++) {
+                udelay(20);
+                data_out = ioread32(&hw->reg->MIIM);
+                if ((data_out & PCH_GBE_MIIM_OPER_READY))
+                        break;
+        }
+        spin_unlock_irqrestore(&hw->miim_lock, flags);
+
+        pr_debug("PHY %s: reg=%d, data=0x%04X\n",
+                 dir == PCH_GBE_MIIM_OPER_READ ? "READ" : "WRITE", reg,
+                 dir == PCH_GBE_MIIM_OPER_READ ? data_out : data);
+        return (u16) data_out;
+}
+
+/**
+ * pch_gbe_mac_set_pause_packet - Set pause packet
+ * @hw:   Pointer to the HW structure
+ */
+static void pch_gbe_mac_set_pause_packet(struct pch_gbe_hw *hw)
+{
+        unsigned long tmp2, tmp3;
+
+        /* Set Pause packet */
+        tmp2 = hw->mac.addr[1];
+        tmp2 = (tmp2 << 8) | hw->mac.addr[0];
+        tmp2 = PCH_GBE_PAUSE_PKT2_VALUE | (tmp2 << 16);
+
+        tmp3 = hw->mac.addr[5];
+        tmp3 = (tmp3 << 8) | hw->mac.addr[4];
+        tmp3 = (tmp3 << 8) | hw->mac.addr[3];
+        tmp3 = (tmp3 << 8) | hw->mac.addr[2];
+
+        iowrite32(PCH_GBE_PAUSE_PKT1_VALUE, &hw->reg->PAUSE_PKT1);
+        iowrite32(tmp2, &hw->reg->PAUSE_PKT2);
+        iowrite32(tmp3, &hw->reg->PAUSE_PKT3);
+        iowrite32(PCH_GBE_PAUSE_PKT4_VALUE, &hw->reg->PAUSE_PKT4);
+        iowrite32(PCH_GBE_PAUSE_PKT5_VALUE, &hw->reg->PAUSE_PKT5);
+
+        /* Transmit Pause Packet */
+        iowrite32(PCH_GBE_PS_PKT_RQ, &hw->reg->PAUSE_REQ);
+
+        pr_debug("PAUSE_PKT1-5 reg : 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x\n",
+                 ioread32(&hw->reg->PAUSE_PKT1), ioread32(&hw->reg->PAUSE_PKT2),
+                 ioread32(&hw->reg->PAUSE_PKT3), ioread32(&hw->reg->PAUSE_PKT4),
+                 ioread32(&hw->reg->PAUSE_PKT5));
+
+        return;
+}
+
+
+/**
+ * pch_gbe_alloc_queues - Allocate memory for all rings
+ * @adapter:  Board private structure to initialize
+ * Returns
+ *      0:      Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_alloc_queues(struct pch_gbe_adapter *adapter)
+{
+        int size;
+
+        size = (int)sizeof(struct pch_gbe_tx_ring);
+        adapter->tx_ring = kzalloc(size, GFP_KERNEL);
+        if (!adapter->tx_ring)
+                return -ENOMEM;
+        size = (int)sizeof(struct pch_gbe_rx_ring);
+        adapter->rx_ring = kzalloc(size, GFP_KERNEL);
+        if (!adapter->rx_ring) {
+                kfree(adapter->tx_ring);
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+/**
+ * pch_gbe_init_stats - Initialize status
+ * @adapter:  Board private structure to initialize
+ */
+static void pch_gbe_init_stats(struct pch_gbe_adapter *adapter)
+{
+        memset(&adapter->stats, 0, sizeof(adapter->stats));
+        return;
+}
+
+/**
+ * pch_gbe_init_phy - Initialize PHY
+ * @adapter:  Board private structure to initialize
+ * Returns
+ *      0:      Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_init_phy(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        u32 addr;
+        u16 bmcr, stat;
+
+        /* Discover phy addr by searching addrs in order {1,0,2,..., 31} */
+        for (addr = 0; addr < PCH_GBE_PHY_REGS_LEN; addr++) {
+                adapter->mii.phy_id = (addr == 0) ? 1 : (addr == 1) ? 0 : addr;
+                bmcr = pch_gbe_mdio_read(netdev, adapter->mii.phy_id, MII_BMCR);
+                stat = pch_gbe_mdio_read(netdev, adapter->mii.phy_id, MII_BMSR);
+                stat = pch_gbe_mdio_read(netdev, adapter->mii.phy_id, MII_BMSR);
+                if (!((bmcr == 0xFFFF) || ((stat == 0) && (bmcr == 0))))
+                        break;
+        }
+        adapter->hw.phy.addr = adapter->mii.phy_id;
+        pr_debug("phy_addr = %d\n", adapter->mii.phy_id);
+        if (addr == 32)
+                return -EAGAIN;
+        /* Selected the phy and isolate the rest */
+        for (addr = 0; addr < PCH_GBE_PHY_REGS_LEN; addr++) {
+                if (addr != adapter->mii.phy_id) {
+                        pch_gbe_mdio_write(netdev, addr, MII_BMCR,
+                                           BMCR_ISOLATE);
+                } else {
+                        bmcr = pch_gbe_mdio_read(netdev, addr, MII_BMCR);
+                        pch_gbe_mdio_write(netdev, addr, MII_BMCR,
+                                           bmcr & ~BMCR_ISOLATE);
+                }
+        }
+
+        /* MII setup */
+        adapter->mii.phy_id_mask = 0x1F;
+        adapter->mii.reg_num_mask = 0x1F;
+        adapter->mii.dev = adapter->netdev;
+        adapter->mii.mdio_read = pch_gbe_mdio_read;
+        adapter->mii.mdio_write = pch_gbe_mdio_write;
+        adapter->mii.supports_gmii = mii_check_gmii_support(&adapter->mii);
+        return 0;
+}
+
+/**
+ * pch_gbe_mdio_read - The read function for mii
+ * @netdev: Network interface device structure
+ * @addr:   Phy ID
+ * @reg:    Access location
+ * Returns
+ *      0:      Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_mdio_read(struct net_device *netdev, int addr, int reg)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        return pch_gbe_mac_ctrl_miim(hw, addr, PCH_GBE_HAL_MIIM_READ, reg,
+                                     (u16) 0);
+}
+
+/**
+ * pch_gbe_mdio_write - The write function for mii
+ * @netdev: Network interface device structure
+ * @addr:   Phy ID (not used)
+ * @reg:    Access location
+ * @data:   Write data
+ */
+static void pch_gbe_mdio_write(struct net_device *netdev,
+                               int addr, int reg, int data)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        pch_gbe_mac_ctrl_miim(hw, addr, PCH_GBE_HAL_MIIM_WRITE, reg, data);
+}
+
+/**
+ * pch_gbe_reset_task - Reset processing at the time of transmission timeout
+ * @work:  Pointer of board private structure
+ */
+static void pch_gbe_reset_task(struct work_struct *work)
+{
+        struct pch_gbe_adapter *adapter;
+        adapter = container_of(work, struct pch_gbe_adapter, reset_task);
+
+        pch_gbe_reinit_locked(adapter);
+}
+
+/**
+ * pch_gbe_reinit_locked- Re-initialization
+ * @adapter:  Board private structure
+ */
+void pch_gbe_reinit_locked(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+
+        rtnl_lock();
+        if (netif_running(netdev)) {
+                pch_gbe_down(adapter);
+                pch_gbe_up(adapter);
+        }
+        rtnl_unlock();
+}
+
+/**
+ * pch_gbe_reset - Reset GbE
+ * @adapter:  Board private structure
+ */
+void pch_gbe_reset(struct pch_gbe_adapter *adapter)
+{
+        pch_gbe_mac_reset_hw(&adapter->hw);
+        /* Setup the receive address. */
+        pch_gbe_mac_init_rx_addrs(&adapter->hw, PCH_GBE_MAR_ENTRIES);
+        if (pch_gbe_hal_init_hw(&adapter->hw))
+                pr_err("Hardware Error\n");
+}
+
+/**
+ * pch_gbe_free_irq - Free an interrupt
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_free_irq(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+
+        free_irq(adapter->pdev->irq, netdev);
+        if (adapter->have_msi) {
+                pci_disable_msi(adapter->pdev);
+                pr_debug("call pci_disable_msi\n");
+        }
+}
+
+/**
+ * pch_gbe_irq_disable - Mask off interrupt generation on the NIC
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_irq_disable(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        atomic_inc(&adapter->irq_sem);
+        iowrite32(0, &hw->reg->INT_EN);
+        ioread32(&hw->reg->INT_ST);
+        synchronize_irq(adapter->pdev->irq);
+
+        pr_debug("INT_EN reg : 0x%08x\n", ioread32(&hw->reg->INT_EN));
+}
+
+/**
+ * pch_gbe_irq_enable - Enable default interrupt generation settings
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_irq_enable(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        if (likely(atomic_dec_and_test(&adapter->irq_sem)))
+                iowrite32(PCH_GBE_INT_ENABLE_MASK, &hw->reg->INT_EN);
+        ioread32(&hw->reg->INT_ST);
+        pr_debug("INT_EN reg : 0x%08x\n", ioread32(&hw->reg->INT_EN));
+}
+
+
+
+/**
+ * pch_gbe_setup_tctl - configure the Transmit control registers
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_setup_tctl(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 tx_mode, tcpip;
+
+        tx_mode = PCH_GBE_TM_LONG_PKT |
+                PCH_GBE_TM_ST_AND_FD |
+                PCH_GBE_TM_SHORT_PKT |
+                PCH_GBE_TM_TH_TX_STRT_8 |
+                PCH_GBE_TM_TH_ALM_EMP_4 | PCH_GBE_TM_TH_ALM_FULL_8;
+
+        iowrite32(tx_mode, &hw->reg->TX_MODE);
+
+        tcpip = ioread32(&hw->reg->TCPIP_ACC);
+        tcpip |= PCH_GBE_TX_TCPIPACC_EN;
+        iowrite32(tcpip, &hw->reg->TCPIP_ACC);
+        return;
+}
+
+/**
+ * pch_gbe_configure_tx - Configure Transmit Unit after Reset
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_configure_tx(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 tdba, tdlen, dctrl;
+
+        pr_debug("dma addr = 0x%08llx  size = 0x%08x\n",
+                 (unsigned long long)adapter->tx_ring->dma,
+                 adapter->tx_ring->size);
+
+        /* Setup the HW Tx Head and Tail descriptor pointers */
+        tdba = adapter->tx_ring->dma;
+        tdlen = adapter->tx_ring->size - 0x10;
+        iowrite32(tdba, &hw->reg->TX_DSC_BASE);
+        iowrite32(tdlen, &hw->reg->TX_DSC_SIZE);
+        iowrite32(tdba, &hw->reg->TX_DSC_SW_P);
+
+        /* Enables Transmission DMA */
+        dctrl = ioread32(&hw->reg->DMA_CTRL);
+        dctrl |= PCH_GBE_TX_DMA_EN;
+        iowrite32(dctrl, &hw->reg->DMA_CTRL);
+}
+
+/**
+ * pch_gbe_setup_rctl - Configure the receive control registers
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_setup_rctl(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 rx_mode, tcpip;
+
+        rx_mode = PCH_GBE_ADD_FIL_EN | PCH_GBE_MLT_FIL_EN |
+        PCH_GBE_RH_ALM_EMP_4 | PCH_GBE_RH_ALM_FULL_4 | PCH_GBE_RH_RD_TRG_8;
+
+        iowrite32(rx_mode, &hw->reg->RX_MODE);
+
+        tcpip = ioread32(&hw->reg->TCPIP_ACC);
+
+        if (adapter->rx_csum) {
+                tcpip &= ~PCH_GBE_RX_TCPIPACC_OFF;
+                tcpip |= PCH_GBE_RX_TCPIPACC_EN;
+        } else {
+                tcpip |= PCH_GBE_RX_TCPIPACC_OFF;
+                tcpip &= ~PCH_GBE_RX_TCPIPACC_EN;
+        }
+        iowrite32(tcpip, &hw->reg->TCPIP_ACC);
+        return;
+}
+
+/**
+ * pch_gbe_configure_rx - Configure Receive Unit after Reset
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_configure_rx(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 rdba, rdlen, rctl, rxdma;
+
+        pr_debug("dma adr = 0x%08llx  size = 0x%08x\n",
+                 (unsigned long long)adapter->rx_ring->dma,
+                 adapter->rx_ring->size);
+
+        pch_gbe_mac_force_mac_fc(hw);
+
+        /* Disables Receive MAC */
+        rctl = ioread32(&hw->reg->MAC_RX_EN);
+        iowrite32((rctl & ~PCH_GBE_MRE_MAC_RX_EN), &hw->reg->MAC_RX_EN);
+
+        /* Disables Receive DMA */
+        rxdma = ioread32(&hw->reg->DMA_CTRL);
+        rxdma &= ~PCH_GBE_RX_DMA_EN;
+        iowrite32(rxdma, &hw->reg->DMA_CTRL);
+
+        pr_debug("MAC_RX_EN reg = 0x%08x  DMA_CTRL reg = 0x%08x\n",
+                 ioread32(&hw->reg->MAC_RX_EN),
+                 ioread32(&hw->reg->DMA_CTRL));
+
+        /* Setup the HW Rx Head and Tail Descriptor Pointers and
+         * the Base and Length of the Rx Descriptor Ring */
+        rdba = adapter->rx_ring->dma;
+        rdlen = adapter->rx_ring->size - 0x10;
+        iowrite32(rdba, &hw->reg->RX_DSC_BASE);
+        iowrite32(rdlen, &hw->reg->RX_DSC_SIZE);
+        iowrite32((rdba + rdlen), &hw->reg->RX_DSC_SW_P);
+
+        /* Enables Receive DMA */
+        rxdma = ioread32(&hw->reg->DMA_CTRL);
+        rxdma |= PCH_GBE_RX_DMA_EN;
+        iowrite32(rxdma, &hw->reg->DMA_CTRL);
+        /* Enables Receive */
+        iowrite32(PCH_GBE_MRE_MAC_RX_EN, &hw->reg->MAC_RX_EN);
+}
+
+/**
+ * pch_gbe_unmap_and_free_tx_resource - Unmap and free tx socket buffer
+ * @adapter:     Board private structure
+ * @buffer_info: Buffer information structure
+ */
+static void pch_gbe_unmap_and_free_tx_resource(
+        struct pch_gbe_adapter *adapter, struct pch_gbe_buffer *buffer_info)
+{
+        if (buffer_info->mapped) {
+                dma_unmap_single(&adapter->pdev->dev, buffer_info->dma,
+                                 buffer_info->length, DMA_TO_DEVICE);
+                buffer_info->mapped = false;
+        }
+        if (buffer_info->skb) {
+                dev_kfree_skb_any(buffer_info->skb);
+                buffer_info->skb = NULL;
+        }
+}
+
+/**
+ * pch_gbe_unmap_and_free_rx_resource - Unmap and free rx socket buffer
+ * @adapter:      Board private structure
+ * @buffer_info:  Buffer information structure
+ */
+static void pch_gbe_unmap_and_free_rx_resource(
+                                        struct pch_gbe_adapter *adapter,
+                                        struct pch_gbe_buffer *buffer_info)
+{
+        if (buffer_info->mapped) {
+                dma_unmap_single(&adapter->pdev->dev, buffer_info->dma,
+                                 buffer_info->length, DMA_FROM_DEVICE);
+                buffer_info->mapped = false;
+        }
+        if (buffer_info->skb) {
+                dev_kfree_skb_any(buffer_info->skb);
+                buffer_info->skb = NULL;
+        }
+}
+
+/**
+ * pch_gbe_clean_tx_ring - Free Tx Buffers
+ * @adapter:  Board private structure
+ * @tx_ring:  Ring to be cleaned
+ */
+static void pch_gbe_clean_tx_ring(struct pch_gbe_adapter *adapter,
+                                   struct pch_gbe_tx_ring *tx_ring)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct pch_gbe_buffer *buffer_info;
+        unsigned long size;
+        unsigned int i;
+
+        /* Free all the Tx ring sk_buffs */
+        for (i = 0; i < tx_ring->count; i++) {
+                buffer_info = &tx_ring->buffer_info[i];
+                pch_gbe_unmap_and_free_tx_resource(adapter, buffer_info);
+        }
+        pr_debug("call pch_gbe_unmap_and_free_tx_resource() %d count\n", i);
+
+        size = (unsigned long)sizeof(struct pch_gbe_buffer) * tx_ring->count;
+        memset(tx_ring->buffer_info, 0, size);
+
+        /* Zero out the descriptor ring */
+        memset(tx_ring->desc, 0, tx_ring->size);
+        tx_ring->next_to_use = 0;
+        tx_ring->next_to_clean = 0;
+        iowrite32(tx_ring->dma, &hw->reg->TX_DSC_HW_P);
+        iowrite32((tx_ring->size - 0x10), &hw->reg->TX_DSC_SIZE);
+}
+
+/**
+ * pch_gbe_clean_rx_ring - Free Rx Buffers
+ * @adapter:  Board private structure
+ * @rx_ring:  Ring to free buffers from
+ */
+static void
+pch_gbe_clean_rx_ring(struct pch_gbe_adapter *adapter,
+                      struct pch_gbe_rx_ring *rx_ring)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct pch_gbe_buffer *buffer_info;
+        unsigned long size;
+        unsigned int i;
+
+        /* Free all the Rx ring sk_buffs */
+        for (i = 0; i < rx_ring->count; i++) {
+                buffer_info = &rx_ring->buffer_info[i];
+                pch_gbe_unmap_and_free_rx_resource(adapter, buffer_info);
+        }
+        pr_debug("call pch_gbe_unmap_and_free_rx_resource() %d count\n", i);
+        size = (unsigned long)sizeof(struct pch_gbe_buffer) * rx_ring->count;
+        memset(rx_ring->buffer_info, 0, size);
+
+        /* Zero out the descriptor ring */
+        memset(rx_ring->desc, 0, rx_ring->size);
+        rx_ring->next_to_clean = 0;
+        rx_ring->next_to_use = 0;
+        iowrite32(rx_ring->dma, &hw->reg->RX_DSC_HW_P);
+        iowrite32((rx_ring->size - 0x10), &hw->reg->RX_DSC_SIZE);
+}
+
+static void pch_gbe_set_rgmii_ctrl(struct pch_gbe_adapter *adapter, u16 speed,
+                                    u16 duplex)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        unsigned long rgmii = 0;
+
+        /* Set the RGMII control. */
+#ifdef PCH_GBE_MAC_IFOP_RGMII
+        switch (speed) {
+        case SPEED_10:
+                rgmii = (PCH_GBE_RGMII_RATE_2_5M |
+                         PCH_GBE_MAC_RGMII_CTRL_SETTING);
+                break;
+        case SPEED_100:
+                rgmii = (PCH_GBE_RGMII_RATE_25M |
+                         PCH_GBE_MAC_RGMII_CTRL_SETTING);
+                break;
+        case SPEED_1000:
+                rgmii = (PCH_GBE_RGMII_RATE_125M |
+                         PCH_GBE_MAC_RGMII_CTRL_SETTING);
+                break;
+        }
+        iowrite32(rgmii, &hw->reg->RGMII_CTRL);
+#else   /* GMII */
+        rgmii = 0;
+        iowrite32(rgmii, &hw->reg->RGMII_CTRL);
+#endif
+}
+static void pch_gbe_set_mode(struct pch_gbe_adapter *adapter, u16 speed,
+                              u16 duplex)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct pch_gbe_hw *hw = &adapter->hw;
+        unsigned long mode = 0;
+
+        /* Set the communication mode */
+        switch (speed) {
+        case SPEED_10:
+                mode = PCH_GBE_MODE_MII_ETHER;
+                netdev->tx_queue_len = 10;
+                break;
+        case SPEED_100:
+                mode = PCH_GBE_MODE_MII_ETHER;
+                netdev->tx_queue_len = 100;
+                break;
+        case SPEED_1000:
+                mode = PCH_GBE_MODE_GMII_ETHER;
+                break;
+        }
+        if (duplex == DUPLEX_FULL)
+                mode |= PCH_GBE_MODE_FULL_DUPLEX;
+        else
+                mode |= PCH_GBE_MODE_HALF_DUPLEX;
+        iowrite32(mode, &hw->reg->MODE);
+}
+
+/**
+ * pch_gbe_watchdog - Watchdog process
+ * @data:  Board private structure
+ */
+static void pch_gbe_watchdog(unsigned long data)
+{
+        struct pch_gbe_adapter *adapter = (struct pch_gbe_adapter *)data;
+        struct net_device *netdev = adapter->netdev;
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct ethtool_cmd cmd;
+
+        pr_debug("right now = %ld\n", jiffies);
+
+        pch_gbe_update_stats(adapter);
+        if ((mii_link_ok(&adapter->mii)) && (!netif_carrier_ok(netdev))) {
+                netdev->tx_queue_len = adapter->tx_queue_len;
+                /* mii library handles link maintenance tasks */
+                if (mii_ethtool_gset(&adapter->mii, &cmd)) {
+                        pr_err("ethtool get setting Error\n");
+                        mod_timer(&adapter->watchdog_timer,
+                                  round_jiffies(jiffies +
+                                                PCH_GBE_WATCHDOG_PERIOD));
+                        return;
+                }
+                hw->mac.link_speed = cmd.speed;
+                hw->mac.link_duplex = cmd.duplex;
+                /* Set the RGMII control. */
+                pch_gbe_set_rgmii_ctrl(adapter, hw->mac.link_speed,
+                                                hw->mac.link_duplex);
+                /* Set the communication mode */
+                pch_gbe_set_mode(adapter, hw->mac.link_speed,
+                                 hw->mac.link_duplex);
+                netdev_dbg(netdev,
+                           "Link is Up %d Mbps %s-Duplex\n",
+                           cmd.speed,
+                           cmd.duplex == DUPLEX_FULL ? "Full" : "Half");
+                netif_carrier_on(netdev);
+                netif_wake_queue(netdev);
+        } else if ((!mii_link_ok(&adapter->mii)) &&
+                   (netif_carrier_ok(netdev))) {
+                netdev_dbg(netdev, "NIC Link is Down\n");
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                netif_carrier_off(netdev);
+                netif_stop_queue(netdev);
+        }
+        mod_timer(&adapter->watchdog_timer,
+                  round_jiffies(jiffies + PCH_GBE_WATCHDOG_PERIOD));
+}
+
+/**
+ * pch_gbe_tx_queue - Carry out queuing of the transmission data
+ * @adapter:  Board private structure
+ * @tx_ring:  Tx descriptor ring structure
+ * @skb:      Sockt buffer structure
+ */
+static void pch_gbe_tx_queue(struct pch_gbe_adapter *adapter,
+                              struct pch_gbe_tx_ring *tx_ring,
+                              struct sk_buff *skb)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct pch_gbe_tx_desc *tx_desc;
+        struct pch_gbe_buffer *buffer_info;
+        struct sk_buff *tmp_skb;
+        unsigned int frame_ctrl;
+        unsigned int ring_num;
+        unsigned long flags;
+
+        /*-- Set frame control --*/
+        frame_ctrl = 0;
+        if (unlikely(skb->len < PCH_GBE_SHORT_PKT))
+                frame_ctrl |= PCH_GBE_TXD_CTRL_APAD;
+        if (unlikely(!adapter->tx_csum))
+                frame_ctrl |= PCH_GBE_TXD_CTRL_TCPIP_ACC_OFF;
+
+        /* Performs checksum processing */
+        /*
+         * It is because the hardware accelerator does not support a checksum,
+         * when the received data size is less than 64 bytes.
+         */
+        if ((skb->len < PCH_GBE_SHORT_PKT) && (adapter->tx_csum)) {
+                frame_ctrl |= PCH_GBE_TXD_CTRL_APAD |
+                              PCH_GBE_TXD_CTRL_TCPIP_ACC_OFF;
+                if (skb->protocol == htons(ETH_P_IP)) {
+                        struct iphdr *iph = ip_hdr(skb);
+                        unsigned int offset;
+                        iph->check = 0;
+                        iph->check = ip_fast_csum((u8 *) iph, iph->ihl);
+                        offset = skb_transport_offset(skb);
+                        if (iph->protocol == IPPROTO_TCP) {
+                                skb->csum = 0;
+                                tcp_hdr(skb)->check = 0;
+                                skb->csum = skb_checksum(skb, offset,
+                                                         skb->len - offset, 0);
+                                tcp_hdr(skb)->check =
+                                        csum_tcpudp_magic(iph->saddr,
+                                                          iph->daddr,
+                                                          skb->len - offset,
+                                                          IPPROTO_TCP,
+                                                          skb->csum);
+                        } else if (iph->protocol == IPPROTO_UDP) {
+                                skb->csum = 0;
+                                udp_hdr(skb)->check = 0;
+                                skb->csum =
+                                        skb_checksum(skb, offset,
+                                                     skb->len - offset, 0);
+                                udp_hdr(skb)->check =
+                                        csum_tcpudp_magic(iph->saddr,
+                                                          iph->daddr,
+                                                          skb->len - offset,
+                                                          IPPROTO_UDP,
+                                                          skb->csum);
+                        }
+                }
+        }
+        spin_lock_irqsave(&tx_ring->tx_lock, flags);
+        ring_num = tx_ring->next_to_use;
+        if (unlikely((ring_num + 1) == tx_ring->count))
+                tx_ring->next_to_use = 0;
+        else
+                tx_ring->next_to_use = ring_num + 1;
+
+        spin_unlock_irqrestore(&tx_ring->tx_lock, flags);
+        buffer_info = &tx_ring->buffer_info[ring_num];
+        tmp_skb = buffer_info->skb;
+
+        /* [Header:14][payload] ---> [Header:14][paddong:2][payload]    */
+        memcpy(tmp_skb->data, skb->data, ETH_HLEN);
+        tmp_skb->data[ETH_HLEN] = 0x00;
+        tmp_skb->data[ETH_HLEN + 1] = 0x00;
+        tmp_skb->len = skb->len;
+        memcpy(&tmp_skb->data[ETH_HLEN + 2], &skb->data[ETH_HLEN],
+               (skb->len - ETH_HLEN));
+        /*-- Set Buffer infomation --*/
+        buffer_info->length = tmp_skb->len;
+        buffer_info->dma = dma_map_single(&adapter->pdev->dev, tmp_skb->data,
+                                          buffer_info->length,
+                                          DMA_TO_DEVICE);
+        if (dma_mapping_error(&adapter->pdev->dev, buffer_info->dma)) {
+                pr_err("TX DMA map failed\n");
+                buffer_info->dma = 0;
+                buffer_info->time_stamp = 0;
+                tx_ring->next_to_use = ring_num;
+                return;
+        }
+        buffer_info->mapped = true;
+        buffer_info->time_stamp = jiffies;
+
+        /*-- Set Tx descriptor --*/
+        tx_desc = PCH_GBE_TX_DESC(*tx_ring, ring_num);
+        tx_desc->buffer_addr = (buffer_info->dma);
+        tx_desc->length = (tmp_skb->len);
+        tx_desc->tx_words_eob = ((tmp_skb->len + 3));
+        tx_desc->tx_frame_ctrl = (frame_ctrl);
+        tx_desc->gbec_status = (DSC_INIT16);
+
+        if (unlikely(++ring_num == tx_ring->count))
+                ring_num = 0;
+
+        /* Update software pointer of TX descriptor */
+        iowrite32(tx_ring->dma +
+                  (int)sizeof(struct pch_gbe_tx_desc) * ring_num,
+                  &hw->reg->TX_DSC_SW_P);
+        dev_kfree_skb_any(skb);
+}
+
+/**
+ * pch_gbe_update_stats - Update the board statistics counters
+ * @adapter:  Board private structure
+ */
+void pch_gbe_update_stats(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_hw_stats *stats = &adapter->stats;
+        unsigned long flags;
+
+        /*
+         * Prevent stats update while adapter is being reset, or if the pci
+         * connection is down.
+         */
+        if ((pdev->error_state) && (pdev->error_state != pci_channel_io_normal))
+                return;
+
+        spin_lock_irqsave(&adapter->stats_lock, flags);
+
+        /* Update device status "adapter->stats" */
+        stats->rx_errors = stats->rx_crc_errors + stats->rx_frame_errors;
+        stats->tx_errors = stats->tx_length_errors +
+            stats->tx_aborted_errors +
+            stats->tx_carrier_errors + stats->tx_timeout_count;
+
+        /* Update network device status "adapter->net_stats" */
+        netdev->stats.rx_packets = stats->rx_packets;
+        netdev->stats.rx_bytes = stats->rx_bytes;
+        netdev->stats.rx_dropped = stats->rx_dropped;
+        netdev->stats.tx_packets = stats->tx_packets;
+        netdev->stats.tx_bytes = stats->tx_bytes;
+        netdev->stats.tx_dropped = stats->tx_dropped;
+        /* Fill out the OS statistics structure */
+        netdev->stats.multicast = stats->multicast;
+        netdev->stats.collisions = stats->collisions;
+        /* Rx Errors */
+        netdev->stats.rx_errors = stats->rx_errors;
+        netdev->stats.rx_crc_errors = stats->rx_crc_errors;
+        netdev->stats.rx_frame_errors = stats->rx_frame_errors;
+        /* Tx Errors */
+        netdev->stats.tx_errors = stats->tx_errors;
+        netdev->stats.tx_aborted_errors = stats->tx_aborted_errors;
+        netdev->stats.tx_carrier_errors = stats->tx_carrier_errors;
+
+        spin_unlock_irqrestore(&adapter->stats_lock, flags);
+}
+
+/**
+ * pch_gbe_intr - Interrupt Handler
+ * @irq:   Interrupt number
+ * @data:  Pointer to a network interface device structure
+ * Returns
+ *      - IRQ_HANDLED:  Our interrupt
+ *      - IRQ_NONE:     Not our interrupt
+ */
+static irqreturn_t pch_gbe_intr(int irq, void *data)
+{
+        struct net_device *netdev = data;
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 int_st;
+        u32 int_en;
+
+        /* Check request status */
+        int_st = ioread32(&hw->reg->INT_ST);
+        int_st = int_st & ioread32(&hw->reg->INT_EN);
+        /* When request status is no interruption factor */
+        if (unlikely(!int_st))
+                return IRQ_NONE;        /* Not our interrupt. End processing. */
+        pr_debug("%s occur int_st = 0x%08x\n", __func__, int_st);
+        if (int_st & PCH_GBE_INT_RX_FRAME_ERR)
+                adapter->stats.intr_rx_frame_err_count++;
+        if (int_st & PCH_GBE_INT_RX_FIFO_ERR)
+                adapter->stats.intr_rx_fifo_err_count++;
+        if (int_st & PCH_GBE_INT_RX_DMA_ERR)
+                adapter->stats.intr_rx_dma_err_count++;
+        if (int_st & PCH_GBE_INT_TX_FIFO_ERR)
+                adapter->stats.intr_tx_fifo_err_count++;
+        if (int_st & PCH_GBE_INT_TX_DMA_ERR)
+                adapter->stats.intr_tx_dma_err_count++;
+        if (int_st & PCH_GBE_INT_TCPIP_ERR)
+                adapter->stats.intr_tcpip_err_count++;
+        /* When Rx descriptor is empty  */
+        if ((int_st & PCH_GBE_INT_RX_DSC_EMP)) {
+                adapter->stats.intr_rx_dsc_empty_count++;
+                pr_err("Rx descriptor is empty\n");
+                int_en = ioread32(&hw->reg->INT_EN);
+                iowrite32((int_en & ~PCH_GBE_INT_RX_DSC_EMP), &hw->reg->INT_EN);
+                if (hw->mac.tx_fc_enable) {
+                        /* Set Pause packet */
+                        pch_gbe_mac_set_pause_packet(hw);
+                }
+                if ((int_en & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT))
+                    == 0) {
+                        return IRQ_HANDLED;
+                }
+        }
+
+        /* When request status is Receive interruption */
+        if ((int_st & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT))) {
+                if (likely(napi_schedule_prep(&adapter->napi))) {
+                        /* Enable only Rx Descriptor empty */
+                        atomic_inc(&adapter->irq_sem);
+                        int_en = ioread32(&hw->reg->INT_EN);
+                        int_en &=
+                            ~(PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT);
+                        iowrite32(int_en, &hw->reg->INT_EN);
+                        /* Start polling for NAPI */
+                        __napi_schedule(&adapter->napi);
+                }
+        }
+        pr_debug("return = 0x%08x  INT_EN reg = 0x%08x\n",
+                 IRQ_HANDLED, ioread32(&hw->reg->INT_EN));
+        return IRQ_HANDLED;
+}
+
+/**
+ * pch_gbe_alloc_rx_buffers - Replace used receive buffers; legacy & extended
+ * @adapter:       Board private structure
+ * @rx_ring:       Rx descriptor ring
+ * @cleaned_count: Cleaned count
+ */
+static void
+pch_gbe_alloc_rx_buffers(struct pch_gbe_adapter *adapter,
+                         struct pch_gbe_rx_ring *rx_ring, int cleaned_count)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct pch_gbe_rx_desc *rx_desc;
+        struct pch_gbe_buffer *buffer_info;
+        struct sk_buff *skb;
+        unsigned int i;
+        unsigned int bufsz;
+
+        bufsz = adapter->rx_buffer_len + PCH_GBE_DMA_ALIGN;
+        i = rx_ring->next_to_use;
+
+        while ((cleaned_count--)) {
+                buffer_info = &rx_ring->buffer_info[i];
+                skb = buffer_info->skb;
+                if (skb) {
+                        skb_trim(skb, 0);
+                } else {
+                        skb = netdev_alloc_skb(netdev, bufsz);
+                        if (unlikely(!skb)) {
+                                /* Better luck next round */
+                                adapter->stats.rx_alloc_buff_failed++;
+                                break;
+                        }
+                        /* 64byte align */
+                        skb_reserve(skb, PCH_GBE_DMA_ALIGN);
+
+                        buffer_info->skb = skb;
+                        buffer_info->length = adapter->rx_buffer_len;
+                }
+                buffer_info->dma = dma_map_single(&pdev->dev,
+                                                  skb->data,
+                                                  buffer_info->length,
+                                                  DMA_FROM_DEVICE);
+                if (dma_mapping_error(&adapter->pdev->dev, buffer_info->dma)) {
+                        dev_kfree_skb(skb);
+                        buffer_info->skb = NULL;
+                        buffer_info->dma = 0;
+                        adapter->stats.rx_alloc_buff_failed++;
+                        break; /* while !buffer_info->skb */
+                }
+                buffer_info->mapped = true;
+                rx_desc = PCH_GBE_RX_DESC(*rx_ring, i);
+                rx_desc->buffer_addr = (buffer_info->dma);
+                rx_desc->gbec_status = DSC_INIT16;
+
+                pr_debug("i = %d  buffer_info->dma = 0x08%llx  buffer_info->length = 0x%x\n",
+                         i, (unsigned long long)buffer_info->dma,
+                         buffer_info->length);
+
+                if (unlikely(++i == rx_ring->count))
+                        i = 0;
+        }
+        if (likely(rx_ring->next_to_use != i)) {
+                rx_ring->next_to_use = i;
+                if (unlikely(i-- == 0))
+                        i = (rx_ring->count - 1);
+                iowrite32(rx_ring->dma +
+                          (int)sizeof(struct pch_gbe_rx_desc) * i,
+                          &hw->reg->RX_DSC_SW_P);
+        }
+        return;
+}
+
+/**
+ * pch_gbe_alloc_tx_buffers - Allocate transmit buffers
+ * @adapter:   Board private structure
+ * @tx_ring:   Tx descriptor ring
+ */
+static void pch_gbe_alloc_tx_buffers(struct pch_gbe_adapter *adapter,
+                                        struct pch_gbe_tx_ring *tx_ring)
+{
+        struct pch_gbe_buffer *buffer_info;
+        struct sk_buff *skb;
+        unsigned int i;
+        unsigned int bufsz;
+        struct pch_gbe_tx_desc *tx_desc;
+
+        bufsz =
+            adapter->hw.mac.max_frame_size + PCH_GBE_DMA_ALIGN + NET_IP_ALIGN;
+
+        for (i = 0; i < tx_ring->count; i++) {
+                buffer_info = &tx_ring->buffer_info[i];
+                skb = netdev_alloc_skb(adapter->netdev, bufsz);
+                skb_reserve(skb, PCH_GBE_DMA_ALIGN);
+                buffer_info->skb = skb;
+                tx_desc = PCH_GBE_TX_DESC(*tx_ring, i);
+                tx_desc->gbec_status = (DSC_INIT16);
+        }
+        return;
+}
+
+/**
+ * pch_gbe_clean_tx - Reclaim resources after transmit completes
+ * @adapter:   Board private structure
+ * @tx_ring:   Tx descriptor ring
+ * Returns
+ *      true:  Cleaned the descriptor
+ *      false: Not cleaned the descriptor
+ */
+static bool
+pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
+                 struct pch_gbe_tx_ring *tx_ring)
+{
+        struct pch_gbe_tx_desc *tx_desc;
+        struct pch_gbe_buffer *buffer_info;
+        struct sk_buff *skb;
+        unsigned int i;
+        unsigned int cleaned_count = 0;
+        bool cleaned = false;
+
+        pr_debug("next_to_clean : %d\n", tx_ring->next_to_clean);
+
+        i = tx_ring->next_to_clean;
+        tx_desc = PCH_GBE_TX_DESC(*tx_ring, i);
+        pr_debug("gbec_status:0x%04x  dma_status:0x%04x\n",
+                 tx_desc->gbec_status, tx_desc->dma_status);
+
+        while ((tx_desc->gbec_status & DSC_INIT16) == 0x0000) {
+                pr_debug("gbec_status:0x%04x\n", tx_desc->gbec_status);
+                cleaned = true;
+                buffer_info = &tx_ring->buffer_info[i];
+                skb = buffer_info->skb;
+
+                if ((tx_desc->gbec_status & PCH_GBE_TXD_GMAC_STAT_ABT)) {
+                        adapter->stats.tx_aborted_errors++;
+                        pr_err("Transfer Abort Error\n");
+                } else if ((tx_desc->gbec_status & PCH_GBE_TXD_GMAC_STAT_CRSER)
+                          ) {
+                        adapter->stats.tx_carrier_errors++;
+                        pr_err("Transfer Carrier Sense Error\n");
+                } else if ((tx_desc->gbec_status & PCH_GBE_TXD_GMAC_STAT_EXCOL)
+                          ) {
+                        adapter->stats.tx_aborted_errors++;
+                        pr_err("Transfer Collision Abort Error\n");
+                } else if ((tx_desc->gbec_status &
+                            (PCH_GBE_TXD_GMAC_STAT_SNGCOL |
+                             PCH_GBE_TXD_GMAC_STAT_MLTCOL))) {
+                        adapter->stats.collisions++;
+                        adapter->stats.tx_packets++;
+                        adapter->stats.tx_bytes += skb->len;
+                        pr_debug("Transfer Collision\n");
+                } else if ((tx_desc->gbec_status & PCH_GBE_TXD_GMAC_STAT_CMPLT)
+                          ) {
+                        adapter->stats.tx_packets++;
+                        adapter->stats.tx_bytes += skb->len;
+                }
+                if (buffer_info->mapped) {
+                        pr_debug("unmap buffer_info->dma : %d\n", i);
+                        dma_unmap_single(&adapter->pdev->dev, buffer_info->dma,
+                                         buffer_info->length, DMA_TO_DEVICE);
+                        buffer_info->mapped = false;
+                }
+                if (buffer_info->skb) {
+                        pr_debug("trim buffer_info->skb : %d\n", i);
+                        skb_trim(buffer_info->skb, 0);
+                }
+                tx_desc->gbec_status = DSC_INIT16;
+                if (unlikely(++i == tx_ring->count))
+                        i = 0;
+                tx_desc = PCH_GBE_TX_DESC(*tx_ring, i);
+
+                /* weight of a sort for tx, to avoid endless transmit cleanup */
+                if (cleaned_count++ == PCH_GBE_TX_WEIGHT)
+                        break;
+        }
+        pr_debug("called pch_gbe_unmap_and_free_tx_resource() %d count\n",
+                 cleaned_count);
+        /* Recover from running out of Tx resources in xmit_frame */
+        if (unlikely(cleaned && (netif_queue_stopped(adapter->netdev)))) {
+                netif_wake_queue(adapter->netdev);
+                adapter->stats.tx_restart_count++;
+                pr_debug("Tx wake queue\n");
+        }
+        spin_lock(&adapter->tx_queue_lock);
+        tx_ring->next_to_clean = i;
+        spin_unlock(&adapter->tx_queue_lock);
+        pr_debug("next_to_clean : %d\n", tx_ring->next_to_clean);
+        return cleaned;
+}
+
+/**
+ * pch_gbe_clean_rx - Send received data up the network stack; legacy
+ * @adapter:     Board private structure
+ * @rx_ring:     Rx descriptor ring
+ * @work_done:   Completed count
+ * @work_to_do:  Request count
+ * Returns
+ *      true:  Cleaned the descriptor
+ *      false: Not cleaned the descriptor
+ */
+static bool
+pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
+                 struct pch_gbe_rx_ring *rx_ring,
+                 int *work_done, int work_to_do)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_buffer *buffer_info;
+        struct pch_gbe_rx_desc *rx_desc;
+        u32 length;
+        unsigned char tmp_packet[ETH_HLEN];
+        unsigned int i;
+        unsigned int cleaned_count = 0;
+        bool cleaned = false;
+        struct sk_buff *skb;
+        u8 dma_status;
+        u16 gbec_status;
+        u32 tcp_ip_status;
+        u8 skb_copy_flag = 0;
+        u8 skb_padding_flag = 0;
+
+        i = rx_ring->next_to_clean;
+
+        while (*work_done < work_to_do) {
+                /* Check Rx descriptor status */
+                rx_desc = PCH_GBE_RX_DESC(*rx_ring, i);
+                if (rx_desc->gbec_status == DSC_INIT16)
+                        break;
+                cleaned = true;
+                cleaned_count++;
+
+                dma_status = rx_desc->dma_status;
+                gbec_status = rx_desc->gbec_status;
+                tcp_ip_status = rx_desc->tcp_ip_status;
+                rx_desc->gbec_status = DSC_INIT16;
+                buffer_info = &rx_ring->buffer_info[i];
+                skb = buffer_info->skb;
+
+                /* unmap dma */
+                dma_unmap_single(&pdev->dev, buffer_info->dma,
+                                   buffer_info->length, DMA_FROM_DEVICE);
+                buffer_info->mapped = false;
+                /* Prefetch the packet */
+                prefetch(skb->data);
+
+                pr_debug("RxDecNo = 0x%04x  Status[DMA:0x%02x GBE:0x%04x "
+                         "TCP:0x%08x]  BufInf = 0x%p\n",
+                         i, dma_status, gbec_status, tcp_ip_status,
+                         buffer_info);
+                /* Error check */
+                if (unlikely(gbec_status & PCH_GBE_RXD_GMAC_STAT_NOTOCTAL)) {
+                        adapter->stats.rx_frame_errors++;
+                        pr_err("Receive Not Octal Error\n");
+                } else if (unlikely(gbec_status &
+                                PCH_GBE_RXD_GMAC_STAT_NBLERR)) {
+                        adapter->stats.rx_frame_errors++;
+                        pr_err("Receive Nibble Error\n");
+                } else if (unlikely(gbec_status &
+                                PCH_GBE_RXD_GMAC_STAT_CRCERR)) {
+                        adapter->stats.rx_crc_errors++;
+                        pr_err("Receive CRC Error\n");
+                } else {
+                        /* get receive length */
+                        /* length convert[-3], padding[-2] */
+                        length = (rx_desc->rx_words_eob) - 3 - 2;
+
+                        /* Decide the data conversion method */
+                        if (!adapter->rx_csum) {
+                                /* [Header:14][payload] */
+                                skb_padding_flag = 0;
+                                skb_copy_flag = 1;
+                        } else {
+                                /* [Header:14][padding:2][payload] */
+                                skb_padding_flag = 1;
+                                if (length < copybreak)
+                                        skb_copy_flag = 1;
+                                else
+                                        skb_copy_flag = 0;
+                        }
+
+                        /* Data conversion */
+                        if (skb_copy_flag) {    /* recycle  skb */
+                                struct sk_buff *new_skb;
+                                new_skb =
+                                    netdev_alloc_skb(netdev,
+                                                     length + NET_IP_ALIGN);
+                                if (new_skb) {
+                                        if (!skb_padding_flag) {
+                                                skb_reserve(new_skb,
+                                                                NET_IP_ALIGN);
+                                        }
+                                        memcpy(new_skb->data, skb->data,
+                                                length);
+                                        /* save the skb
+                                         * in buffer_info as good */
+                                        skb = new_skb;
+                                } else if (!skb_padding_flag) {
+                                        /* dorrop error */
+                                        pr_err("New skb allocation Error\n");
+                                        goto dorrop;
+                                }
+                        } else {
+                                buffer_info->skb = NULL;
+                        }
+                        if (skb_padding_flag) {
+                                memcpy(&tmp_packet[0], &skb->data[0], ETH_HLEN);
+                                memcpy(&skb->data[NET_IP_ALIGN], &tmp_packet[0],
+                                        ETH_HLEN);
+                                skb_reserve(skb, NET_IP_ALIGN);
+
+                        }
+
+                        /* update status of driver */
+                        adapter->stats.rx_bytes += length;
+                        adapter->stats.rx_packets++;
+                        if ((gbec_status & PCH_GBE_RXD_GMAC_STAT_MARMLT))
+                                adapter->stats.multicast++;
+                        /* Write meta date of skb */
+                        skb_put(skb, length);
+                        skb->protocol = eth_type_trans(skb, netdev);
+                        if ((tcp_ip_status & PCH_GBE_RXD_ACC_STAT_TCPIPOK) ==
+                            PCH_GBE_RXD_ACC_STAT_TCPIPOK) {
+                                skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        } else {
+                                skb->ip_summed = CHECKSUM_NONE;
+                        }
+                        napi_gro_receive(&adapter->napi, skb);
+                        (*work_done)++;
+                        pr_debug("Receive skb->ip_summed: %d length: %d\n",
+                                 skb->ip_summed, length);
+                }
+dorrop:
+                /* return some buffers to hardware, one at a time is too slow */
+                if (unlikely(cleaned_count >= PCH_GBE_RX_BUFFER_WRITE)) {
+                        pch_gbe_alloc_rx_buffers(adapter, rx_ring,
+                                                 cleaned_count);
+                        cleaned_count = 0;
+                }
+                if (++i == rx_ring->count)
+                        i = 0;
+        }
+        rx_ring->next_to_clean = i;
+        if (cleaned_count)
+                pch_gbe_alloc_rx_buffers(adapter, rx_ring, cleaned_count);
+        return cleaned;
+}
+
+/**
+ * pch_gbe_setup_tx_resources - Allocate Tx resources (Descriptors)
+ * @adapter:  Board private structure
+ * @tx_ring:  Tx descriptor ring (for a specific queue) to setup
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed
+ */
+int pch_gbe_setup_tx_resources(struct pch_gbe_adapter *adapter,
+                                struct pch_gbe_tx_ring *tx_ring)
+{
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_tx_desc *tx_desc;
+        int size;
+        int desNo;
+
+        size = (int)sizeof(struct pch_gbe_buffer) * tx_ring->count;
+        tx_ring->buffer_info = vmalloc(size);
+        if (!tx_ring->buffer_info) {
+                pr_err("Unable to allocate memory for the buffer infomation\n");
+                return -ENOMEM;
+        }
+        memset(tx_ring->buffer_info, 0, size);
+
+        tx_ring->size = tx_ring->count * (int)sizeof(struct pch_gbe_tx_desc);
+
+        tx_ring->desc = dma_alloc_coherent(&pdev->dev, tx_ring->size,
+                                           &tx_ring->dma, GFP_KERNEL);
+        if (!tx_ring->desc) {
+                vfree(tx_ring->buffer_info);
+                pr_err("Unable to allocate memory for the transmit descriptor ring\n");
+                return -ENOMEM;
+        }
+        memset(tx_ring->desc, 0, tx_ring->size);
+
+        tx_ring->next_to_use = 0;
+        tx_ring->next_to_clean = 0;
+        spin_lock_init(&tx_ring->tx_lock);
+
+        for (desNo = 0; desNo < tx_ring->count; desNo++) {
+                tx_desc = PCH_GBE_TX_DESC(*tx_ring, desNo);
+                tx_desc->gbec_status = DSC_INIT16;
+        }
+        pr_debug("tx_ring->desc = 0x%p  tx_ring->dma = 0x%08llx\n"
+                 "next_to_clean = 0x%08x  next_to_use = 0x%08x\n",
+                 tx_ring->desc, (unsigned long long)tx_ring->dma,
+                 tx_ring->next_to_clean, tx_ring->next_to_use);
+        return 0;
+}
+
+/**
+ * pch_gbe_setup_rx_resources - Allocate Rx resources (Descriptors)
+ * @adapter:  Board private structure
+ * @rx_ring:  Rx descriptor ring (for a specific queue) to setup
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed
+ */
+int pch_gbe_setup_rx_resources(struct pch_gbe_adapter *adapter,
+                                struct pch_gbe_rx_ring *rx_ring)
+{
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_rx_desc *rx_desc;
+        int size;
+        int desNo;
+
+        size = (int)sizeof(struct pch_gbe_buffer) * rx_ring->count;
+        rx_ring->buffer_info = vmalloc(size);
+        if (!rx_ring->buffer_info) {
+                pr_err("Unable to allocate memory for the receive descriptor ring\n");
+                return -ENOMEM;
+        }
+        memset(rx_ring->buffer_info, 0, size);
+        rx_ring->size = rx_ring->count * (int)sizeof(struct pch_gbe_rx_desc);
+        rx_ring->desc = dma_alloc_coherent(&pdev->dev, rx_ring->size,
+                                           &rx_ring->dma, GFP_KERNEL);
+
+        if (!rx_ring->desc) {
+                pr_err("Unable to allocate memory for the receive descriptor ring\n");
+                vfree(rx_ring->buffer_info);
+                return -ENOMEM;
+        }
+        memset(rx_ring->desc, 0, rx_ring->size);
+        rx_ring->next_to_clean = 0;
+        rx_ring->next_to_use = 0;
+        for (desNo = 0; desNo < rx_ring->count; desNo++) {
+                rx_desc = PCH_GBE_RX_DESC(*rx_ring, desNo);
+                rx_desc->gbec_status = DSC_INIT16;
+        }
+        pr_debug("rx_ring->desc = 0x%p  rx_ring->dma = 0x%08llx "
+                 "next_to_clean = 0x%08x  next_to_use = 0x%08x\n",
+                 rx_ring->desc, (unsigned long long)rx_ring->dma,
+                 rx_ring->next_to_clean, rx_ring->next_to_use);
+        return 0;
+}
+
+/**
+ * pch_gbe_free_tx_resources - Free Tx Resources
+ * @adapter:  Board private structure
+ * @tx_ring:  Tx descriptor ring for a specific queue
+ */
+void pch_gbe_free_tx_resources(struct pch_gbe_adapter *adapter,
+                                struct pch_gbe_tx_ring *tx_ring)
+{
+        struct pci_dev *pdev = adapter->pdev;
+
+        pch_gbe_clean_tx_ring(adapter, tx_ring);
+        vfree(tx_ring->buffer_info);
+        tx_ring->buffer_info = NULL;
+        pci_free_consistent(pdev, tx_ring->size, tx_ring->desc, tx_ring->dma);
+        tx_ring->desc = NULL;
+}
+
+/**
+ * pch_gbe_free_rx_resources - Free Rx Resources
+ * @adapter:  Board private structure
+ * @rx_ring:  Ring to clean the resources from
+ */
+void pch_gbe_free_rx_resources(struct pch_gbe_adapter *adapter,
+                                struct pch_gbe_rx_ring *rx_ring)
+{
+        struct pci_dev *pdev = adapter->pdev;
+
+        pch_gbe_clean_rx_ring(adapter, rx_ring);
+        vfree(rx_ring->buffer_info);
+        rx_ring->buffer_info = NULL;
+        pci_free_consistent(pdev, rx_ring->size, rx_ring->desc, rx_ring->dma);
+        rx_ring->desc = NULL;
+}
+
+/**
+ * pch_gbe_request_irq - Allocate an interrupt line
+ * @adapter:  Board private structure
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_request_irq(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        int err;
+        int flags;
+
+        flags = IRQF_SHARED;
+        adapter->have_msi = false;
+        err = pci_enable_msi(adapter->pdev);
+        pr_debug("call pci_enable_msi\n");
+        if (err) {
+                pr_debug("call pci_enable_msi - Error: %d\n", err);
+        } else {
+                flags = 0;
+                adapter->have_msi = true;
+        }
+        err = request_irq(adapter->pdev->irq, &pch_gbe_intr,
+                          flags, netdev->name, netdev);
+        if (err)
+                pr_err("Unable to allocate interrupt Error: %d\n", err);
+        pr_debug("adapter->have_msi : %d  flags : 0x%04x  return : 0x%04x\n",
+                 adapter->have_msi, flags, err);
+        return err;
+}
+
+
+static void pch_gbe_set_multi(struct net_device *netdev);
+/**
+ * pch_gbe_up - Up GbE network device
+ * @adapter:  Board private structure
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed
+ */
+int pch_gbe_up(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
+        struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
+        int err;
+
+        /* hardware has been reset, we need to reload some things */
+        pch_gbe_set_multi(netdev);
+
+        pch_gbe_setup_tctl(adapter);
+        pch_gbe_configure_tx(adapter);
+        pch_gbe_setup_rctl(adapter);
+        pch_gbe_configure_rx(adapter);
+
+        err = pch_gbe_request_irq(adapter);
+        if (err) {
+                pr_err("Error: can't bring device up\n");
+                return err;
+        }
+        pch_gbe_alloc_tx_buffers(adapter, tx_ring);
+        pch_gbe_alloc_rx_buffers(adapter, rx_ring, rx_ring->count);
+        adapter->tx_queue_len = netdev->tx_queue_len;
+
+        mod_timer(&adapter->watchdog_timer, jiffies);
+
+        napi_enable(&adapter->napi);
+        pch_gbe_irq_enable(adapter);
+        netif_start_queue(adapter->netdev);
+
+        return 0;
+}
+
+/**
+ * pch_gbe_down - Down GbE network device
+ * @adapter:  Board private structure
+ */
+void pch_gbe_down(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+
+        /* signal that we're down so the interrupt handler does not
+         * reschedule our watchdog timer */
+        napi_disable(&adapter->napi);
+        atomic_set(&adapter->irq_sem, 0);
+
+        pch_gbe_irq_disable(adapter);
+        pch_gbe_free_irq(adapter);
+
+        del_timer_sync(&adapter->watchdog_timer);
+
+        netdev->tx_queue_len = adapter->tx_queue_len;
+        netif_carrier_off(netdev);
+        netif_stop_queue(netdev);
+
+        pch_gbe_reset(adapter);
+        pch_gbe_clean_tx_ring(adapter, adapter->tx_ring);
+        pch_gbe_clean_rx_ring(adapter, adapter->rx_ring);
+}
+
+/**
+ * pch_gbe_sw_init - Initialize general software structures (struct pch_gbe_adapter)
+ * @adapter:  Board private structure to initialize
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_sw_init(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct net_device *netdev = adapter->netdev;
+
+        adapter->rx_buffer_len = PCH_GBE_FRAME_SIZE_2048;
+        hw->mac.max_frame_size = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
+        hw->mac.min_frame_size = ETH_ZLEN + ETH_FCS_LEN;
+
+        /* Initialize the hardware-specific values */
+        if (pch_gbe_hal_setup_init_funcs(hw)) {
+                pr_err("Hardware Initialization Failure\n");
+                return -EIO;
+        }
+        if (pch_gbe_alloc_queues(adapter)) {
+                pr_err("Unable to allocate memory for queues\n");
+                return -ENOMEM;
+        }
+        spin_lock_init(&adapter->hw.miim_lock);
+        spin_lock_init(&adapter->tx_queue_lock);
+        spin_lock_init(&adapter->stats_lock);
+        spin_lock_init(&adapter->ethtool_lock);
+        atomic_set(&adapter->irq_sem, 0);
+        pch_gbe_irq_disable(adapter);
+
+        pch_gbe_init_stats(adapter);
+
+        pr_debug("rx_buffer_len : %d  mac.min_frame_size : %d  mac.max_frame_size : %d\n",
+                 (u32) adapter->rx_buffer_len,
+                 hw->mac.min_frame_size, hw->mac.max_frame_size);
+        return 0;
+}
+
+/**
+ * pch_gbe_open - Called when a network interface is made active
+ * @netdev:     Network interface device structure
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_open(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        int err;
+
+        /* allocate transmit descriptors */
+        err = pch_gbe_setup_tx_resources(adapter, adapter->tx_ring);
+        if (err)
+                goto err_setup_tx;
+        /* allocate receive descriptors */
+        err = pch_gbe_setup_rx_resources(adapter, adapter->rx_ring);
+        if (err)
+                goto err_setup_rx;
+        pch_gbe_hal_power_up_phy(hw);
+        err = pch_gbe_up(adapter);
+        if (err)
+                goto err_up;
+        pr_debug("Success End\n");
+        return 0;
+
+err_up:
+        if (!adapter->wake_up_evt)
+                pch_gbe_hal_power_down_phy(hw);
+        pch_gbe_free_rx_resources(adapter, adapter->rx_ring);
+err_setup_rx:
+        pch_gbe_free_tx_resources(adapter, adapter->tx_ring);
+err_setup_tx:
+        pch_gbe_reset(adapter);
+        pr_err("Error End\n");
+        return err;
+}
+
+/**
+ * pch_gbe_stop - Disables a network interface
+ * @netdev:  Network interface device structure
+ * Returns
+ *      0: Successfully
+ */
+static int pch_gbe_stop(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        pch_gbe_down(adapter);
+        if (!adapter->wake_up_evt)
+                pch_gbe_hal_power_down_phy(hw);
+        pch_gbe_free_tx_resources(adapter, adapter->tx_ring);
+        pch_gbe_free_rx_resources(adapter, adapter->rx_ring);
+        return 0;
+}
+
+/**
+ * pch_gbe_xmit_frame - Packet transmitting start
+ * @skb:     Socket buffer structure
+ * @netdev:  Network interface device structure
+ * Returns
+ *      - NETDEV_TX_OK:   Normal end
+ *      - NETDEV_TX_BUSY: Error end
+ */
+static int pch_gbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
+        unsigned long flags;
+
+        if (unlikely(skb->len > (adapter->hw.mac.max_frame_size - 4))) {
+                pr_err("Transfer length Error: skb len: %d > max: %d\n",
+                       skb->len, adapter->hw.mac.max_frame_size);
+                dev_kfree_skb_any(skb);
+                adapter->stats.tx_length_errors++;
+                return NETDEV_TX_OK;
+        }
+        if (!spin_trylock_irqsave(&tx_ring->tx_lock, flags)) {
+                /* Collision - tell upper layer to requeue */
+                return NETDEV_TX_LOCKED;
+        }
+        if (unlikely(!PCH_GBE_DESC_UNUSED(tx_ring))) {
+                netif_stop_queue(netdev);
+                spin_unlock_irqrestore(&tx_ring->tx_lock, flags);
+                pr_debug("Return : BUSY  next_to use : 0x%08x  next_to clean : 0x%08x\n",
+                         tx_ring->next_to_use, tx_ring->next_to_clean);
+                return NETDEV_TX_BUSY;
+        }
+        spin_unlock_irqrestore(&tx_ring->tx_lock, flags);
+
+        /* CRC,ITAG no support */
+        pch_gbe_tx_queue(adapter, tx_ring, skb);
+        return NETDEV_TX_OK;
+}
+
+/**
+ * pch_gbe_get_stats - Get System Network Statistics
+ * @netdev:  Network interface device structure
+ * Returns:  The current stats
+ */
+static struct net_device_stats *pch_gbe_get_stats(struct net_device *netdev)
+{
+        /* only return the current stats */
+        return &netdev->stats;
+}
+
+/**
+ * pch_gbe_set_multi - Multicast and Promiscuous mode set
+ * @netdev:   Network interface device structure
+ */
+static void pch_gbe_set_multi(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct netdev_hw_addr *ha;
+        u8 *mta_list;
+        u32 rctl;
+        int i;
+        int mc_count;
+
+        pr_debug("netdev->flags : 0x%08x\n", netdev->flags);
+
+        /* Check for Promiscuous and All Multicast modes */
+        rctl = ioread32(&hw->reg->RX_MODE);
+        mc_count = netdev_mc_count(netdev);
+        if ((netdev->flags & IFF_PROMISC)) {
+                rctl &= ~PCH_GBE_ADD_FIL_EN;
+                rctl &= ~PCH_GBE_MLT_FIL_EN;
+        } else if ((netdev->flags & IFF_ALLMULTI)) {
+                /* all the multicasting receive permissions */
+                rctl |= PCH_GBE_ADD_FIL_EN;
+                rctl &= ~PCH_GBE_MLT_FIL_EN;
+        } else {
+                if (mc_count >= PCH_GBE_MAR_ENTRIES) {
+                        /* all the multicasting receive permissions */
+                        rctl |= PCH_GBE_ADD_FIL_EN;
+                        rctl &= ~PCH_GBE_MLT_FIL_EN;
+                } else {
+                        rctl |= (PCH_GBE_ADD_FIL_EN | PCH_GBE_MLT_FIL_EN);
+                }
+        }
+        iowrite32(rctl, &hw->reg->RX_MODE);
+
+        if (mc_count >= PCH_GBE_MAR_ENTRIES)
+                return;
+        mta_list = kmalloc(mc_count * ETH_ALEN, GFP_ATOMIC);
+        if (!mta_list)
+                return;
+
+        /* The shared function expects a packed array of only addresses. */
+        i = 0;
+        netdev_for_each_mc_addr(ha, netdev) {
+                if (i == mc_count)
+                        break;
+                memcpy(mta_list + (i++ * ETH_ALEN), &ha->addr, ETH_ALEN);
+        }
+        pch_gbe_mac_mc_addr_list_update(hw, mta_list, i, 1,
+                                        PCH_GBE_MAR_ENTRIES);
+        kfree(mta_list);
+
+        pr_debug("RX_MODE reg(check bit31,30 ADD,MLT) : 0x%08x  netdev->mc_count : 0x%08x\n",
+                 ioread32(&hw->reg->RX_MODE), mc_count);
+}
+
+/**
+ * pch_gbe_set_mac - Change the Ethernet Address of the NIC
+ * @netdev: Network interface device structure
+ * @addr:   Pointer to an address structure
+ * Returns
+ *      0:              Successfully
+ *      -EADDRNOTAVAIL: Failed
+ */
+static int pch_gbe_set_mac(struct net_device *netdev, void *addr)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct sockaddr *skaddr = addr;
+        int ret_val;
+
+        if (!is_valid_ether_addr(skaddr->sa_data)) {
+                ret_val = -EADDRNOTAVAIL;
+        } else {
+                memcpy(netdev->dev_addr, skaddr->sa_data, netdev->addr_len);
+                memcpy(adapter->hw.mac.addr, skaddr->sa_data, netdev->addr_len);
+                pch_gbe_mac_mar_set(&adapter->hw, adapter->hw.mac.addr, 0);
+                ret_val = 0;
+        }
+        pr_debug("ret_val : 0x%08x\n", ret_val);
+        pr_debug("dev_addr : %pM\n", netdev->dev_addr);
+        pr_debug("mac_addr : %pM\n", adapter->hw.mac.addr);
+        pr_debug("MAC_ADR1AB reg : 0x%08x 0x%08x\n",
+                 ioread32(&adapter->hw.reg->mac_adr[0].high),
+                 ioread32(&adapter->hw.reg->mac_adr[0].low));
+        return ret_val;
+}
+
+/**
+ * pch_gbe_change_mtu - Change the Maximum Transfer Unit
+ * @netdev:   Network interface device structure
+ * @new_mtu:  New value for maximum frame size
+ * Returns
+ *      0:              Successfully
+ *      -EINVAL:        Failed
+ */
+static int pch_gbe_change_mtu(struct net_device *netdev, int new_mtu)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        int max_frame;
+
+        max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN;
+        if ((max_frame < ETH_ZLEN + ETH_FCS_LEN) ||
+                (max_frame > PCH_GBE_MAX_JUMBO_FRAME_SIZE)) {
+                pr_err("Invalid MTU setting\n");
+                return -EINVAL;
+        }
+        if (max_frame <= PCH_GBE_FRAME_SIZE_2048)
+                adapter->rx_buffer_len = PCH_GBE_FRAME_SIZE_2048;
+        else if (max_frame <= PCH_GBE_FRAME_SIZE_4096)
+                adapter->rx_buffer_len = PCH_GBE_FRAME_SIZE_4096;
+        else if (max_frame <= PCH_GBE_FRAME_SIZE_8192)
+                adapter->rx_buffer_len = PCH_GBE_FRAME_SIZE_8192;
+        else
+                adapter->rx_buffer_len = PCH_GBE_MAX_JUMBO_FRAME_SIZE;
+        netdev->mtu = new_mtu;
+        adapter->hw.mac.max_frame_size = max_frame;
+
+        if (netif_running(netdev))
+                pch_gbe_reinit_locked(adapter);
+        else
+                pch_gbe_reset(adapter);
+
+        pr_debug("max_frame : %d  rx_buffer_len : %d  mtu : %d  max_frame_size : %d\n",
+                 max_frame, (u32) adapter->rx_buffer_len, netdev->mtu,
+                 adapter->hw.mac.max_frame_size);
+        return 0;
+}
+
+/**
+ * pch_gbe_ioctl - Controls register through a MII interface
+ * @netdev:   Network interface device structure
+ * @ifr:      Pointer to ifr structure
+ * @cmd:      Control command
+ * Returns
+ *      0:      Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        pr_debug("cmd : 0x%04x\n", cmd);
+
+        return generic_mii_ioctl(&adapter->mii, if_mii(ifr), cmd, NULL);
+}
+
+/**
+ * pch_gbe_tx_timeout - Respond to a Tx Hang
+ * @netdev:   Network interface device structure
+ */
+static void pch_gbe_tx_timeout(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        /* Do the reset outside of interrupt context */
+        adapter->stats.tx_timeout_count++;
+        schedule_work(&adapter->reset_task);
+}
+
+/**
+ * pch_gbe_napi_poll - NAPI receive and transfer polling callback
+ * @napi:    Pointer of polling device struct
+ * @budget:  The maximum number of a packet
+ * Returns
+ *      false:  Exit the polling mode
+ *      true:   Continue the polling mode
+ */
+static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
+{
+        struct pch_gbe_adapter *adapter =
+            container_of(napi, struct pch_gbe_adapter, napi);
+        struct net_device *netdev = adapter->netdev;
+        int work_done = 0;
+        bool poll_end_flag = false;
+        bool cleaned = false;
+
+        pr_debug("budget : %d\n", budget);
+
+        /* Keep link state information with original netdev */
+        if (!netif_carrier_ok(netdev)) {
+                poll_end_flag = true;
+        } else {
+                cleaned = pch_gbe_clean_tx(adapter, adapter->tx_ring);
+                pch_gbe_clean_rx(adapter, adapter->rx_ring, &work_done, budget);
+
+                if (cleaned)
+                        work_done = budget;
+                /* If no Tx and not enough Rx work done,
+                 * exit the polling mode
+                 */
+                if ((work_done < budget) || !netif_running(netdev))
+                        poll_end_flag = true;
+        }
+
+        if (poll_end_flag) {
+                napi_complete(napi);
+                pch_gbe_irq_enable(adapter);
+        }
+
+        pr_debug("poll_end_flag : %d  work_done : %d  budget : %d\n",
+                 poll_end_flag, work_done, budget);
+
+        return work_done;
+}
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+/**
+ * pch_gbe_netpoll - Used by things like netconsole to send skbs
+ * @netdev:  Network interface device structure
+ */
+static void pch_gbe_netpoll(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        disable_irq(adapter->pdev->irq);
+        pch_gbe_intr(adapter->pdev->irq, netdev);
+        enable_irq(adapter->pdev->irq);
+}
+#endif
+
+static const struct net_device_ops pch_gbe_netdev_ops = {
+        .ndo_open = pch_gbe_open,
+        .ndo_stop = pch_gbe_stop,
+        .ndo_start_xmit = pch_gbe_xmit_frame,
+        .ndo_get_stats = pch_gbe_get_stats,
+        .ndo_set_mac_address = pch_gbe_set_mac,
+        .ndo_tx_timeout = pch_gbe_tx_timeout,
+        .ndo_change_mtu = pch_gbe_change_mtu,
+        .ndo_do_ioctl = pch_gbe_ioctl,
+        .ndo_set_multicast_list = &pch_gbe_set_multi,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller = pch_gbe_netpoll,
+#endif
+};
+
+static pci_ers_result_t pch_gbe_io_error_detected(struct pci_dev *pdev,
+                                                pci_channel_state_t state)
+{
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        netif_device_detach(netdev);
+        if (netif_running(netdev))
+                pch_gbe_down(adapter);
+        pci_disable_device(pdev);
+        /* Request a slot slot reset. */
+        return PCI_ERS_RESULT_NEED_RESET;
+}
+
+static pci_ers_result_t pch_gbe_io_slot_reset(struct pci_dev *pdev)
+{
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        if (pci_enable_device(pdev)) {
+                pr_err("Cannot re-enable PCI device after reset\n");
+                return PCI_ERS_RESULT_DISCONNECT;
+        }
+        pci_set_master(pdev);
+        pci_enable_wake(pdev, PCI_D0, 0);
+        pch_gbe_hal_power_up_phy(hw);
+        pch_gbe_reset(adapter);
+        /* Clear wake up status */
+        pch_gbe_mac_set_wol_event(hw, 0);
+
+        return PCI_ERS_RESULT_RECOVERED;
+}
+
+static void pch_gbe_io_resume(struct pci_dev *pdev)
+{
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        if (netif_running(netdev)) {
+                if (pch_gbe_up(adapter)) {
+                        pr_debug("can't bring device back up after reset\n");
+                        return;
+                }
+        }
+        netif_device_attach(netdev);
+}
+
+static int __pch_gbe_suspend(struct pci_dev *pdev)
+{
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 wufc = adapter->wake_up_evt;
+        int retval = 0;
+
+        netif_device_detach(netdev);
+        if (netif_running(netdev))
+                pch_gbe_down(adapter);
+        if (wufc) {
+                pch_gbe_set_multi(netdev);
+                pch_gbe_setup_rctl(adapter);
+                pch_gbe_configure_rx(adapter);
+                pch_gbe_set_rgmii_ctrl(adapter, hw->mac.link_speed,
+                                        hw->mac.link_duplex);
+                pch_gbe_set_mode(adapter, hw->mac.link_speed,
+                                        hw->mac.link_duplex);
+                pch_gbe_mac_set_wol_event(hw, wufc);
+                pci_disable_device(pdev);
+        } else {
+                pch_gbe_hal_power_down_phy(hw);
+                pch_gbe_mac_set_wol_event(hw, wufc);
+                pci_disable_device(pdev);
+        }
+        return retval;
+}
+
+#ifdef CONFIG_PM
+static int pch_gbe_suspend(struct device *device)
+{
+        struct pci_dev *pdev = to_pci_dev(device);
+
+        return __pch_gbe_suspend(pdev);
+}
+
+static int pch_gbe_resume(struct device *device)
+{
+        struct pci_dev *pdev = to_pci_dev(device);
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 err;
+
+        err = pci_enable_device(pdev);
+        if (err) {
+                pr_err("Cannot enable PCI device from suspend\n");
+                return err;
+        }
+        pci_set_master(pdev);
+        pch_gbe_hal_power_up_phy(hw);
+        pch_gbe_reset(adapter);
+        /* Clear wake on lan control and status */
+        pch_gbe_mac_set_wol_event(hw, 0);
+
+        if (netif_running(netdev))
+                pch_gbe_up(adapter);
+        netif_device_attach(netdev);
+
+        return 0;
+}
+#endif /* CONFIG_PM */
+
+static void pch_gbe_shutdown(struct pci_dev *pdev)
+{
+        __pch_gbe_suspend(pdev);
+        if (system_state == SYSTEM_POWER_OFF) {
+                pci_wake_from_d3(pdev, true);
+                pci_set_power_state(pdev, PCI_D3hot);
+        }
+}
+
+static void pch_gbe_remove(struct pci_dev *pdev)
+{
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        flush_scheduled_work();
+        unregister_netdev(netdev);
+
+        pch_gbe_hal_phy_hw_reset(&adapter->hw);
+
+        kfree(adapter->tx_ring);
+        kfree(adapter->rx_ring);
+
+        iounmap(adapter->hw.reg);
+        pci_release_regions(pdev);
+        free_netdev(netdev);
+        pci_disable_device(pdev);
+}
+
+static int pch_gbe_probe(struct pci_dev *pdev,
+                          const struct pci_device_id *pci_id)
+{
+        struct net_device *netdev;
+        struct pch_gbe_adapter *adapter;
+        int ret;
+
+        ret = pci_enable_device(pdev);
+        if (ret)
+                return ret;
+
+        if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64))
+                || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
+                ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+                if (ret) {
+                        ret = pci_set_consistent_dma_mask(pdev,
+                                                          DMA_BIT_MASK(32));
+                        if (ret) {
+                                dev_err(&pdev->dev, "ERR: No usable DMA "
+                                        "configuration, aborting\n");
+                                goto err_disable_device;
+                        }
+                }
+        }
+
+        ret = pci_request_regions(pdev, KBUILD_MODNAME);
+        if (ret) {
+                dev_err(&pdev->dev,
+                        "ERR: Can't reserve PCI I/O and memory resources\n");
+                goto err_disable_device;
+        }
+        pci_set_master(pdev);
+
+        netdev = alloc_etherdev((int)sizeof(struct pch_gbe_adapter));
+        if (!netdev) {
+                ret = -ENOMEM;
+                dev_err(&pdev->dev,
+                        "ERR: Can't allocate and set up an Ethernet device\n");
+                goto err_release_pci;
+        }
+        SET_NETDEV_DEV(netdev, &pdev->dev);
+
+        pci_set_drvdata(pdev, netdev);
+        adapter = netdev_priv(netdev);
+        adapter->netdev = netdev;
+        adapter->pdev = pdev;
+        adapter->hw.back = adapter;
+        adapter->hw.reg = pci_iomap(pdev, PCH_GBE_PCI_BAR, 0);
+        if (!adapter->hw.reg) {
+                ret = -EIO;
+                dev_err(&pdev->dev, "Can't ioremap\n");
+                goto err_free_netdev;
+        }
+
+        netdev->netdev_ops = &pch_gbe_netdev_ops;
+        netdev->watchdog_timeo = PCH_GBE_WATCHDOG_PERIOD;
+        netif_napi_add(netdev, &adapter->napi,
+                       pch_gbe_napi_poll, PCH_GBE_RX_WEIGHT);
+        netdev->features = NETIF_F_HW_CSUM | NETIF_F_GRO;
+        pch_gbe_set_ethtool_ops(netdev);
+
+        pch_gbe_mac_reset_hw(&adapter->hw);
+
+        /* setup the private structure */
+        ret = pch_gbe_sw_init(adapter);
+        if (ret)
+                goto err_iounmap;
+
+        /* Initialize PHY */
+        ret = pch_gbe_init_phy(adapter);
+        if (ret) {
+                dev_err(&pdev->dev, "PHY initialize error\n");
+                goto err_free_adapter;
+        }
+        pch_gbe_hal_get_bus_info(&adapter->hw);
+
+        /* Read the MAC address. and store to the private data */
+        ret = pch_gbe_hal_read_mac_addr(&adapter->hw);
+        if (ret) {
+                dev_err(&pdev->dev, "MAC address Read Error\n");
+                goto err_free_adapter;
+        }
+
+        memcpy(netdev->dev_addr, adapter->hw.mac.addr, netdev->addr_len);
+        if (!is_valid_ether_addr(netdev->dev_addr)) {
+                dev_err(&pdev->dev, "Invalid MAC Address\n");
+                ret = -EIO;
+                goto err_free_adapter;
+        }
+        setup_timer(&adapter->watchdog_timer, pch_gbe_watchdog,
+                    (unsigned long)adapter);
+
+        INIT_WORK(&adapter->reset_task, pch_gbe_reset_task);
+
+        pch_gbe_check_options(adapter);
+
+        if (adapter->tx_csum)
+                netdev->features |= NETIF_F_HW_CSUM;
+        else
+                netdev->features &= ~NETIF_F_HW_CSUM;
+
+        /* initialize the wol settings based on the eeprom settings */
+        adapter->wake_up_evt = PCH_GBE_WL_INIT_SETTING;
+        dev_info(&pdev->dev, "MAC address : %pM\n", netdev->dev_addr);
+
+        /* reset the hardware with the new settings */
+        pch_gbe_reset(adapter);
+
+        ret = register_netdev(netdev);
+        if (ret)
+                goto err_free_adapter;
+        /* tell the stack to leave us alone until pch_gbe_open() is called */
+        netif_carrier_off(netdev);
+        netif_stop_queue(netdev);
+
+        dev_dbg(&pdev->dev, "OKIsemi(R) PCH Network Connection\n");
+
+        device_set_wakeup_enable(&pdev->dev, 1);
+        return 0;
+
+err_free_adapter:
+        pch_gbe_hal_phy_hw_reset(&adapter->hw);
+        kfree(adapter->tx_ring);
+        kfree(adapter->rx_ring);
+err_iounmap:
+        iounmap(adapter->hw.reg);
+err_free_netdev:
+        free_netdev(netdev);
+err_release_pci:
+        pci_release_regions(pdev);
+err_disable_device:
+        pci_disable_device(pdev);
+        return ret;
+}
+
+static DEFINE_PCI_DEVICE_TABLE(pch_gbe_pcidev_id) = {
+        {.vendor = PCI_VENDOR_ID_INTEL,
+         .device = PCI_DEVICE_ID_INTEL_IOH1_GBE,
+         .subvendor = PCI_ANY_ID,
+         .subdevice = PCI_ANY_ID,
+         .class = (PCI_CLASS_NETWORK_ETHERNET << 8),
+         .class_mask = (0xFFFF00)
+         },
+        /* required last entry */
+        {0}
+};
+
+#ifdef CONFIG_PM
+static const struct dev_pm_ops pch_gbe_pm_ops = {
+        .suspend = pch_gbe_suspend,
+        .resume = pch_gbe_resume,
+        .freeze = pch_gbe_suspend,
+        .thaw = pch_gbe_resume,
+        .poweroff = pch_gbe_suspend,
+        .restore = pch_gbe_resume,
+};
+#endif
+
+static struct pci_error_handlers pch_gbe_err_handler = {
+        .error_detected = pch_gbe_io_error_detected,
+        .slot_reset = pch_gbe_io_slot_reset,
+        .resume = pch_gbe_io_resume
+};
+
+static struct pci_driver pch_gbe_pcidev = {
+        .name = KBUILD_MODNAME,
+        .id_table = pch_gbe_pcidev_id,
+        .probe = pch_gbe_probe,
+        .remove = pch_gbe_remove,
+#ifdef CONFIG_PM_OPS
+        .driver.pm = &pch_gbe_pm_ops,
+#endif
+        .shutdown = pch_gbe_shutdown,
+        .err_handler = &pch_gbe_err_handler
+};
+
+
+static int __init pch_gbe_init_module(void)
+{
+        int ret;
+
+        ret = pci_register_driver(&pch_gbe_pcidev);
+        if (copybreak != PCH_GBE_COPYBREAK_DEFAULT) {
+                if (copybreak == 0) {
+                        pr_info("copybreak disabled\n");
+                } else {
+                        pr_info("copybreak enabled for packets <= %u bytes\n",
+                                copybreak);
+                }
+        }
+        return ret;
+}
+
+static void __exit pch_gbe_exit_module(void)
+{
+        pci_unregister_driver(&pch_gbe_pcidev);
+}
+
+module_init(pch_gbe_init_module);
+module_exit(pch_gbe_exit_module);
+
+MODULE_DESCRIPTION("OKI semiconductor PCH Gigabit ethernet Driver");
+MODULE_AUTHOR("OKI semiconductor, <masa-korg@dsn.okisemi.com>");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRV_VERSION);
+MODULE_DEVICE_TABLE(pci, pch_gbe_pcidev_id);
+
+module_param(copybreak, uint, 0644);
+MODULE_PARM_DESC(copybreak,
+        "Maximum size of packet that is copied to a new buffer on receive");
+
+/* pch_gbe_main.c */
diff --git a/drivers/net/pch_gbe/pch_gbe_param.c b/drivers/net/pch_gbe/pch_gbe_param.c
new file mode 100644
index 000000000000..2510146fc560
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_param.c
@@ -0,0 +1,499 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include "pch_gbe.h"
+
+#define OPTION_UNSET   -1
+#define OPTION_DISABLED 0
+#define OPTION_ENABLED  1
+
+/**
+ * TxDescriptors - Transmit Descriptor Count
+ * @Valid Range:   PCH_GBE_MIN_TXD - PCH_GBE_MAX_TXD
+ * @Default Value: PCH_GBE_DEFAULT_TXD
+ */
+static int TxDescriptors = OPTION_UNSET;
+module_param(TxDescriptors, int, 0);
+MODULE_PARM_DESC(TxDescriptors, "Number of transmit descriptors");
+
+/**
+ * RxDescriptors -Receive Descriptor Count
+ * @Valid Range:   PCH_GBE_MIN_RXD - PCH_GBE_MAX_RXD
+ * @Default Value: PCH_GBE_DEFAULT_RXD
+ */
+static int RxDescriptors = OPTION_UNSET;
+module_param(RxDescriptors, int, 0);
+MODULE_PARM_DESC(RxDescriptors, "Number of receive descriptors");
+
+/**
+ * Speed - User Specified Speed Override
+ * @Valid Range: 0, 10, 100, 1000
+ *   - 0:    auto-negotiate at all supported speeds
+ *   - 10:   only link at 10 Mbps
+ *   - 100:  only link at 100 Mbps
+ *   - 1000: only link at 1000 Mbps
+ * @Default Value: 0
+ */
+static int Speed = OPTION_UNSET;
+module_param(Speed, int, 0);
+MODULE_PARM_DESC(Speed, "Speed setting");
+
+/**
+ * Duplex - User Specified Duplex Override
+ * @Valid Range: 0-2
+ *   - 0:  auto-negotiate for duplex
+ *   - 1:  only link at half duplex
+ *   - 2:  only link at full duplex
+ * @Default Value: 0
+ */
+static int Duplex = OPTION_UNSET;
+module_param(Duplex, int, 0);
+MODULE_PARM_DESC(Duplex, "Duplex setting");
+
+#define HALF_DUPLEX 1
+#define FULL_DUPLEX 2
+
+/**
+ * AutoNeg - Auto-negotiation Advertisement Override
+ * @Valid Range: 0x01-0x0F, 0x20-0x2F
+ *
+ *       The AutoNeg value is a bit mask describing which speed and duplex
+ *       combinations should be advertised during auto-negotiation.
+ *       The supported speed and duplex modes are listed below
+ *
+ *       Bit           7     6     5      4      3     2     1      0
+ *       Speed (Mbps)  N/A   N/A   1000   N/A    100   100   10     10
+ *       Duplex                    Full          Full  Half  Full   Half
+ *
+ * @Default Value: 0x2F (copper)
+ */
+static int AutoNeg = OPTION_UNSET;
+module_param(AutoNeg, int, 0);
+MODULE_PARM_DESC(AutoNeg, "Advertised auto-negotiation setting");
+
+#define PHY_ADVERTISE_10_HALF      0x0001
+#define PHY_ADVERTISE_10_FULL      0x0002
+#define PHY_ADVERTISE_100_HALF     0x0004
+#define PHY_ADVERTISE_100_FULL     0x0008
+#define PHY_ADVERTISE_1000_HALF    0x0010 /* Not used, just FYI */
+#define PHY_ADVERTISE_1000_FULL    0x0020
+#define PCH_AUTONEG_ADVERTISE_DEFAULT   0x2F
+
+/**
+ * FlowControl - User Specified Flow Control Override
+ * @Valid Range: 0-3
+ *    - 0:  No Flow Control
+ *    - 1:  Rx only, respond to PAUSE frames but do not generate them
+ *    - 2:  Tx only, generate PAUSE frames but ignore them on receive
+ *    - 3:  Full Flow Control Support
+ * @Default Value: Read flow control settings from the EEPROM
+ */
+static int FlowControl = OPTION_UNSET;
+module_param(FlowControl, int, 0);
+MODULE_PARM_DESC(FlowControl, "Flow Control setting");
+
+/*
+ * XsumRX - Receive Checksum Offload Enable/Disable
+ * @Valid Range: 0, 1
+ *    - 0:  disables all checksum offload
+ *    - 1:  enables receive IP/TCP/UDP checksum offload
+ * @Default Value: PCH_GBE_DEFAULT_RX_CSUM
+ */
+static int XsumRX = OPTION_UNSET;
+module_param(XsumRX, int, 0);
+MODULE_PARM_DESC(XsumRX, "Disable or enable Receive Checksum offload");
+
+#define PCH_GBE_DEFAULT_RX_CSUM             true        /* trueorfalse */
+
+/*
+ * XsumTX - Transmit Checksum Offload Enable/Disable
+ * @Valid Range: 0, 1
+ *    - 0:  disables all checksum offload
+ *    - 1:  enables transmit IP/TCP/UDP checksum offload
+ * @Default Value: PCH_GBE_DEFAULT_TX_CSUM
+ */
+static int XsumTX = OPTION_UNSET;
+module_param(XsumTX, int, 0);
+MODULE_PARM_DESC(XsumTX, "Disable or enable Transmit Checksum offload");
+
+#define PCH_GBE_DEFAULT_TX_CSUM             true        /* trueorfalse */
+
+/**
+ * pch_gbe_option - Force the MAC's flow control settings
+ * @hw:             Pointer to the HW structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+struct pch_gbe_option {
+        enum { enable_option, range_option, list_option } type;
+        char *name;
+        char *err;
+        int  def;
+        union {
+                struct { /* range_option info */
+                        int min;
+                        int max;
+                } r;
+                struct { /* list_option info */
+                        int nr;
+                        const struct pch_gbe_opt_list { int i; char *str; } *p;
+                } l;
+        } arg;
+};
+
+static const struct pch_gbe_opt_list speed_list[] = {
+        { 0, "" },
+        { SPEED_10, "" },
+        { SPEED_100, "" },
+        { SPEED_1000, "" }
+};
+
+static const struct pch_gbe_opt_list dplx_list[] = {
+        { 0, "" },
+        { HALF_DUPLEX, "" },
+        { FULL_DUPLEX, "" }
+};
+
+static const struct pch_gbe_opt_list an_list[] =
+        #define AA "AutoNeg advertising "
+        {{ 0x01, AA "10/HD" },
+         { 0x02, AA "10/FD" },
+         { 0x03, AA "10/FD, 10/HD" },
+         { 0x04, AA "100/HD" },
+         { 0x05, AA "100/HD, 10/HD" },
+         { 0x06, AA "100/HD, 10/FD" },
+         { 0x07, AA "100/HD, 10/FD, 10/HD" },
+         { 0x08, AA "100/FD" },
+         { 0x09, AA "100/FD, 10/HD" },
+         { 0x0a, AA "100/FD, 10/FD" },
+         { 0x0b, AA "100/FD, 10/FD, 10/HD" },
+         { 0x0c, AA "100/FD, 100/HD" },
+         { 0x0d, AA "100/FD, 100/HD, 10/HD" },
+         { 0x0e, AA "100/FD, 100/HD, 10/FD" },
+         { 0x0f, AA "100/FD, 100/HD, 10/FD, 10/HD" },
+         { 0x20, AA "1000/FD" },
+         { 0x21, AA "1000/FD, 10/HD" },
+         { 0x22, AA "1000/FD, 10/FD" },
+         { 0x23, AA "1000/FD, 10/FD, 10/HD" },
+         { 0x24, AA "1000/FD, 100/HD" },
+         { 0x25, AA "1000/FD, 100/HD, 10/HD" },
+         { 0x26, AA "1000/FD, 100/HD, 10/FD" },
+         { 0x27, AA "1000/FD, 100/HD, 10/FD, 10/HD" },
+         { 0x28, AA "1000/FD, 100/FD" },
+         { 0x29, AA "1000/FD, 100/FD, 10/HD" },
+         { 0x2a, AA "1000/FD, 100/FD, 10/FD" },
+         { 0x2b, AA "1000/FD, 100/FD, 10/FD, 10/HD" },
+         { 0x2c, AA "1000/FD, 100/FD, 100/HD" },
+         { 0x2d, AA "1000/FD, 100/FD, 100/HD, 10/HD" },
+         { 0x2e, AA "1000/FD, 100/FD, 100/HD, 10/FD" },
+         { 0x2f, AA "1000/FD, 100/FD, 100/HD, 10/FD, 10/HD" }
+};
+
+static const struct pch_gbe_opt_list fc_list[] = {
+        { PCH_GBE_FC_NONE, "Flow Control Disabled" },
+        { PCH_GBE_FC_RX_PAUSE, "Flow Control Receive Only" },
+        { PCH_GBE_FC_TX_PAUSE, "Flow Control Transmit Only" },
+        { PCH_GBE_FC_FULL, "Flow Control Enabled" }
+};
+
+/**
+ * pch_gbe_validate_option - Validate option
+ * @value:    value
+ * @opt:      option
+ * @adapter:  Board private structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_validate_option(int *value,
+                                    const struct pch_gbe_option *opt,
+                                    struct pch_gbe_adapter *adapter)
+{
+        if (*value == OPTION_UNSET) {
+                *value = opt->def;
+                return 0;
+        }
+
+        switch (opt->type) {
+        case enable_option:
+                switch (*value) {
+                case OPTION_ENABLED:
+                        pr_debug("%s Enabled\n", opt->name);
+                        return 0;
+                case OPTION_DISABLED:
+                        pr_debug("%s Disabled\n", opt->name);
+                        return 0;
+                }
+                break;
+        case range_option:
+                if (*value >= opt->arg.r.min && *value <= opt->arg.r.max) {
+                        pr_debug("%s set to %i\n", opt->name, *value);
+                        return 0;
+                }
+                break;
+        case list_option: {
+                int i;
+                const struct pch_gbe_opt_list *ent;
+
+                for (i = 0; i < opt->arg.l.nr; i++) {
+                        ent = &opt->arg.l.p[i];
+                        if (*value == ent->i) {
+                                if (ent->str[0] != '\0')
+                                        pr_debug("%s\n", ent->str);
+                                return 0;
+                        }
+                }
+        }
+                break;
+        default:
+                BUG();
+        }
+
+        pr_debug("Invalid %s value specified (%i) %s\n",
+                 opt->name, *value, opt->err);
+        *value = opt->def;
+        return -1;
+}
+
+/**
+ * pch_gbe_check_copper_options - Range Checking for Link Options, Copper Version
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        int speed, dplx;
+
+        { /* Speed */
+                static const struct pch_gbe_option opt = {
+                        .type = list_option,
+                        .name = "Speed",
+                        .err  = "parameter ignored",
+                        .def  = 0,
+                        .arg  = { .l = { .nr = (int)ARRAY_SIZE(speed_list),
+                                         .p = speed_list } }
+                };
+                speed = Speed;
+                pch_gbe_validate_option(&speed, &opt, adapter);
+        }
+        { /* Duplex */
+                static const struct pch_gbe_option opt = {
+                        .type = list_option,
+                        .name = "Duplex",
+                        .err  = "parameter ignored",
+                        .def  = 0,
+                        .arg  = { .l = { .nr = (int)ARRAY_SIZE(dplx_list),
+                                         .p = dplx_list } }
+                };
+                dplx = Duplex;
+                pch_gbe_validate_option(&dplx, &opt, adapter);
+        }
+
+        { /* Autoneg */
+                static const struct pch_gbe_option opt = {
+                        .type = list_option,
+                        .name = "AutoNeg",
+                        .err  = "parameter ignored",
+                        .def  = PCH_AUTONEG_ADVERTISE_DEFAULT,
+                        .arg  = { .l = { .nr = (int)ARRAY_SIZE(an_list),
+                                         .p = an_list} }
+                };
+                if (speed || dplx) {
+                        pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n");
+                        hw->phy.autoneg_advertised = opt.def;
+                } else {
+                        hw->phy.autoneg_advertised = AutoNeg;
+                        pch_gbe_validate_option(
+                                (int *)(&hw->phy.autoneg_advertised),
+                                &opt, adapter);
+                }
+        }
+
+        switch (speed + dplx) {
+        case 0:
+                hw->mac.autoneg = hw->mac.fc_autoneg = 1;
+                if ((speed || dplx))
+                        pr_debug("Speed and duplex autonegotiation enabled\n");
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                break;
+        case HALF_DUPLEX:
+                pr_debug("Half Duplex specified without Speed\n");
+                pr_debug("Using Autonegotiation at Half Duplex only\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 1;
+                hw->phy.autoneg_advertised = PHY_ADVERTISE_10_HALF |
+                                                PHY_ADVERTISE_100_HALF;
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                break;
+        case FULL_DUPLEX:
+                pr_debug("Full Duplex specified without Speed\n");
+                pr_debug("Using Autonegotiation at Full Duplex only\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 1;
+                hw->phy.autoneg_advertised = PHY_ADVERTISE_10_FULL |
+                                                PHY_ADVERTISE_100_FULL |
+                                                PHY_ADVERTISE_1000_FULL;
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_FULL;
+                break;
+        case SPEED_10:
+                pr_debug("10 Mbps Speed specified without Duplex\n");
+                pr_debug("Using Autonegotiation at 10 Mbps only\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 1;
+                hw->phy.autoneg_advertised = PHY_ADVERTISE_10_HALF |
+                                                PHY_ADVERTISE_10_FULL;
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                break;
+        case SPEED_10 + HALF_DUPLEX:
+                pr_debug("Forcing to 10 Mbps Half Duplex\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 0;
+                hw->phy.autoneg_advertised = 0;
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                break;
+        case SPEED_10 + FULL_DUPLEX:
+                pr_debug("Forcing to 10 Mbps Full Duplex\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 0;
+                hw->phy.autoneg_advertised = 0;
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_FULL;
+                break;
+        case SPEED_100:
+                pr_debug("100 Mbps Speed specified without Duplex\n");
+                pr_debug("Using Autonegotiation at 100 Mbps only\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 1;
+                hw->phy.autoneg_advertised = PHY_ADVERTISE_100_HALF |
+                                                PHY_ADVERTISE_100_FULL;
+                hw->mac.link_speed = SPEED_100;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                break;
+        case SPEED_100 + HALF_DUPLEX:
+                pr_debug("Forcing to 100 Mbps Half Duplex\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 0;
+                hw->phy.autoneg_advertised = 0;
+                hw->mac.link_speed = SPEED_100;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                break;
+        case SPEED_100 + FULL_DUPLEX:
+                pr_debug("Forcing to 100 Mbps Full Duplex\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 0;
+                hw->phy.autoneg_advertised = 0;
+                hw->mac.link_speed = SPEED_100;
+                hw->mac.link_duplex = DUPLEX_FULL;
+                break;
+        case SPEED_1000:
+                pr_debug("1000 Mbps Speed specified without Duplex\n");
+                goto full_duplex_only;
+        case SPEED_1000 + HALF_DUPLEX:
+                pr_debug("Half Duplex is not supported at 1000 Mbps\n");
+                /* fall through */
+        case SPEED_1000 + FULL_DUPLEX:
+full_duplex_only:
+                pr_debug("Using Autonegotiation at 1000 Mbps Full Duplex only\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 1;
+                hw->phy.autoneg_advertised = PHY_ADVERTISE_1000_FULL;
+                hw->mac.link_speed = SPEED_1000;
+                hw->mac.link_duplex = DUPLEX_FULL;
+                break;
+        default:
+                BUG();
+        }
+}
+
+/**
+ * pch_gbe_check_options - Range Checking for Command Line Parameters
+ * @adapter:  Board private structure
+ */
+void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        { /* Transmit Descriptor Count */
+                static const struct pch_gbe_option opt = {
+                        .type = range_option,
+                        .name = "Transmit Descriptors",
+                        .err  = "using default of "
+                                __MODULE_STRING(PCH_GBE_DEFAULT_TXD),
+                        .def  = PCH_GBE_DEFAULT_TXD,
+                        .arg  = { .r = { .min = PCH_GBE_MIN_TXD } },
+                        .arg  = { .r = { .max = PCH_GBE_MAX_TXD } }
+                };
+                struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
+                tx_ring->count = TxDescriptors;
+                pch_gbe_validate_option(&tx_ring->count, &opt, adapter);
+                tx_ring->count = roundup(tx_ring->count,
+                                        PCH_GBE_TX_DESC_MULTIPLE);
+        }
+        { /* Receive Descriptor Count */
+                static const struct pch_gbe_option opt = {
+                        .type = range_option,
+                        .name = "Receive Descriptors",
+                        .err  = "using default of "
+                                __MODULE_STRING(PCH_GBE_DEFAULT_RXD),
+                        .def  = PCH_GBE_DEFAULT_RXD,
+                        .arg  = { .r = { .min = PCH_GBE_MIN_RXD } },
+                        .arg  = { .r = { .max = PCH_GBE_MAX_RXD } }
+                };
+                struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
+                rx_ring->count = RxDescriptors;
+                pch_gbe_validate_option(&rx_ring->count, &opt, adapter);
+                rx_ring->count = roundup(rx_ring->count,
+                                PCH_GBE_RX_DESC_MULTIPLE);
+        }
+        { /* Checksum Offload Enable/Disable */
+                static const struct pch_gbe_option opt = {
+                        .type = enable_option,
+                        .name = "Checksum Offload",
+                        .err  = "defaulting to Enabled",
+                        .def  = PCH_GBE_DEFAULT_RX_CSUM
+                };
+                adapter->rx_csum = XsumRX;
+                pch_gbe_validate_option((int *)(&adapter->rx_csum),
+                                        &opt, adapter);
+        }
+        { /* Checksum Offload Enable/Disable */
+                static const struct pch_gbe_option opt = {
+                        .type = enable_option,
+                        .name = "Checksum Offload",
+                        .err  = "defaulting to Enabled",
+                        .def  = PCH_GBE_DEFAULT_TX_CSUM
+                };
+                adapter->tx_csum = XsumTX;
+                pch_gbe_validate_option((int *)(&adapter->tx_csum),
+                                                &opt, adapter);
+        }
+        { /* Flow Control */
+                static const struct pch_gbe_option opt = {
+                        .type = list_option,
+                        .name = "Flow Control",
+                        .err  = "reading default settings from EEPROM",
+                        .def  = PCH_GBE_FC_DEFAULT,
+                        .arg  = { .l = { .nr = (int)ARRAY_SIZE(fc_list),
+                                         .p = fc_list } }
+                };
+                hw->mac.fc = FlowControl;
+                pch_gbe_validate_option((int *)(&hw->mac.fc),
+                                                &opt, adapter);
+        }
+
+        pch_gbe_check_copper_options(adapter);
+}
diff --git a/drivers/net/pch_gbe/pch_gbe_phy.c b/drivers/net/pch_gbe/pch_gbe_phy.c
new file mode 100644
index 000000000000..923a687acd30
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_phy.c
@@ -0,0 +1,274 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include "pch_gbe.h"
+#include "pch_gbe_phy.h"
+
+#define PHY_MAX_REG_ADDRESS   0x1F      /* 5 bit address bus (0-0x1F) */
+
+/* PHY 1000 MII Register/Bit Definitions */
+/* PHY Registers defined by IEEE */
+#define PHY_CONTROL           0x00  /* Control Register */
+#define PHY_STATUS            0x01  /* Status Regiser */
+#define PHY_ID1               0x02  /* Phy Id Register (word 1) */
+#define PHY_ID2               0x03  /* Phy Id Register (word 2) */
+#define PHY_AUTONEG_ADV       0x04  /* Autoneg Advertisement */
+#define PHY_LP_ABILITY        0x05  /* Link Partner Ability (Base Page) */
+#define PHY_AUTONEG_EXP       0x06  /* Autoneg Expansion Register */
+#define PHY_NEXT_PAGE_TX      0x07  /* Next Page TX */
+#define PHY_LP_NEXT_PAGE      0x08  /* Link Partner Next Page */
+#define PHY_1000T_CTRL        0x09  /* 1000Base-T Control Register */
+#define PHY_1000T_STATUS      0x0A  /* 1000Base-T Status Register */
+#define PHY_EXT_STATUS        0x0F  /* Extended Status Register */
+#define PHY_PHYSP_CONTROL     0x10  /* PHY Specific Control Register */
+#define PHY_EXT_PHYSP_CONTROL 0x14  /* Extended PHY Specific Control Register */
+#define PHY_LED_CONTROL       0x18  /* LED Control Register */
+#define PHY_EXT_PHYSP_STATUS  0x1B  /* Extended PHY Specific Status Register */
+
+/* PHY Control Register */
+#define MII_CR_SPEED_SELECT_MSB 0x0040  /* bits 6,13: 10=1000, 01=100, 00=10 */
+#define MII_CR_COLL_TEST_ENABLE 0x0080  /* Collision test enable */
+#define MII_CR_FULL_DUPLEX      0x0100  /* FDX =1, half duplex =0 */
+#define MII_CR_RESTART_AUTO_NEG 0x0200  /* Restart auto negotiation */
+#define MII_CR_ISOLATE          0x0400  /* Isolate PHY from MII */
+#define MII_CR_POWER_DOWN       0x0800  /* Power down */
+#define MII_CR_AUTO_NEG_EN      0x1000  /* Auto Neg Enable */
+#define MII_CR_SPEED_SELECT_LSB 0x2000  /* bits 6,13: 10=1000, 01=100, 00=10 */
+#define MII_CR_LOOPBACK         0x4000  /* 0 = normal, 1 = loopback */
+#define MII_CR_RESET            0x8000  /* 0 = normal, 1 = PHY reset */
+#define MII_CR_SPEED_1000       0x0040
+#define MII_CR_SPEED_100        0x2000
+#define MII_CR_SPEED_10         0x0000
+
+/* PHY Status Register */
+#define MII_SR_EXTENDED_CAPS     0x0001 /* Extended register capabilities */
+#define MII_SR_JABBER_DETECT     0x0002 /* Jabber Detected */
+#define MII_SR_LINK_STATUS       0x0004 /* Link Status 1 = link */
+#define MII_SR_AUTONEG_CAPS      0x0008 /* Auto Neg Capable */
+#define MII_SR_REMOTE_FAULT      0x0010 /* Remote Fault Detect */
+#define MII_SR_AUTONEG_COMPLETE  0x0020 /* Auto Neg Complete */
+#define MII_SR_PREAMBLE_SUPPRESS 0x0040 /* Preamble may be suppressed */
+#define MII_SR_EXTENDED_STATUS   0x0100 /* Ext. status info in Reg 0x0F */
+#define MII_SR_100T2_HD_CAPS     0x0200 /* 100T2 Half Duplex Capable */
+#define MII_SR_100T2_FD_CAPS     0x0400 /* 100T2 Full Duplex Capable */
+#define MII_SR_10T_HD_CAPS       0x0800 /* 10T   Half Duplex Capable */
+#define MII_SR_10T_FD_CAPS       0x1000 /* 10T   Full Duplex Capable */
+#define MII_SR_100X_HD_CAPS      0x2000 /* 100X  Half Duplex Capable */
+#define MII_SR_100X_FD_CAPS      0x4000 /* 100X  Full Duplex Capable */
+#define MII_SR_100T4_CAPS        0x8000 /* 100T4 Capable */
+
+/* Phy Id Register (word 2) */
+#define PHY_REVISION_MASK        0x000F
+
+/* PHY Specific Control Register */
+#define PHYSP_CTRL_ASSERT_CRS_TX  0x0800
+
+
+/* Default value of PHY register */
+#define PHY_CONTROL_DEFAULT         0x1140 /* Control Register */
+#define PHY_AUTONEG_ADV_DEFAULT     0x01e0 /* Autoneg Advertisement */
+#define PHY_NEXT_PAGE_TX_DEFAULT    0x2001 /* Next Page TX */
+#define PHY_1000T_CTRL_DEFAULT      0x0300 /* 1000Base-T Control Register */
+#define PHY_PHYSP_CONTROL_DEFAULT   0x01EE /* PHY Specific Control Register */
+
+/**
+ * pch_gbe_phy_get_id - Retrieve the PHY ID and revision
+ * @hw:        Pointer to the HW structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+s32 pch_gbe_phy_get_id(struct pch_gbe_hw *hw)
+{
+        struct pch_gbe_phy_info *phy = &hw->phy;
+        s32 ret;
+        u16 phy_id1;
+        u16 phy_id2;
+
+        ret = pch_gbe_phy_read_reg_miic(hw, PHY_ID1, &phy_id1);
+        if (ret)
+                return ret;
+        ret = pch_gbe_phy_read_reg_miic(hw, PHY_ID2, &phy_id2);
+        if (ret)
+                return ret;
+        /*
+         * PHY_ID1: [bit15-0:ID(21-6)]
+         * PHY_ID2: [bit15-10:ID(5-0)][bit9-4:Model][bit3-0:revision]
+         */
+        phy->id = (u32)phy_id1;
+        phy->id = ((phy->id << 6) | ((phy_id2 & 0xFC00) >> 10));
+        phy->revision = (u32) (phy_id2 & 0x000F);
+        pr_debug("phy->id : 0x%08x  phy->revision : 0x%08x\n",
+                 phy->id, phy->revision);
+        return 0;
+}
+
+/**
+ * pch_gbe_phy_read_reg_miic - Read MII control register
+ * @hw:      Pointer to the HW structure
+ * @offset:  Register offset to be read
+ * @data:    Pointer to the read data
+ * Returns
+ *      0:              Successful.
+ *      -EINVAL:        Invalid argument.
+ */
+s32 pch_gbe_phy_read_reg_miic(struct pch_gbe_hw *hw, u32 offset, u16 *data)
+{
+        struct pch_gbe_phy_info *phy = &hw->phy;
+
+        if (offset > PHY_MAX_REG_ADDRESS) {
+                pr_err("PHY Address %d is out of range\n", offset);
+                return -EINVAL;
+        }
+        *data = pch_gbe_mac_ctrl_miim(hw, phy->addr, PCH_GBE_HAL_MIIM_READ,
+                                      offset, (u16)0);
+        return 0;
+}
+
+/**
+ * pch_gbe_phy_write_reg_miic - Write MII control register
+ * @hw:      Pointer to the HW structure
+ * @offset:  Register offset to be read
+ * @data:    data to write to register at offset
+ * Returns
+ *      0:              Successful.
+ *      -EINVAL:        Invalid argument.
+ */
+s32 pch_gbe_phy_write_reg_miic(struct pch_gbe_hw *hw, u32 offset, u16 data)
+{
+        struct pch_gbe_phy_info *phy = &hw->phy;
+
+        if (offset > PHY_MAX_REG_ADDRESS) {
+                pr_err("PHY Address %d is out of range\n", offset);
+                return -EINVAL;
+        }
+        pch_gbe_mac_ctrl_miim(hw, phy->addr, PCH_GBE_HAL_MIIM_WRITE,
+                                 offset, data);
+        return 0;
+}
+
+/**
+ * pch_gbe_phy_sw_reset - PHY software reset
+ * @hw:             Pointer to the HW structure
+ */
+void pch_gbe_phy_sw_reset(struct pch_gbe_hw *hw)
+{
+        u16 phy_ctrl;
+
+        pch_gbe_phy_read_reg_miic(hw, PHY_CONTROL, &phy_ctrl);
+        phy_ctrl |= MII_CR_RESET;
+        pch_gbe_phy_write_reg_miic(hw, PHY_CONTROL, phy_ctrl);
+        udelay(1);
+}
+
+/**
+ * pch_gbe_phy_hw_reset - PHY hardware reset
+ * @hw:    Pointer to the HW structure
+ */
+void pch_gbe_phy_hw_reset(struct pch_gbe_hw *hw)
+{
+        pch_gbe_phy_write_reg_miic(hw, PHY_CONTROL, PHY_CONTROL_DEFAULT);
+        pch_gbe_phy_write_reg_miic(hw, PHY_AUTONEG_ADV,
+                                        PHY_AUTONEG_ADV_DEFAULT);
+        pch_gbe_phy_write_reg_miic(hw, PHY_NEXT_PAGE_TX,
+                                        PHY_NEXT_PAGE_TX_DEFAULT);
+        pch_gbe_phy_write_reg_miic(hw, PHY_1000T_CTRL, PHY_1000T_CTRL_DEFAULT);
+        pch_gbe_phy_write_reg_miic(hw, PHY_PHYSP_CONTROL,
+                                        PHY_PHYSP_CONTROL_DEFAULT);
+}
+
+/**
+ * pch_gbe_phy_power_up - restore link in case the phy was powered down
+ * @hw:    Pointer to the HW structure
+ */
+void pch_gbe_phy_power_up(struct pch_gbe_hw *hw)
+{
+        u16 mii_reg;
+
+        mii_reg = 0;
+        /* Just clear the power down bit to wake the phy back up */
+        /* according to the manual, the phy will retain its
+         * settings across a power-down/up cycle */
+        pch_gbe_phy_read_reg_miic(hw, PHY_CONTROL, &mii_reg);
+        mii_reg &= ~MII_CR_POWER_DOWN;
+        pch_gbe_phy_write_reg_miic(hw, PHY_CONTROL, mii_reg);
+}
+
+/**
+ * pch_gbe_phy_power_down - Power down PHY
+ * @hw:    Pointer to the HW structure
+ */
+void pch_gbe_phy_power_down(struct pch_gbe_hw *hw)
+{
+        u16 mii_reg;
+
+        mii_reg = 0;
+        /* Power down the PHY so no link is implied when interface is down *
+         * The PHY cannot be powered down if any of the following is TRUE *
+         * (a) WoL is enabled
+         * (b) AMT is active
+         */
+        pch_gbe_phy_read_reg_miic(hw, PHY_CONTROL, &mii_reg);
+        mii_reg |= MII_CR_POWER_DOWN;
+        pch_gbe_phy_write_reg_miic(hw, PHY_CONTROL, mii_reg);
+        mdelay(1);
+}
+
+/**
+ * pch_gbe_phy_set_rgmii - RGMII interface setting
+ * @hw:             Pointer to the HW structure
+ */
+inline void pch_gbe_phy_set_rgmii(struct pch_gbe_hw *hw)
+{
+        pch_gbe_phy_sw_reset(hw);
+}
+
+/**
+ * pch_gbe_phy_init_setting - PHY initial setting
+ * @hw:             Pointer to the HW structure
+ */
+void pch_gbe_phy_init_setting(struct pch_gbe_hw *hw)
+{
+        struct pch_gbe_adapter *adapter;
+        struct ethtool_cmd     cmd;
+        int ret;
+        u16 mii_reg;
+
+        adapter = container_of(hw, struct pch_gbe_adapter, hw);
+        ret = mii_ethtool_gset(&adapter->mii, &cmd);
+        if (ret)
+                pr_err("Error: mii_ethtool_gset\n");
+
+        cmd.speed = hw->mac.link_speed;
+        cmd.duplex = hw->mac.link_duplex;
+        cmd.advertising = hw->phy.autoneg_advertised;
+        cmd.autoneg = hw->mac.autoneg;
+        pch_gbe_phy_write_reg_miic(hw, MII_BMCR, BMCR_RESET);
+        ret = mii_ethtool_sset(&adapter->mii, &cmd);
+        if (ret)
+                pr_err("Error: mii_ethtool_sset\n");
+
+        pch_gbe_phy_sw_reset(hw);
+
+        pch_gbe_phy_read_reg_miic(hw, PHY_PHYSP_CONTROL, &mii_reg);
+        mii_reg |= PHYSP_CTRL_ASSERT_CRS_TX;
+        pch_gbe_phy_write_reg_miic(hw, PHY_PHYSP_CONTROL, mii_reg);
+
+}
diff --git a/drivers/net/pch_gbe/pch_gbe_phy.h b/drivers/net/pch_gbe/pch_gbe_phy.h
new file mode 100644
index 000000000000..03264dc7b5ec
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_phy.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+#ifndef _PCH_GBE_PHY_H_
+#define _PCH_GBE_PHY_H_
+
+#define PCH_GBE_PHY_REGS_LEN            32
+#define PCH_GBE_PHY_RESET_DELAY_US      10
+#define PCH_GBE_MAC_IFOP_RGMII
+
+s32 pch_gbe_phy_get_id(struct pch_gbe_hw *hw);
+s32 pch_gbe_phy_read_reg_miic(struct pch_gbe_hw *hw, u32 offset, u16 *data);
+s32 pch_gbe_phy_write_reg_miic(struct pch_gbe_hw *hw, u32 offset, u16 data);
+void pch_gbe_phy_sw_reset(struct pch_gbe_hw *hw);
+void pch_gbe_phy_hw_reset(struct pch_gbe_hw *hw);
+void pch_gbe_phy_power_up(struct pch_gbe_hw *hw);
+void pch_gbe_phy_power_down(struct pch_gbe_hw *hw);
+void pch_gbe_phy_set_rgmii(struct pch_gbe_hw *hw);
+void pch_gbe_phy_init_setting(struct pch_gbe_hw *hw);
+
+#endif /* _PCH_GBE_PHY_H_ */
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 7f2baf5eae26..35562a395770 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -266,7 +266,7 @@ static int tc589_config(struct pcmcia_device *link)
     __be16 *phys_addr;
     int ret, i, j, multi = 0, fifo;
     unsigned int ioaddr;
-    char *ram_split[] = {"5:3", "3:1", "1:1", "3:5"};
+    static const char * const ram_split[] = {"5:3", "3:1", "1:1", "3:5"};
     u8 *buf;
     size_t len;
 
diff --git a/drivers/net/pcmcia/nmclan_cs.c b/drivers/net/pcmcia/nmclan_cs.c
index 89cf63bb8c91..c1d8ce9e4a6c 100644
--- a/drivers/net/pcmcia/nmclan_cs.c
+++ b/drivers/net/pcmcia/nmclan_cs.c
@@ -521,7 +521,7 @@ static int mace_read(mace_private *lp, unsigned int ioaddr, int reg)
       spin_unlock_irqrestore(&lp->bank_lock, flags);
       break;
   }
-  return (data & 0xFF);
+  return data & 0xFF;
 } /* mace_read */
 
 /* ----------------------------------------------------------------------------
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index e180832c278f..c94311aed1ab 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -506,7 +506,8 @@ static int pcnet_confcheck(struct pcmcia_device *p_dev,
                            unsigned int vcc,
                            void *priv_data)
 {
-        int *has_shmem = priv_data;
+        int *priv = priv_data;
+        int try = (*priv & 0x1);
         int i;
         cistpl_io_t *io = &cfg->io;
 
@@ -523,77 +524,103 @@ static int pcnet_confcheck(struct pcmcia_device *p_dev,
                 i = p_dev->resource[1]->end = 0;
         }
 
-        *has_shmem = ((cfg->mem.nwin == 1) &&
-                      (cfg->mem.win[0].len >= 0x4000));
+        *priv &= ((cfg->mem.nwin == 1) &&
+                  (cfg->mem.win[0].len >= 0x4000)) ? 0x10 : ~0x10;
+
         p_dev->resource[0]->start = io->win[i].base;
         p_dev->resource[0]->end = io->win[i].len;
-        p_dev->io_lines = io->flags & CISTPL_IO_LINES_MASK;
+        if (!try)
+                p_dev->io_lines = io->flags & CISTPL_IO_LINES_MASK;
+        else
+                p_dev->io_lines = 16;
         if (p_dev->resource[0]->end + p_dev->resource[1]->end >= 32)
                 return try_io_port(p_dev);
 
-        return 0;
+        return -EINVAL;
+}
+
+static hw_info_t *pcnet_try_config(struct pcmcia_device *link,
+                                   int *has_shmem, int try)
+{
+        struct net_device *dev = link->priv;
+        hw_info_t *local_hw_info;
+        pcnet_dev_t *info = PRIV(dev);
+        int priv = try;
+        int ret;
+
+        ret = pcmcia_loop_config(link, pcnet_confcheck, &priv);
+        if (ret) {
+                dev_warn(&link->dev, "no useable port range found\n");
+                return NULL;
+        }
+        *has_shmem = (priv & 0x10);
+
+        if (!link->irq)
+                return NULL;
+
+        if (resource_size(link->resource[1]) == 8) {
+                link->conf.Attributes |= CONF_ENABLE_SPKR;
+                link->conf.Status = CCSR_AUDIO_ENA;
+        }
+        if ((link->manf_id == MANFID_IBM) &&
+            (link->card_id == PRODID_IBM_HOME_AND_AWAY))
+                link->conf.ConfigIndex |= 0x10;
+
+        ret = pcmcia_request_configuration(link, &link->conf);
+        if (ret)
+                return NULL;
+
+        dev->irq = link->irq;
+        dev->base_addr = link->resource[0]->start;
+
+        if (info->flags & HAS_MISC_REG) {
+                if ((if_port == 1) || (if_port == 2))
+                        dev->if_port = if_port;
+                else
+                        dev_notice(&link->dev, "invalid if_port requested\n");
+        } else
+                dev->if_port = 0;
+
+        if ((link->conf.ConfigBase == 0x03c0) &&
+            (link->manf_id == 0x149) && (link->card_id == 0xc1ab)) {
+                dev_info(&link->dev,
+                        "this is an AX88190 card - use axnet_cs instead.\n");
+                return NULL;
+        }
+
+        local_hw_info = get_hwinfo(link);
+        if (!local_hw_info)
+                local_hw_info = get_prom(link);
+        if (!local_hw_info)
+                local_hw_info = get_dl10019(link);
+        if (!local_hw_info)
+                local_hw_info = get_ax88190(link);
+        if (!local_hw_info)
+                local_hw_info = get_hwired(link);
+
+        return local_hw_info;
 }
 
 static int pcnet_config(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     pcnet_dev_t *info = PRIV(dev);
-    int ret, start_pg, stop_pg, cm_offset;
+    int start_pg, stop_pg, cm_offset;
     int has_shmem = 0;
     hw_info_t *local_hw_info;
 
     dev_dbg(&link->dev, "pcnet_config\n");
 
-    ret = pcmcia_loop_config(link, pcnet_confcheck, &has_shmem);
-    if (ret)
-        goto failed;
-
-    if (!link->irq)
-            goto failed;
-
-    if (resource_size(link->resource[1]) == 8) {
-        link->conf.Attributes |= CONF_ENABLE_SPKR;
-        link->conf.Status = CCSR_AUDIO_ENA;
-    }
-    if ((link->manf_id == MANFID_IBM) &&
-        (link->card_id == PRODID_IBM_HOME_AND_AWAY))
-        link->conf.ConfigIndex |= 0x10;
-
-    ret = pcmcia_request_configuration(link, &link->conf);
-    if (ret)
-            goto failed;
-    dev->irq = link->irq;
-    dev->base_addr = link->resource[0]->start;
-    if (info->flags & HAS_MISC_REG) {
-        if ((if_port == 1) || (if_port == 2))
-            dev->if_port = if_port;
-        else
-            pr_notice("invalid if_port requested\n");
-    } else {
-        dev->if_port = 0;
-    }
-
-    if ((link->conf.ConfigBase == 0x03c0) &&
-        (link->manf_id == 0x149) && (link->card_id == 0xc1ab)) {
-        pr_notice("this is an AX88190 card!\n");
-        pr_notice("use axnet_cs instead.\n");
-        goto failed;
-    }
-
-    local_hw_info = get_hwinfo(link);
-    if (local_hw_info == NULL)
-        local_hw_info = get_prom(link);
-    if (local_hw_info == NULL)
-        local_hw_info = get_dl10019(link);
-    if (local_hw_info == NULL)
-        local_hw_info = get_ax88190(link);
-    if (local_hw_info == NULL)
-        local_hw_info = get_hwired(link);
-
-    if (local_hw_info == NULL) {
-        pr_notice("unable to read hardware net address for io base %#3lx\n",
-                  dev->base_addr);
-        goto failed;
+    local_hw_info = pcnet_try_config(link, &has_shmem, 0);
+    if (!local_hw_info) {
+            /* check whether forcing io_lines to 16 helps... */
+            pcmcia_disable_device(link);
+            local_hw_info = pcnet_try_config(link, &has_shmem, 1);
+            if (local_hw_info == NULL) {
+                    dev_notice(&link->dev, "unable to read hardware net"
+                            " address for io base %#3lx\n", dev->base_addr);
+                    goto failed;
+            }
     }
 
     info->flags = local_hw_info->flags;
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index 3d1c549b7038..7204a4b5529b 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -815,7 +815,7 @@ static int check_sig(struct pcmcia_device *link)
         ((s >> 8) != (s & 0xff))) {
         SMC_SELECT_BANK(3);
         s = inw(ioaddr + REVISION);
-        return (s & 0xff);
+        return s & 0xff;
     }
 
     if (width) {
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index c200c2821730..aee3bb0358bf 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -376,7 +376,7 @@ static void pcnet32_wio_reset(unsigned long addr)
 static int pcnet32_wio_check(unsigned long addr)
 {
         outw(88, addr + PCNET32_WIO_RAP);
-        return (inw(addr + PCNET32_WIO_RAP) == 88);
+        return inw(addr + PCNET32_WIO_RAP) == 88;
 }
 
 static struct pcnet32_access pcnet32_wio = {
@@ -431,7 +431,7 @@ static void pcnet32_dwio_reset(unsigned long addr)
 static int pcnet32_dwio_check(unsigned long addr)
 {
         outl(88, addr + PCNET32_DWIO_RAP);
-        return ((inl(addr + PCNET32_DWIO_RAP) & 0xffff) == 88);
+        return (inl(addr + PCNET32_DWIO_RAP) & 0xffff) == 88;
 }
 
 static struct pcnet32_access pcnet32_dwio = {
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index eb799b36c86a..cb3d13e4e074 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -58,7 +58,6 @@ config BROADCOM_PHY
 
 config BCM63XX_PHY
         tristate "Drivers for Broadcom 63xx SOCs internal PHY"
-        depends on BCM63XX
         ---help---
           Currently supports the 6348 and 6358 PHYs.
 
diff --git a/drivers/net/phy/bcm63xx.c b/drivers/net/phy/bcm63xx.c
index c12815679837..e16f98cb4f04 100644
--- a/drivers/net/phy/bcm63xx.c
+++ b/drivers/net/phy/bcm63xx.c
@@ -131,7 +131,7 @@ static void __exit bcm63xx_phy_exit(void)
 module_init(bcm63xx_phy_init);
 module_exit(bcm63xx_phy_exit);
 
-static struct mdio_device_id bcm63xx_tbl[] = {
+static struct mdio_device_id __maybe_unused bcm63xx_tbl[] = {
         { 0x00406000, 0xfffffc00 },
         { 0x002bdc00, 0xfffffc00 },
         { }
diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
index 4accd83d3dfe..d84c4224dd12 100644
--- a/drivers/net/phy/broadcom.c
+++ b/drivers/net/phy/broadcom.c
@@ -930,7 +930,7 @@ static void __exit broadcom_exit(void)
 module_init(broadcom_init);
 module_exit(broadcom_exit);
 
-static struct mdio_device_id broadcom_tbl[] = {
+static struct mdio_device_id __maybe_unused broadcom_tbl[] = {
         { PHY_ID_BCM5411, 0xfffffff0 },
         { PHY_ID_BCM5421, 0xfffffff0 },
         { PHY_ID_BCM5461, 0xfffffff0 },
diff --git a/drivers/net/phy/cicada.c b/drivers/net/phy/cicada.c
index 1a325d63756b..d28173161c21 100644
--- a/drivers/net/phy/cicada.c
+++ b/drivers/net/phy/cicada.c
@@ -159,7 +159,7 @@ static void __exit cicada_exit(void)
 module_init(cicada_init);
 module_exit(cicada_exit);
 
-static struct mdio_device_id cicada_tbl[] = {
+static struct mdio_device_id __maybe_unused cicada_tbl[] = {
         { 0x000fc410, 0x000ffff0 },
         { 0x000fc440, 0x000fffc0 },
         { }
diff --git a/drivers/net/phy/davicom.c b/drivers/net/phy/davicom.c
index 29c17617a2ec..2f774acdb551 100644
--- a/drivers/net/phy/davicom.c
+++ b/drivers/net/phy/davicom.c
@@ -219,7 +219,7 @@ static void __exit davicom_exit(void)
 module_init(davicom_init);
 module_exit(davicom_exit);
 
-static struct mdio_device_id davicom_tbl[] = {
+static struct mdio_device_id __maybe_unused davicom_tbl[] = {
         { 0x0181b880, 0x0ffffff0 },
         { 0x0181b8a0, 0x0ffffff0 },
         { 0x00181b80, 0x0ffffff0 },
diff --git a/drivers/net/phy/et1011c.c b/drivers/net/phy/et1011c.c
index 13995f52d6af..a8eb19ec3183 100644
--- a/drivers/net/phy/et1011c.c
+++ b/drivers/net/phy/et1011c.c
@@ -111,7 +111,7 @@ static void __exit et1011c_exit(void)
 module_init(et1011c_init);
 module_exit(et1011c_exit);
 
-static struct mdio_device_id et1011c_tbl[] = {
+static struct mdio_device_id __maybe_unused et1011c_tbl[] = {
         { 0x0282f014, 0xfffffff0 },
         { }
 };
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index 3f2583f18a39..c1d2d251fe8b 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -134,7 +134,7 @@ static void __exit ip175c_exit(void)
 module_init(ip175c_init);
 module_exit(ip175c_exit);
 
-static struct mdio_device_id icplus_tbl[] = {
+static struct mdio_device_id __maybe_unused icplus_tbl[] = {
         { 0x02430d80, 0x0ffffff0 },
         { }
 };
diff --git a/drivers/net/phy/lxt.c b/drivers/net/phy/lxt.c
index 29c39ff85de5..6f6e8b616a62 100644
--- a/drivers/net/phy/lxt.c
+++ b/drivers/net/phy/lxt.c
@@ -223,7 +223,7 @@ static void __exit lxt_exit(void)
 module_init(lxt_init);
 module_exit(lxt_exit);
 
-static struct mdio_device_id lxt_tbl[] = {
+static struct mdio_device_id __maybe_unused lxt_tbl[] = {
         { 0x78100000, 0xfffffff0 },
         { 0x001378e0, 0xfffffff0 },
         { 0x00137a10, 0xfffffff0 },
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 0101f2bdf400..e2afdce0a437 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -196,20 +196,27 @@ static int m88e1121_config_aneg(struct phy_device *phydev)
                         MII_88E1121_PHY_MSCR_PAGE);
         if (err < 0)
                 return err;
-        mscr = phy_read(phydev, MII_88E1121_PHY_MSCR_REG) &
-                MII_88E1121_PHY_MSCR_DELAY_MASK;
 
-        if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID)
-                mscr |= (MII_88E1121_PHY_MSCR_RX_DELAY |
-                         MII_88E1121_PHY_MSCR_TX_DELAY);
-        else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID)
-                mscr |= MII_88E1121_PHY_MSCR_RX_DELAY;
-        else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
-                mscr |= MII_88E1121_PHY_MSCR_TX_DELAY;
+        if ((phydev->interface == PHY_INTERFACE_MODE_RGMII) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)) {
 
-        err = phy_write(phydev, MII_88E1121_PHY_MSCR_REG, mscr);
-        if (err < 0)
-                return err;
+                mscr = phy_read(phydev, MII_88E1121_PHY_MSCR_REG) &
+                        MII_88E1121_PHY_MSCR_DELAY_MASK;
+
+                if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID)
+                        mscr |= (MII_88E1121_PHY_MSCR_RX_DELAY |
+                                 MII_88E1121_PHY_MSCR_TX_DELAY);
+                else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID)
+                        mscr |= MII_88E1121_PHY_MSCR_RX_DELAY;
+                else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
+                        mscr |= MII_88E1121_PHY_MSCR_TX_DELAY;
+
+                err = phy_write(phydev, MII_88E1121_PHY_MSCR_REG, mscr);
+                if (err < 0)
+                        return err;
+        }
 
         phy_write(phydev, MII_88E1121_PHY_PAGE, oldpage);
 
@@ -721,7 +728,7 @@ static void __exit marvell_exit(void)
 module_init(marvell_init);
 module_exit(marvell_exit);
 
-static struct mdio_device_id marvell_tbl[] = {
+static struct mdio_device_id __maybe_unused marvell_tbl[] = {
         { 0x01410c60, 0xfffffff0 },
         { 0x01410c90, 0xfffffff0 },
         { 0x01410cc0, 0xfffffff0 },
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 6a6b8199a0d6..6c58da2b882c 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -308,7 +308,7 @@ static int mdio_bus_suspend(struct device *dev)
          * may call phy routines that try to grab the same lock, and that may
          * lead to a deadlock.
          */
-        if (phydev->attached_dev)
+        if (phydev->attached_dev && phydev->adjust_link)
                 phy_stop_machine(phydev);
 
         if (!mdio_bus_phy_may_suspend(phydev))
@@ -331,7 +331,7 @@ static int mdio_bus_resume(struct device *dev)
                 return ret;
 
 no_resume:
-        if (phydev->attached_dev)
+        if (phydev->attached_dev && phydev->adjust_link)
                 phy_start_machine(phydev, NULL);
 
         return 0;
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 8bb7db676a5c..0fd1678bc5a9 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -231,7 +231,7 @@ MODULE_DESCRIPTION("Micrel PHY driver");
 MODULE_AUTHOR("David J. Choi");
 MODULE_LICENSE("GPL");
 
-static struct mdio_device_id micrel_tbl[] = {
+static struct mdio_device_id __maybe_unused micrel_tbl[] = {
         { PHY_ID_KSZ9021, 0x000fff10 },
         { PHY_ID_KS8001, 0x00fffff0 },
         { PHY_ID_KS8737, 0x00fffff0 },
diff --git a/drivers/net/phy/national.c b/drivers/net/phy/national.c
index a73ba0bcc0ce..0620ba963508 100644
--- a/drivers/net/phy/national.c
+++ b/drivers/net/phy/national.c
@@ -151,7 +151,7 @@ MODULE_LICENSE("GPL");
 module_init(ns_init);
 module_exit(ns_exit);
 
-static struct mdio_device_id ns_tbl[] = {
+static struct mdio_device_id __maybe_unused ns_tbl[] = {
         { DP83865_PHY_ID, 0xfffffff0 },
         { }
 };
diff --git a/drivers/net/phy/qsemi.c b/drivers/net/phy/qsemi.c
index 6736b23f1b28..fe0d0a15d5e1 100644
--- a/drivers/net/phy/qsemi.c
+++ b/drivers/net/phy/qsemi.c
@@ -138,7 +138,7 @@ static void __exit qs6612_exit(void)
 module_init(qs6612_init);
 module_exit(qs6612_exit);
 
-static struct mdio_device_id qs6612_tbl[] = {
+static struct mdio_device_id __maybe_unused qs6612_tbl[] = {
         { 0x00181440, 0xfffffff0 },
         { }
 };
diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
index f567c0e1aaa1..a4eae750a414 100644
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -79,7 +79,7 @@ static void __exit realtek_exit(void)
 module_init(realtek_init);
 module_exit(realtek_exit);
 
-static struct mdio_device_id realtek_tbl[] = {
+static struct mdio_device_id __maybe_unused realtek_tbl[] = {
         { 0x001cc912, 0x001fffff },
         { }
 };
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index 78fa988256fc..342505c976d6 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -254,7 +254,7 @@ MODULE_LICENSE("GPL");
 module_init(smsc_init);
 module_exit(smsc_exit);
 
-static struct mdio_device_id smsc_tbl[] = {
+static struct mdio_device_id __maybe_unused smsc_tbl[] = {
         { 0x0007c0a0, 0xfffffff0 },
         { 0x0007c0b0, 0xfffffff0 },
         { 0x0007c0c0, 0xfffffff0 },
diff --git a/drivers/net/phy/ste10Xp.c b/drivers/net/phy/ste10Xp.c
index 72290099e5e1..187a2fa814f2 100644
--- a/drivers/net/phy/ste10Xp.c
+++ b/drivers/net/phy/ste10Xp.c
@@ -132,7 +132,7 @@ static void __exit ste10Xp_exit(void)
 module_init(ste10Xp_init);
 module_exit(ste10Xp_exit);
 
-static struct mdio_device_id ste10Xp_tbl[] = {
+static struct mdio_device_id __maybe_unused ste10Xp_tbl[] = {
         { STE101P_PHY_ID, 0xfffffff0 },
         { STE100P_PHY_ID, 0xffffffff },
         { }
diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c
index 45cce50a2799..5d8f6e17bd55 100644
--- a/drivers/net/phy/vitesse.c
+++ b/drivers/net/phy/vitesse.c
@@ -192,7 +192,7 @@ static void __exit vsc82xx_exit(void)
 module_init(vsc82xx_init);
 module_exit(vsc82xx_exit);
 
-static struct mdio_device_id vitesse_tbl[] = {
+static struct mdio_device_id __maybe_unused vitesse_tbl[] = {
         { PHY_ID_VSC8244, 0x000fffc0 },
         { PHY_ID_VSC8221, 0x000ffff0 },
         { }
diff --git a/drivers/net/plip.c b/drivers/net/plip.c
index 7e82a82422cf..ca4df7f4cf21 100644
--- a/drivers/net/plip.c
+++ b/drivers/net/plip.c
@@ -995,8 +995,10 @@ plip_tx_packet(struct sk_buff *skb, struct net_device *dev)
 static void
 plip_rewrite_address(const struct net_device *dev, struct ethhdr *eth)
 {
-        const struct in_device *in_dev = dev->ip_ptr;
+        const struct in_device *in_dev;
 
+        rcu_read_lock();
+        in_dev = __in_dev_get_rcu(dev);
         if (in_dev) {
                 /* Any address will do - we take the first */
                 const struct in_ifaddr *ifa = in_dev->ifa_list;
@@ -1006,6 +1008,7 @@ plip_rewrite_address(const struct net_device *dev, struct ethhdr *eth)
                         memcpy(eth->h_dest+2, &ifa->ifa_address, 4);
                 }
         }
+        rcu_read_unlock();
 }
 
 static int
@@ -1088,7 +1091,8 @@ plip_open(struct net_device *dev)
            when the device address isn't identical to the address of a
            received frame, the kernel incorrectly drops it).             */
 
-        if ((in_dev=dev->ip_ptr) != NULL) {
+        in_dev=__in_dev_get_rtnl(dev);
+        if (in_dev) {
                 /* Any address will do - we take the first. We already
                    have the first two bytes filled with 0xfc, from
                    plip_init_dev(). */
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 6695a51e09e9..866e221643ab 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1314,8 +1314,13 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
         hdrlen = (ppp->flags & SC_MP_XSHORTSEQ)? MPHDRLEN_SSN: MPHDRLEN;
         i = 0;
         list_for_each_entry(pch, &ppp->channels, clist) {
-                navail += pch->avail = (pch->chan != NULL);
-                pch->speed = pch->chan->speed;
+                if (pch->chan) {
+                        pch->avail = 1;
+                        navail++;
+                        pch->speed = pch->chan->speed;
+                } else {
+                        pch->avail = 0;
+                }
                 if (pch->avail) {
                         if (skb_queue_empty(&pch->file.xq) ||
                                 !pch->had_frag) {
@@ -1542,9 +1547,11 @@ ppp_channel_push(struct channel *pch)
  * Receive-side routines.
  */
 
-/* misuse a few fields of the skb for MP reconstruction */
-#define sequence        priority
-#define BEbits          cb[0]
+struct ppp_mp_skb_parm {
+        u32             sequence;
+        u8              BEbits;
+};
+#define PPP_MP_CB(skb)  ((struct ppp_mp_skb_parm *)((skb)->cb))
 
 static inline void
 ppp_do_recv(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
@@ -1873,13 +1880,13 @@ ppp_receive_mp_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
                 seq = (skb->data[3] << 16) | (skb->data[4] << 8)| skb->data[5];
                 mask = 0xffffff;
         }
-        skb->BEbits = skb->data[2];
+        PPP_MP_CB(skb)->BEbits = skb->data[2];
         skb_pull(skb, mphdrlen);        /* pull off PPP and MP headers */
 
         /*
          * Do protocol ID decompression on the first fragment of each packet.
          */
-        if ((skb->BEbits & B) && (skb->data[0] & 1))
+        if ((PPP_MP_CB(skb)->BEbits & B) && (skb->data[0] & 1))
                 *skb_push(skb, 1) = 0;
 
         /*
@@ -1891,7 +1898,7 @@ ppp_receive_mp_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
                 seq += mask + 1;
         else if ((int)(seq - ppp->minseq) > (int)(mask >> 1))
                 seq -= mask + 1;        /* should never happen */
-        skb->sequence = seq;
+        PPP_MP_CB(skb)->sequence = seq;
         pch->lastseq = seq;
 
         /*
@@ -1927,8 +1934,8 @@ ppp_receive_mp_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
            before the start of the queue. */
         if (skb_queue_len(&ppp->mrq) >= PPP_MP_MAX_QLEN) {
                 struct sk_buff *mskb = skb_peek(&ppp->mrq);
-                if (seq_before(ppp->minseq, mskb->sequence))
-                        ppp->minseq = mskb->sequence;
+                if (seq_before(ppp->minseq, PPP_MP_CB(mskb)->sequence))
+                        ppp->minseq = PPP_MP_CB(mskb)->sequence;
         }
 
         /* Pull completed packets off the queue and receive them. */
@@ -1958,12 +1965,12 @@ ppp_mp_insert(struct ppp *ppp, struct sk_buff *skb)
 {
         struct sk_buff *p;
         struct sk_buff_head *list = &ppp->mrq;
-        u32 seq = skb->sequence;
+        u32 seq = PPP_MP_CB(skb)->sequence;
 
         /* N.B. we don't need to lock the list lock because we have the
            ppp unit receive-side lock. */
         skb_queue_walk(list, p) {
-                if (seq_before(seq, p->sequence))
+                if (seq_before(seq, PPP_MP_CB(p)->sequence))
                         break;
         }
         __skb_queue_before(list, p, skb);
@@ -1992,22 +1999,22 @@ ppp_mp_reconstruct(struct ppp *ppp)
         tail = NULL;
         for (p = head; p != (struct sk_buff *) list; p = next) {
                 next = p->next;
-                if (seq_before(p->sequence, seq)) {
+                if (seq_before(PPP_MP_CB(p)->sequence, seq)) {
                         /* this can't happen, anyway ignore the skb */
                         printk(KERN_ERR "ppp_mp_reconstruct bad seq %u < %u\n",
-                               p->sequence, seq);
+                               PPP_MP_CB(p)->sequence, seq);
                         head = next;
                         continue;
                 }
-                if (p->sequence != seq) {
+                if (PPP_MP_CB(p)->sequence != seq) {
                         /* Fragment `seq' is missing.  If it is after
                            minseq, it might arrive later, so stop here. */
                         if (seq_after(seq, minseq))
                                 break;
                         /* Fragment `seq' is lost, keep going. */
                         lost = 1;
-                        seq = seq_before(minseq, p->sequence)?
-                                minseq + 1: p->sequence;
+                        seq = seq_before(minseq, PPP_MP_CB(p)->sequence)?
+                                minseq + 1: PPP_MP_CB(p)->sequence;
                         next = p;
                         continue;
                 }
@@ -2021,7 +2028,7 @@ ppp_mp_reconstruct(struct ppp *ppp)
                  */
 
                 /* B bit set indicates this fragment starts a packet */
-                if (p->BEbits & B) {
+                if (PPP_MP_CB(p)->BEbits & B) {
                         head = p;
                         lost = 0;
                         len = 0;
@@ -2030,7 +2037,8 @@ ppp_mp_reconstruct(struct ppp *ppp)
                 len += p->len;
 
                 /* Got a complete packet yet? */
-                if (lost == 0 && (p->BEbits & E) && (head->BEbits & B)) {
+                if (lost == 0 && (PPP_MP_CB(p)->BEbits & E) &&
+                    (PPP_MP_CB(head)->BEbits & B)) {
                         if (len > ppp->mrru + 2) {
                                 ++ppp->dev->stats.rx_length_errors;
                                 printk(KERN_DEBUG "PPP: reconstructed packet"
@@ -2056,7 +2064,7 @@ ppp_mp_reconstruct(struct ppp *ppp)
                  * and we haven't found a complete valid packet yet,
                  * we can discard up to and including this fragment.
                  */
-                if (p->BEbits & E)
+                if (PPP_MP_CB(p)->BEbits & E)
                         head = next;
 
                 ++seq;
@@ -2066,10 +2074,11 @@ ppp_mp_reconstruct(struct ppp *ppp)
         if (tail != NULL) {
                 /* If we have discarded any fragments,
                    signal a receive error. */
-                if (head->sequence != ppp->nextseq) {
+                if (PPP_MP_CB(head)->sequence != ppp->nextseq) {
                         if (ppp->debug & 1)
                                 printk(KERN_DEBUG "  missed pkts %u..%u\n",
-                                       ppp->nextseq, head->sequence-1);
+                                       ppp->nextseq,
+                                       PPP_MP_CB(head)->sequence-1);
                         ++ppp->dev->stats.rx_dropped;
                         ppp_receive_error(ppp);
                 }
@@ -2078,7 +2087,7 @@ ppp_mp_reconstruct(struct ppp *ppp)
                         /* copy to a single skb */
                         for (p = head; p != tail->next; p = p->next)
                                 skb_copy_bits(p, 0, skb_put(skb, p->len), p->len);
-                ppp->nextseq = tail->sequence + 1;
+                ppp->nextseq = PPP_MP_CB(tail)->sequence + 1;
                 head = tail->next;
         }
 
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index c07de359dc07..d72fb0519a2a 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -1124,7 +1124,7 @@ static const struct proto_ops pppoe_ops = {
         .ioctl          = pppox_ioctl,
 };
 
-static struct pppox_proto pppoe_proto = {
+static const struct pppox_proto pppoe_proto = {
         .create = pppoe_create,
         .ioctl  = pppoe_ioctl,
         .owner  = THIS_MODULE,
diff --git a/drivers/net/pppox.c b/drivers/net/pppox.c
index d4191ef9cad1..8c0d170dabcd 100644
--- a/drivers/net/pppox.c
+++ b/drivers/net/pppox.c
@@ -36,9 +36,9 @@
 
 #include <asm/uaccess.h>
 
-static struct pppox_proto *pppox_protos[PX_MAX_PROTO + 1];
+static const struct pppox_proto *pppox_protos[PX_MAX_PROTO + 1];
 
-int register_pppox_proto(int proto_num, struct pppox_proto *pp)
+int register_pppox_proto(int proto_num, const struct pppox_proto *pp)
 {
         if (proto_num < 0 || proto_num > PX_MAX_PROTO)
                 return -EINVAL;
diff --git a/drivers/net/pptp.c b/drivers/net/pptp.c
index 761f0eced724..ccbc91326bfa 100644
--- a/drivers/net/pptp.c
+++ b/drivers/net/pptp.c
@@ -53,7 +53,7 @@ static struct pppox_sock **callid_sock;
 static DEFINE_SPINLOCK(chan_lock);
 
 static struct proto pptp_sk_proto __read_mostly;
-static struct ppp_channel_ops pptp_chan_ops;
+static const struct ppp_channel_ops pptp_chan_ops;
 static const struct proto_ops pptp_ops;
 
 #define PPP_LCP_ECHOREQ 0x09
@@ -628,7 +628,7 @@ static int pptp_ppp_ioctl(struct ppp_channel *chan, unsigned int cmd,
         return err;
 }
 
-static struct ppp_channel_ops pptp_chan_ops = {
+static const struct ppp_channel_ops pptp_chan_ops = {
         .start_xmit = pptp_xmit,
         .ioctl      = pptp_ppp_ioctl,
 };
@@ -659,12 +659,12 @@ static const struct proto_ops pptp_ops = {
         .ioctl      = pppox_ioctl,
 };
 
-static struct pppox_proto pppox_pptp_proto = {
+static const struct pppox_proto pppox_pptp_proto = {
         .create = pptp_create,
         .owner  = THIS_MODULE,
 };
 
-static struct gre_protocol gre_pptp_protocol = {
+static const struct gre_protocol gre_pptp_protocol = {
         .handler = pptp_rcv,
 };
 
diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c
index 43b8d7797f0a..4a624a29393f 100644
--- a/drivers/net/ps3_gelic_wireless.c
+++ b/drivers/net/ps3_gelic_wireless.c
@@ -85,12 +85,12 @@ static const int bitrate_list[] = {
  */
 static inline int wpa2_capable(void)
 {
-        return (0 <= ps3_compare_firmware_version(2, 0, 0));
+        return 0 <= ps3_compare_firmware_version(2, 0, 0);
 }
 
 static inline int precise_ie(void)
 {
-        return (0 <= ps3_compare_firmware_version(2, 2, 0));
+        return 0 <= ps3_compare_firmware_version(2, 2, 0);
 }
 /*
  * post_eurus_cmd helpers
@@ -506,7 +506,7 @@ static size_t gelic_wl_synthesize_ie(u8 *buf,
         start[1] = (buf - start - 2);
 
         pr_debug("%s: ->\n", __func__);
-        return (buf - start);
+        return buf - start;
 }
 
 struct ie_item {
diff --git a/drivers/net/pxa168_eth.c b/drivers/net/pxa168_eth.c
index 75c2ff99d66d..18c0297743f1 100644
--- a/drivers/net/pxa168_eth.c
+++ b/drivers/net/pxa168_eth.c
@@ -4,6 +4,7 @@
  *
  * Copyright (C) 2010 Marvell International Ltd.
  *              Sachin Sanap <ssanap@marvell.com>
+ *              Zhangfei Gao <zgao6@marvell.com>
  *              Philip Rakity <prakity@marvell.com>
  *              Mark Brown <markb@marvell.com>
  *
diff --git a/drivers/net/qlcnic/qlcnic.h b/drivers/net/qlcnic/qlcnic.h
index cc8385a6727e..26c37d3a5868 100644
--- a/drivers/net/qlcnic/qlcnic.h
+++ b/drivers/net/qlcnic/qlcnic.h
@@ -51,8 +51,8 @@
 
 #define _QLCNIC_LINUX_MAJOR 5
 #define _QLCNIC_LINUX_MINOR 0
-#define _QLCNIC_LINUX_SUBVERSION 9
-#define QLCNIC_LINUX_VERSIONID  "5.0.9"
+#define _QLCNIC_LINUX_SUBVERSION 11
+#define QLCNIC_LINUX_VERSIONID  "5.0.11"
 #define QLCNIC_DRV_IDC_VER  0x01
 #define QLCNIC_DRIVER_VERSION  ((_QLCNIC_LINUX_MAJOR << 16) |\
                  (_QLCNIC_LINUX_MINOR << 8) | (_QLCNIC_LINUX_SUBVERSION))
@@ -94,11 +94,12 @@
 #define FIRST_PAGE_GROUP_START  0
 #define FIRST_PAGE_GROUP_END    0x100000
 
-#define P3_MAX_MTU                     (9600)
+#define P3P_MAX_MTU                     (9600)
+#define P3P_MIN_MTU                     (68)
 #define QLCNIC_MAX_ETHERHDR                32 /* This contains some padding */
 
-#define QLCNIC_P3_RX_BUF_MAX_LEN         (QLCNIC_MAX_ETHERHDR + ETH_DATA_LEN)
-#define QLCNIC_P3_RX_JUMBO_BUF_MAX_LEN   (QLCNIC_MAX_ETHERHDR + P3_MAX_MTU)
+#define QLCNIC_P3P_RX_BUF_MAX_LEN         (QLCNIC_MAX_ETHERHDR + ETH_DATA_LEN)
+#define QLCNIC_P3P_RX_JUMBO_BUF_MAX_LEN   (QLCNIC_MAX_ETHERHDR + P3P_MAX_MTU)
 #define QLCNIC_CT_DEFAULT_RX_BUF_LEN    2048
 #define QLCNIC_LRO_BUFFER_EXTRA         2048
 
@@ -306,20 +307,20 @@ struct uni_data_desc{
 /* Magic number to let user know flash is programmed */
 #define QLCNIC_BDINFO_MAGIC 0x12345678
 
-#define QLCNIC_BRDTYPE_P3_REF_QG        0x0021
-#define QLCNIC_BRDTYPE_P3_HMEZ          0x0022
-#define QLCNIC_BRDTYPE_P3_10G_CX4_LP    0x0023
-#define QLCNIC_BRDTYPE_P3_4_GB          0x0024
-#define QLCNIC_BRDTYPE_P3_IMEZ          0x0025
-#define QLCNIC_BRDTYPE_P3_10G_SFP_PLUS  0x0026
-#define QLCNIC_BRDTYPE_P3_10000_BASE_T  0x0027
-#define QLCNIC_BRDTYPE_P3_XG_LOM        0x0028
-#define QLCNIC_BRDTYPE_P3_4_GB_MM       0x0029
-#define QLCNIC_BRDTYPE_P3_10G_SFP_CT    0x002a
-#define QLCNIC_BRDTYPE_P3_10G_SFP_QT    0x002b
-#define QLCNIC_BRDTYPE_P3_10G_CX4       0x0031
-#define QLCNIC_BRDTYPE_P3_10G_XFP       0x0032
-#define QLCNIC_BRDTYPE_P3_10G_TP        0x0080
+#define QLCNIC_BRDTYPE_P3P_REF_QG       0x0021
+#define QLCNIC_BRDTYPE_P3P_HMEZ         0x0022
+#define QLCNIC_BRDTYPE_P3P_10G_CX4_LP   0x0023
+#define QLCNIC_BRDTYPE_P3P_4_GB         0x0024
+#define QLCNIC_BRDTYPE_P3P_IMEZ         0x0025
+#define QLCNIC_BRDTYPE_P3P_10G_SFP_PLUS 0x0026
+#define QLCNIC_BRDTYPE_P3P_10000_BASE_T 0x0027
+#define QLCNIC_BRDTYPE_P3P_XG_LOM       0x0028
+#define QLCNIC_BRDTYPE_P3P_4_GB_MM      0x0029
+#define QLCNIC_BRDTYPE_P3P_10G_SFP_CT   0x002a
+#define QLCNIC_BRDTYPE_P3P_10G_SFP_QT   0x002b
+#define QLCNIC_BRDTYPE_P3P_10G_CX4      0x0031
+#define QLCNIC_BRDTYPE_P3P_10G_XFP      0x0032
+#define QLCNIC_BRDTYPE_P3P_10G_TP       0x0080
 
 #define QLCNIC_MSIX_TABLE_OFFSET        0x44
 
@@ -718,7 +719,7 @@ struct qlcnic_cardrsp_tx_ctx {
 
 /* MAC */
 
-#define MC_COUNT_P3     38
+#define MC_COUNT_P3P    38
 
 #define QLCNIC_MAC_NOOP 0
 #define QLCNIC_MAC_ADD  1
@@ -898,6 +899,16 @@ struct qlcnic_mac_req {
         u8 mac_addr[6];
 };
 
+struct qlcnic_vlan_req {
+        __le16 vlan_id;
+        __le16 rsvd[3];
+};
+
+struct qlcnic_ipaddr {
+        __be32 ipv4;
+        __be32 ipv6[4];
+};
+
 #define QLCNIC_MSI_ENABLED              0x02
 #define QLCNIC_MSIX_ENABLED             0x04
 #define QLCNIC_LRO_ENABLED              0x08
@@ -909,6 +920,7 @@ struct qlcnic_mac_req {
 #define QLCNIC_TAGGING_ENABLED          0x100
 #define QLCNIC_MACSPOOF                 0x200
 #define QLCNIC_MAC_OVERRIDE_DISABLED    0x400
+#define QLCNIC_PROMISC_DISABLED         0x800
 #define QLCNIC_IS_MSI_FAMILY(adapter) \
         ((adapter)->flags & (QLCNIC_MSI_ENABLED | QLCNIC_MSIX_ENABLED))
 
@@ -935,7 +947,7 @@ struct qlcnic_mac_req {
 struct qlcnic_filter {
         struct hlist_node fnode;
         u8 faddr[ETH_ALEN];
-        u16 vlan_id;
+        __le16 vlan_id;
         unsigned long ftime;
 };
 
@@ -1013,6 +1025,7 @@ struct qlcnic_adapter {
 
         u64 dev_rst_time;
 
+        struct vlan_group *vlgrp;
         struct qlcnic_npar_info *npars;
         struct qlcnic_eswitch *eswitch;
         struct qlcnic_nic_template *nic_ops;
@@ -1168,6 +1181,18 @@ struct qlcnic_esw_func_cfg {
 #define QLCNIC_STATS_ESWITCH            2
 #define QLCNIC_QUERY_RX_COUNTER         0
 #define QLCNIC_QUERY_TX_COUNTER         1
+#define QLCNIC_ESW_STATS_NOT_AVAIL      0xffffffffffffffffULL
+
+#define QLCNIC_ADD_ESW_STATS(VAL1, VAL2)\
+do {    \
+        if (((VAL1) == QLCNIC_ESW_STATS_NOT_AVAIL) && \
+            ((VAL2) != QLCNIC_ESW_STATS_NOT_AVAIL)) \
+                (VAL1) = (VAL2); \
+        else if (((VAL1) != QLCNIC_ESW_STATS_NOT_AVAIL) && \
+                 ((VAL2) != QLCNIC_ESW_STATS_NOT_AVAIL)) \
+                        (VAL1) += (VAL2); \
+} while (0)
+
 struct __qlcnic_esw_statistics {
         __le16 context_id;
         __le16 version;
@@ -1273,7 +1298,7 @@ void qlcnic_free_mac_list(struct qlcnic_adapter *adapter);
 int qlcnic_nic_set_promisc(struct qlcnic_adapter *adapter, u32);
 int qlcnic_config_intr_coalesce(struct qlcnic_adapter *adapter);
 int qlcnic_config_rss(struct qlcnic_adapter *adapter, int enable);
-int qlcnic_config_ipaddr(struct qlcnic_adapter *adapter, u32 ip, int cmd);
+int qlcnic_config_ipaddr(struct qlcnic_adapter *adapter, __be32 ip, int cmd);
 int qlcnic_linkevent_request(struct qlcnic_adapter *adapter, int enable);
 void qlcnic_advert_link_change(struct qlcnic_adapter *adapter, int linkup);
 
@@ -1289,6 +1314,8 @@ int qlcnic_set_ilb_mode(struct qlcnic_adapter *adapter);
 void qlcnic_fetch_mac(struct qlcnic_adapter *, u32, u32, u8, u8 *);
 
 /* Functions from qlcnic_main.c */
+int qlcnic_request_quiscent_mode(struct qlcnic_adapter *adapter);
+void qlcnic_clear_quiscent_mode(struct qlcnic_adapter *adapter);
 int qlcnic_reset_context(struct qlcnic_adapter *);
 u32 qlcnic_issue_cmd(struct qlcnic_adapter *adapter,
         u32 pci_fn, u32 version, u32 arg1, u32 arg2, u32 arg3, u32 cmd);
@@ -1299,19 +1326,12 @@ netdev_tx_t qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
 void qlcnic_process_rcv_ring_diag(struct qlcnic_host_sds_ring *sds_ring);
 
 /* Management functions */
-int qlcnic_set_mac_address(struct qlcnic_adapter *, u8*);
 int qlcnic_get_mac_address(struct qlcnic_adapter *, u8*);
 int qlcnic_get_nic_info(struct qlcnic_adapter *, struct qlcnic_info *, u8);
 int qlcnic_set_nic_info(struct qlcnic_adapter *, struct qlcnic_info *);
 int qlcnic_get_pci_info(struct qlcnic_adapter *, struct qlcnic_pci_info*);
-int qlcnic_reset_partition(struct qlcnic_adapter *, u8);
 
 /*  eSwitch management functions */
-int qlcnic_get_eswitch_capabilities(struct qlcnic_adapter *, u8,
-                                struct qlcnic_eswitch *);
-int qlcnic_get_eswitch_status(struct qlcnic_adapter *, u8,
-                                struct qlcnic_eswitch *);
-int qlcnic_toggle_eswitch(struct qlcnic_adapter *, u8, u8);
 int qlcnic_config_switch_port(struct qlcnic_adapter *,
                                 struct qlcnic_esw_func_cfg *);
 int qlcnic_get_eswitch_port_config(struct qlcnic_adapter *,
@@ -1351,7 +1371,7 @@ static const struct qlcnic_brdinfo qlcnic_boards[] = {
         {0x1077, 0x8020, 0x1077, 0x20f,
                 "3200 Series Single Port 10Gb Intelligent Ethernet Adapter"},
         {0x1077, 0x8020, 0x103c, 0x3733,
-                "NC523SFP 10Gb 2-port Flex-10 Server Adapter"},
+                "NC523SFP 10Gb 2-port Server Adapter"},
         {0x1077, 0x8020, 0x0, 0x0, "cLOM8214 1/10GbE Controller"},
 };
 
diff --git a/drivers/net/qlcnic/qlcnic_ctx.c b/drivers/net/qlcnic/qlcnic_ctx.c
index 95a821e0b66f..1cdc05dade6b 100644
--- a/drivers/net/qlcnic/qlcnic_ctx.c
+++ b/drivers/net/qlcnic/qlcnic_ctx.c
@@ -556,32 +556,6 @@ void qlcnic_free_hw_resources(struct qlcnic_adapter *adapter)
         }
 }
 
-/* Set MAC address of a NIC partition */
-int qlcnic_set_mac_address(struct qlcnic_adapter *adapter, u8* mac)
-{
-        int err = 0;
-        u32 arg1, arg2, arg3;
-
-        arg1 = adapter->ahw.pci_func | BIT_9;
-        arg2 = mac[0] | (mac[1] << 8) | (mac[2] << 16) | (mac[3] << 24);
-        arg3 = mac[4] | (mac[5] << 16);
-
-        err = qlcnic_issue_cmd(adapter,
-                        adapter->ahw.pci_func,
-                        adapter->fw_hal_version,
-                        arg1,
-                        arg2,
-                        arg3,
-                        QLCNIC_CDRP_CMD_MAC_ADDRESS);
-
-        if (err != QLCNIC_RCODE_SUCCESS) {
-                dev_err(&adapter->pdev->dev,
-                        "Failed to set mac address%d\n", err);
-                err = -EIO;
-        }
-
-        return err;
-}
 
 /* Get MAC address of a NIC partition */
 int qlcnic_get_mac_address(struct qlcnic_adapter *adapter, u8 *mac)
@@ -742,15 +716,15 @@ int qlcnic_get_pci_info(struct qlcnic_adapter *adapter,
 
         if (err == QLCNIC_RCODE_SUCCESS) {
                 for (i = 0; i < QLCNIC_MAX_PCI_FUNC; i++, npar++, pci_info++) {
-                        pci_info->id = le32_to_cpu(npar->id);
-                        pci_info->active = le32_to_cpu(npar->active);
-                        pci_info->type = le32_to_cpu(npar->type);
+                        pci_info->id = le16_to_cpu(npar->id);
+                        pci_info->active = le16_to_cpu(npar->active);
+                        pci_info->type = le16_to_cpu(npar->type);
                         pci_info->default_port =
-                                le32_to_cpu(npar->default_port);
+                                le16_to_cpu(npar->default_port);
                         pci_info->tx_min_bw =
-                                le32_to_cpu(npar->tx_min_bw);
+                                le16_to_cpu(npar->tx_min_bw);
                         pci_info->tx_max_bw =
-                                le32_to_cpu(npar->tx_max_bw);
+                                le16_to_cpu(npar->tx_max_bw);
                         memcpy(pci_info->mac, npar->mac, ETH_ALEN);
                 }
         } else {
@@ -764,149 +738,6 @@ int qlcnic_get_pci_info(struct qlcnic_adapter *adapter,
         return err;
 }
 
-/* Reset a NIC partition */
-
-int qlcnic_reset_partition(struct qlcnic_adapter *adapter, u8 func_no)
-{
-        int err = -EIO;
-
-        if (adapter->op_mode != QLCNIC_MGMT_FUNC)
-                return err;
-
-        err = qlcnic_issue_cmd(adapter,
-                        adapter->ahw.pci_func,
-                        adapter->fw_hal_version,
-                        func_no,
-                        0,
-                        0,
-                        QLCNIC_CDRP_CMD_RESET_NPAR);
-
-        if (err != QLCNIC_RCODE_SUCCESS) {
-                dev_err(&adapter->pdev->dev,
-                        "Failed to issue reset partition%d\n", err);
-                err = -EIO;
-        }
-
-        return err;
-}
-
-/* Get eSwitch Capabilities */
-int qlcnic_get_eswitch_capabilities(struct qlcnic_adapter *adapter, u8 port,
-                                        struct qlcnic_eswitch *eswitch)
-{
-        int err = -EIO;
-        u32 arg1, arg2;
-
-        if (adapter->op_mode == QLCNIC_NON_PRIV_FUNC)
-                return err;
-
-        err = qlcnic_issue_cmd(adapter,
-                        adapter->ahw.pci_func,
-                        adapter->fw_hal_version,
-                        port,
-                        0,
-                        0,
-                        QLCNIC_CDRP_CMD_GET_ESWITCH_CAPABILITY);
-
-        if (err == QLCNIC_RCODE_SUCCESS) {
-                arg1 = QLCRD32(adapter, QLCNIC_ARG1_CRB_OFFSET);
-                arg2 = QLCRD32(adapter, QLCNIC_ARG2_CRB_OFFSET);
-
-                eswitch->port = arg1 & 0xf;
-                eswitch->max_ucast_filters = LSW(arg2);
-                eswitch->max_active_vlans = MSW(arg2) & 0xfff;
-                if (arg1 & BIT_6)
-                        eswitch->flags |= QLCNIC_SWITCH_VLAN_FILTERING;
-                if (arg1 & BIT_7)
-                        eswitch->flags |= QLCNIC_SWITCH_PROMISC_MODE;
-                if (arg1 & BIT_8)
-                        eswitch->flags |= QLCNIC_SWITCH_PORT_MIRRORING;
-        } else {
-                dev_err(&adapter->pdev->dev,
-                        "Failed to get eswitch capabilities%d\n", err);
-        }
-
-        return err;
-}
-
-/* Get current status of eswitch */
-int qlcnic_get_eswitch_status(struct qlcnic_adapter *adapter, u8 port,
-                                struct qlcnic_eswitch *eswitch)
-{
-        int err = -EIO;
-        u32 arg1, arg2;
-
-        if (adapter->op_mode != QLCNIC_MGMT_FUNC)
-                return err;
-
-        err = qlcnic_issue_cmd(adapter,
-                        adapter->ahw.pci_func,
-                        adapter->fw_hal_version,
-                        port,
-                        0,
-                        0,
-                        QLCNIC_CDRP_CMD_GET_ESWITCH_STATUS);
-
-        if (err == QLCNIC_RCODE_SUCCESS) {
-                arg1 = QLCRD32(adapter, QLCNIC_ARG1_CRB_OFFSET);
-                arg2 = QLCRD32(adapter, QLCNIC_ARG2_CRB_OFFSET);
-
-                eswitch->port = arg1 & 0xf;
-                eswitch->active_vports = LSB(arg2);
-                eswitch->active_ucast_filters = MSB(arg2);
-                eswitch->active_vlans = LSB(MSW(arg2));
-                if (arg1 & BIT_6)
-                        eswitch->flags |= QLCNIC_SWITCH_VLAN_FILTERING;
-                if (arg1 & BIT_8)
-                        eswitch->flags |= QLCNIC_SWITCH_PORT_MIRRORING;
-
-        } else {
-                dev_err(&adapter->pdev->dev,
-                        "Failed to get eswitch status%d\n", err);
-        }
-
-        return err;
-}
-
-/* Enable/Disable eSwitch */
-int qlcnic_toggle_eswitch(struct qlcnic_adapter *adapter, u8 id, u8 enable)
-{
-        int err = -EIO;
-        u32 arg1, arg2;
-        struct qlcnic_eswitch *eswitch;
-
-        if (adapter->op_mode != QLCNIC_MGMT_FUNC)
-                return err;
-
-        eswitch = &adapter->eswitch[id];
-        if (!eswitch)
-                return err;
-
-        arg1 = eswitch->port | (enable ? BIT_4 : 0);
-        arg2 = eswitch->active_vports | (eswitch->max_ucast_filters << 8) |
-                (eswitch->max_active_vlans << 16);
-        err = qlcnic_issue_cmd(adapter,
-                        adapter->ahw.pci_func,
-                        adapter->fw_hal_version,
-                        arg1,
-                        arg2,
-                        0,
-                        QLCNIC_CDRP_CMD_TOGGLE_ESWITCH);
-
-        if (err != QLCNIC_RCODE_SUCCESS) {
-                dev_err(&adapter->pdev->dev,
-                        "Failed to enable eswitch%d\n", eswitch->port);
-                eswitch->flags &= ~QLCNIC_SWITCH_ENABLE;
-                err = -EIO;
-        } else {
-                eswitch->flags |= QLCNIC_SWITCH_ENABLE;
-                dev_info(&adapter->pdev->dev,
-                        "Enabled eSwitch for port %d\n", eswitch->port);
-        }
-
-        return err;
-}
-
 /* Configure eSwitch for port mirroring */
 int qlcnic_config_port_mirroring(struct qlcnic_adapter *adapter, u8 id,
                                 u8 enable_mirroring, u8 pci_func)
@@ -1016,7 +847,14 @@ int qlcnic_get_eswitch_stats(struct qlcnic_adapter *adapter, const u8 eswitch,
         if (adapter->npars == NULL)
                 return -EIO;
 
-        memset(esw_stats, 0, sizeof(struct __qlcnic_esw_statistics));
+        memset(esw_stats, 0, sizeof(u64));
+        esw_stats->unicast_frames = QLCNIC_ESW_STATS_NOT_AVAIL;
+        esw_stats->multicast_frames = QLCNIC_ESW_STATS_NOT_AVAIL;
+        esw_stats->broadcast_frames = QLCNIC_ESW_STATS_NOT_AVAIL;
+        esw_stats->dropped_frames = QLCNIC_ESW_STATS_NOT_AVAIL;
+        esw_stats->errors = QLCNIC_ESW_STATS_NOT_AVAIL;
+        esw_stats->local_frames = QLCNIC_ESW_STATS_NOT_AVAIL;
+        esw_stats->numbytes = QLCNIC_ESW_STATS_NOT_AVAIL;
         esw_stats->context_id = eswitch;
 
         for (i = 0; i < QLCNIC_MAX_PCI_FUNC; i++) {
@@ -1029,14 +867,20 @@ int qlcnic_get_eswitch_stats(struct qlcnic_adapter *adapter, const u8 eswitch,
 
                 esw_stats->size = port_stats.size;
                 esw_stats->version = port_stats.version;
-                esw_stats->unicast_frames += port_stats.unicast_frames;
-                esw_stats->multicast_frames += port_stats.multicast_frames;
-                esw_stats->broadcast_frames += port_stats.broadcast_frames;
-                esw_stats->dropped_frames += port_stats.dropped_frames;
-                esw_stats->errors += port_stats.errors;
-                esw_stats->local_frames += port_stats.local_frames;
-                esw_stats->numbytes += port_stats.numbytes;
-
+                QLCNIC_ADD_ESW_STATS(esw_stats->unicast_frames,
+                                                port_stats.unicast_frames);
+                QLCNIC_ADD_ESW_STATS(esw_stats->multicast_frames,
+                                                port_stats.multicast_frames);
+                QLCNIC_ADD_ESW_STATS(esw_stats->broadcast_frames,
+                                                port_stats.broadcast_frames);
+                QLCNIC_ADD_ESW_STATS(esw_stats->dropped_frames,
+                                                port_stats.dropped_frames);
+                QLCNIC_ADD_ESW_STATS(esw_stats->errors,
+                                                port_stats.errors);
+                QLCNIC_ADD_ESW_STATS(esw_stats->local_frames,
+                                                port_stats.local_frames);
+                QLCNIC_ADD_ESW_STATS(esw_stats->numbytes,
+                                                port_stats.numbytes);
                 ret = 0;
         }
         return ret;
diff --git a/drivers/net/qlcnic/qlcnic_ethtool.c b/drivers/net/qlcnic/qlcnic_ethtool.c
index cb9463bd6b1e..25e93a53fca0 100644
--- a/drivers/net/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/qlcnic/qlcnic_ethtool.c
@@ -78,7 +78,25 @@ static const struct qlcnic_stats qlcnic_gstrings_stats[] = {
 
 };
 
+static const char qlcnic_device_gstrings_stats[][ETH_GSTRING_LEN] = {
+        "rx unicast frames",
+        "rx multicast frames",
+        "rx broadcast frames",
+        "rx dropped frames",
+        "rx errors",
+        "rx local frames",
+        "rx numbytes",
+        "tx unicast frames",
+        "tx multicast frames",
+        "tx broadcast frames",
+        "tx dropped frames",
+        "tx errors",
+        "tx local frames",
+        "tx numbytes",
+};
+
 #define QLCNIC_STATS_LEN        ARRAY_SIZE(qlcnic_gstrings_stats)
+#define QLCNIC_DEVICE_STATS_LEN ARRAY_SIZE(qlcnic_device_gstrings_stats)
 
 static const char qlcnic_gstrings_test[][ETH_GSTRING_LEN] = {
         "Register_Test_on_offline",
@@ -96,7 +114,7 @@ static const char qlcnic_gstrings_test[][ETH_GSTRING_LEN] = {
 static const u32 diag_registers[] = {
         CRB_CMDPEG_STATE,
         CRB_RCVPEG_STATE,
-        CRB_XG_STATE_P3,
+        CRB_XG_STATE_P3P,
         CRB_FW_CAPABILITIES_1,
         ISR_INT_STATE_REG,
         QLCNIC_CRB_DRV_ACTIVE,
@@ -189,9 +207,9 @@ qlcnic_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
                         goto skip;
                 }
 
-                val = QLCRD32(adapter, P3_LINK_SPEED_REG(pcifn));
-                ecmd->speed = P3_LINK_SPEED_MHZ *
-                        P3_LINK_SPEED_VAL(pcifn, val);
+                val = QLCRD32(adapter, P3P_LINK_SPEED_REG(pcifn));
+                ecmd->speed = P3P_LINK_SPEED_MHZ *
+                        P3P_LINK_SPEED_VAL(pcifn, val);
                 ecmd->duplex = DUPLEX_FULL;
                 ecmd->autoneg = AUTONEG_DISABLE;
         } else
@@ -202,42 +220,42 @@ skip:
         ecmd->transceiver = XCVR_EXTERNAL;
 
         switch (adapter->ahw.board_type) {
-        case QLCNIC_BRDTYPE_P3_REF_QG:
-        case QLCNIC_BRDTYPE_P3_4_GB:
-        case QLCNIC_BRDTYPE_P3_4_GB_MM:
+        case QLCNIC_BRDTYPE_P3P_REF_QG:
+        case QLCNIC_BRDTYPE_P3P_4_GB:
+        case QLCNIC_BRDTYPE_P3P_4_GB_MM:
 
                 ecmd->supported |= SUPPORTED_Autoneg;
                 ecmd->advertising |= ADVERTISED_Autoneg;
-        case QLCNIC_BRDTYPE_P3_10G_CX4:
-        case QLCNIC_BRDTYPE_P3_10G_CX4_LP:
-        case QLCNIC_BRDTYPE_P3_10000_BASE_T:
+        case QLCNIC_BRDTYPE_P3P_10G_CX4:
+        case QLCNIC_BRDTYPE_P3P_10G_CX4_LP:
+        case QLCNIC_BRDTYPE_P3P_10000_BASE_T:
                 ecmd->supported |= SUPPORTED_TP;
                 ecmd->advertising |= ADVERTISED_TP;
                 ecmd->port = PORT_TP;
                 ecmd->autoneg =  adapter->link_autoneg;
                 break;
-        case QLCNIC_BRDTYPE_P3_IMEZ:
-        case QLCNIC_BRDTYPE_P3_XG_LOM:
-        case QLCNIC_BRDTYPE_P3_HMEZ:
+        case QLCNIC_BRDTYPE_P3P_IMEZ:
+        case QLCNIC_BRDTYPE_P3P_XG_LOM:
+        case QLCNIC_BRDTYPE_P3P_HMEZ:
                 ecmd->supported |= SUPPORTED_MII;
                 ecmd->advertising |= ADVERTISED_MII;
                 ecmd->port = PORT_MII;
                 ecmd->autoneg = AUTONEG_DISABLE;
                 break;
-        case QLCNIC_BRDTYPE_P3_10G_SFP_PLUS:
-        case QLCNIC_BRDTYPE_P3_10G_SFP_CT:
-        case QLCNIC_BRDTYPE_P3_10G_SFP_QT:
+        case QLCNIC_BRDTYPE_P3P_10G_SFP_PLUS:
+        case QLCNIC_BRDTYPE_P3P_10G_SFP_CT:
+        case QLCNIC_BRDTYPE_P3P_10G_SFP_QT:
                 ecmd->advertising |= ADVERTISED_TP;
                 ecmd->supported |= SUPPORTED_TP;
                 check_sfp_module = netif_running(dev) &&
                         adapter->has_link_events;
-        case QLCNIC_BRDTYPE_P3_10G_XFP:
+        case QLCNIC_BRDTYPE_P3P_10G_XFP:
                 ecmd->supported |= SUPPORTED_FIBRE;
                 ecmd->advertising |= ADVERTISED_FIBRE;
                 ecmd->port = PORT_FIBRE;
                 ecmd->autoneg = AUTONEG_DISABLE;
                 break;
-        case QLCNIC_BRDTYPE_P3_10G_TP:
+        case QLCNIC_BRDTYPE_P3P_10G_TP:
                 if (adapter->ahw.port_type == QLCNIC_XGBE) {
                         ecmd->autoneg = AUTONEG_DISABLE;
                         ecmd->supported |= (SUPPORTED_FIBRE | SUPPORTED_TP);
@@ -343,7 +361,7 @@ qlcnic_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *p)
         struct qlcnic_recv_context *recv_ctx = &adapter->recv_ctx;
         struct qlcnic_host_sds_ring *sds_ring;
         u32 *regs_buff = p;
-        int ring, i = 0;
+        int ring, i = 0, j = 0;
 
         memset(p, 0, qlcnic_get_regs_len(dev));
         regs->version = (QLCNIC_ETHTOOL_REGS_VER << 24) |
@@ -352,8 +370,8 @@ qlcnic_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *p)
         regs_buff[0] = (0xcafe0000 | (QLCNIC_DEV_INFO_SIZE & 0xffff));
         regs_buff[1] = QLCNIC_MGMT_API_VERSION;
 
-        for (i = QLCNIC_DEV_INFO_SIZE + 1; diag_registers[i] != -1; i++)
-                regs_buff[i] = QLCRD32(adapter, diag_registers[i]);
+        for (i = QLCNIC_DEV_INFO_SIZE + 1; diag_registers[j] != -1; j++, i++)
+                regs_buff[i] = QLCRD32(adapter, diag_registers[j]);
 
         if (!test_bit(__QLCNIC_DEV_UP, &adapter->state))
                 return;
@@ -381,9 +399,9 @@ static u32 qlcnic_test_link(struct net_device *dev)
         struct qlcnic_adapter *adapter = netdev_priv(dev);
         u32 val;
 
-        val = QLCRD32(adapter, CRB_XG_STATE_P3);
-        val = XG_LINK_STATE_P3(adapter->ahw.pci_func, val);
-        return (val == XG_LINK_UP_P3) ? 0 : 1;
+        val = QLCRD32(adapter, CRB_XG_STATE_P3P);
+        val = XG_LINK_STATE_P3P(adapter->ahw.pci_func, val);
+        return (val == XG_LINK_UP_P3P) ? 0 : 1;
 }
 
 static int
@@ -625,10 +643,13 @@ static int qlcnic_reg_test(struct net_device *dev)
 
 static int qlcnic_get_sset_count(struct net_device *dev, int sset)
 {
+        struct qlcnic_adapter *adapter = netdev_priv(dev);
         switch (sset) {
         case ETH_SS_TEST:
                 return QLCNIC_TEST_LEN;
         case ETH_SS_STATS:
+                if (adapter->flags & QLCNIC_ESWITCH_ENABLED)
+                        return QLCNIC_STATS_LEN + QLCNIC_DEVICE_STATS_LEN;
                 return QLCNIC_STATS_LEN;
         default:
                 return -EOPNOTSUPP;
@@ -636,6 +657,8 @@ static int qlcnic_get_sset_count(struct net_device *dev, int sset)
 }
 
 #define QLC_ILB_PKT_SIZE 64
+#define QLC_NUM_ILB_PKT 16
+#define QLC_ILB_MAX_RCV_LOOP 10
 
 static void qlcnic_create_loopback_buff(unsigned char *data)
 {
@@ -657,24 +680,34 @@ static int qlcnic_do_ilb_test(struct qlcnic_adapter *adapter)
         struct qlcnic_recv_context *recv_ctx = &adapter->recv_ctx;
         struct qlcnic_host_sds_ring *sds_ring = &recv_ctx->sds_rings[0];
         struct sk_buff *skb;
-        int i;
+        int i, loop, cnt = 0;
 
-        for (i = 0; i < 16; i++) {
+        for (i = 0; i < QLC_NUM_ILB_PKT; i++) {
                 skb = dev_alloc_skb(QLC_ILB_PKT_SIZE);
                 qlcnic_create_loopback_buff(skb->data);
                 skb_put(skb, QLC_ILB_PKT_SIZE);
 
                 adapter->diag_cnt = 0;
-
                 qlcnic_xmit_frame(skb, adapter->netdev);
 
-                msleep(5);
-
-                qlcnic_process_rcv_ring_diag(sds_ring);
+                loop = 0;
+                do {
+                        msleep(1);
+                        qlcnic_process_rcv_ring_diag(sds_ring);
+                } while (loop++ < QLC_ILB_MAX_RCV_LOOP &&
+                         !adapter->diag_cnt);
 
                 dev_kfree_skb_any(skb);
+
                 if (!adapter->diag_cnt)
-                        return -1;
+                        dev_warn(&adapter->pdev->dev, "ILB Test: %dth packet"
+                                " not recevied\n", i + 1);
+                else
+                        cnt++;
+        }
+        if (cnt != i) {
+                dev_warn(&adapter->pdev->dev, "ILB Test failed\n");
+                return -1;
         }
         return 0;
 }
@@ -694,6 +727,11 @@ static int qlcnic_loopback_test(struct net_device *netdev)
         if (test_and_set_bit(__QLCNIC_RESETTING, &adapter->state))
                 return -EIO;
 
+        if (qlcnic_request_quiscent_mode(adapter)) {
+                clear_bit(__QLCNIC_RESETTING, &adapter->state);
+                return -EIO;
+        }
+
         ret = qlcnic_diag_alloc_res(netdev, QLCNIC_LOOPBACK_TEST);
         if (ret)
                 goto clear_it;
@@ -710,6 +748,7 @@ done:
         qlcnic_diag_free_res(netdev, max_sds_rings);
 
 clear_it:
+        qlcnic_clear_quiscent_mode(adapter);
         adapter->max_sds_rings = max_sds_rings;
         clear_bit(__QLCNIC_RESETTING, &adapter->state);
         return ret;
@@ -777,7 +816,8 @@ qlcnic_diag_test(struct net_device *dev, struct ethtool_test *eth_test,
 static void
 qlcnic_get_strings(struct net_device *dev, u32 stringset, u8 * data)
 {
-        int index;
+        struct qlcnic_adapter *adapter = netdev_priv(dev);
+        int index, i;
 
         switch (stringset) {
         case ETH_SS_TEST:
@@ -790,16 +830,43 @@ qlcnic_get_strings(struct net_device *dev, u32 stringset, u8 * data)
                                qlcnic_gstrings_stats[index].stat_string,
                                ETH_GSTRING_LEN);
                 }
-                break;
+                if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED))
+                        return;
+                for (i = 0; i < QLCNIC_DEVICE_STATS_LEN; index++, i++) {
+                        memcpy(data + index * ETH_GSTRING_LEN,
+                               qlcnic_device_gstrings_stats[i],
+                               ETH_GSTRING_LEN);
+                }
         }
 }
 
+#define QLCNIC_FILL_ESWITCH_STATS(VAL1) \
+        (((VAL1) == QLCNIC_ESW_STATS_NOT_AVAIL) ? 0 : VAL1)
+
+static void
+qlcnic_fill_device_stats(int *index, u64 *data,
+                struct __qlcnic_esw_statistics *stats)
+{
+        int ind = *index;
+
+        data[ind++] = QLCNIC_FILL_ESWITCH_STATS(stats->unicast_frames);
+        data[ind++] = QLCNIC_FILL_ESWITCH_STATS(stats->multicast_frames);
+        data[ind++] = QLCNIC_FILL_ESWITCH_STATS(stats->broadcast_frames);
+        data[ind++] = QLCNIC_FILL_ESWITCH_STATS(stats->dropped_frames);
+        data[ind++] = QLCNIC_FILL_ESWITCH_STATS(stats->errors);
+        data[ind++] = QLCNIC_FILL_ESWITCH_STATS(stats->local_frames);
+        data[ind++] = QLCNIC_FILL_ESWITCH_STATS(stats->numbytes);
+
+        *index = ind;
+}
+
 static void
 qlcnic_get_ethtool_stats(struct net_device *dev,
                              struct ethtool_stats *stats, u64 * data)
 {
         struct qlcnic_adapter *adapter = netdev_priv(dev);
-        int index;
+        struct qlcnic_esw_statistics port_stats;
+        int index, ret;
 
         for (index = 0; index < QLCNIC_STATS_LEN; index++) {
                 char *p =
@@ -809,6 +876,24 @@ qlcnic_get_ethtool_stats(struct net_device *dev,
                     (qlcnic_gstrings_stats[index].sizeof_stat ==
                      sizeof(u64)) ? *(u64 *)p:(*(u32 *)p);
         }
+
+        if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED))
+                return;
+
+        memset(&port_stats, 0, sizeof(struct qlcnic_esw_statistics));
+        ret = qlcnic_get_port_stats(adapter, adapter->ahw.pci_func,
+                        QLCNIC_QUERY_RX_COUNTER, &port_stats.rx);
+        if (ret)
+                return;
+
+        qlcnic_fill_device_stats(&index, data, &port_stats.rx);
+
+        ret = qlcnic_get_port_stats(adapter, adapter->ahw.pci_func,
+                        QLCNIC_QUERY_TX_COUNTER, &port_stats.tx);
+        if (ret)
+                return;
+
+        qlcnic_fill_device_stats(&index, data, &port_stats.tx);
 }
 
 static int qlcnic_set_tx_csum(struct net_device *dev, u32 data)
@@ -847,7 +932,7 @@ static int qlcnic_set_rx_csum(struct net_device *dev, u32 data)
                 return 0;
         }
 
-        if (adapter->flags & QLCNIC_LRO_ENABLED) {
+        if (dev->features & NETIF_F_LRO) {
                 if (qlcnic_config_hw_lro(adapter, QLCNIC_LRO_DISABLED))
                         return -EIO;
 
@@ -1044,7 +1129,7 @@ static int qlcnic_set_flags(struct net_device *netdev, u32 data)
                 return -EINVAL;
         }
 
-        if ((data & ETH_FLAG_LRO) && (adapter->flags & QLCNIC_LRO_ENABLED))
+        if ((data & ETH_FLAG_LRO) && (netdev->features & NETIF_F_LRO))
                 return 0;
 
         if (data & ETH_FLAG_LRO) {
diff --git a/drivers/net/qlcnic/qlcnic_hdr.h b/drivers/net/qlcnic/qlcnic_hdr.h
index 716203e41dc7..4290b80cde1a 100644
--- a/drivers/net/qlcnic/qlcnic_hdr.h
+++ b/drivers/net/qlcnic/qlcnic_hdr.h
@@ -556,18 +556,18 @@ enum {
 #define XG_LINK_UP      0x10
 #define XG_LINK_DOWN    0x20
 
-#define XG_LINK_UP_P3   0x01
-#define XG_LINK_DOWN_P3 0x02
-#define XG_LINK_STATE_P3_MASK 0xf
-#define XG_LINK_STATE_P3(pcifn, val) \
-        (((val) >> ((pcifn) * 4)) & XG_LINK_STATE_P3_MASK)
-
-#define P3_LINK_SPEED_MHZ       100
-#define P3_LINK_SPEED_MASK      0xff
-#define P3_LINK_SPEED_REG(pcifn)        \
+#define XG_LINK_UP_P3P  0x01
+#define XG_LINK_DOWN_P3P        0x02
+#define XG_LINK_STATE_P3P_MASK 0xf
+#define XG_LINK_STATE_P3P(pcifn, val) \
+        (((val) >> ((pcifn) * 4)) & XG_LINK_STATE_P3P_MASK)
+
+#define P3P_LINK_SPEED_MHZ      100
+#define P3P_LINK_SPEED_MASK     0xff
+#define P3P_LINK_SPEED_REG(pcifn)       \
         (CRB_PF_LINK_SPEED_1 + (((pcifn) / 4) * 4))
-#define P3_LINK_SPEED_VAL(pcifn, reg)   \
-        (((reg) >> (8 * ((pcifn) & 0x3))) & P3_LINK_SPEED_MASK)
+#define P3P_LINK_SPEED_VAL(pcifn, reg)  \
+        (((reg) >> (8 * ((pcifn) & 0x3))) & P3P_LINK_SPEED_MASK)
 
 #define QLCNIC_CAM_RAM_BASE     (QLCNIC_CRB_CAM + 0x02000)
 #define QLCNIC_CAM_RAM(reg)     (QLCNIC_CAM_RAM_BASE + (reg))
@@ -592,7 +592,7 @@ enum {
 #define CRB_CMDPEG_STATE                (QLCNIC_REG(0x50))
 #define CRB_RCVPEG_STATE                (QLCNIC_REG(0x13c))
 
-#define CRB_XG_STATE_P3                 (QLCNIC_REG(0x98))
+#define CRB_XG_STATE_P3P                (QLCNIC_REG(0x98))
 #define CRB_PF_LINK_SPEED_1             (QLCNIC_REG(0xe8))
 #define CRB_PF_LINK_SPEED_2             (QLCNIC_REG(0xec))
 
diff --git a/drivers/net/qlcnic/qlcnic_hw.c b/drivers/net/qlcnic/qlcnic_hw.c
index c198df90ff3c..7a47a2a7ee27 100644
--- a/drivers/net/qlcnic/qlcnic_hw.c
+++ b/drivers/net/qlcnic/qlcnic_hw.c
@@ -375,10 +375,11 @@ qlcnic_send_cmd_descs(struct qlcnic_adapter *adapter,
 
 static int
 qlcnic_sre_macaddr_change(struct qlcnic_adapter *adapter, u8 *addr,
-                                u16 vlan_id, unsigned op)
+                                __le16 vlan_id, unsigned op)
 {
         struct qlcnic_nic_req req;
         struct qlcnic_mac_req *mac_req;
+        struct qlcnic_vlan_req *vlan_req;
         u64 word;
 
         memset(&req, 0, sizeof(struct qlcnic_nic_req));
@@ -391,7 +392,8 @@ qlcnic_sre_macaddr_change(struct qlcnic_adapter *adapter, u8 *addr,
         mac_req->op = op;
         memcpy(mac_req->mac_addr, addr, 6);
 
-        req.words[1] = cpu_to_le64(vlan_id);
+        vlan_req = (struct qlcnic_vlan_req *)&req.words[1];
+        vlan_req->vlan_id = vlan_id;
 
         return qlcnic_send_cmd_descs(adapter, (struct cmd_desc_type0 *)&req, 1);
 }
@@ -440,7 +442,8 @@ void qlcnic_set_multi(struct net_device *netdev)
         qlcnic_nic_add_mac(adapter, bcast_addr);
 
         if (netdev->flags & IFF_PROMISC) {
-                mode = VPORT_MISS_MODE_ACCEPT_ALL;
+                if (!(adapter->flags & QLCNIC_PROMISC_DISABLED))
+                        mode = VPORT_MISS_MODE_ACCEPT_ALL;
                 goto send_fw_cmd;
         }
 
@@ -580,9 +583,6 @@ int qlcnic_config_hw_lro(struct qlcnic_adapter *adapter, int enable)
         u64 word;
         int rv;
 
-        if ((adapter->flags & QLCNIC_LRO_ENABLED) == enable)
-                return 0;
-
         memset(&req, 0, sizeof(struct qlcnic_nic_req));
 
         req.qhdr = cpu_to_le64(QLCNIC_HOST_REQUEST << 23);
@@ -597,8 +597,6 @@ int qlcnic_config_hw_lro(struct qlcnic_adapter *adapter, int enable)
                 dev_err(&adapter->netdev->dev,
                         "Could not send configure hw lro request\n");
 
-        adapter->flags ^= QLCNIC_LRO_ENABLED;
-
         return rv;
 }
 
@@ -676,9 +674,10 @@ int qlcnic_config_rss(struct qlcnic_adapter *adapter, int enable)
         return rv;
 }
 
-int qlcnic_config_ipaddr(struct qlcnic_adapter *adapter, u32 ip, int cmd)
+int qlcnic_config_ipaddr(struct qlcnic_adapter *adapter, __be32 ip, int cmd)
 {
         struct qlcnic_nic_req req;
+        struct qlcnic_ipaddr *ipa;
         u64 word;
         int rv;
 
@@ -689,7 +688,8 @@ int qlcnic_config_ipaddr(struct qlcnic_adapter *adapter, u32 ip, int cmd)
         req.req_hdr = cpu_to_le64(word);
 
         req.words[0] = cpu_to_le64(cmd);
-        req.words[1] = cpu_to_le64(ip);
+        ipa = (struct qlcnic_ipaddr *)&req.words[1];
+        ipa->ipv4 = ip;
 
         rv = qlcnic_send_cmd_descs(adapter, (struct cmd_desc_type0 *)&req, 1);
         if (rv != 0)
@@ -754,9 +754,9 @@ int qlcnic_change_mtu(struct net_device *netdev, int mtu)
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         int rc = 0;
 
-        if (mtu > P3_MAX_MTU) {
-                dev_err(&adapter->netdev->dev, "mtu > %d bytes unsupported\n",
-                                                P3_MAX_MTU);
+        if (mtu < P3P_MIN_MTU || mtu > P3P_MAX_MTU) {
+                dev_err(&adapter->netdev->dev, "%d bytes < mtu < %d bytes"
+                        " not supported\n", P3P_MAX_MTU, P3P_MIN_MTU);
                 return -EINVAL;
         }
 
@@ -1161,31 +1161,31 @@ int qlcnic_get_board_info(struct qlcnic_adapter *adapter)
 
         adapter->ahw.board_type = board_type;
 
-        if (board_type == QLCNIC_BRDTYPE_P3_4_GB_MM) {
+        if (board_type == QLCNIC_BRDTYPE_P3P_4_GB_MM) {
                 u32 gpio = QLCRD32(adapter, QLCNIC_ROMUSB_GLB_PAD_GPIO_I);
                 if ((gpio & 0x8000) == 0)
-                        board_type = QLCNIC_BRDTYPE_P3_10G_TP;
+                        board_type = QLCNIC_BRDTYPE_P3P_10G_TP;
         }
 
         switch (board_type) {
-        case QLCNIC_BRDTYPE_P3_HMEZ:
-        case QLCNIC_BRDTYPE_P3_XG_LOM:
-        case QLCNIC_BRDTYPE_P3_10G_CX4:
-        case QLCNIC_BRDTYPE_P3_10G_CX4_LP:
-        case QLCNIC_BRDTYPE_P3_IMEZ:
-        case QLCNIC_BRDTYPE_P3_10G_SFP_PLUS:
-        case QLCNIC_BRDTYPE_P3_10G_SFP_CT:
-        case QLCNIC_BRDTYPE_P3_10G_SFP_QT:
-        case QLCNIC_BRDTYPE_P3_10G_XFP:
-        case QLCNIC_BRDTYPE_P3_10000_BASE_T:
+        case QLCNIC_BRDTYPE_P3P_HMEZ:
+        case QLCNIC_BRDTYPE_P3P_XG_LOM:
+        case QLCNIC_BRDTYPE_P3P_10G_CX4:
+        case QLCNIC_BRDTYPE_P3P_10G_CX4_LP:
+        case QLCNIC_BRDTYPE_P3P_IMEZ:
+        case QLCNIC_BRDTYPE_P3P_10G_SFP_PLUS:
+        case QLCNIC_BRDTYPE_P3P_10G_SFP_CT:
+        case QLCNIC_BRDTYPE_P3P_10G_SFP_QT:
+        case QLCNIC_BRDTYPE_P3P_10G_XFP:
+        case QLCNIC_BRDTYPE_P3P_10000_BASE_T:
                 adapter->ahw.port_type = QLCNIC_XGBE;
                 break;
-        case QLCNIC_BRDTYPE_P3_REF_QG:
-        case QLCNIC_BRDTYPE_P3_4_GB:
-        case QLCNIC_BRDTYPE_P3_4_GB_MM:
+        case QLCNIC_BRDTYPE_P3P_REF_QG:
+        case QLCNIC_BRDTYPE_P3P_4_GB:
+        case QLCNIC_BRDTYPE_P3P_4_GB_MM:
                 adapter->ahw.port_type = QLCNIC_GBE;
                 break;
-        case QLCNIC_BRDTYPE_P3_10G_TP:
+        case QLCNIC_BRDTYPE_P3P_10G_TP:
                 adapter->ahw.port_type = (adapter->portnum < 2) ?
                         QLCNIC_XGBE : QLCNIC_GBE;
                 break;
diff --git a/drivers/net/qlcnic/qlcnic_init.c b/drivers/net/qlcnic/qlcnic_init.c
index 26a7d6bca5c7..0d180c6e41fe 100644
--- a/drivers/net/qlcnic/qlcnic_init.c
+++ b/drivers/net/qlcnic/qlcnic_init.c
@@ -259,14 +259,14 @@ int qlcnic_alloc_sw_resources(struct qlcnic_adapter *adapter)
                 switch (ring) {
                 case RCV_RING_NORMAL:
                         rds_ring->num_desc = adapter->num_rxd;
-                        rds_ring->dma_size = QLCNIC_P3_RX_BUF_MAX_LEN;
+                        rds_ring->dma_size = QLCNIC_P3P_RX_BUF_MAX_LEN;
                         rds_ring->skb_size = rds_ring->dma_size + NET_IP_ALIGN;
                         break;
 
                 case RCV_RING_JUMBO:
                         rds_ring->num_desc = adapter->num_jumbo_rxd;
                         rds_ring->dma_size =
-                                QLCNIC_P3_RX_JUMBO_BUF_MAX_LEN;
+                                QLCNIC_P3P_RX_JUMBO_BUF_MAX_LEN;
 
                         if (adapter->capabilities & QLCNIC_FW_CAPABILITY_HW_LRO)
                                 rds_ring->dma_size += QLCNIC_LRO_BUFFER_EXTRA;
@@ -1015,8 +1015,6 @@ qlcnic_check_fw_hearbeat(struct qlcnic_adapter *adapter)
 int
 qlcnic_need_fw_reset(struct qlcnic_adapter *adapter)
 {
-        u32 val, version, major, minor, build;
-
         if (qlcnic_check_fw_hearbeat(adapter)) {
                 qlcnic_rom_lock_recovery(adapter);
                 return 1;
@@ -1025,20 +1023,8 @@ qlcnic_need_fw_reset(struct qlcnic_adapter *adapter)
         if (adapter->need_fw_reset)
                 return 1;
 
-        /* check if we have got newer or different file firmware */
-        if (adapter->fw) {
-
-                val = qlcnic_get_fw_version(adapter);
-
-                version = QLCNIC_DECODE_VERSION(val);
-
-                major = QLCRD32(adapter, QLCNIC_FW_VERSION_MAJOR);
-                minor = QLCRD32(adapter, QLCNIC_FW_VERSION_MINOR);
-                build = QLCRD32(adapter, QLCNIC_FW_VERSION_SUB);
-
-                if (version > QLCNIC_VERSION_CODE(major, minor, build))
-                        return 1;
-        }
+        if (adapter->fw)
+                return 1;
 
         return 0;
 }
@@ -1174,18 +1160,6 @@ qlcnic_validate_firmware(struct qlcnic_adapter *adapter)
                 return -EINVAL;
         }
 
-        /* check if flashed firmware is newer */
-        if (qlcnic_rom_fast_read(adapter,
-                        QLCNIC_FW_VERSION_OFFSET, (int *)&val))
-                return -EIO;
-
-        val = QLCNIC_DECODE_VERSION(val);
-        if (val > ver) {
-                dev_info(&pdev->dev, "%s: firmware is older than flash\n",
-                                fw_name[fw_type]);
-                return -EINVAL;
-        }
-
         QLCWR32(adapter, QLCNIC_CAM_RAM(0x1fc), QLCNIC_BDINFO_MAGIC);
         return 0;
 }
@@ -1329,7 +1303,7 @@ qlcnic_alloc_rx_skb(struct qlcnic_adapter *adapter,
                 return -ENOMEM;
         }
 
-        skb_reserve(skb, 2);
+        skb_reserve(skb, NET_IP_ALIGN);
 
         dma = pci_map_single(pdev, skb->data,
                         rds_ring->dma_size, PCI_DMA_FROMDEVICE);
@@ -1380,24 +1354,28 @@ static struct sk_buff *qlcnic_process_rxbuf(struct qlcnic_adapter *adapter,
 }
 
 static int
-qlcnic_check_rx_tagging(struct qlcnic_adapter *adapter, struct sk_buff *skb)
+qlcnic_check_rx_tagging(struct qlcnic_adapter *adapter, struct sk_buff *skb,
+                        u16 *vlan_tag)
 {
-        u16 vlan_tag;
         struct ethhdr *eth_hdr;
 
-        if (!__vlan_get_tag(skb, &vlan_tag)) {
-                if (vlan_tag == adapter->pvid) {
-                        /* strip the tag from the packet and send it up */
-                        eth_hdr = (struct ethhdr *) skb->data;
-                        memmove(skb->data + VLAN_HLEN, eth_hdr, ETH_ALEN * 2);
-                        skb_pull(skb, VLAN_HLEN);
-                        return 0;
-                }
+        if (!__vlan_get_tag(skb, vlan_tag)) {
+                eth_hdr = (struct ethhdr *) skb->data;
+                memmove(skb->data + VLAN_HLEN, eth_hdr, ETH_ALEN * 2);
+                skb_pull(skb, VLAN_HLEN);
+        }
+        if (!adapter->pvid)
+                return 0;
+
+        if (*vlan_tag == adapter->pvid) {
+                /* Outer vlan tag. Packet should follow non-vlan path */
+                *vlan_tag = 0xffff;
+                return 0;
         }
         if (adapter->flags & QLCNIC_TAGGING_ENABLED)
                 return 0;
 
-        return -EIO;
+        return -EINVAL;
 }
 
 static struct qlcnic_rx_buffer *
@@ -1411,6 +1389,7 @@ qlcnic_process_rcv(struct qlcnic_adapter *adapter,
         struct sk_buff *skb;
         struct qlcnic_host_rds_ring *rds_ring;
         int index, length, cksum, pkt_offset;
+        u16 vid = 0xffff;
 
         if (unlikely(ring >= adapter->max_rds_rings))
                 return NULL;
@@ -1439,19 +1418,18 @@ qlcnic_process_rcv(struct qlcnic_adapter *adapter,
         if (pkt_offset)
                 skb_pull(skb, pkt_offset);
 
-        skb->truesize = skb->len + sizeof(struct sk_buff);
-
-        if (unlikely(adapter->pvid)) {
-                if (qlcnic_check_rx_tagging(adapter, skb)) {
-                        adapter->stats.rxdropped++;
-                        dev_kfree_skb_any(skb);
-                        return buffer;
-                }
+        if (unlikely(qlcnic_check_rx_tagging(adapter, skb, &vid))) {
+                adapter->stats.rxdropped++;
+                dev_kfree_skb(skb);
+                return buffer;
         }
 
         skb->protocol = eth_type_trans(skb, netdev);
 
-        napi_gro_receive(&sds_ring->napi, skb);
+        if ((vid != 0xffff) && adapter->vlgrp)
+                vlan_gro_receive(&sds_ring->napi, adapter->vlgrp, vid, skb);
+        else
+                napi_gro_receive(&sds_ring->napi, skb);
 
         adapter->stats.rx_pkts++;
         adapter->stats.rxbytes += length;
@@ -1480,6 +1458,7 @@ qlcnic_process_lro(struct qlcnic_adapter *adapter,
         int index;
         u16 lro_length, length, data_offset;
         u32 seq_number;
+        u16 vid = 0xffff;
 
         if (unlikely(ring > adapter->max_rds_rings))
                 return NULL;
@@ -1510,17 +1489,14 @@ qlcnic_process_lro(struct qlcnic_adapter *adapter,
 
         skb_put(skb, lro_length + data_offset);
 
-        skb->truesize = skb->len + sizeof(struct sk_buff) + skb_headroom(skb);
-
         skb_pull(skb, l2_hdr_offset);
 
-        if (unlikely(adapter->pvid)) {
-                if (qlcnic_check_rx_tagging(adapter, skb)) {
-                        adapter->stats.rxdropped++;
-                        dev_kfree_skb_any(skb);
-                        return buffer;
-                }
+        if (unlikely(qlcnic_check_rx_tagging(adapter, skb, &vid))) {
+                adapter->stats.rxdropped++;
+                dev_kfree_skb(skb);
+                return buffer;
         }
+
         skb->protocol = eth_type_trans(skb, netdev);
 
         iph = (struct iphdr *)skb->data;
@@ -1535,7 +1511,10 @@ qlcnic_process_lro(struct qlcnic_adapter *adapter,
 
         length = skb->len;
 
-        netif_receive_skb(skb);
+        if ((vid != 0xffff) && adapter->vlgrp)
+                vlan_hwaccel_receive_skb(skb, adapter->vlgrp, vid);
+        else
+                netif_receive_skb(skb);
 
         adapter->stats.lro_pkts++;
         adapter->stats.lrobytes += length;
@@ -1714,6 +1693,18 @@ qlcnic_post_rx_buffers_nodb(struct qlcnic_adapter *adapter,
         spin_unlock(&rds_ring->lock);
 }
 
+static void dump_skb(struct sk_buff *skb)
+{
+        int i;
+        unsigned char *data = skb->data;
+
+        for (i = 0; i < skb->len; i++) {
+                printk("%02x ", data[i]);
+                if ((i & 0x0f) == 8)
+                        printk("\n");
+        }
+}
+
 static struct qlcnic_rx_buffer *
 qlcnic_process_rcv_diag(struct qlcnic_adapter *adapter,
                 struct qlcnic_host_sds_ring *sds_ring,
@@ -1744,15 +1735,18 @@ qlcnic_process_rcv_diag(struct qlcnic_adapter *adapter,
         if (!skb)
                 return buffer;
 
-        skb_put(skb, rds_ring->skb_size);
+        if (length > rds_ring->skb_size)
+                skb_put(skb, rds_ring->skb_size);
+        else
+                skb_put(skb, length);
 
         if (pkt_offset)
                 skb_pull(skb, pkt_offset);
 
-        skb->truesize = skb->len + sizeof(struct sk_buff);
-
         if (!qlcnic_check_loopback_buff(skb->data))
                 adapter->diag_cnt++;
+        else
+                dump_skb(skb);
 
         dev_kfree_skb_any(skb);
         adapter->stats.rx_pkts++;
diff --git a/drivers/net/qlcnic/qlcnic_main.c b/drivers/net/qlcnic/qlcnic_main.c
index 5fd2abd1eb67..f047c7c48314 100644
--- a/drivers/net/qlcnic/qlcnic_main.c
+++ b/drivers/net/qlcnic/qlcnic_main.c
@@ -28,6 +28,7 @@
 
 #include "qlcnic.h"
 
+#include <linux/swab.h>
 #include <linux/dma-mapping.h>
 #include <linux/if_vlan.h>
 #include <net/ip.h>
@@ -45,11 +46,7 @@ char qlcnic_driver_name[] = "qlcnic";
 static const char qlcnic_driver_string[] = "QLogic 1/10 GbE "
         "Converged/Intelligent Ethernet Driver v" QLCNIC_LINUX_VERSIONID;
 
-static int port_mode = QLCNIC_PORT_MODE_AUTO_NEG;
-
-/* Default to restricted 1G auto-neg mode */
-static int wol_port_mode = 5;
-
+static struct workqueue_struct *qlcnic_wq;
 static int qlcnic_mac_learn;
 module_param(qlcnic_mac_learn, int, 0644);
 MODULE_PARM_DESC(qlcnic_mac_learn, "Mac Filter (0=disabled, 1=enabled)");
@@ -107,7 +104,7 @@ static irqreturn_t qlcnic_msi_intr(int irq, void *data);
 static irqreturn_t qlcnic_msix_intr(int irq, void *data);
 
 static struct net_device_stats *qlcnic_get_stats(struct net_device *netdev);
-static void qlcnic_config_indev_addr(struct net_device *dev, unsigned long);
+static void qlcnic_restore_indev_addr(struct net_device *dev, unsigned long);
 static int qlcnic_start_firmware(struct qlcnic_adapter *);
 
 static void qlcnic_alloc_lb_filters_mem(struct qlcnic_adapter *adapter);
@@ -172,7 +169,7 @@ qlcnic_alloc_sds_rings(struct qlcnic_recv_context *recv_ctx, int count)
 
         recv_ctx->sds_rings = kzalloc(size, GFP_KERNEL);
 
-        return (recv_ctx->sds_rings == NULL);
+        return recv_ctx->sds_rings == NULL;
 }
 
 static void
@@ -263,40 +260,6 @@ static void qlcnic_clear_stats(struct qlcnic_adapter *adapter)
         memset(&adapter->stats, 0, sizeof(adapter->stats));
 }
 
-static void qlcnic_set_port_mode(struct qlcnic_adapter *adapter)
-{
-        u32 val, data;
-
-        val = adapter->ahw.board_type;
-        if ((val == QLCNIC_BRDTYPE_P3_HMEZ) ||
-                (val == QLCNIC_BRDTYPE_P3_XG_LOM)) {
-                if (port_mode == QLCNIC_PORT_MODE_802_3_AP) {
-                        data = QLCNIC_PORT_MODE_802_3_AP;
-                        QLCWR32(adapter, QLCNIC_PORT_MODE_ADDR, data);
-                } else if (port_mode == QLCNIC_PORT_MODE_XG) {
-                        data = QLCNIC_PORT_MODE_XG;
-                        QLCWR32(adapter, QLCNIC_PORT_MODE_ADDR, data);
-                } else if (port_mode == QLCNIC_PORT_MODE_AUTO_NEG_1G) {
-                        data = QLCNIC_PORT_MODE_AUTO_NEG_1G;
-                        QLCWR32(adapter, QLCNIC_PORT_MODE_ADDR, data);
-                } else if (port_mode == QLCNIC_PORT_MODE_AUTO_NEG_XG) {
-                        data = QLCNIC_PORT_MODE_AUTO_NEG_XG;
-                        QLCWR32(adapter, QLCNIC_PORT_MODE_ADDR, data);
-                } else {
-                        data = QLCNIC_PORT_MODE_AUTO_NEG;
-                        QLCWR32(adapter, QLCNIC_PORT_MODE_ADDR, data);
-                }
-
-                if ((wol_port_mode != QLCNIC_PORT_MODE_802_3_AP) &&
-                        (wol_port_mode != QLCNIC_PORT_MODE_XG) &&
-                        (wol_port_mode != QLCNIC_PORT_MODE_AUTO_NEG_1G) &&
-                        (wol_port_mode != QLCNIC_PORT_MODE_AUTO_NEG_XG)) {
-                        wol_port_mode = QLCNIC_PORT_MODE_AUTO_NEG;
-                }
-                QLCWR32(adapter, QLCNIC_WOL_PORT_MODE, wol_port_mode);
-        }
-}
-
 static void qlcnic_set_msix_bit(struct pci_dev *pdev, int enable)
 {
         u32 control;
@@ -371,6 +334,13 @@ static int qlcnic_set_mac(struct net_device *netdev, void *p)
         return 0;
 }
 
+static void qlcnic_vlan_rx_register(struct net_device *netdev,
+                struct vlan_group *grp)
+{
+        struct qlcnic_adapter *adapter = netdev_priv(netdev);
+        adapter->vlgrp = grp;
+}
+
 static const struct net_device_ops qlcnic_netdev_ops = {
         .ndo_open          = qlcnic_open,
         .ndo_stop          = qlcnic_close,
@@ -381,6 +351,7 @@ static const struct net_device_ops qlcnic_netdev_ops = {
         .ndo_set_mac_address    = qlcnic_set_mac,
         .ndo_change_mtu    = qlcnic_change_mtu,
         .ndo_tx_timeout    = qlcnic_tx_timeout,
+        .ndo_vlan_rx_register = qlcnic_vlan_rx_register,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = qlcnic_poll_controller,
 #endif
@@ -512,9 +483,9 @@ qlcnic_init_pci_info(struct qlcnic_adapter *adapter)
                 pfn = pci_info[i].id;
                 if (pfn > QLCNIC_MAX_PCI_FUNC)
                         return QL_STATUS_INVALID_PARAM;
-                adapter->npars[pfn].active = pci_info[i].active;
-                adapter->npars[pfn].type = pci_info[i].type;
-                adapter->npars[pfn].phy_port = pci_info[i].default_port;
+                adapter->npars[pfn].active = (u8)pci_info[i].active;
+                adapter->npars[pfn].type = (u8)pci_info[i].type;
+                adapter->npars[pfn].phy_port = (u8)pci_info[i].default_port;
                 adapter->npars[pfn].min_bw = pci_info[i].tx_min_bw;
                 adapter->npars[pfn].max_bw = pci_info[i].tx_max_bw;
         }
@@ -686,8 +657,6 @@ qlcnic_check_options(struct qlcnic_adapter *adapter)
         dev_info(&pdev->dev, "firmware v%d.%d.%d\n",
                         fw_major, fw_minor, fw_build);
 
-        adapter->flags &= ~QLCNIC_LRO_ENABLED;
-
         if (adapter->ahw.port_type == QLCNIC_XGBE) {
                 adapter->num_rxd = DEFAULT_RCV_DESCRIPTORS_10G;
                 adapter->num_jumbo_rxd = MAX_JUMBO_RCV_DESCRIPTORS_10G;
@@ -714,7 +683,7 @@ qlcnic_initialize_nic(struct qlcnic_adapter *adapter)
         if (err)
                 return err;
 
-        adapter->physical_port = nic_info.phys_port;
+        adapter->physical_port = (u8)nic_info.phys_port;
         adapter->switch_mode = nic_info.switch_mode;
         adapter->max_tx_ques = nic_info.max_tx_ques;
         adapter->max_rx_ques = nic_info.max_rx_ques;
@@ -749,8 +718,8 @@ static void
 qlcnic_set_eswitch_port_features(struct qlcnic_adapter *adapter,
                 struct qlcnic_esw_func_cfg *esw_cfg)
 {
-        adapter->flags &= ~QLCNIC_MACSPOOF;
-        adapter->flags &= ~QLCNIC_MAC_OVERRIDE_DISABLED;
+        adapter->flags &= ~(QLCNIC_MACSPOOF | QLCNIC_MAC_OVERRIDE_DISABLED |
+                                QLCNIC_PROMISC_DISABLED);
 
         if (esw_cfg->mac_anti_spoof)
                 adapter->flags |= QLCNIC_MACSPOOF;
@@ -758,6 +727,9 @@ qlcnic_set_eswitch_port_features(struct qlcnic_adapter *adapter,
         if (!esw_cfg->mac_override)
                 adapter->flags |= QLCNIC_MAC_OVERRIDE_DISABLED;
 
+        if (!esw_cfg->promisc_mode)
+                adapter->flags |= QLCNIC_PROMISC_DISABLED;
+
         qlcnic_set_netdev_features(adapter, esw_cfg);
 }
 
@@ -876,6 +848,7 @@ qlcnic_set_default_offload_settings(struct qlcnic_adapter *adapter)
                 esw_cfg.pci_func = i;
                 esw_cfg.offload_flags = BIT_0;
                 esw_cfg.mac_override = BIT_0;
+                esw_cfg.promisc_mode = BIT_0;
                 if (adapter->capabilities  & QLCNIC_FW_CAPABILITY_TSO)
                         esw_cfg.offload_flags |= (BIT_1 | BIT_2);
                 if (qlcnic_config_switch_port(adapter, &esw_cfg))
@@ -1023,7 +996,6 @@ qlcnic_start_firmware(struct qlcnic_adapter *adapter)
         err = qlcnic_pinit_from_rom(adapter);
         if (err)
                 goto err_out;
-        qlcnic_set_port_mode(adapter);
 
         err = qlcnic_load_firmware(adapter);
         if (err)
@@ -1446,7 +1418,7 @@ qlcnic_setup_netdev(struct qlcnic_adapter *adapter,
         SET_ETHTOOL_OPS(netdev, &qlcnic_ethtool_ops);
 
         netdev->features |= (NETIF_F_SG | NETIF_F_IP_CSUM |
-                NETIF_F_IPV6_CSUM | NETIF_F_GRO);
+                NETIF_F_IPV6_CSUM | NETIF_F_GRO | NETIF_F_HW_VLAN_RX);
         netdev->vlan_features |= (NETIF_F_SG | NETIF_F_IP_CSUM |
                 NETIF_F_IPV6_CSUM);
 
@@ -1751,7 +1723,7 @@ qlcnic_resume(struct pci_dev *pdev)
                 if (err)
                         goto done;
 
-                qlcnic_config_indev_addr(netdev, NETDEV_UP);
+                qlcnic_restore_indev_addr(netdev, NETDEV_UP);
         }
 done:
         netif_device_attach(netdev);
@@ -1826,11 +1798,12 @@ static void qlcnic_free_lb_filters_mem(struct qlcnic_adapter *adapter)
 }
 
 static void qlcnic_change_filter(struct qlcnic_adapter *adapter,
-                u64 uaddr, u16 vlan_id, struct qlcnic_host_tx_ring *tx_ring)
+                u64 uaddr, __le16 vlan_id, struct qlcnic_host_tx_ring *tx_ring)
 {
         struct cmd_desc_type0 *hwdesc;
         struct qlcnic_nic_req *req;
         struct qlcnic_mac_req *mac_req;
+        struct qlcnic_vlan_req *vlan_req;
         u32 producer;
         u64 word;
 
@@ -1848,7 +1821,8 @@ static void qlcnic_change_filter(struct qlcnic_adapter *adapter,
         mac_req->op = vlan_id ? QLCNIC_MAC_VLAN_ADD : QLCNIC_MAC_ADD;
         memcpy(mac_req->mac_addr, &uaddr, ETH_ALEN);
 
-        req->words[1] = cpu_to_le64(vlan_id);
+        vlan_req = (struct qlcnic_vlan_req *)&req->words[1];
+        vlan_req->vlan_id = vlan_id;
 
         tx_ring->producer = get_next_index(producer, tx_ring->num_desc);
 }
@@ -1867,7 +1841,7 @@ qlcnic_send_filter(struct qlcnic_adapter *adapter,
         struct hlist_node *tmp_hnode, *n;
         struct hlist_head *head;
         u64 src_addr = 0;
-        u16 vlan_id = 0;
+        __le16 vlan_id = 0;
         u8 hindex;
 
         if (!compare_ether_addr(phdr->h_source, adapter->mac_addr))
@@ -1920,7 +1894,8 @@ qlcnic_tso_check(struct net_device *netdev,
         struct vlan_ethhdr *vh;
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         u32 producer = tx_ring->producer;
-        int vlan_oob = first_desc->flags_opcode & cpu_to_le16(FLAGS_VLAN_OOB);
+        __le16 vlan_oob = first_desc->flags_opcode &
+                                cpu_to_le16(FLAGS_VLAN_OOB);
 
         if (*(skb->data) & BIT_0) {
                 flags |= BIT_0;
@@ -1991,7 +1966,8 @@ qlcnic_tso_check(struct net_device *netdev,
                 vh = (struct vlan_ethhdr *)((char *)hwdesc + 2);
                 skb_copy_from_linear_data(skb, vh, 12);
                 vh->h_vlan_proto = htons(ETH_P_8021Q);
-                vh->h_vlan_TCI = htons(first_desc->vlan_TCI);
+                vh->h_vlan_TCI = (__be16)swab16((u16)first_desc->vlan_TCI);
+
                 skb_copy_from_linear_data_offset(skb, 12,
                                 (char *)vh + 16, copy_len - 16);
 
@@ -2738,7 +2714,8 @@ qlcnic_fwinit_work(struct work_struct *work)
                 goto err_ret;
 
         dev_state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
-        if (dev_state ==  QLCNIC_DEV_QUISCENT) {
+        if (dev_state == QLCNIC_DEV_QUISCENT ||
+            dev_state == QLCNIC_DEV_NEED_QUISCENT) {
                 qlcnic_api_unlock(adapter);
                 qlcnic_schedule_work(adapter, qlcnic_fwinit_work,
                                                 FW_POLL_DELAY * 2);
@@ -2760,18 +2737,6 @@ qlcnic_fwinit_work(struct work_struct *work)
 skip_ack_check:
                 dev_state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
 
-                if (dev_state == QLCNIC_DEV_NEED_QUISCENT) {
-                        QLCWR32(adapter, QLCNIC_CRB_DEV_STATE,
-                                                QLCNIC_DEV_QUISCENT);
-                        qlcnic_schedule_work(adapter, qlcnic_fwinit_work,
-                                                FW_POLL_DELAY * 2);
-                        QLCDB(adapter, DRV, "Quiscing the driver\n");
-                        qlcnic_idc_debug_info(adapter, 0);
-
-                        qlcnic_api_unlock(adapter);
-                        return;
-                }
-
                 if (dev_state == QLCNIC_DEV_NEED_RESET) {
                         QLCWR32(adapter, QLCNIC_CRB_DEV_STATE,
                                                 QLCNIC_DEV_INITIALIZING);
@@ -2828,7 +2793,12 @@ qlcnic_detach_work(struct work_struct *work)
 
         netif_device_detach(netdev);
 
-        qlcnic_down(adapter, netdev);
+        /* Dont grab rtnl lock during Quiscent mode */
+        if (adapter->dev_state == QLCNIC_DEV_NEED_QUISCENT) {
+                if (netif_running(netdev))
+                        __qlcnic_down(adapter, netdev);
+        } else
+                qlcnic_down(adapter, netdev);
 
         status = QLCRD32(adapter, QLCNIC_PEG_HALT_STATUS1);
 
@@ -2870,6 +2840,61 @@ qlcnic_set_npar_non_operational(struct qlcnic_adapter *adapter)
         qlcnic_api_unlock(adapter);
 }
 
+/* Caller should held RESETTING bit.
+ * This should be call in sync with qlcnic_request_quiscent_mode.
+ */
+void qlcnic_clear_quiscent_mode(struct qlcnic_adapter *adapter)
+{
+        qlcnic_clr_drv_state(adapter);
+        qlcnic_api_lock(adapter);
+        QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_READY);
+        qlcnic_api_unlock(adapter);
+}
+
+/* Caller should held RESETTING bit.
+ */
+int qlcnic_request_quiscent_mode(struct qlcnic_adapter *adapter)
+{
+        u8 timeo = adapter->dev_init_timeo / 2;
+        u32 state;
+
+        if (qlcnic_api_lock(adapter))
+                return -EIO;
+
+        state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state != QLCNIC_DEV_READY)
+                return -EIO;
+
+        QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_NEED_QUISCENT);
+        qlcnic_api_unlock(adapter);
+        QLCDB(adapter, DRV, "NEED QUISCENT state set\n");
+        qlcnic_idc_debug_info(adapter, 0);
+
+        qlcnic_set_drv_state(adapter, QLCNIC_DEV_NEED_QUISCENT);
+
+        do {
+                msleep(2000);
+                state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
+                if (state == QLCNIC_DEV_QUISCENT)
+                        return 0;
+                if (!qlcnic_check_drv_state(adapter)) {
+                        if (qlcnic_api_lock(adapter))
+                                return -EIO;
+                        QLCWR32(adapter, QLCNIC_CRB_DEV_STATE,
+                                                        QLCNIC_DEV_QUISCENT);
+                        qlcnic_api_unlock(adapter);
+                        QLCDB(adapter, DRV, "QUISCENT mode set\n");
+                        return 0;
+                }
+        } while (--timeo);
+
+        dev_err(&adapter->pdev->dev, "Failed to quiesce device, DRV_STATE=%08x"
+                " DRV_ACTIVE=%08x\n", QLCRD32(adapter, QLCNIC_CRB_DRV_STATE),
+                QLCRD32(adapter, QLCNIC_CRB_DRV_ACTIVE));
+        qlcnic_clear_quiscent_mode(adapter);
+        return -EIO;
+}
+
 /*Transit to RESET state from READY state only */
 static void
 qlcnic_dev_request_reset(struct qlcnic_adapter *adapter)
@@ -2913,7 +2938,8 @@ qlcnic_schedule_work(struct qlcnic_adapter *adapter,
                 return;
 
         INIT_DELAYED_WORK(&adapter->fw_work, func);
-        schedule_delayed_work(&adapter->fw_work, round_jiffies_relative(delay));
+        queue_delayed_work(qlcnic_wq, &adapter->fw_work,
+                                        round_jiffies_relative(delay));
 }
 
 static void
@@ -2950,7 +2976,7 @@ attach:
                 if (qlcnic_up(adapter, netdev))
                         goto done;
 
-                qlcnic_config_indev_addr(netdev, NETDEV_UP);
+                qlcnic_restore_indev_addr(netdev, NETDEV_UP);
         }
 
 done:
@@ -2976,11 +3002,11 @@ qlcnic_check_health(struct qlcnic_adapter *adapter)
                 qlcnic_dev_request_reset(adapter);
 
         state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
-        if (state == QLCNIC_DEV_NEED_RESET ||
-            state == QLCNIC_DEV_NEED_QUISCENT) {
+        if (state == QLCNIC_DEV_NEED_RESET) {
                 qlcnic_set_npar_non_operational(adapter);
                 adapter->need_fw_reset = 1;
-        }
+        } else if (state == QLCNIC_DEV_NEED_QUISCENT)
+                goto detach;
 
         heartbeat = QLCRD32(adapter, QLCNIC_PEG_ALIVE_COUNTER);
         if (heartbeat != adapter->heartbeat) {
@@ -3112,7 +3138,7 @@ static int qlcnic_attach_func(struct pci_dev *pdev)
                 if (err)
                         goto done;
 
-                qlcnic_config_indev_addr(netdev, NETDEV_UP);
+                qlcnic_restore_indev_addr(netdev, NETDEV_UP);
         }
  done:
         netif_device_attach(netdev);
@@ -3549,6 +3575,7 @@ validate_esw_config(struct qlcnic_adapter *adapter,
                                                 QLCNIC_NON_PRIV_FUNC) {
                                 esw_cfg[i].mac_anti_spoof = 0;
                                 esw_cfg[i].mac_override = 1;
+                                esw_cfg[i].promisc_mode = 1;
                         }
                         break;
                 case QLCNIC_ADD_VLAN:
@@ -3749,7 +3776,7 @@ qlcnic_sysfs_read_npar_config(struct file *file, struct kobject *kobj,
                         return ret;
 
                 np_cfg[i].pci_func = i;
-                np_cfg[i].op_mode = nic_info.op_mode;
+                np_cfg[i].op_mode = (u8)nic_info.op_mode;
                 np_cfg[i].port_num = nic_info.phys_port;
                 np_cfg[i].fw_capab = nic_info.capabilities;
                 np_cfg[i].min_bw = nic_info.min_tx_bw ;
@@ -4027,10 +4054,10 @@ qlcnic_remove_diag_entries(struct qlcnic_adapter *adapter)
 #define is_qlcnic_netdev(dev) (dev->netdev_ops == &qlcnic_netdev_ops)
 
 static void
-qlcnic_config_indev_addr(struct net_device *dev, unsigned long event)
+qlcnic_config_indev_addr(struct qlcnic_adapter *adapter,
+                        struct net_device *dev, unsigned long event)
 {
         struct in_device *indev;
-        struct qlcnic_adapter *adapter = netdev_priv(dev);
 
         indev = in_dev_get(dev);
         if (!indev)
@@ -4054,6 +4081,27 @@ qlcnic_config_indev_addr(struct net_device *dev, unsigned long event)
         in_dev_put(indev);
 }
 
+static void
+qlcnic_restore_indev_addr(struct net_device *netdev, unsigned long event)
+{
+        struct qlcnic_adapter *adapter = netdev_priv(netdev);
+        struct net_device *dev;
+        u16 vid;
+
+        qlcnic_config_indev_addr(adapter, netdev, event);
+
+        if (!adapter->vlgrp)
+                return;
+
+        for (vid = 0; vid < VLAN_N_VID; vid++) {
+                dev = vlan_group_get_device(adapter->vlgrp, vid);
+                if (!dev)
+                        continue;
+
+                qlcnic_config_indev_addr(adapter, dev, event);
+        }
+}
+
 static int qlcnic_netdev_event(struct notifier_block *this,
                                  unsigned long event, void *ptr)
 {
@@ -4080,7 +4128,7 @@ recheck:
         if (!test_bit(__QLCNIC_DEV_UP, &adapter->state))
                 goto done;
 
-        qlcnic_config_indev_addr(dev, event);
+        qlcnic_config_indev_addr(adapter, dev, event);
 done:
         return NOTIFY_DONE;
 }
@@ -4097,7 +4145,7 @@ qlcnic_inetaddr_event(struct notifier_block *this,
         dev = ifa->ifa_dev ? ifa->ifa_dev->dev : NULL;
 
 recheck:
-        if (dev == NULL || !netif_running(dev))
+        if (dev == NULL)
                 goto done;
 
         if (dev->priv_flags & IFF_802_1Q_VLAN) {
@@ -4140,7 +4188,7 @@ static struct notifier_block qlcnic_inetaddr_cb = {
 };
 #else
 static void
-qlcnic_config_indev_addr(struct net_device *dev, unsigned long event)
+qlcnic_restore_indev_addr(struct net_device *dev, unsigned long event)
 { }
 #endif
 static struct pci_error_handlers qlcnic_err_handler = {
@@ -4169,6 +4217,12 @@ static int __init qlcnic_init_module(void)
 
         printk(KERN_INFO "%s\n", qlcnic_driver_string);
 
+        qlcnic_wq = create_singlethread_workqueue("qlcnic");
+        if (qlcnic_wq == NULL) {
+                printk(KERN_ERR "qlcnic: cannot create workqueue\n");
+                return -ENOMEM;
+        }
+
 #ifdef CONFIG_INET
         register_netdevice_notifier(&qlcnic_netdev_cb);
         register_inetaddr_notifier(&qlcnic_inetaddr_cb);
@@ -4180,6 +4234,7 @@ static int __init qlcnic_init_module(void)
                 unregister_inetaddr_notifier(&qlcnic_inetaddr_cb);
                 unregister_netdevice_notifier(&qlcnic_netdev_cb);
 #endif
+                destroy_workqueue(qlcnic_wq);
         }
 
         return ret;
@@ -4196,6 +4251,7 @@ static void __exit qlcnic_exit_module(void)
         unregister_inetaddr_notifier(&qlcnic_inetaddr_cb);
         unregister_netdevice_notifier(&qlcnic_netdev_cb);
 #endif
+        destroy_workqueue(qlcnic_wq);
 }
 
 module_exit(qlcnic_exit_module);
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index 4ffebe83d883..ba0053d8515e 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -2572,7 +2572,7 @@ static netdev_tx_t qlge_send(struct sk_buff *skb, struct net_device *ndev)
 
         mac_iocb_ptr->frame_len = cpu_to_le16((u16) skb->len);
 
-        if (qdev->vlgrp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 netif_printk(qdev, tx_queued, KERN_DEBUG, qdev->ndev,
                              "Adding a vlan tag %d.\n", vlan_tx_tag_get(skb));
                 mac_iocb_ptr->flags3 |= OB_MAC_IOCB_V;
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 63db065508f4..68a84198eb05 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -745,6 +745,9 @@ static void r6040_mac_address(struct net_device *dev)
         iowrite16(adrp[0], ioaddr + MID_0L);
         iowrite16(adrp[1], ioaddr + MID_0M);
         iowrite16(adrp[2], ioaddr + MID_0H);
+
+        /* Store MAC Address in perm_addr */
+        memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
 }
 
 static int r6040_open(struct net_device *dev)
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 54900332f12d..d88ce9fb1cbd 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -187,12 +187,7 @@ static DEFINE_PCI_DEVICE_TABLE(rtl8169_pci_tbl) = {
 
 MODULE_DEVICE_TABLE(pci, rtl8169_pci_tbl);
 
-/*
- * we set our copybreak very high so that we don't have
- * to allocate 16k frames all the time (see note in
- * rtl8169_open()
- */
-static int rx_copybreak = 16383;
+static int rx_buf_sz = 16383;
 static int use_dac;
 static struct {
         u32 msg_enable;
@@ -484,10 +479,8 @@ struct rtl8169_private {
         struct RxDesc *RxDescArray;     /* 256-aligned Rx descriptor ring */
         dma_addr_t TxPhyAddr;
         dma_addr_t RxPhyAddr;
-        struct sk_buff *Rx_skbuff[NUM_RX_DESC]; /* Rx data buffers */
+        void *Rx_databuff[NUM_RX_DESC]; /* Rx data buffers */
         struct ring_info tx_skb[NUM_TX_DESC];   /* Tx data buffers */
-        unsigned align;
-        unsigned rx_buf_sz;
         struct timer_list timer;
         u16 cp_cmd;
         u16 intr_event;
@@ -515,8 +508,6 @@ struct rtl8169_private {
 
 MODULE_AUTHOR("Realtek and the Linux r8169 crew <netdev@vger.kernel.org>");
 MODULE_DESCRIPTION("RealTek RTL-8169 Gigabit Ethernet driver");
-module_param(rx_copybreak, int, 0);
-MODULE_PARM_DESC(rx_copybreak, "Copy breakpoint for copy-only-tiny-frames");
 module_param(use_dac, int, 0);
 MODULE_PARM_DESC(use_dac, "Enable PCI DAC. Unsafe on 32 bit PCI slot.");
 module_param_named(debug, debug.msg_enable, int, 0);
@@ -1043,7 +1034,7 @@ static int rtl8169_set_rx_csum(struct net_device *dev, u32 data)
 static inline u32 rtl8169_tx_vlan_tag(struct rtl8169_private *tp,
                                       struct sk_buff *skb)
 {
-        return (tp->vlgrp && vlan_tx_tag_present(skb)) ?
+        return (vlan_tx_tag_present(skb)) ?
                 TxVlanTag | swab16(vlan_tx_tag_get(skb)) : 0x00;
 }
 
@@ -1209,6 +1200,7 @@ static void rtl8169_update_counters(struct net_device *dev)
         dma_addr_t paddr;
         u32 cmd;
         int wait = 1000;
+        struct device *d = &tp->pci_dev->dev;
 
         /*
          * Some chips are unable to dump tally counters when the receiver
@@ -1217,7 +1209,7 @@ static void rtl8169_update_counters(struct net_device *dev)
         if ((RTL_R8(ChipCmd) & CmdRxEnb) == 0)
                 return;
 
-        counters = pci_alloc_consistent(tp->pci_dev, sizeof(*counters), &paddr);
+        counters = dma_alloc_coherent(d, sizeof(*counters), &paddr, GFP_KERNEL);
         if (!counters)
                 return;
 
@@ -1238,7 +1230,7 @@ static void rtl8169_update_counters(struct net_device *dev)
         RTL_W32(CounterAddrLow, 0);
         RTL_W32(CounterAddrHigh, 0);
 
-        pci_free_consistent(tp->pci_dev, sizeof(*counters), counters, paddr);
+        dma_free_coherent(d, sizeof(*counters), counters, paddr);
 }
 
 static void rtl8169_get_ethtool_stats(struct net_device *dev,
@@ -2939,7 +2931,7 @@ static const struct rtl_cfg_info {
                 .hw_start       = rtl_hw_start_8168,
                 .region         = 2,
                 .align          = 8,
-                .intr_event     = SYSErr | LinkChg | RxOverflow |
+                .intr_event     = SYSErr | RxFIFOOver | LinkChg | RxOverflow |
                                   TxErr | TxOK | RxOK | RxErr,
                 .napi_event     = TxErr | TxOK | RxOK | RxOverflow,
                 .features       = RTL_FEATURE_GMII | RTL_FEATURE_MSI,
@@ -3194,7 +3186,6 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         dev->features |= NETIF_F_GRO;
 
         tp->intr_mask = 0xffff;
-        tp->align = cfg->align;
         tp->hw_start = cfg->hw_start;
         tp->intr_event = cfg->intr_event;
         tp->napi_event = cfg->napi_event;
@@ -3264,18 +3255,6 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
         pci_set_drvdata(pdev, NULL);
 }
 
-static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
-                                  unsigned int mtu)
-{
-        unsigned int max_frame = mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
-
-        if (max_frame != 16383)
-                printk(KERN_WARNING PFX "WARNING! Changing of MTU on this "
-                        "NIC may lead to frame reception errors!\n");
-
-        tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE;
-}
-
 static int rtl8169_open(struct net_device *dev)
 {
         struct rtl8169_private *tp = netdev_priv(dev);
@@ -3285,28 +3264,16 @@ static int rtl8169_open(struct net_device *dev)
         pm_runtime_get_sync(&pdev->dev);
 
         /*
-         * Note that we use a magic value here, its wierd I know
-         * its done because, some subset of rtl8169 hardware suffers from
-         * a problem in which frames received that are longer than
-         * the size set in RxMaxSize register return garbage sizes
-         * when received.  To avoid this we need to turn off filtering,
-         * which is done by setting a value of 16383 in the RxMaxSize register
-         * and allocating 16k frames to handle the largest possible rx value
-         * thats what the magic math below does.
-         */
-        rtl8169_set_rxbufsize(tp, 16383 - VLAN_ETH_HLEN - ETH_FCS_LEN);
-
-        /*
          * Rx and Tx desscriptors needs 256 bytes alignment.
-         * pci_alloc_consistent provides more.
+         * dma_alloc_coherent provides more.
          */
-        tp->TxDescArray = pci_alloc_consistent(pdev, R8169_TX_RING_BYTES,
-                                               &tp->TxPhyAddr);
+        tp->TxDescArray = dma_alloc_coherent(&pdev->dev, R8169_TX_RING_BYTES,
+                                             &tp->TxPhyAddr, GFP_KERNEL);
         if (!tp->TxDescArray)
                 goto err_pm_runtime_put;
 
-        tp->RxDescArray = pci_alloc_consistent(pdev, R8169_RX_RING_BYTES,
-                                               &tp->RxPhyAddr);
+        tp->RxDescArray = dma_alloc_coherent(&pdev->dev, R8169_RX_RING_BYTES,
+                                             &tp->RxPhyAddr, GFP_KERNEL);
         if (!tp->RxDescArray)
                 goto err_free_tx_0;
 
@@ -3340,12 +3307,12 @@ out:
 err_release_ring_2:
         rtl8169_rx_clear(tp);
 err_free_rx_1:
-        pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray,
-                            tp->RxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
+                          tp->RxPhyAddr);
         tp->RxDescArray = NULL;
 err_free_tx_0:
-        pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray,
-                            tp->TxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_TX_RING_BYTES, tp->TxDescArray,
+                          tp->TxPhyAddr);
         tp->TxDescArray = NULL;
 err_pm_runtime_put:
         pm_runtime_put_noidle(&pdev->dev);
@@ -3472,7 +3439,7 @@ static void rtl_hw_start_8169(struct net_device *dev)
 
         RTL_W8(EarlyTxThres, EarlyTxThld);
 
-        rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
+        rtl_set_rx_max_size(ioaddr, rx_buf_sz);
 
         if ((tp->mac_version == RTL_GIGA_MAC_VER_01) ||
             (tp->mac_version == RTL_GIGA_MAC_VER_02) ||
@@ -3733,7 +3700,7 @@ static void rtl_hw_start_8168(struct net_device *dev)
 
         RTL_W8(EarlyTxThres, EarlyTxThld);
 
-        rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
+        rtl_set_rx_max_size(ioaddr, rx_buf_sz);
 
         tp->cp_cmd |= RTL_R16(CPlusCmd) | PktCntrDisable | INTT_1;
 
@@ -3913,7 +3880,7 @@ static void rtl_hw_start_8101(struct net_device *dev)
 
         RTL_W8(EarlyTxThres, EarlyTxThld);
 
-        rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
+        rtl_set_rx_max_size(ioaddr, rx_buf_sz);
 
         tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW;
 
@@ -3941,33 +3908,11 @@ static void rtl_hw_start_8101(struct net_device *dev)
 
 static int rtl8169_change_mtu(struct net_device *dev, int new_mtu)
 {
-        struct rtl8169_private *tp = netdev_priv(dev);
-        int ret = 0;
-
         if (new_mtu < ETH_ZLEN || new_mtu > SafeMtu)
                 return -EINVAL;
 
         dev->mtu = new_mtu;
-
-        if (!netif_running(dev))
-                goto out;
-
-        rtl8169_down(dev);
-
-        rtl8169_set_rxbufsize(tp, dev->mtu);
-
-        ret = rtl8169_init_ring(dev);
-        if (ret < 0)
-                goto out;
-
-        napi_enable(&tp->napi);
-
-        rtl_hw_start(dev);
-
-        rtl8169_request_timer(dev);
-
-out:
-        return ret;
+        return 0;
 }
 
 static inline void rtl8169_make_unusable_by_asic(struct RxDesc *desc)
@@ -3976,15 +3921,14 @@ static inline void rtl8169_make_unusable_by_asic(struct RxDesc *desc)
         desc->opts1 &= ~cpu_to_le32(DescOwn | RsvdMask);
 }
 
-static void rtl8169_free_rx_skb(struct rtl8169_private *tp,
-                                struct sk_buff **sk_buff, struct RxDesc *desc)
+static void rtl8169_free_rx_databuff(struct rtl8169_private *tp,
+                                     void **data_buff, struct RxDesc *desc)
 {
-        struct pci_dev *pdev = tp->pci_dev;
+        dma_unmap_single(&tp->pci_dev->dev, le64_to_cpu(desc->addr), rx_buf_sz,
+                         DMA_FROM_DEVICE);
 
-        pci_unmap_single(pdev, le64_to_cpu(desc->addr), tp->rx_buf_sz,
-                         PCI_DMA_FROMDEVICE);
-        dev_kfree_skb(*sk_buff);
-        *sk_buff = NULL;
+        kfree(*data_buff);
+        *data_buff = NULL;
         rtl8169_make_unusable_by_asic(desc);
 }
 
@@ -4003,33 +3947,45 @@ static inline void rtl8169_map_to_asic(struct RxDesc *desc, dma_addr_t mapping,
         rtl8169_mark_to_asic(desc, rx_buf_sz);
 }
 
-static struct sk_buff *rtl8169_alloc_rx_skb(struct pci_dev *pdev,
-                                            struct net_device *dev,
-                                            struct RxDesc *desc, int rx_buf_sz,
-                                            unsigned int align)
+static inline void *rtl8169_align(void *data)
 {
-        struct sk_buff *skb;
-        dma_addr_t mapping;
-        unsigned int pad;
+        return (void *)ALIGN((long)data, 16);
+}
 
-        pad = align ? align : NET_IP_ALIGN;
+static struct sk_buff *rtl8169_alloc_rx_data(struct rtl8169_private *tp,
+                                             struct RxDesc *desc)
+{
+        void *data;
+        dma_addr_t mapping;
+        struct device *d = &tp->pci_dev->dev;
+        struct net_device *dev = tp->dev;
+        int node = dev->dev.parent ? dev_to_node(dev->dev.parent) : -1;
 
-        skb = netdev_alloc_skb(dev, rx_buf_sz + pad);
-        if (!skb)
-                goto err_out;
+        data = kmalloc_node(rx_buf_sz, GFP_KERNEL, node);
+        if (!data)
+                return NULL;
 
-        skb_reserve(skb, align ? ((pad - 1) & (unsigned long)skb->data) : pad);
+        if (rtl8169_align(data) != data) {
+                kfree(data);
+                data = kmalloc_node(rx_buf_sz + 15, GFP_KERNEL, node);
+                if (!data)
+                        return NULL;
+        }
 
-        mapping = pci_map_single(pdev, skb->data, rx_buf_sz,
-                                 PCI_DMA_FROMDEVICE);
+        mapping = dma_map_single(d, rtl8169_align(data), rx_buf_sz,
+                                 DMA_FROM_DEVICE);
+        if (unlikely(dma_mapping_error(d, mapping))) {
+                if (net_ratelimit())
+                        netif_err(tp, drv, tp->dev, "Failed to map RX DMA!\n");
+                goto err_out;
+        }
 
         rtl8169_map_to_asic(desc, mapping, rx_buf_sz);
-out:
-        return skb;
+        return data;
 
 err_out:
-        rtl8169_make_unusable_by_asic(desc);
-        goto out;
+        kfree(data);
+        return NULL;
 }
 
 static void rtl8169_rx_clear(struct rtl8169_private *tp)
@@ -4037,41 +3993,42 @@ static void rtl8169_rx_clear(struct rtl8169_private *tp)
         unsigned int i;
 
         for (i = 0; i < NUM_RX_DESC; i++) {
-                if (tp->Rx_skbuff[i]) {
-                        rtl8169_free_rx_skb(tp, tp->Rx_skbuff + i,
+                if (tp->Rx_databuff[i]) {
+                        rtl8169_free_rx_databuff(tp, tp->Rx_databuff + i,
                                             tp->RxDescArray + i);
                 }
         }
 }
 
-static u32 rtl8169_rx_fill(struct rtl8169_private *tp, struct net_device *dev,
-                           u32 start, u32 end)
+static inline void rtl8169_mark_as_last_descriptor(struct RxDesc *desc)
 {
-        u32 cur;
+        desc->opts1 |= cpu_to_le32(RingEnd);
+}
 
-        for (cur = start; end - cur != 0; cur++) {
-                struct sk_buff *skb;
-                unsigned int i = cur % NUM_RX_DESC;
+static int rtl8169_rx_fill(struct rtl8169_private *tp)
+{
+        unsigned int i;
 
-                WARN_ON((s32)(end - cur) < 0);
+        for (i = 0; i < NUM_RX_DESC; i++) {
+                void *data;
 
-                if (tp->Rx_skbuff[i])
+                if (tp->Rx_databuff[i])
                         continue;
 
-                skb = rtl8169_alloc_rx_skb(tp->pci_dev, dev,
-                                           tp->RxDescArray + i,
-                                           tp->rx_buf_sz, tp->align);
-                if (!skb)
-                        break;
-
-                tp->Rx_skbuff[i] = skb;
+                data = rtl8169_alloc_rx_data(tp, tp->RxDescArray + i);
+                if (!data) {
+                        rtl8169_make_unusable_by_asic(tp->RxDescArray + i);
+                        goto err_out;
+                }
+                tp->Rx_databuff[i] = data;
         }
-        return cur - start;
-}
 
-static inline void rtl8169_mark_as_last_descriptor(struct RxDesc *desc)
-{
-        desc->opts1 |= cpu_to_le32(RingEnd);
+        rtl8169_mark_as_last_descriptor(tp->RxDescArray + NUM_RX_DESC - 1);
+        return 0;
+
+err_out:
+        rtl8169_rx_clear(tp);
+        return -ENOMEM;
 }
 
 static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
@@ -4086,53 +4043,51 @@ static int rtl8169_init_ring(struct net_device *dev)
         rtl8169_init_ring_indexes(tp);
 
         memset(tp->tx_skb, 0x0, NUM_TX_DESC * sizeof(struct ring_info));
-        memset(tp->Rx_skbuff, 0x0, NUM_RX_DESC * sizeof(struct sk_buff *));
-
-        if (rtl8169_rx_fill(tp, dev, 0, NUM_RX_DESC) != NUM_RX_DESC)
-                goto err_out;
-
-        rtl8169_mark_as_last_descriptor(tp->RxDescArray + NUM_RX_DESC - 1);
-
-        return 0;
+        memset(tp->Rx_databuff, 0x0, NUM_RX_DESC * sizeof(void *));
 
-err_out:
-        rtl8169_rx_clear(tp);
-        return -ENOMEM;
+        return rtl8169_rx_fill(tp);
 }
 
-static void rtl8169_unmap_tx_skb(struct pci_dev *pdev, struct ring_info *tx_skb,
+static void rtl8169_unmap_tx_skb(struct device *d, struct ring_info *tx_skb,
                                  struct TxDesc *desc)
 {
         unsigned int len = tx_skb->len;
 
-        pci_unmap_single(pdev, le64_to_cpu(desc->addr), len, PCI_DMA_TODEVICE);
+        dma_unmap_single(d, le64_to_cpu(desc->addr), len, DMA_TO_DEVICE);
+
         desc->opts1 = 0x00;
         desc->opts2 = 0x00;
         desc->addr = 0x00;
         tx_skb->len = 0;
 }
 
-static void rtl8169_tx_clear(struct rtl8169_private *tp)
+static void rtl8169_tx_clear_range(struct rtl8169_private *tp, u32 start,
+                                   unsigned int n)
 {
         unsigned int i;
 
-        for (i = tp->dirty_tx; i < tp->dirty_tx + NUM_TX_DESC; i++) {
-                unsigned int entry = i % NUM_TX_DESC;
+        for (i = 0; i < n; i++) {
+                unsigned int entry = (start + i) % NUM_TX_DESC;
                 struct ring_info *tx_skb = tp->tx_skb + entry;
                 unsigned int len = tx_skb->len;
 
                 if (len) {
                         struct sk_buff *skb = tx_skb->skb;
 
-                        rtl8169_unmap_tx_skb(tp->pci_dev, tx_skb,
+                        rtl8169_unmap_tx_skb(&tp->pci_dev->dev, tx_skb,
                                              tp->TxDescArray + entry);
                         if (skb) {
+                                tp->dev->stats.tx_dropped++;
                                 dev_kfree_skb(skb);
                                 tx_skb->skb = NULL;
                         }
-                        tp->dev->stats.tx_dropped++;
                 }
         }
+}
+
+static void rtl8169_tx_clear(struct rtl8169_private *tp)
+{
+        rtl8169_tx_clear_range(tp, tp->dirty_tx, NUM_TX_DESC);
         tp->cur_tx = tp->dirty_tx = 0;
 }
 
@@ -4236,6 +4191,7 @@ static int rtl8169_xmit_frags(struct rtl8169_private *tp, struct sk_buff *skb,
         struct skb_shared_info *info = skb_shinfo(skb);
         unsigned int cur_frag, entry;
         struct TxDesc * uninitialized_var(txd);
+        struct device *d = &tp->pci_dev->dev;
 
         entry = tp->cur_tx;
         for (cur_frag = 0; cur_frag < info->nr_frags; cur_frag++) {
@@ -4249,7 +4205,13 @@ static int rtl8169_xmit_frags(struct rtl8169_private *tp, struct sk_buff *skb,
                 txd = tp->TxDescArray + entry;
                 len = frag->size;
                 addr = ((void *) page_address(frag->page)) + frag->page_offset;
-                mapping = pci_map_single(tp->pci_dev, addr, len, PCI_DMA_TODEVICE);
+                mapping = dma_map_single(d, addr, len, DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(d, mapping))) {
+                        if (net_ratelimit())
+                                netif_err(tp, drv, tp->dev,
+                                          "Failed to map TX fragments DMA!\n");
+                        goto err_out;
+                }
 
                 /* anti gcc 2.95.3 bugware (sic) */
                 status = opts1 | len | (RingEnd * !((entry + 1) % NUM_TX_DESC));
@@ -4266,6 +4228,10 @@ static int rtl8169_xmit_frags(struct rtl8169_private *tp, struct sk_buff *skb,
         }
 
         return cur_frag;
+
+err_out:
+        rtl8169_tx_clear_range(tp, tp->cur_tx + 1, cur_frag);
+        return -EIO;
 }
 
 static inline u32 rtl8169_tso_csum(struct sk_buff *skb, struct net_device *dev)
@@ -4292,39 +4258,47 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
                                       struct net_device *dev)
 {
         struct rtl8169_private *tp = netdev_priv(dev);
-        unsigned int frags, entry = tp->cur_tx % NUM_TX_DESC;
+        unsigned int entry = tp->cur_tx % NUM_TX_DESC;
         struct TxDesc *txd = tp->TxDescArray + entry;
         void __iomem *ioaddr = tp->mmio_addr;
+        struct device *d = &tp->pci_dev->dev;
         dma_addr_t mapping;
         u32 status, len;
         u32 opts1;
+        int frags;
 
         if (unlikely(TX_BUFFS_AVAIL(tp) < skb_shinfo(skb)->nr_frags)) {
                 netif_err(tp, drv, dev, "BUG! Tx Ring full when queue awake!\n");
-                goto err_stop;
+                goto err_stop_0;
         }
 
         if (unlikely(le32_to_cpu(txd->opts1) & DescOwn))
-                goto err_stop;
+                goto err_stop_0;
+
+        len = skb_headlen(skb);
+        mapping = dma_map_single(d, skb->data, len, DMA_TO_DEVICE);
+        if (unlikely(dma_mapping_error(d, mapping))) {
+                if (net_ratelimit())
+                        netif_err(tp, drv, dev, "Failed to map TX DMA!\n");
+                goto err_dma_0;
+        }
+
+        tp->tx_skb[entry].len = len;
+        txd->addr = cpu_to_le64(mapping);
+        txd->opts2 = cpu_to_le32(rtl8169_tx_vlan_tag(tp, skb));
 
         opts1 = DescOwn | rtl8169_tso_csum(skb, dev);
 
         frags = rtl8169_xmit_frags(tp, skb, opts1);
-        if (frags) {
-                len = skb_headlen(skb);
+        if (frags < 0)
+                goto err_dma_1;
+        else if (frags)
                 opts1 |= FirstFrag;
-        } else {
-                len = skb->len;
+        else {
                 opts1 |= FirstFrag | LastFrag;
                 tp->tx_skb[entry].skb = skb;
         }
 
-        mapping = pci_map_single(tp->pci_dev, skb->data, len, PCI_DMA_TODEVICE);
-
-        tp->tx_skb[entry].len = len;
-        txd->addr = cpu_to_le64(mapping);
-        txd->opts2 = cpu_to_le32(rtl8169_tx_vlan_tag(tp, skb));
-
         wmb();
 
         /* anti gcc 2.95.3 bugware (sic) */
@@ -4346,7 +4320,14 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
 
         return NETDEV_TX_OK;
 
-err_stop:
+err_dma_1:
+        rtl8169_unmap_tx_skb(d, tp->tx_skb + entry, txd);
+err_dma_0:
+        dev_kfree_skb(skb);
+        dev->stats.tx_dropped++;
+        return NETDEV_TX_OK;
+
+err_stop_0:
         netif_stop_queue(dev);
         dev->stats.tx_dropped++;
         return NETDEV_TX_BUSY;
@@ -4411,7 +4392,6 @@ static void rtl8169_tx_interrupt(struct net_device *dev,
         while (tx_left > 0) {
                 unsigned int entry = dirty_tx % NUM_TX_DESC;
                 struct ring_info *tx_skb = tp->tx_skb + entry;
-                u32 len = tx_skb->len;
                 u32 status;
 
                 rmb();
@@ -4419,12 +4399,11 @@ static void rtl8169_tx_interrupt(struct net_device *dev,
                 if (status & DescOwn)
                         break;
 
-                dev->stats.tx_bytes += len;
-                dev->stats.tx_packets++;
-
-                rtl8169_unmap_tx_skb(tp->pci_dev, tx_skb, tp->TxDescArray + entry);
-
+                rtl8169_unmap_tx_skb(&tp->pci_dev->dev, tx_skb,
+                                     tp->TxDescArray + entry);
                 if (status & LastFrag) {
+                        dev->stats.tx_packets++;
+                        dev->stats.tx_bytes += tx_skb->skb->len;
                         dev_kfree_skb(tx_skb->skb);
                         tx_skb->skb = NULL;
                 }
@@ -4468,27 +4447,23 @@ static inline void rtl8169_rx_csum(struct sk_buff *skb, u32 opts1)
                 skb_checksum_none_assert(skb);
 }
 
-static inline bool rtl8169_try_rx_copy(struct sk_buff **sk_buff,
-                                       struct rtl8169_private *tp, int pkt_size,
-                                       dma_addr_t addr)
+static struct sk_buff *rtl8169_try_rx_copy(void *data,
+                                           struct rtl8169_private *tp,
+                                           int pkt_size,
+                                           dma_addr_t addr)
 {
         struct sk_buff *skb;
-        bool done = false;
-
-        if (pkt_size >= rx_copybreak)
-                goto out;
+        struct device *d = &tp->pci_dev->dev;
 
+        data = rtl8169_align(data);
+        dma_sync_single_for_cpu(d, addr, pkt_size, DMA_FROM_DEVICE);
+        prefetch(data);
         skb = netdev_alloc_skb_ip_align(tp->dev, pkt_size);
-        if (!skb)
-                goto out;
+        if (skb)
+                memcpy(skb->data, data, pkt_size);
+        dma_sync_single_for_device(d, addr, pkt_size, DMA_FROM_DEVICE);
 
-        pci_dma_sync_single_for_cpu(tp->pci_dev, addr, pkt_size,
-                                    PCI_DMA_FROMDEVICE);
-        skb_copy_from_linear_data(*sk_buff, skb->data, pkt_size);
-        *sk_buff = skb;
-        done = true;
-out:
-        return done;
+        return skb;
 }
 
 /*
@@ -4503,7 +4478,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                                 void __iomem *ioaddr, u32 budget)
 {
         unsigned int cur_rx, rx_left;
-        unsigned int delta, count;
+        unsigned int count;
         int polling = (budget != ~(u32)0) ? 1 : 0;
 
         cur_rx = tp->cur_rx;
@@ -4532,12 +4507,11 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                                 rtl8169_schedule_work(dev, rtl8169_reset_task);
                                 dev->stats.rx_fifo_errors++;
                         }
-                        rtl8169_mark_to_asic(desc, tp->rx_buf_sz);
+                        rtl8169_mark_to_asic(desc, rx_buf_sz);
                 } else {
-                        struct sk_buff *skb = tp->Rx_skbuff[entry];
+                        struct sk_buff *skb;
                         dma_addr_t addr = le64_to_cpu(desc->addr);
                         int pkt_size = (status & 0x00001FFF) - 4;
-                        struct pci_dev *pdev = tp->pci_dev;
 
                         /*
                          * The driver does not support incoming fragmented
@@ -4547,18 +4521,16 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                         if (unlikely(rtl8169_fragmented_frame(status))) {
                                 dev->stats.rx_dropped++;
                                 dev->stats.rx_length_errors++;
-                                rtl8169_mark_to_asic(desc, tp->rx_buf_sz);
+                                rtl8169_mark_to_asic(desc, rx_buf_sz);
                                 continue;
                         }
 
-                        if (rtl8169_try_rx_copy(&skb, tp, pkt_size, addr)) {
-                                pci_dma_sync_single_for_device(pdev, addr,
-                                        pkt_size, PCI_DMA_FROMDEVICE);
-                                rtl8169_mark_to_asic(desc, tp->rx_buf_sz);
-                        } else {
-                                pci_unmap_single(pdev, addr, tp->rx_buf_sz,
-                                                 PCI_DMA_FROMDEVICE);
-                                tp->Rx_skbuff[entry] = NULL;
+                        skb = rtl8169_try_rx_copy(tp->Rx_databuff[entry],
+                                                  tp, pkt_size, addr);
+                        rtl8169_mark_to_asic(desc, rx_buf_sz);
+                        if (!skb) {
+                                dev->stats.rx_dropped++;
+                                continue;
                         }
 
                         rtl8169_rx_csum(skb, status);
@@ -4587,20 +4559,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
         count = cur_rx - tp->cur_rx;
         tp->cur_rx = cur_rx;
 
-        delta = rtl8169_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx);
-        if (!delta && count)
-                netif_info(tp, intr, dev, "no Rx buffer allocated\n");
-        tp->dirty_rx += delta;
-
-        /*
-         * FIXME: until there is periodic timer to try and refill the ring,
-         * a temporary shortage may definitely kill the Rx process.
-         * - disable the asic to try and avoid an overflow and kick it again
-         *   after refill ?
-         * - how do others driver handle this condition (Uh oh...).
-         */
-        if (tp->dirty_rx + NUM_RX_DESC == tp->cur_rx)
-                netif_emerg(tp, intr, dev, "Rx buffers exhausted\n");
+        tp->dirty_rx += count;
 
         return count;
 }
@@ -4629,8 +4588,7 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
                 }
 
                 /* Work around for rx fifo overflow */
-                if (unlikely(status & RxFIFOOver) &&
-                (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
+                if (unlikely(status & RxFIFOOver)) {
                         netif_stop_queue(dev);
                         rtl8169_tx_timeout(dev);
                         break;
@@ -4716,7 +4674,6 @@ static void rtl8169_down(struct net_device *dev)
 {
         struct rtl8169_private *tp = netdev_priv(dev);
         void __iomem *ioaddr = tp->mmio_addr;
-        unsigned int intrmask;
 
         rtl8169_delete_timer(dev);
 
@@ -4724,11 +4681,14 @@ static void rtl8169_down(struct net_device *dev)
 
         napi_disable(&tp->napi);
 
-core_down:
         spin_lock_irq(&tp->lock);
 
         rtl8169_asic_down(ioaddr);
-
+        /*
+         * At this point device interrupts can not be enabled in any function,
+         * as netif_running is not true (rtl8169_interrupt, rtl8169_reset_task,
+         * rtl8169_reinit_task) and napi is disabled (rtl8169_poll).
+         */
         rtl8169_rx_missed(dev, ioaddr);
 
         spin_unlock_irq(&tp->lock);
@@ -4738,23 +4698,6 @@ core_down:
         /* Give a racing hard_start_xmit a few cycles to complete. */
         synchronize_sched();  /* FIXME: should this be synchronize_irq()? */
 
-        /*
-         * And now for the 50k$ question: are IRQ disabled or not ?
-         *
-         * Two paths lead here:
-         * 1) dev->close
-         *    -> netif_running() is available to sync the current code and the
-         *       IRQ handler. See rtl8169_interrupt for details.
-         * 2) dev->change_mtu
-         *    -> rtl8169_poll can not be issued again and re-enable the
-         *       interruptions. Let's simply issue the IRQ down sequence again.
-         *
-         * No loop if hotpluged or major error (0xffff).
-         */
-        intrmask = RTL_R16(IntrMask);
-        if (intrmask && (intrmask != 0xffff))
-                goto core_down;
-
         rtl8169_tx_clear(tp);
 
         rtl8169_rx_clear(tp);
@@ -4774,10 +4717,10 @@ static int rtl8169_close(struct net_device *dev)
 
         free_irq(dev->irq, dev);
 
-        pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray,
-                            tp->RxPhyAddr);
-        pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray,
-                            tp->TxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
+                          tp->RxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_TX_RING_BYTES, tp->TxDescArray,
+                          tp->TxPhyAddr);
         tp->TxDescArray = NULL;
         tp->RxDescArray = NULL;
 
@@ -4891,6 +4834,9 @@ static int rtl8169_resume(struct device *device)
 {
         struct pci_dev *pdev = to_pci_dev(device);
         struct net_device *dev = pci_get_drvdata(pdev);
+        struct rtl8169_private *tp = netdev_priv(dev);
+
+        rtl8169_init_phy(dev, tp);
 
         if (netif_running(dev))
                 __rtl8169_resume(dev);
@@ -4931,6 +4877,8 @@ static int rtl8169_runtime_resume(struct device *device)
         tp->saved_wolopts = 0;
         spin_unlock_irq(&tp->lock);
 
+        rtl8169_init_phy(dev, tp);
+
         __rtl8169_resume(dev);
 
         return 0;
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 07eb884ff982..44150f2f7bfd 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -384,7 +384,7 @@ static void rionet_remove(struct rio_dev *rdev)
         free_pages((unsigned long)rionet_active, rdev->net->hport->sys_size ?
                                         __ilog2(sizeof(void *)) + 4 : 0);
         unregister_netdev(ndev);
-        kfree(ndev);
+        free_netdev(ndev);
 
         list_for_each_entry_safe(peer, tmp, &rionet_peers, node) {
                 list_del(&peer->node);
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index c70ad515383a..ecc25aab896a 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -4101,7 +4101,7 @@ static netdev_tx_t s2io_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         queue = 0;
-        if (sp->vlgrp && vlan_tx_tag_present(skb))
+        if (vlan_tx_tag_present(skb))
                 vlan_tag = vlan_tx_tag_get(skb);
         if (sp->config.tx_steering_type == TX_DEFAULT_STEERING) {
                 if (skb->protocol == htons(ETH_P_IP)) {
diff --git a/drivers/net/sfc/Makefile b/drivers/net/sfc/Makefile
index 1047b19c60a5..ab31c7124db1 100644
--- a/drivers/net/sfc/Makefile
+++ b/drivers/net/sfc/Makefile
@@ -1,7 +1,8 @@
-sfc-y                   += efx.o nic.o falcon.o siena.o tx.o rx.o \
-                           falcon_gmac.o falcon_xmac.o mcdi_mac.o \
+sfc-y                   += efx.o nic.o falcon.o siena.o tx.o rx.o filter.o \
+                           falcon_xmac.o mcdi_mac.o \
                            selftest.o ethtool.o qt202x_phy.o mdio_10g.o \
-                           tenxpress.o falcon_boards.o mcdi.o mcdi_phy.o
+                           tenxpress.o txc43128_phy.o falcon_boards.o \
+                           mcdi.o mcdi_phy.o
 sfc-$(CONFIG_SFC_MTD)   += mtd.o
 
 obj-$(CONFIG_SFC)       += sfc.o
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index f702f1fb63b6..05df20e47976 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -68,14 +68,6 @@ const char *efx_loopback_mode_names[] = {
         [LOOPBACK_PHYXS_WS]     = "PHYXS_WS",
 };
 
-/* Interrupt mode names (see INT_MODE())) */
-const unsigned int efx_interrupt_mode_max = EFX_INT_MODE_MAX;
-const char *efx_interrupt_mode_names[] = {
-        [EFX_INT_MODE_MSIX]   = "MSI-X",
-        [EFX_INT_MODE_MSI]    = "MSI",
-        [EFX_INT_MODE_LEGACY] = "legacy",
-};
-
 const unsigned int efx_reset_type_max = RESET_TYPE_MAX;
 const char *efx_reset_type_names[] = {
         [RESET_TYPE_INVISIBLE]     = "INVISIBLE",
@@ -124,10 +116,11 @@ MODULE_PARM_DESC(separate_tx_channels,
 static int napi_weight = 64;
 
 /* This is the time (in jiffies) between invocations of the hardware
- * monitor, which checks for known hardware bugs and resets the
- * hardware and driver as necessary.
+ * monitor.  On Falcon-based NICs, this will:
+ * - Check the on-board hardware monitor;
+ * - Poll the link state and reconfigure the hardware as necessary.
  */
-unsigned int efx_monitor_interval = 1 * HZ;
+static unsigned int efx_monitor_interval = 1 * HZ;
 
 /* This controls whether or not the driver will initialise devices
  * with invalid MAC addresses stored in the EEPROM or flash.  If true,
@@ -1314,7 +1307,8 @@ static int efx_probe_nic(struct efx_nic *efx)
                 efx->rx_indir_table[i] = i % efx->n_rx_channels;
 
         efx_set_channels(efx);
-        efx->net_dev->real_num_tx_queues = efx->n_tx_channels;
+        netif_set_real_num_tx_queues(efx->net_dev, efx->n_tx_channels);
+        netif_set_real_num_rx_queues(efx->net_dev, efx->n_rx_channels);
 
         /* Initialise the interrupt moderation settings */
         efx_init_irq_moderation(efx, tx_irq_mod_usec, rx_irq_mod_usec, true);
@@ -1357,8 +1351,17 @@ static int efx_probe_all(struct efx_nic *efx)
         if (rc)
                 goto fail3;
 
+        rc = efx_probe_filters(efx);
+        if (rc) {
+                netif_err(efx, probe, efx->net_dev,
+                          "failed to create filter tables\n");
+                goto fail4;
+        }
+
         return 0;
 
+ fail4:
+        efx_remove_channels(efx);
  fail3:
         efx_remove_port(efx);
  fail2:
@@ -1489,6 +1492,7 @@ static void efx_stop_all(struct efx_nic *efx)
 
 static void efx_remove_all(struct efx_nic *efx)
 {
+        efx_remove_filters(efx);
         efx_remove_channels(efx);
         efx_remove_port(efx);
         efx_remove_nic(efx);
@@ -1535,8 +1539,7 @@ void efx_init_irq_moderation(struct efx_nic *efx, int tx_usecs, int rx_usecs,
  *
  **************************************************************************/
 
-/* Run periodically off the general workqueue. Serialised against
- * efx_reconfigure_port via the mac_lock */
+/* Run periodically off the general workqueue */
 static void efx_monitor(struct work_struct *data)
 {
         struct efx_nic *efx = container_of(data, struct efx_nic,
@@ -1549,16 +1552,13 @@ static void efx_monitor(struct work_struct *data)
 
         /* If the mac_lock is already held then it is likely a port
          * reconfiguration is already in place, which will likely do
-         * most of the work of check_hw() anyway. */
-        if (!mutex_trylock(&efx->mac_lock))
-                goto out_requeue;
-        if (!efx->port_enabled)
-                goto out_unlock;
-        efx->type->monitor(efx);
+         * most of the work of monitor() anyway. */
+        if (mutex_trylock(&efx->mac_lock)) {
+                if (efx->port_enabled)
+                        efx->type->monitor(efx);
+                mutex_unlock(&efx->mac_lock);
+        }
 
-out_unlock:
-        mutex_unlock(&efx->mac_lock);
-out_requeue:
         queue_delayed_work(efx->workqueue, &efx->monitor_work,
                            efx_monitor_interval);
 }
@@ -2002,6 +2002,7 @@ int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok)
         efx->mac_op->reconfigure(efx);
 
         efx_init_channels(efx);
+        efx_restore_filters(efx);
 
         mutex_unlock(&efx->spi_lock);
         mutex_unlock(&efx->mac_lock);
@@ -2171,10 +2172,8 @@ int efx_port_dummy_op_int(struct efx_nic *efx)
         return 0;
 }
 void efx_port_dummy_op_void(struct efx_nic *efx) {}
-void efx_port_dummy_op_set_id_led(struct efx_nic *efx, enum efx_led_mode mode)
-{
-}
-bool efx_port_dummy_op_poll(struct efx_nic *efx)
+
+static bool efx_port_dummy_op_poll(struct efx_nic *efx)
 {
         return false;
 }
diff --git a/drivers/net/sfc/efx.h b/drivers/net/sfc/efx.h
index e783c0fedfd8..10a1bf40da96 100644
--- a/drivers/net/sfc/efx.h
+++ b/drivers/net/sfc/efx.h
@@ -12,6 +12,7 @@
 #define EFX_EFX_H
 
 #include "net_driver.h"
+#include "filter.h"
 
 /* PCI IDs */
 #define EFX_VENDID_SFC          0x1924
@@ -64,6 +65,19 @@ extern void efx_schedule_slow_fill(struct efx_rx_queue *rx_queue);
  * skb. Falcon/A1 may require up to three descriptors per skb_frag. */
 #define EFX_MIN_RING_SIZE (roundup_pow_of_two(2 * 3 * MAX_SKB_FRAGS))
 
+/* Filters */
+extern int efx_probe_filters(struct efx_nic *efx);
+extern void efx_restore_filters(struct efx_nic *efx);
+extern void efx_remove_filters(struct efx_nic *efx);
+extern int efx_filter_insert_filter(struct efx_nic *efx,
+                                    struct efx_filter_spec *spec,
+                                    bool replace);
+extern int efx_filter_remove_filter(struct efx_nic *efx,
+                                    struct efx_filter_spec *spec);
+extern void efx_filter_table_clear(struct efx_nic *efx,
+                                   enum efx_filter_table_id table_id,
+                                   enum efx_filter_priority priority);
+
 /* Channels */
 extern void efx_process_channel_now(struct efx_channel *channel);
 extern int
@@ -74,10 +88,6 @@ extern int efx_reconfigure_port(struct efx_nic *efx);
 extern int __efx_reconfigure_port(struct efx_nic *efx);
 
 /* Ethtool support */
-extern int efx_ethtool_get_settings(struct net_device *net_dev,
-                                    struct ethtool_cmd *ecmd);
-extern int efx_ethtool_set_settings(struct net_device *net_dev,
-                                    struct ethtool_cmd *ecmd);
 extern const struct ethtool_ops efx_ethtool_ops;
 
 /* Reset handling */
@@ -93,9 +103,7 @@ extern void efx_init_irq_moderation(struct efx_nic *efx, int tx_usecs,
 /* Dummy PHY ops for PHY drivers */
 extern int efx_port_dummy_op_int(struct efx_nic *efx);
 extern void efx_port_dummy_op_void(struct efx_nic *efx);
-extern void
-efx_port_dummy_op_set_id_led(struct efx_nic *efx, enum efx_led_mode mode);
-extern bool efx_port_dummy_op_poll(struct efx_nic *efx);
+
 
 /* MTD */
 #ifdef CONFIG_SFC_MTD
@@ -108,8 +116,6 @@ static inline void efx_mtd_rename(struct efx_nic *efx) {}
 static inline void efx_mtd_remove(struct efx_nic *efx) {}
 #endif
 
-extern unsigned int efx_monitor_interval;
-
 static inline void efx_schedule_channel(struct efx_channel *channel)
 {
         netif_vdbg(channel->efx, intr, channel->efx->net_dev,
diff --git a/drivers/net/sfc/ethtool.c b/drivers/net/sfc/ethtool.c
index 7f735d804801..edb9d16b8b47 100644
--- a/drivers/net/sfc/ethtool.c
+++ b/drivers/net/sfc/ethtool.c
@@ -15,6 +15,7 @@
 #include "workarounds.h"
 #include "selftest.h"
 #include "efx.h"
+#include "filter.h"
 #include "nic.h"
 #include "spi.h"
 #include "mdio_10g.h"
@@ -186,8 +187,8 @@ static int efx_ethtool_phys_id(struct net_device *net_dev, u32 count)
 }
 
 /* This must be called with rtnl_lock held. */
-int efx_ethtool_get_settings(struct net_device *net_dev,
-                             struct ethtool_cmd *ecmd)
+static int efx_ethtool_get_settings(struct net_device *net_dev,
+                                    struct ethtool_cmd *ecmd)
 {
         struct efx_nic *efx = netdev_priv(net_dev);
         struct efx_link_state *link_state = &efx->link_state;
@@ -210,8 +211,8 @@ int efx_ethtool_get_settings(struct net_device *net_dev,
 }
 
 /* This must be called with rtnl_lock held. */
-int efx_ethtool_set_settings(struct net_device *net_dev,
-                             struct ethtool_cmd *ecmd)
+static int efx_ethtool_set_settings(struct net_device *net_dev,
+                                    struct ethtool_cmd *ecmd)
 {
         struct efx_nic *efx = netdev_priv(net_dev);
         int rc;
@@ -551,9 +552,22 @@ static u32 efx_ethtool_get_rx_csum(struct net_device *net_dev)
 static int efx_ethtool_set_flags(struct net_device *net_dev, u32 data)
 {
         struct efx_nic *efx = netdev_priv(net_dev);
-        u32 supported = efx->type->offload_features & ETH_FLAG_RXHASH;
+        u32 supported = (efx->type->offload_features &
+                         (ETH_FLAG_RXHASH | ETH_FLAG_NTUPLE));
+        int rc;
+
+        rc = ethtool_op_set_flags(net_dev, data, supported);
+        if (rc)
+                return rc;
+
+        if (!(data & ETH_FLAG_NTUPLE)) {
+                efx_filter_table_clear(efx, EFX_FILTER_TABLE_RX_IP,
+                                       EFX_FILTER_PRI_MANUAL);
+                efx_filter_table_clear(efx, EFX_FILTER_TABLE_RX_MAC,
+                                       EFX_FILTER_PRI_MANUAL);
+        }
 
-        return ethtool_op_set_flags(net_dev, data, supported);
+        return 0;
 }
 
 static void efx_ethtool_self_test(struct net_device *net_dev,
@@ -877,7 +891,7 @@ static int efx_ethtool_set_wol(struct net_device *net_dev,
         return efx->type->set_wol(efx, wol->wolopts);
 }
 
-extern int efx_ethtool_reset(struct net_device *net_dev, u32 *flags)
+static int efx_ethtool_reset(struct net_device *net_dev, u32 *flags)
 {
         struct efx_nic *efx = netdev_priv(net_dev);
         enum reset_type method;
@@ -955,6 +969,105 @@ efx_ethtool_get_rxnfc(struct net_device *net_dev,
         }
 }
 
+static int efx_ethtool_set_rx_ntuple(struct net_device *net_dev,
+                                     struct ethtool_rx_ntuple *ntuple)
+{
+        struct efx_nic *efx = netdev_priv(net_dev);
+        struct ethtool_tcpip4_spec *ip_entry = &ntuple->fs.h_u.tcp_ip4_spec;
+        struct ethtool_tcpip4_spec *ip_mask = &ntuple->fs.m_u.tcp_ip4_spec;
+        struct ethhdr *mac_entry = &ntuple->fs.h_u.ether_spec;
+        struct ethhdr *mac_mask = &ntuple->fs.m_u.ether_spec;
+        struct efx_filter_spec filter;
+
+        /* Range-check action */
+        if (ntuple->fs.action < ETHTOOL_RXNTUPLE_ACTION_CLEAR ||
+            ntuple->fs.action >= (s32)efx->n_rx_channels)
+                return -EINVAL;
+
+        if (~ntuple->fs.data_mask)
+                return -EINVAL;
+
+        switch (ntuple->fs.flow_type) {
+        case TCP_V4_FLOW:
+        case UDP_V4_FLOW:
+                /* Must match all of destination, */
+                if (ip_mask->ip4dst | ip_mask->pdst)
+                        return -EINVAL;
+                /* all or none of source, */
+                if ((ip_mask->ip4src | ip_mask->psrc) &&
+                    ((__force u32)~ip_mask->ip4src |
+                     (__force u16)~ip_mask->psrc))
+                        return -EINVAL;
+                /* and nothing else */
+                if ((u8)~ip_mask->tos | (u16)~ntuple->fs.vlan_tag_mask)
+                        return -EINVAL;
+                break;
+        case ETHER_FLOW:
+                /* Must match all of destination, */
+                if (!is_zero_ether_addr(mac_mask->h_dest))
+                        return -EINVAL;
+                /* all or none of VID, */
+                if (ntuple->fs.vlan_tag_mask != 0xf000 &&
+                    ntuple->fs.vlan_tag_mask != 0xffff)
+                        return -EINVAL;
+                /* and nothing else */
+                if (!is_broadcast_ether_addr(mac_mask->h_source) ||
+                    mac_mask->h_proto != htons(0xffff))
+                        return -EINVAL;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        filter.priority = EFX_FILTER_PRI_MANUAL;
+        filter.flags = 0;
+
+        switch (ntuple->fs.flow_type) {
+        case TCP_V4_FLOW:
+                if (!ip_mask->ip4src)
+                        efx_filter_set_rx_tcp_full(&filter,
+                                                   htonl(ip_entry->ip4src),
+                                                   htons(ip_entry->psrc),
+                                                   htonl(ip_entry->ip4dst),
+                                                   htons(ip_entry->pdst));
+                else
+                        efx_filter_set_rx_tcp_wild(&filter,
+                                                   htonl(ip_entry->ip4dst),
+                                                   htons(ip_entry->pdst));
+                break;
+        case UDP_V4_FLOW:
+                if (!ip_mask->ip4src)
+                        efx_filter_set_rx_udp_full(&filter,
+                                                   htonl(ip_entry->ip4src),
+                                                   htons(ip_entry->psrc),
+                                                   htonl(ip_entry->ip4dst),
+                                                   htons(ip_entry->pdst));
+                else
+                        efx_filter_set_rx_udp_wild(&filter,
+                                                   htonl(ip_entry->ip4dst),
+                                                   htons(ip_entry->pdst));
+                break;
+        case ETHER_FLOW:
+                if (ntuple->fs.vlan_tag_mask == 0xf000)
+                        efx_filter_set_rx_mac_full(&filter,
+                                                   ntuple->fs.vlan_tag & 0xfff,
+                                                   mac_entry->h_dest);
+                else
+                        efx_filter_set_rx_mac_wild(&filter, mac_entry->h_dest);
+                break;
+        }
+
+        if (ntuple->fs.action == ETHTOOL_RXNTUPLE_ACTION_CLEAR) {
+                return efx_filter_remove_filter(efx, &filter);
+        } else {
+                if (ntuple->fs.action == ETHTOOL_RXNTUPLE_ACTION_DROP)
+                        filter.dmaq_id = 0xfff;
+                else
+                        filter.dmaq_id = ntuple->fs.action;
+                return efx_filter_insert_filter(efx, &filter, true);
+        }
+}
+
 static int efx_ethtool_get_rxfh_indir(struct net_device *net_dev,
                                       struct ethtool_rxfh_indir *indir)
 {
@@ -1033,6 +1146,7 @@ const struct ethtool_ops efx_ethtool_ops = {
         .set_wol                = efx_ethtool_set_wol,
         .reset                  = efx_ethtool_reset,
         .get_rxnfc              = efx_ethtool_get_rxnfc,
+        .set_rx_ntuple          = efx_ethtool_set_rx_ntuple,
         .get_rxfh_indir         = efx_ethtool_get_rxfh_indir,
         .set_rxfh_indir         = efx_ethtool_set_rxfh_indir,
 };
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index b4d8efe67772..267019bb2b15 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -446,30 +446,19 @@ static void falcon_reset_macs(struct efx_nic *efx)
                 /* It's not safe to use GLB_CTL_REG to reset the
                  * macs, so instead use the internal MAC resets
                  */
-                if (!EFX_IS10G(efx)) {
-                        EFX_POPULATE_OWORD_1(reg, FRF_AB_GM_SW_RST, 1);
-                        efx_writeo(efx, &reg, FR_AB_GM_CFG1);
-                        udelay(1000);
-
-                        EFX_POPULATE_OWORD_1(reg, FRF_AB_GM_SW_RST, 0);
-                        efx_writeo(efx, &reg, FR_AB_GM_CFG1);
-                        udelay(1000);
-                        return;
-                } else {
-                        EFX_POPULATE_OWORD_1(reg, FRF_AB_XM_CORE_RST, 1);
-                        efx_writeo(efx, &reg, FR_AB_XM_GLB_CFG);
-
-                        for (count = 0; count < 10000; count++) {
-                                efx_reado(efx, &reg, FR_AB_XM_GLB_CFG);
-                                if (EFX_OWORD_FIELD(reg, FRF_AB_XM_CORE_RST) ==
-                                    0)
-                                        return;
-                                udelay(10);
-                        }
-
-                        netif_err(efx, hw, efx->net_dev,
-                                  "timed out waiting for XMAC core reset\n");
+                EFX_POPULATE_OWORD_1(reg, FRF_AB_XM_CORE_RST, 1);
+                efx_writeo(efx, &reg, FR_AB_XM_GLB_CFG);
+
+                for (count = 0; count < 10000; count++) {
+                        efx_reado(efx, &reg, FR_AB_XM_GLB_CFG);
+                        if (EFX_OWORD_FIELD(reg, FRF_AB_XM_CORE_RST) ==
+                            0)
+                                return;
+                        udelay(10);
                 }
+
+                netif_err(efx, hw, efx->net_dev,
+                          "timed out waiting for XMAC core reset\n");
         }
 
         /* Mac stats will fail whist the TX fifo is draining */
@@ -508,7 +497,6 @@ static void falcon_reset_macs(struct efx_nic *efx)
          * are re-enabled by the caller */
         efx_writeo(efx, &mac_ctrl, FR_AB_MAC_CTRL);
 
-        /* This can run even when the GMAC is selected */
         falcon_setup_xaui(efx);
 }
 
@@ -646,8 +634,6 @@ static void falcon_stats_timer_func(unsigned long context)
         spin_unlock(&efx->stats_lock);
 }
 
-static void falcon_switch_mac(struct efx_nic *efx);
-
 static bool falcon_loopback_link_poll(struct efx_nic *efx)
 {
         struct efx_link_state old_state = efx->link_state;
@@ -658,11 +644,7 @@ static bool falcon_loopback_link_poll(struct efx_nic *efx)
         efx->link_state.fd = true;
         efx->link_state.fc = efx->wanted_fc;
         efx->link_state.up = true;
-
-        if (efx->loopback_mode == LOOPBACK_GMAC)
-                efx->link_state.speed = 1000;
-        else
-                efx->link_state.speed = 10000;
+        efx->link_state.speed = 10000;
 
         return !efx_link_state_equal(&efx->link_state, &old_state);
 }
@@ -685,7 +667,7 @@ static int falcon_reconfigure_port(struct efx_nic *efx)
         falcon_stop_nic_stats(efx);
         falcon_deconfigure_mac_wrapper(efx);
 
-        falcon_switch_mac(efx);
+        falcon_reset_macs(efx);
 
         efx->phy_op->reconfigure(efx);
         rc = efx->mac_op->reconfigure(efx);
@@ -835,73 +817,23 @@ out:
         return rc;
 }
 
-static void falcon_clock_mac(struct efx_nic *efx)
-{
-        unsigned strap_val;
-        efx_oword_t nic_stat;
-
-        /* Configure the NIC generated MAC clock correctly */
-        efx_reado(efx, &nic_stat, FR_AB_NIC_STAT);
-        strap_val = EFX_IS10G(efx) ? 5 : 3;
-        if (efx_nic_rev(efx) >= EFX_REV_FALCON_B0) {
-                EFX_SET_OWORD_FIELD(nic_stat, FRF_BB_EE_STRAP_EN, 1);
-                EFX_SET_OWORD_FIELD(nic_stat, FRF_BB_EE_STRAP, strap_val);
-                efx_writeo(efx, &nic_stat, FR_AB_NIC_STAT);
-        } else {
-                /* Falcon A1 does not support 1G/10G speed switching
-                 * and must not be used with a PHY that does. */
-                BUG_ON(EFX_OWORD_FIELD(nic_stat, FRF_AB_STRAP_PINS) !=
-                       strap_val);
-        }
-}
-
-static void falcon_switch_mac(struct efx_nic *efx)
-{
-        struct efx_mac_operations *old_mac_op = efx->mac_op;
-        struct falcon_nic_data *nic_data = efx->nic_data;
-        unsigned int stats_done_offset;
-
-        WARN_ON(!mutex_is_locked(&efx->mac_lock));
-        WARN_ON(nic_data->stats_disable_count == 0);
-
-        efx->mac_op = (EFX_IS10G(efx) ?
-                       &falcon_xmac_operations : &falcon_gmac_operations);
-
-        if (EFX_IS10G(efx))
-                stats_done_offset = XgDmaDone_offset;
-        else
-                stats_done_offset = GDmaDone_offset;
-        nic_data->stats_dma_done = efx->stats_buffer.addr + stats_done_offset;
-
-        if (old_mac_op == efx->mac_op)
-                return;
-
-        falcon_clock_mac(efx);
-
-        netif_dbg(efx, hw, efx->net_dev, "selected %cMAC\n",
-                  EFX_IS10G(efx) ? 'X' : 'G');
-        /* Not all macs support a mac-level link state */
-        efx->xmac_poll_required = false;
-        falcon_reset_macs(efx);
-}
-
 /* This call is responsible for hooking in the MAC and PHY operations */
 static int falcon_probe_port(struct efx_nic *efx)
 {
+        struct falcon_nic_data *nic_data = efx->nic_data;
         int rc;
 
         switch (efx->phy_type) {
         case PHY_TYPE_SFX7101:
                 efx->phy_op = &falcon_sfx7101_phy_ops;
                 break;
-        case PHY_TYPE_SFT9001A:
-        case PHY_TYPE_SFT9001B:
-                efx->phy_op = &falcon_sft9001_phy_ops;
-                break;
         case PHY_TYPE_QT2022C2:
         case PHY_TYPE_QT2025C:
                 efx->phy_op = &falcon_qt202x_phy_ops;
                 break;
+        case PHY_TYPE_TXC43128:
+                efx->phy_op = &falcon_txc_phy_ops;
+                break;
         default:
                 netif_err(efx, probe, efx->net_dev, "Unknown PHY type %d\n",
                           efx->phy_type);
@@ -937,6 +869,7 @@ static int falcon_probe_port(struct efx_nic *efx)
                   (u64)efx->stats_buffer.dma_addr,
                   efx->stats_buffer.addr,
                   (u64)virt_to_phys(efx->stats_buffer.addr));
+        nic_data->stats_dma_done = efx->stats_buffer.addr + XgDmaDone_offset;
 
         return 0;
 }
@@ -1201,7 +1134,7 @@ static void falcon_monitor(struct efx_nic *efx)
                 falcon_stop_nic_stats(efx);
                 falcon_deconfigure_mac_wrapper(efx);
 
-                falcon_switch_mac(efx);
+                falcon_reset_macs(efx);
                 rc = efx->mac_op->reconfigure(efx);
                 BUG_ON(rc);
 
@@ -1210,8 +1143,7 @@ static void falcon_monitor(struct efx_nic *efx)
                 efx_link_status_changed(efx);
         }
 
-        if (EFX_IS10G(efx))
-                falcon_poll_xmac(efx);
+        falcon_poll_xmac(efx);
 }
 
 /* Zeroes out the SRAM contents.  This routine must be called in
@@ -1604,16 +1536,6 @@ static int falcon_init_nic(struct efx_nic *efx)
         EFX_SET_OWORD_FIELD(temp, FRF_AB_ONCHIP_SRAM, 1);
         efx_writeo(efx, &temp, FR_AB_NIC_STAT);
 
-        /* Set the source of the GMAC clock */
-        if (efx_nic_rev(efx) == EFX_REV_FALCON_B0) {
-                efx_reado(efx, &temp, FR_AB_GPIO_CTL);
-                EFX_SET_OWORD_FIELD(temp, FRF_AB_USE_NIC_CLK, true);
-                efx_writeo(efx, &temp, FR_AB_GPIO_CTL);
-        }
-
-        /* Select the correct MAC */
-        falcon_clock_mac(efx);
-
         rc = falcon_reset_sram(efx);
         if (rc)
                 return rc;
@@ -1874,7 +1796,7 @@ struct efx_nic_type falcon_b0_nic_type = {
                                    * channels */
         .tx_dc_base = 0x130000,
         .rx_dc_base = 0x100000,
-        .offload_features = NETIF_F_IP_CSUM | NETIF_F_RXHASH,
+        .offload_features = NETIF_F_IP_CSUM | NETIF_F_RXHASH | NETIF_F_NTUPLE,
         .reset_world_flags = ETH_RESET_IRQ,
 };
 
diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
index 3d950c2cf205..cfc6a5b5a477 100644
--- a/drivers/net/sfc/falcon_boards.c
+++ b/drivers/net/sfc/falcon_boards.c
@@ -26,7 +26,7 @@
 /* Board types */
 #define FALCON_BOARD_SFE4001 0x01
 #define FALCON_BOARD_SFE4002 0x02
-#define FALCON_BOARD_SFN4111T 0x51
+#define FALCON_BOARD_SFE4003 0x03
 #define FALCON_BOARD_SFN4112F 0x52
 
 /* Board temperature is about 15°C above ambient when air flow is
@@ -142,17 +142,17 @@ static inline int efx_check_lm87(struct efx_nic *efx, unsigned mask)
 #endif /* CONFIG_SENSORS_LM87 */
 
 /*****************************************************************************
- * Support for the SFE4001 and SFN4111T NICs.
+ * Support for the SFE4001 NIC.
  *
  * The SFE4001 does not power-up fully at reset due to its high power
  * consumption.  We control its power via a PCA9539 I/O expander.
- * Both boards have a MAX6647 temperature monitor which we expose to
+ * It also has a MAX6647 temperature monitor which we expose to
  * the lm90 driver.
  *
  * This also provides minimal support for reflashing the PHY, which is
  * initiated by resetting it with the FLASH_CFG_1 pin pulled down.
  * On SFE4001 rev A2 and later this is connected to the 3V3X output of
- * the IO-expander; on the SFN4111T it is connected to Falcon's GPIO3.
+ * the IO-expander.
  * We represent reflash mode as PHY_MODE_SPECIAL and make it mutually
  * exclusive with the network device being open.
  */
@@ -304,34 +304,6 @@ fail_on:
         return rc;
 }
 
-static int sfn4111t_reset(struct efx_nic *efx)
-{
-        struct falcon_board *board = falcon_board(efx);
-        efx_oword_t reg;
-
-        /* GPIO 3 and the GPIO register are shared with I2C, so block that */
-        i2c_lock_adapter(&board->i2c_adap);
-
-        /* Pull RST_N (GPIO 2) low then let it up again, setting the
-         * FLASH_CFG_1 strap (GPIO 3) appropriately.  Only change the
-         * output enables; the output levels should always be 0 (low)
-         * and we rely on external pull-ups. */
-        efx_reado(efx, &reg, FR_AB_GPIO_CTL);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GPIO2_OEN, true);
-        efx_writeo(efx, &reg, FR_AB_GPIO_CTL);
-        msleep(1000);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GPIO2_OEN, false);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GPIO3_OEN,
-                            !!(efx->phy_mode & PHY_MODE_SPECIAL));
-        efx_writeo(efx, &reg, FR_AB_GPIO_CTL);
-        msleep(1);
-
-        i2c_unlock_adapter(&board->i2c_adap);
-
-        ssleep(1);
-        return 0;
-}
-
 static ssize_t show_phy_flash_cfg(struct device *dev,
                                   struct device_attribute *attr, char *buf)
 {
@@ -363,10 +335,7 @@ static ssize_t set_phy_flash_cfg(struct device *dev,
                 efx->phy_mode = new_mode;
                 if (new_mode & PHY_MODE_SPECIAL)
                         falcon_stop_nic_stats(efx);
-                if (falcon_board(efx)->type->id == FALCON_BOARD_SFE4001)
-                        err = sfe4001_poweron(efx);
-                else
-                        err = sfn4111t_reset(efx);
+                err = sfe4001_poweron(efx);
                 if (!err)
                         err = efx_reconfigure_port(efx);
                 if (!(new_mode & PHY_MODE_SPECIAL))
@@ -479,83 +448,6 @@ fail_hwmon:
         return rc;
 }
 
-static int sfn4111t_check_hw(struct efx_nic *efx)
-{
-        s32 status;
-
-        /* If XAUI link is up then do not monitor */
-        if (EFX_WORKAROUND_7884(efx) && !efx->xmac_poll_required)
-                return 0;
-
-        /* Test LHIGH, RHIGH, FAULT, EOT and IOT alarms */
-        status = i2c_smbus_read_byte_data(falcon_board(efx)->hwmon_client,
-                                          MAX664X_REG_RSL);
-        if (status < 0)
-                return -EIO;
-        if (status & 0x57)
-                return -ERANGE;
-        return 0;
-}
-
-static void sfn4111t_fini(struct efx_nic *efx)
-{
-        netif_info(efx, drv, efx->net_dev, "%s\n", __func__);
-
-        device_remove_file(&efx->pci_dev->dev, &dev_attr_phy_flash_cfg);
-        i2c_unregister_device(falcon_board(efx)->hwmon_client);
-}
-
-static struct i2c_board_info sfn4111t_a0_hwmon_info = {
-        I2C_BOARD_INFO("max6647", 0x4e),
-};
-
-static struct i2c_board_info sfn4111t_r5_hwmon_info = {
-        I2C_BOARD_INFO("max6646", 0x4d),
-};
-
-static void sfn4111t_init_phy(struct efx_nic *efx)
-{
-        if (!(efx->phy_mode & PHY_MODE_SPECIAL)) {
-                if (sft9001_wait_boot(efx) != -EINVAL)
-                        return;
-
-                efx->phy_mode = PHY_MODE_SPECIAL;
-                falcon_stop_nic_stats(efx);
-        }
-
-        sfn4111t_reset(efx);
-        sft9001_wait_boot(efx);
-}
-
-static int sfn4111t_init(struct efx_nic *efx)
-{
-        struct falcon_board *board = falcon_board(efx);
-        int rc;
-
-        board->hwmon_client =
-                i2c_new_device(&board->i2c_adap,
-                               (board->minor < 5) ?
-                               &sfn4111t_a0_hwmon_info :
-                               &sfn4111t_r5_hwmon_info);
-        if (!board->hwmon_client)
-                return -EIO;
-
-        rc = device_create_file(&efx->pci_dev->dev, &dev_attr_phy_flash_cfg);
-        if (rc)
-                goto fail_hwmon;
-
-        if (efx->phy_mode & PHY_MODE_SPECIAL)
-                /* PHY may not generate a 156.25 MHz clock and MAC
-                 * stats fetch will fail. */
-                falcon_stop_nic_stats(efx);
-
-        return 0;
-
-fail_hwmon:
-        i2c_unregister_device(board->hwmon_client);
-        return rc;
-}
-
 /*****************************************************************************
  * Support for the SFE4002
  *
@@ -691,6 +583,75 @@ static int sfn4112f_init(struct efx_nic *efx)
         return efx_init_lm87(efx, &sfn4112f_hwmon_info, sfn4112f_lm87_regs);
 }
 
+/*****************************************************************************
+ * Support for the SFE4003
+ *
+ */
+static u8 sfe4003_lm87_channel = 0x03; /* use AIN not FAN inputs */
+
+static const u8 sfe4003_lm87_regs[] = {
+        LM87_IN_LIMITS(0, 0x67, 0x7f),          /* 2.5V:  1.5V +/- 10% */
+        LM87_IN_LIMITS(1, 0x4c, 0x5e),          /* Vccp1: 1.2V +/- 10% */
+        LM87_IN_LIMITS(2, 0xac, 0xd4),          /* 3.3V:  3.3V +/- 10% */
+        LM87_IN_LIMITS(4, 0xac, 0xe0),          /* 12V:   10.8-14V */
+        LM87_IN_LIMITS(5, 0x3f, 0x4f),          /* Vccp2: 1.0V +/- 10% */
+        LM87_TEMP_INT_LIMITS(0, 70 + FALCON_BOARD_TEMP_BIAS),
+        0
+};
+
+static struct i2c_board_info sfe4003_hwmon_info = {
+        I2C_BOARD_INFO("lm87", 0x2e),
+        .platform_data  = &sfe4003_lm87_channel,
+};
+
+/* Board-specific LED info. */
+#define SFE4003_RED_LED_GPIO    11
+#define SFE4003_LED_ON          1
+#define SFE4003_LED_OFF         0
+
+static void sfe4003_set_id_led(struct efx_nic *efx, enum efx_led_mode mode)
+{
+        struct falcon_board *board = falcon_board(efx);
+
+        /* The LEDs were not wired to GPIOs before A3 */
+        if (board->minor < 3 && board->major == 0)
+                return;
+
+        falcon_txc_set_gpio_val(
+                efx, SFE4003_RED_LED_GPIO,
+                (mode == EFX_LED_ON) ? SFE4003_LED_ON : SFE4003_LED_OFF);
+}
+
+static void sfe4003_init_phy(struct efx_nic *efx)
+{
+        struct falcon_board *board = falcon_board(efx);
+
+        /* The LEDs were not wired to GPIOs before A3 */
+        if (board->minor < 3 && board->major == 0)
+                return;
+
+        falcon_txc_set_gpio_dir(efx, SFE4003_RED_LED_GPIO, TXC_GPIO_DIR_OUTPUT);
+        falcon_txc_set_gpio_val(efx, SFE4003_RED_LED_GPIO, SFE4003_LED_OFF);
+}
+
+static int sfe4003_check_hw(struct efx_nic *efx)
+{
+        struct falcon_board *board = falcon_board(efx);
+
+        /* A0/A1/A2 board rev. 4003s  report a temperature fault the whole time
+         * (bad sensor) so we mask it out. */
+        unsigned alarm_mask =
+                (board->major == 0 && board->minor <= 2) ?
+                ~LM87_ALARM_TEMP_EXT1 : ~0;
+
+        return efx_check_lm87(efx, alarm_mask);
+}
+
+static int sfe4003_init(struct efx_nic *efx)
+{
+        return efx_init_lm87(efx, &sfe4003_hwmon_info, sfe4003_lm87_regs);
+}
+
 static const struct falcon_board_type board_types[] = {
         {
                 .id             = FALCON_BOARD_SFE4001,
@@ -713,14 +674,14 @@ static const struct falcon_board_type board_types[] = {
                 .monitor        = sfe4002_check_hw,
         },
         {
-                .id             = FALCON_BOARD_SFN4111T,
-                .ref_model      = "SFN4111T",
-                .gen_type       = "100/1000/10GBASE-T adapter",
-                .init           = sfn4111t_init,
-                .init_phy       = sfn4111t_init_phy,
-                .fini           = sfn4111t_fini,
-                .set_id_led     = tenxpress_set_id_led,
-                .monitor        = sfn4111t_check_hw,
+                .id             = FALCON_BOARD_SFE4003,
+                .ref_model      = "SFE4003",
+                .gen_type       = "10GBASE-CX4 adapter",
+                .init           = sfe4003_init,
+                .init_phy       = sfe4003_init_phy,
+                .fini           = efx_fini_lm87,
+                .set_id_led     = sfe4003_set_id_led,
+                .monitor        = sfe4003_check_hw,
         },
         {
                 .id             = FALCON_BOARD_SFN4112F,
diff --git a/drivers/net/sfc/falcon_gmac.c b/drivers/net/sfc/falcon_gmac.c
deleted file mode 100644
index 7dadfcbd6ce7..000000000000
--- a/drivers/net/sfc/falcon_gmac.c
+++ /dev/null
@@ -1,230 +0,0 @@
-/****************************************************************************
- * Driver for Solarflare Solarstorm network controllers and boards
- * Copyright 2005-2006 Fen Systems Ltd.
- * Copyright 2006-2009 Solarflare Communications Inc.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published
- * by the Free Software Foundation, incorporated herein by reference.
- */
-
-#include <linux/delay.h>
-#include "net_driver.h"
-#include "efx.h"
-#include "nic.h"
-#include "mac.h"
-#include "regs.h"
-#include "io.h"
-
-/**************************************************************************
- *
- * MAC operations
- *
- *************************************************************************/
-
-static int falcon_reconfigure_gmac(struct efx_nic *efx)
-{
-        struct efx_link_state *link_state = &efx->link_state;
-        bool loopback, tx_fc, rx_fc, bytemode;
-        int if_mode;
-        unsigned int max_frame_len;
-        efx_oword_t reg;
-
-        /* Configuration register 1 */
-        tx_fc = (link_state->fc & EFX_FC_TX) || !link_state->fd;
-        rx_fc = !!(link_state->fc & EFX_FC_RX);
-        loopback = (efx->loopback_mode == LOOPBACK_GMAC);
-        bytemode = (link_state->speed == 1000);
-
-        EFX_POPULATE_OWORD_5(reg,
-                             FRF_AB_GM_LOOP, loopback,
-                             FRF_AB_GM_TX_EN, 1,
-                             FRF_AB_GM_TX_FC_EN, tx_fc,
-                             FRF_AB_GM_RX_EN, 1,
-                             FRF_AB_GM_RX_FC_EN, rx_fc);
-        efx_writeo(efx, &reg, FR_AB_GM_CFG1);
-        udelay(10);
-
-        /* Configuration register 2 */
-        if_mode = (bytemode) ? 2 : 1;
-        EFX_POPULATE_OWORD_5(reg,
-                             FRF_AB_GM_IF_MODE, if_mode,
-                             FRF_AB_GM_PAD_CRC_EN, 1,
-                             FRF_AB_GM_LEN_CHK, 1,
-                             FRF_AB_GM_FD, link_state->fd,
-                             FRF_AB_GM_PAMBL_LEN, 0x7/*datasheet recommended */);
-
-        efx_writeo(efx, &reg, FR_AB_GM_CFG2);
-        udelay(10);
-
-        /* Max frame len register */
-        max_frame_len = EFX_MAX_FRAME_LEN(efx->net_dev->mtu);
-        EFX_POPULATE_OWORD_1(reg, FRF_AB_GM_MAX_FLEN, max_frame_len);
-        efx_writeo(efx, &reg, FR_AB_GM_MAX_FLEN);
-        udelay(10);
-
-        /* FIFO configuration register 0 */
-        EFX_POPULATE_OWORD_5(reg,
-                             FRF_AB_GMF_FTFENREQ, 1,
-                             FRF_AB_GMF_STFENREQ, 1,
-                             FRF_AB_GMF_FRFENREQ, 1,
-                             FRF_AB_GMF_SRFENREQ, 1,
-                             FRF_AB_GMF_WTMENREQ, 1);
-        efx_writeo(efx, &reg, FR_AB_GMF_CFG0);
-        udelay(10);
-
-        /* FIFO configuration register 1 */
-        EFX_POPULATE_OWORD_2(reg,
-                             FRF_AB_GMF_CFGFRTH, 0x12,
-                             FRF_AB_GMF_CFGXOFFRTX, 0xffff);
-        efx_writeo(efx, &reg, FR_AB_GMF_CFG1);
-        udelay(10);
-
-        /* FIFO configuration register 2 */
-        EFX_POPULATE_OWORD_2(reg,
-                             FRF_AB_GMF_CFGHWM, 0x3f,
-                             FRF_AB_GMF_CFGLWM, 0xa);
-        efx_writeo(efx, &reg, FR_AB_GMF_CFG2);
-        udelay(10);
-
-        /* FIFO configuration register 3 */
-        EFX_POPULATE_OWORD_2(reg,
-                             FRF_AB_GMF_CFGHWMFT, 0x1c,
-                             FRF_AB_GMF_CFGFTTH, 0x08);
-        efx_writeo(efx, &reg, FR_AB_GMF_CFG3);
-        udelay(10);
-
-        /* FIFO configuration register 4 */
-        EFX_POPULATE_OWORD_1(reg, FRF_AB_GMF_HSTFLTRFRM_PAUSE, 1);
-        efx_writeo(efx, &reg, FR_AB_GMF_CFG4);
-        udelay(10);
-
-        /* FIFO configuration register 5 */
-        efx_reado(efx, &reg, FR_AB_GMF_CFG5);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GMF_CFGBYTMODE, bytemode);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GMF_CFGHDPLX, !link_state->fd);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GMF_HSTDRPLT64, !link_state->fd);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GMF_HSTFLTRFRMDC_PAUSE, 0);
-        efx_writeo(efx, &reg, FR_AB_GMF_CFG5);
-        udelay(10);
-
-        /* MAC address */
-        EFX_POPULATE_OWORD_4(reg,
-                             FRF_AB_GM_ADR_B0, efx->net_dev->dev_addr[5],
-                             FRF_AB_GM_ADR_B1, efx->net_dev->dev_addr[4],
-                             FRF_AB_GM_ADR_B2, efx->net_dev->dev_addr[3],
-                             FRF_AB_GM_ADR_B3, efx->net_dev->dev_addr[2]);
-        efx_writeo(efx, &reg, FR_AB_GM_ADR1);
-        udelay(10);
-        EFX_POPULATE_OWORD_2(reg,
-                             FRF_AB_GM_ADR_B4, efx->net_dev->dev_addr[1],
-                             FRF_AB_GM_ADR_B5, efx->net_dev->dev_addr[0]);
-        efx_writeo(efx, &reg, FR_AB_GM_ADR2);
-        udelay(10);
-
-        falcon_reconfigure_mac_wrapper(efx);
-
-        return 0;
-}
-
-static void falcon_update_stats_gmac(struct efx_nic *efx)
-{
-        struct efx_mac_stats *mac_stats = &efx->mac_stats;
-        unsigned long old_rx_pause, old_tx_pause;
-        unsigned long new_rx_pause, new_tx_pause;
-
-        /* Pause frames are erroneously counted as errors (SFC bug 3269) */
-        old_rx_pause = mac_stats->rx_pause;
-        old_tx_pause = mac_stats->tx_pause;
-
-        /* Update MAC stats from DMAed values */
-        FALCON_STAT(efx, GRxGoodOct, rx_good_bytes);
-        FALCON_STAT(efx, GRxBadOct, rx_bad_bytes);
-        FALCON_STAT(efx, GRxMissPkt, rx_missed);
-        FALCON_STAT(efx, GRxFalseCRS, rx_false_carrier);
-        FALCON_STAT(efx, GRxPausePkt, rx_pause);
-        FALCON_STAT(efx, GRxBadPkt, rx_bad);
-        FALCON_STAT(efx, GRxUcastPkt, rx_unicast);
-        FALCON_STAT(efx, GRxMcastPkt, rx_multicast);
-        FALCON_STAT(efx, GRxBcastPkt, rx_broadcast);
-        FALCON_STAT(efx, GRxGoodLt64Pkt, rx_good_lt64);
-        FALCON_STAT(efx, GRxBadLt64Pkt, rx_bad_lt64);
-        FALCON_STAT(efx, GRx64Pkt, rx_64);
-        FALCON_STAT(efx, GRx65to127Pkt, rx_65_to_127);
-        FALCON_STAT(efx, GRx128to255Pkt, rx_128_to_255);
-        FALCON_STAT(efx, GRx256to511Pkt, rx_256_to_511);
-        FALCON_STAT(efx, GRx512to1023Pkt, rx_512_to_1023);
-        FALCON_STAT(efx, GRx1024to15xxPkt, rx_1024_to_15xx);
-        FALCON_STAT(efx, GRx15xxtoJumboPkt, rx_15xx_to_jumbo);
-        FALCON_STAT(efx, GRxGtJumboPkt, rx_gtjumbo);
-        FALCON_STAT(efx, GRxFcsErr64to15xxPkt, rx_bad_64_to_15xx);
-        FALCON_STAT(efx, GRxFcsErr15xxtoJumboPkt, rx_bad_15xx_to_jumbo);
-        FALCON_STAT(efx, GRxFcsErrGtJumboPkt, rx_bad_gtjumbo);
-        FALCON_STAT(efx, GTxGoodBadOct, tx_bytes);
-        FALCON_STAT(efx, GTxGoodOct, tx_good_bytes);
-        FALCON_STAT(efx, GTxSglColPkt, tx_single_collision);
-        FALCON_STAT(efx, GTxMultColPkt, tx_multiple_collision);
-        FALCON_STAT(efx, GTxExColPkt, tx_excessive_collision);
-        FALCON_STAT(efx, GTxDefPkt, tx_deferred);
-        FALCON_STAT(efx, GTxLateCol, tx_late_collision);
-        FALCON_STAT(efx, GTxExDefPkt, tx_excessive_deferred);
-        FALCON_STAT(efx, GTxPausePkt, tx_pause);
-        FALCON_STAT(efx, GTxBadPkt, tx_bad);
-        FALCON_STAT(efx, GTxUcastPkt, tx_unicast);
-        FALCON_STAT(efx, GTxMcastPkt, tx_multicast);
-        FALCON_STAT(efx, GTxBcastPkt, tx_broadcast);
-        FALCON_STAT(efx, GTxLt64Pkt, tx_lt64);
-        FALCON_STAT(efx, GTx64Pkt, tx_64);
-        FALCON_STAT(efx, GTx65to127Pkt, tx_65_to_127);
-        FALCON_STAT(efx, GTx128to255Pkt, tx_128_to_255);
-        FALCON_STAT(efx, GTx256to511Pkt, tx_256_to_511);
-        FALCON_STAT(efx, GTx512to1023Pkt, tx_512_to_1023);
-        FALCON_STAT(efx, GTx1024to15xxPkt, tx_1024_to_15xx);
-        FALCON_STAT(efx, GTx15xxtoJumboPkt, tx_15xx_to_jumbo);
-        FALCON_STAT(efx, GTxGtJumboPkt, tx_gtjumbo);
-        FALCON_STAT(efx, GTxNonTcpUdpPkt, tx_non_tcpudp);
-        FALCON_STAT(efx, GTxMacSrcErrPkt, tx_mac_src_error);
-        FALCON_STAT(efx, GTxIpSrcErrPkt, tx_ip_src_error);
-
-        /* Pause frames are erroneously counted as errors (SFC bug 3269) */
-        new_rx_pause = mac_stats->rx_pause;
-        new_tx_pause = mac_stats->tx_pause;
-        mac_stats->rx_bad -= (new_rx_pause - old_rx_pause);
-        mac_stats->tx_bad -= (new_tx_pause - old_tx_pause);
-
-        /* Derive stats that the MAC doesn't provide directly */
-        mac_stats->tx_bad_bytes =
-                mac_stats->tx_bytes - mac_stats->tx_good_bytes;
-        mac_stats->tx_packets =
-                mac_stats->tx_lt64 + mac_stats->tx_64 +
-                mac_stats->tx_65_to_127 + mac_stats->tx_128_to_255 +
-                mac_stats->tx_256_to_511 + mac_stats->tx_512_to_1023 +
-                mac_stats->tx_1024_to_15xx + mac_stats->tx_15xx_to_jumbo +
-                mac_stats->tx_gtjumbo;
-        mac_stats->tx_collision =
-                mac_stats->tx_single_collision +
-                mac_stats->tx_multiple_collision +
-                mac_stats->tx_excessive_collision +
-                mac_stats->tx_late_collision;
-        mac_stats->rx_bytes =
-                mac_stats->rx_good_bytes + mac_stats->rx_bad_bytes;
-        mac_stats->rx_packets =
-                mac_stats->rx_good_lt64 + mac_stats->rx_bad_lt64 +
-                mac_stats->rx_64 + mac_stats->rx_65_to_127 +
-                mac_stats->rx_128_to_255 + mac_stats->rx_256_to_511 +
-                mac_stats->rx_512_to_1023 + mac_stats->rx_1024_to_15xx +
-                mac_stats->rx_15xx_to_jumbo + mac_stats->rx_gtjumbo;
-        mac_stats->rx_good = mac_stats->rx_packets - mac_stats->rx_bad;
-        mac_stats->rx_lt64 = mac_stats->rx_good_lt64 + mac_stats->rx_bad_lt64;
-}
-
-static bool falcon_gmac_check_fault(struct efx_nic *efx)
-{
-        return false;
-}
-
-struct efx_mac_operations falcon_gmac_operations = {
-        .reconfigure    = falcon_reconfigure_gmac,
-        .update_stats   = falcon_update_stats_gmac,
-        .check_fault    = falcon_gmac_check_fault,
-};
diff --git a/drivers/net/sfc/falcon_xmac.c b/drivers/net/sfc/falcon_xmac.c
index bae656dd2c4e..b31f595ebb5b 100644
--- a/drivers/net/sfc/falcon_xmac.c
+++ b/drivers/net/sfc/falcon_xmac.c
@@ -143,7 +143,7 @@ static bool falcon_xmac_link_ok(struct efx_nic *efx)
                  efx_mdio_phyxgxs_lane_sync(efx));
 }
 
-void falcon_reconfigure_xmac_core(struct efx_nic *efx)
+static void falcon_reconfigure_xmac_core(struct efx_nic *efx)
 {
         unsigned int max_frame_len;
         efx_oword_t reg;
diff --git a/drivers/net/sfc/filter.c b/drivers/net/sfc/filter.c
new file mode 100644
index 000000000000..52cb6082b910
--- /dev/null
+++ b/drivers/net/sfc/filter.c
@@ -0,0 +1,454 @@
+/****************************************************************************
+ * Driver for Solarflare Solarstorm network controllers and boards
+ * Copyright 2005-2010 Solarflare Communications Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation, incorporated herein by reference.
+ */
+
+#include "efx.h"
+#include "filter.h"
+#include "io.h"
+#include "nic.h"
+#include "regs.h"
+
+/* "Fudge factors" - difference between programmed value and actual depth.
+ * Due to pipelined implementation we need to program H/W with a value that
+ * is larger than the hop limit we want.
+ */
+#define FILTER_CTL_SRCH_FUDGE_WILD 3
+#define FILTER_CTL_SRCH_FUDGE_FULL 1
+
+/* Hard maximum hop limit.  Hardware will time-out beyond 200-something.
+ * We also need to avoid infinite loops in efx_filter_search() when the
+ * table is full.
+ */
+#define FILTER_CTL_SRCH_MAX 200
+
+struct efx_filter_table {
+        u32             offset;         /* address of table relative to BAR */
+        unsigned        size;           /* number of entries */
+        unsigned        step;           /* step between entries */
+        unsigned        used;           /* number currently used */
+        unsigned long   *used_bitmap;
+        struct efx_filter_spec *spec;
+};
+
+struct efx_filter_state {
+        spinlock_t      lock;
+        struct efx_filter_table table[EFX_FILTER_TABLE_COUNT];
+        unsigned        search_depth[EFX_FILTER_TYPE_COUNT];
+};
+
+/* The filter hash function is LFSR polynomial x^16 + x^3 + 1 of a 32-bit
+ * key derived from the n-tuple.  The initial LFSR state is 0xffff. */
+static u16 efx_filter_hash(u32 key)
+{
+        u16 tmp;
+
+        /* First 16 rounds */
+        tmp = 0x1fff ^ key >> 16;
+        tmp = tmp ^ tmp >> 3 ^ tmp >> 6;
+        tmp = tmp ^ tmp >> 9;
+        /* Last 16 rounds */
+        tmp = tmp ^ tmp << 13 ^ key;
+        tmp = tmp ^ tmp >> 3 ^ tmp >> 6;
+        return tmp ^ tmp >> 9;
+}
+
+/* To allow for hash collisions, filter search continues at these
+ * increments from the first possible entry selected by the hash. */
+static u16 efx_filter_increment(u32 key)
+{
+        return key * 2 - 1;
+}
+
+static enum efx_filter_table_id
+efx_filter_type_table_id(enum efx_filter_type type)
+{
+        BUILD_BUG_ON(EFX_FILTER_TABLE_RX_IP != (EFX_FILTER_RX_TCP_FULL >> 2));
+        BUILD_BUG_ON(EFX_FILTER_TABLE_RX_IP != (EFX_FILTER_RX_TCP_WILD >> 2));
+        BUILD_BUG_ON(EFX_FILTER_TABLE_RX_IP != (EFX_FILTER_RX_UDP_FULL >> 2));
+        BUILD_BUG_ON(EFX_FILTER_TABLE_RX_IP != (EFX_FILTER_RX_UDP_WILD >> 2));
+        BUILD_BUG_ON(EFX_FILTER_TABLE_RX_MAC != (EFX_FILTER_RX_MAC_FULL >> 2));
+        BUILD_BUG_ON(EFX_FILTER_TABLE_RX_MAC != (EFX_FILTER_RX_MAC_WILD >> 2));
+        return type >> 2;
+}
+
+static void
+efx_filter_table_reset_search_depth(struct efx_filter_state *state,
+                                    enum efx_filter_table_id table_id)
+{
+        memset(state->search_depth + (table_id << 2), 0,
+               sizeof(state->search_depth[0]) << 2);
+}
+
+static void efx_filter_push_rx_limits(struct efx_nic *efx)
+{
+        struct efx_filter_state *state = efx->filter_state;
+        efx_oword_t filter_ctl;
+
+        efx_reado(efx, &filter_ctl, FR_BZ_RX_FILTER_CTL);
+
+        EFX_SET_OWORD_FIELD(filter_ctl, FRF_BZ_TCP_FULL_SRCH_LIMIT,
+                            state->search_depth[EFX_FILTER_RX_TCP_FULL] +
+                            FILTER_CTL_SRCH_FUDGE_FULL);
+        EFX_SET_OWORD_FIELD(filter_ctl, FRF_BZ_TCP_WILD_SRCH_LIMIT,
+                            state->search_depth[EFX_FILTER_RX_TCP_WILD] +
+                            FILTER_CTL_SRCH_FUDGE_WILD);
+        EFX_SET_OWORD_FIELD(filter_ctl, FRF_BZ_UDP_FULL_SRCH_LIMIT,
+                            state->search_depth[EFX_FILTER_RX_UDP_FULL] +
+                            FILTER_CTL_SRCH_FUDGE_FULL);
+        EFX_SET_OWORD_FIELD(filter_ctl, FRF_BZ_UDP_WILD_SRCH_LIMIT,
+                            state->search_depth[EFX_FILTER_RX_UDP_WILD] +
+                            FILTER_CTL_SRCH_FUDGE_WILD);
+
+        if (state->table[EFX_FILTER_TABLE_RX_MAC].size) {
+                EFX_SET_OWORD_FIELD(
+                        filter_ctl, FRF_CZ_ETHERNET_FULL_SEARCH_LIMIT,
+                        state->search_depth[EFX_FILTER_RX_MAC_FULL] +
+                        FILTER_CTL_SRCH_FUDGE_FULL);
+                EFX_SET_OWORD_FIELD(
+                        filter_ctl, FRF_CZ_ETHERNET_WILDCARD_SEARCH_LIMIT,
+                        state->search_depth[EFX_FILTER_RX_MAC_WILD] +
+                        FILTER_CTL_SRCH_FUDGE_WILD);
+        }
+
+        efx_writeo(efx, &filter_ctl, FR_BZ_RX_FILTER_CTL);
+}
+
+/* Build a filter entry and return its n-tuple key. */
+static u32 efx_filter_build(efx_oword_t *filter, struct efx_filter_spec *spec)
+{
+        u32 data3;
+
+        switch (efx_filter_type_table_id(spec->type)) {
+        case EFX_FILTER_TABLE_RX_IP: {
+                bool is_udp = (spec->type == EFX_FILTER_RX_UDP_FULL ||
+                               spec->type == EFX_FILTER_RX_UDP_WILD);
+                EFX_POPULATE_OWORD_7(
+                        *filter,
+                        FRF_BZ_RSS_EN,
+                        !!(spec->flags & EFX_FILTER_FLAG_RX_RSS),
+                        FRF_BZ_SCATTER_EN,
+                        !!(spec->flags & EFX_FILTER_FLAG_RX_SCATTER),
+                        FRF_BZ_TCP_UDP, is_udp,
+                        FRF_BZ_RXQ_ID, spec->dmaq_id,
+                        EFX_DWORD_2, spec->data[2],
+                        EFX_DWORD_1, spec->data[1],
+                        EFX_DWORD_0, spec->data[0]);
+                data3 = is_udp;
+                break;
+        }
+
+        case EFX_FILTER_TABLE_RX_MAC: {
+                bool is_wild = spec->type == EFX_FILTER_RX_MAC_WILD;
+                EFX_POPULATE_OWORD_8(
+                        *filter,
+                        FRF_CZ_RMFT_RSS_EN,
+                        !!(spec->flags & EFX_FILTER_FLAG_RX_RSS),
+                        FRF_CZ_RMFT_SCATTER_EN,
+                        !!(spec->flags & EFX_FILTER_FLAG_RX_SCATTER),
+                        FRF_CZ_RMFT_IP_OVERRIDE,
+                        !!(spec->flags & EFX_FILTER_FLAG_RX_OVERRIDE_IP),
+                        FRF_CZ_RMFT_RXQ_ID, spec->dmaq_id,
+                        FRF_CZ_RMFT_WILDCARD_MATCH, is_wild,
+                        FRF_CZ_RMFT_DEST_MAC_HI, spec->data[2],
+                        FRF_CZ_RMFT_DEST_MAC_LO, spec->data[1],
+                        FRF_CZ_RMFT_VLAN_ID, spec->data[0]);
+                data3 = is_wild;
+                break;
+        }
+
+        default:
+                BUG();
+        }
+
+        return spec->data[0] ^ spec->data[1] ^ spec->data[2] ^ data3;
+}
+
+static bool efx_filter_equal(const struct efx_filter_spec *left,
+                             const struct efx_filter_spec *right)
+{
+        if (left->type != right->type ||
+            memcmp(left->data, right->data, sizeof(left->data)))
+                return false;
+
+        return true;
+}
+
+static int efx_filter_search(struct efx_filter_table *table,
+                             struct efx_filter_spec *spec, u32 key,
+                             bool for_insert, int *depth_required)
+{
+        unsigned hash, incr, filter_idx, depth;
+        struct efx_filter_spec *cmp;
+
+        hash = efx_filter_hash(key);
+        incr = efx_filter_increment(key);
+
+        for (depth = 1, filter_idx = hash & (table->size - 1);
+             depth <= FILTER_CTL_SRCH_MAX &&
+                     test_bit(filter_idx, table->used_bitmap);
+             ++depth) {
+                cmp = &table->spec[filter_idx];
+                if (efx_filter_equal(spec, cmp))
+                        goto found;
+                filter_idx = (filter_idx + incr) & (table->size - 1);
+        }
+        if (!for_insert)
+                return -ENOENT;
+        if (depth > FILTER_CTL_SRCH_MAX)
+                return -EBUSY;
+found:
+        *depth_required = depth;
+        return filter_idx;
+}
+
+/**
+ * efx_filter_insert_filter - add or replace a filter
+ * @efx: NIC in which to insert the filter
+ * @spec: Specification for the filter
+ * @replace: Flag for whether the specified filter may replace a filter
+ *      with an identical match expression and equal or lower priority
+ *
+ * On success, return the filter index within its table.
+ * On failure, return a negative error code.
+ */
+int efx_filter_insert_filter(struct efx_nic *efx, struct efx_filter_spec *spec,
+                             bool replace)
+{
+        struct efx_filter_state *state = efx->filter_state;
+        enum efx_filter_table_id table_id =
+                efx_filter_type_table_id(spec->type);
+        struct efx_filter_table *table = &state->table[table_id];
+        struct efx_filter_spec *saved_spec;
+        efx_oword_t filter;
+        int filter_idx, depth;
+        u32 key;
+        int rc;
+
+        if (table->size == 0)
+                return -EINVAL;
+
+        key = efx_filter_build(&filter, spec);
+
+        netif_vdbg(efx, hw, efx->net_dev,
+                   "%s: type %d search_depth=%d", __func__, spec->type,
+                   state->search_depth[spec->type]);
+
+        spin_lock_bh(&state->lock);
+
+        rc = efx_filter_search(table, spec, key, true, &depth);
+        if (rc < 0)
+                goto out;
+        filter_idx = rc;
+        BUG_ON(filter_idx >= table->size);
+        saved_spec = &table->spec[filter_idx];
+
+        if (test_bit(filter_idx, table->used_bitmap)) {
+                /* Should we replace the existing filter? */
+                if (!replace) {
+                        rc = -EEXIST;
+                        goto out;
+                }
+                if (spec->priority < saved_spec->priority) {
+                        rc = -EPERM;
+                        goto out;
+                }
+        } else {
+                __set_bit(filter_idx, table->used_bitmap);
+                ++table->used;
+        }
+        *saved_spec = *spec;
+
+        if (state->search_depth[spec->type] < depth) {
+                state->search_depth[spec->type] = depth;
+                efx_filter_push_rx_limits(efx);
+        }
+
+        efx_writeo(efx, &filter, table->offset + table->step * filter_idx);
+
+        netif_vdbg(efx, hw, efx->net_dev,
+                   "%s: filter type %d index %d rxq %u set",
+                   __func__, spec->type, filter_idx, spec->dmaq_id);
+
+out:
+        spin_unlock_bh(&state->lock);
+        return rc;
+}
+
+static void efx_filter_table_clear_entry(struct efx_nic *efx,
+                                         struct efx_filter_table *table,
+                                         int filter_idx)
+{
+        static efx_oword_t filter;
+
+        if (test_bit(filter_idx, table->used_bitmap)) {
+                __clear_bit(filter_idx, table->used_bitmap);
+                --table->used;
+                memset(&table->spec[filter_idx], 0, sizeof(table->spec[0]));
+
+                efx_writeo(efx, &filter,
+                           table->offset + table->step * filter_idx);
+        }
+}
+
+/**
+ * efx_filter_remove_filter - remove a filter by specification
+ * @efx: NIC from which to remove the filter
+ * @spec: Specification for the filter
+ *
+ * On success, return zero.
+ * On failure, return a negative error code.
+ */
+int efx_filter_remove_filter(struct efx_nic *efx, struct efx_filter_spec *spec)
+{
+        struct efx_filter_state *state = efx->filter_state;
+        enum efx_filter_table_id table_id =
+                efx_filter_type_table_id(spec->type);
+        struct efx_filter_table *table = &state->table[table_id];
+        struct efx_filter_spec *saved_spec;
+        efx_oword_t filter;
+        int filter_idx, depth;
+        u32 key;
+        int rc;
+
+        key = efx_filter_build(&filter, spec);
+
+        spin_lock_bh(&state->lock);
+
+        rc = efx_filter_search(table, spec, key, false, &depth);
+        if (rc < 0)
+                goto out;
+        filter_idx = rc;
+        saved_spec = &table->spec[filter_idx];
+
+        if (spec->priority < saved_spec->priority) {
+                rc = -EPERM;
+                goto out;
+        }
+
+        efx_filter_table_clear_entry(efx, table, filter_idx);
+        if (table->used == 0)
+                efx_filter_table_reset_search_depth(state, table_id);
+        rc = 0;
+
+out:
+        spin_unlock_bh(&state->lock);
+        return rc;
+}
+
+/**
+ * efx_filter_table_clear - remove filters from a table by priority
+ * @efx: NIC from which to remove the filters
+ * @table_id: Table from which to remove the filters
+ * @priority: Maximum priority to remove
+ */
+void efx_filter_table_clear(struct efx_nic *efx,
+                            enum efx_filter_table_id table_id,
+                            enum efx_filter_priority priority)
+{
+        struct efx_filter_state *state = efx->filter_state;
+        struct efx_filter_table *table = &state->table[table_id];
+        int filter_idx;
+
+        spin_lock_bh(&state->lock);
+
+        for (filter_idx = 0; filter_idx < table->size; ++filter_idx)
+                if (table->spec[filter_idx].priority <= priority)
+                        efx_filter_table_clear_entry(efx, table, filter_idx);
+        if (table->used == 0)
+                efx_filter_table_reset_search_depth(state, table_id);
+
+        spin_unlock_bh(&state->lock);
+}
+
+/* Restore filter stater after reset */
+void efx_restore_filters(struct efx_nic *efx)
+{
+        struct efx_filter_state *state = efx->filter_state;
+        enum efx_filter_table_id table_id;
+        struct efx_filter_table *table;
+        efx_oword_t filter;
+        int filter_idx;
+
+        spin_lock_bh(&state->lock);
+
+        for (table_id = 0; table_id < EFX_FILTER_TABLE_COUNT; table_id++) {
+                table = &state->table[table_id];
+                for (filter_idx = 0; filter_idx < table->size; filter_idx++) {
+                        if (!test_bit(filter_idx, table->used_bitmap))
+                                continue;
+                        efx_filter_build(&filter, &table->spec[filter_idx]);
+                        efx_writeo(efx, &filter,
+                                   table->offset + table->step * filter_idx);
+                }
+        }
+
+        efx_filter_push_rx_limits(efx);
+
+        spin_unlock_bh(&state->lock);
+}
+
+int efx_probe_filters(struct efx_nic *efx)
+{
+        struct efx_filter_state *state;
+        struct efx_filter_table *table;
+        unsigned table_id;
+
+        state = kzalloc(sizeof(*efx->filter_state), GFP_KERNEL);
+        if (!state)
+                return -ENOMEM;
+        efx->filter_state = state;
+
+        spin_lock_init(&state->lock);
+
+        if (efx_nic_rev(efx) >= EFX_REV_FALCON_B0) {
+                table = &state->table[EFX_FILTER_TABLE_RX_IP];
+                table->offset = FR_BZ_RX_FILTER_TBL0;
+                table->size = FR_BZ_RX_FILTER_TBL0_ROWS;
+                table->step = FR_BZ_RX_FILTER_TBL0_STEP;
+        }
+
+        if (efx_nic_rev(efx) >= EFX_REV_SIENA_A0) {
+                table = &state->table[EFX_FILTER_TABLE_RX_MAC];
+                table->offset = FR_CZ_RX_MAC_FILTER_TBL0;
+                table->size = FR_CZ_RX_MAC_FILTER_TBL0_ROWS;
+                table->step = FR_CZ_RX_MAC_FILTER_TBL0_STEP;
+        }
+
+        for (table_id = 0; table_id < EFX_FILTER_TABLE_COUNT; table_id++) {
+                table = &state->table[table_id];
+                if (table->size == 0)
+                        continue;
+                table->used_bitmap = kcalloc(BITS_TO_LONGS(table->size),
+                                             sizeof(unsigned long),
+                                             GFP_KERNEL);
+                if (!table->used_bitmap)
+                        goto fail;
+                table->spec = vmalloc(table->size * sizeof(*table->spec));
+                if (!table->spec)
+                        goto fail;
+                memset(table->spec, 0, table->size * sizeof(*table->spec));
+        }
+
+        return 0;
+
+fail:
+        efx_remove_filters(efx);
+        return -ENOMEM;
+}
+
+void efx_remove_filters(struct efx_nic *efx)
+{
+        struct efx_filter_state *state = efx->filter_state;
+        enum efx_filter_table_id table_id;
+
+        for (table_id = 0; table_id < EFX_FILTER_TABLE_COUNT; table_id++) {
+                kfree(state->table[table_id].used_bitmap);
+                vfree(state->table[table_id].spec);
+        }
+        kfree(state);
+}
diff --git a/drivers/net/sfc/filter.h b/drivers/net/sfc/filter.h
new file mode 100644
index 000000000000..a53319ded79c
--- /dev/null
+++ b/drivers/net/sfc/filter.h
@@ -0,0 +1,189 @@
+/****************************************************************************
+ * Driver for Solarflare Solarstorm network controllers and boards
+ * Copyright 2005-2010 Solarflare Communications Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation, incorporated herein by reference.
+ */
+
+#ifndef EFX_FILTER_H
+#define EFX_FILTER_H
+
+#include <linux/types.h>
+
+enum efx_filter_table_id {
+        EFX_FILTER_TABLE_RX_IP = 0,
+        EFX_FILTER_TABLE_RX_MAC,
+        EFX_FILTER_TABLE_COUNT,
+};
+
+/**
+ * enum efx_filter_type - type of hardware filter
+ * @EFX_FILTER_RX_TCP_FULL: RX, matching TCP/IPv4 4-tuple
+ * @EFX_FILTER_RX_TCP_WILD: RX, matching TCP/IPv4 destination (host, port)
+ * @EFX_FILTER_RX_UDP_FULL: RX, matching UDP/IPv4 4-tuple
+ * @EFX_FILTER_RX_UDP_WILD: RX, matching UDP/IPv4 destination (host, port)
+ * @EFX_FILTER_RX_MAC_FULL: RX, matching Ethernet destination MAC address, VID
+ * @EFX_FILTER_RX_MAC_WILD: RX, matching Ethernet destination MAC address
+ *
+ * Falcon NICs only support the RX TCP/IPv4 and UDP/IPv4 filter types.
+ */
+enum efx_filter_type {
+        EFX_FILTER_RX_TCP_FULL = 0,
+        EFX_FILTER_RX_TCP_WILD,
+        EFX_FILTER_RX_UDP_FULL,
+        EFX_FILTER_RX_UDP_WILD,
+        EFX_FILTER_RX_MAC_FULL = 4,
+        EFX_FILTER_RX_MAC_WILD,
+        EFX_FILTER_TYPE_COUNT,
+};
+
+/**
+ * enum efx_filter_priority - priority of a hardware filter specification
+ * @EFX_FILTER_PRI_HINT: Performance hint
+ * @EFX_FILTER_PRI_MANUAL: Manually configured filter
+ * @EFX_FILTER_PRI_REQUIRED: Required for correct behaviour
+ */
+enum efx_filter_priority {
+        EFX_FILTER_PRI_HINT = 0,
+        EFX_FILTER_PRI_MANUAL,
+        EFX_FILTER_PRI_REQUIRED,
+};
+
+/**
+ * enum efx_filter_flags - flags for hardware filter specifications
+ * @EFX_FILTER_FLAG_RX_RSS: Use RSS to spread across multiple queues.
+ *      By default, matching packets will be delivered only to the
+ *      specified queue. If this flag is set, they will be delivered
+ *      to a range of queues offset from the specified queue number
+ *      according to the indirection table.
+ * @EFX_FILTER_FLAG_RX_SCATTER: Enable DMA scatter on the receiving
+ *      queue.
+ * @EFX_FILTER_FLAG_RX_OVERRIDE_IP: Enables a MAC filter to override
+ *      any IP filter that matches the same packet.  By default, IP
+ *      filters take precedence.
+ *
+ * Currently, no flags are defined for TX filters.
+ */
+enum efx_filter_flags {
+        EFX_FILTER_FLAG_RX_RSS = 0x01,
+        EFX_FILTER_FLAG_RX_SCATTER = 0x02,
+        EFX_FILTER_FLAG_RX_OVERRIDE_IP = 0x04,
+};
+
+/**
+ * struct efx_filter_spec - specification for a hardware filter
+ * @type: Type of match to be performed, from &enum efx_filter_type
+ * @priority: Priority of the filter, from &enum efx_filter_priority
+ * @flags: Miscellaneous flags, from &enum efx_filter_flags
+ * @dmaq_id: Source/target queue index
+ * @data: Match data (type-dependent)
+ *
+ * Use the efx_filter_set_*() functions to initialise the @type and
+ * @data fields.
+ */
+struct efx_filter_spec {
+        u8      type:4;
+        u8      priority:4;
+        u8      flags;
+        u16     dmaq_id;
+        u32     data[3];
+};
+
+/**
+ * efx_filter_set_rx_tcp_full - specify RX filter with TCP/IPv4 full match
+ * @spec: Specification to initialise
+ * @shost: Source host address (host byte order)
+ * @sport: Source port (host byte order)
+ * @dhost: Destination host address (host byte order)
+ * @dport: Destination port (host byte order)
+ */
+static inline void
+efx_filter_set_rx_tcp_full(struct efx_filter_spec *spec,
+                           u32 shost, u16 sport, u32 dhost, u16 dport)
+{
+        spec->type = EFX_FILTER_RX_TCP_FULL;
+        spec->data[0] = sport | shost << 16;
+        spec->data[1] = dport << 16 | shost >> 16;
+        spec->data[2] = dhost;
+}
+
+/**
+ * efx_filter_set_rx_tcp_wild - specify RX filter with TCP/IPv4 wildcard match
+ * @spec: Specification to initialise
+ * @dhost: Destination host address (host byte order)
+ * @dport: Destination port (host byte order)
+ */
+static inline void
+efx_filter_set_rx_tcp_wild(struct efx_filter_spec *spec, u32 dhost, u16 dport)
+{
+        spec->type = EFX_FILTER_RX_TCP_WILD;
+        spec->data[0] = 0;
+        spec->data[1] = dport << 16;
+        spec->data[2] = dhost;
+}
+
+/**
+ * efx_filter_set_rx_udp_full - specify RX filter with UDP/IPv4 full match
+ * @spec: Specification to initialise
+ * @shost: Source host address (host byte order)
+ * @sport: Source port (host byte order)
+ * @dhost: Destination host address (host byte order)
+ * @dport: Destination port (host byte order)
+ */
+static inline void
+efx_filter_set_rx_udp_full(struct efx_filter_spec *spec,
+                           u32 shost, u16 sport, u32 dhost, u16 dport)
+{
+        spec->type = EFX_FILTER_RX_UDP_FULL;
+        spec->data[0] = sport | shost << 16;
+        spec->data[1] = dport << 16 | shost >> 16;
+        spec->data[2] = dhost;
+}
+
+/**
+ * efx_filter_set_rx_udp_wild - specify RX filter with UDP/IPv4 wildcard match
+ * @spec: Specification to initialise
+ * @dhost: Destination host address (host byte order)
+ * @dport: Destination port (host byte order)
+ */
+static inline void
+efx_filter_set_rx_udp_wild(struct efx_filter_spec *spec, u32 dhost, u16 dport)
+{
+        spec->type = EFX_FILTER_RX_UDP_WILD;
+        spec->data[0] = dport;
+        spec->data[1] = 0;
+        spec->data[2] = dhost;
+}
+
+/**
+ * efx_filter_set_rx_mac_full - specify RX filter with MAC full match
+ * @spec: Specification to initialise
+ * @vid: VLAN ID
+ * @addr: Destination MAC address
+ */
+static inline void efx_filter_set_rx_mac_full(struct efx_filter_spec *spec,
+                                              u16 vid, const u8 *addr)
+{
+        spec->type = EFX_FILTER_RX_MAC_FULL;
+        spec->data[0] = vid;
+        spec->data[1] = addr[2] << 24 | addr[3] << 16 | addr[4] << 8 | addr[5];
+        spec->data[2] = addr[0] << 8 | addr[1];
+}
+
+/**
+ * efx_filter_set_rx_mac_full - specify RX filter with MAC wildcard match
+ * @spec: Specification to initialise
+ * @addr: Destination MAC address
+ */
+static inline void efx_filter_set_rx_mac_wild(struct efx_filter_spec *spec,
+                                              const u8 *addr)
+{
+        spec->type = EFX_FILTER_RX_MAC_WILD;
+        spec->data[0] = 0;
+        spec->data[1] = addr[2] << 24 | addr[3] << 16 | addr[4] << 8 | addr[5];
+        spec->data[2] = addr[0] << 8 | addr[1];
+}
+
+#endif /* EFX_FILTER_H */
diff --git a/drivers/net/sfc/mac.h b/drivers/net/sfc/mac.h
index f1aa5f374890..6886cdf87c12 100644
--- a/drivers/net/sfc/mac.h
+++ b/drivers/net/sfc/mac.h
@@ -13,10 +13,8 @@
 
 #include "net_driver.h"
 
-extern struct efx_mac_operations falcon_gmac_operations;
 extern struct efx_mac_operations falcon_xmac_operations;
 extern struct efx_mac_operations efx_mcdi_mac_operations;
-extern void falcon_reconfigure_xmac_core(struct efx_nic *efx);
 extern int efx_mcdi_mac_stats(struct efx_nic *efx, dma_addr_t dma_addr,
                               u32 dma_len, int enable, int clear);
 
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index 3912b8fed912..12cf910c2ce7 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -1093,8 +1093,8 @@ int efx_mcdi_reset_mc(struct efx_nic *efx)
         return rc;
 }
 
-int efx_mcdi_wol_filter_set(struct efx_nic *efx, u32 type,
-                            const u8 *mac, int *id_out)
+static int efx_mcdi_wol_filter_set(struct efx_nic *efx, u32 type,
+                                   const u8 *mac, int *id_out)
 {
         u8 inbuf[MC_CMD_WOL_FILTER_SET_IN_LEN];
         u8 outbuf[MC_CMD_WOL_FILTER_SET_OUT_LEN];
diff --git a/drivers/net/sfc/mcdi.h b/drivers/net/sfc/mcdi.h
index f1f89ad4075a..c792f1d65e48 100644
--- a/drivers/net/sfc/mcdi.h
+++ b/drivers/net/sfc/mcdi.h
@@ -121,8 +121,6 @@ extern int efx_mcdi_handle_assertion(struct efx_nic *efx);
 extern void efx_mcdi_set_id_led(struct efx_nic *efx, enum efx_led_mode mode);
 extern int efx_mcdi_reset_port(struct efx_nic *efx);
 extern int efx_mcdi_reset_mc(struct efx_nic *efx);
-extern int efx_mcdi_wol_filter_set(struct efx_nic *efx, u32 type,
-                                   const u8 *mac, int *id_out);
 extern int efx_mcdi_wol_filter_set_magic(struct efx_nic *efx,
                                          const u8 *mac, int *id_out);
 extern int efx_mcdi_wol_filter_get_magic(struct efx_nic *efx, int *id_out);
diff --git a/drivers/net/sfc/mcdi_phy.c b/drivers/net/sfc/mcdi_phy.c
index 0121e71702bf..c992742446b1 100644
--- a/drivers/net/sfc/mcdi_phy.c
+++ b/drivers/net/sfc/mcdi_phy.c
@@ -713,7 +713,8 @@ static int efx_mcdi_phy_run_tests(struct efx_nic *efx, int *results,
         return 0;
 }
 
-const char *efx_mcdi_phy_test_name(struct efx_nic *efx, unsigned int index)
+static const char *efx_mcdi_phy_test_name(struct efx_nic *efx,
+                                          unsigned int index)
 {
         struct efx_mcdi_phy_data *phy_cfg = efx->phy_data;
 
diff --git a/drivers/net/sfc/mdio_10g.c b/drivers/net/sfc/mdio_10g.c
index eeaf0bd64bd3..98d946020429 100644
--- a/drivers/net/sfc/mdio_10g.c
+++ b/drivers/net/sfc/mdio_10g.c
@@ -286,46 +286,24 @@ int efx_mdio_set_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
  */
 void efx_mdio_an_reconfigure(struct efx_nic *efx)
 {
-        bool xnp = (efx->link_advertising & ADVERTISED_10000baseT_Full
-                    || EFX_WORKAROUND_13204(efx));
         int reg;
 
         WARN_ON(!(efx->mdio.mmds & MDIO_DEVS_AN));
 
         /* Set up the base page */
-        reg = ADVERTISE_CSMA;
-        if (efx->link_advertising & ADVERTISED_10baseT_Half)
-                reg |= ADVERTISE_10HALF;
-        if (efx->link_advertising & ADVERTISED_10baseT_Full)
-                reg |= ADVERTISE_10FULL;
-        if (efx->link_advertising & ADVERTISED_100baseT_Half)
-                reg |= ADVERTISE_100HALF;
-        if (efx->link_advertising & ADVERTISED_100baseT_Full)
-                reg |= ADVERTISE_100FULL;
-        if (xnp)
-                reg |= ADVERTISE_RESV;
-        else if (efx->link_advertising & (ADVERTISED_1000baseT_Half |
-                                          ADVERTISED_1000baseT_Full))
-                reg |= ADVERTISE_NPAGE;
+        reg = ADVERTISE_CSMA | ADVERTISE_RESV;
         if (efx->link_advertising & ADVERTISED_Pause)
                 reg |= ADVERTISE_PAUSE_CAP;
         if (efx->link_advertising & ADVERTISED_Asym_Pause)
                 reg |= ADVERTISE_PAUSE_ASYM;
         efx_mdio_write(efx, MDIO_MMD_AN, MDIO_AN_ADVERTISE, reg);
 
-        /* Set up the (extended) next page if necessary */
-        if (efx->phy_op->set_npage_adv)
-                efx->phy_op->set_npage_adv(efx, efx->link_advertising);
+        /* Set up the (extended) next page */
+        efx->phy_op->set_npage_adv(efx, efx->link_advertising);
 
         /* Enable and restart AN */
         reg = efx_mdio_read(efx, MDIO_MMD_AN, MDIO_CTRL1);
-        reg |= MDIO_AN_CTRL1_ENABLE;
-        if (!(EFX_WORKAROUND_15195(efx) && LOOPBACK_EXTERNAL(efx)))
-                reg |= MDIO_AN_CTRL1_RESTART;
-        if (xnp)
-                reg |= MDIO_AN_CTRL1_XNP;
-        else
-                reg &= ~MDIO_AN_CTRL1_XNP;
+        reg |= MDIO_AN_CTRL1_ENABLE | MDIO_AN_CTRL1_RESTART | MDIO_AN_CTRL1_XNP;
         efx_mdio_write(efx, MDIO_MMD_AN, MDIO_CTRL1, reg);
 }
 
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 152342dbff29..0a7e26d73b52 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -29,6 +29,7 @@
 #include <linux/device.h>
 #include <linux/highmem.h>
 #include <linux/workqueue.h>
+#include <linux/vmalloc.h>
 #include <linux/i2c.h>
 
 #include "enum.h"
@@ -386,11 +387,6 @@ extern const unsigned int efx_loopback_mode_max;
 #define LOOPBACK_MODE(efx) \
         STRING_TABLE_LOOKUP((efx)->loopback_mode, efx_loopback_mode)
 
-extern const char *efx_interrupt_mode_names[];
-extern const unsigned int efx_interrupt_mode_max;
-#define INT_MODE(efx) \
-        STRING_TABLE_LOOKUP(efx->interrupt_mode, efx_interrupt_mode)
-
 extern const char *efx_reset_type_names[];
 extern const unsigned int efx_reset_type_max;
 #define RESET_TYPE(type) \
@@ -405,8 +401,6 @@ enum efx_int_mode {
 };
 #define EFX_INT_MODE_USE_MSI(x) (((x)->interrupt_mode) <= EFX_INT_MODE_MSI)
 
-#define EFX_IS10G(efx) ((efx)->link_state.speed == 10000)
-
 enum nic_state {
         STATE_INIT = 0,
         STATE_RUNNING = 1,
@@ -619,6 +613,8 @@ union efx_multicast_hash {
         efx_oword_t oword[EFX_MCAST_HASH_ENTRIES / sizeof(efx_oword_t) / 8];
 };
 
+struct efx_filter_state;
+
 /**
  * struct efx_nic - an Efx NIC
  * @name: Device name (net device name or bus id before net device registered)
@@ -799,6 +795,8 @@ struct efx_nic {
         u64 loopback_modes;
 
         void *loopback_selftest;
+
+        struct efx_filter_state *filter_state;
 };
 
 static inline int efx_dev_registered(struct efx_nic *efx)
@@ -982,7 +980,7 @@ static inline int efx_rx_queue_index(struct efx_rx_queue *rx_queue)
 static inline struct efx_rx_buffer *efx_rx_buffer(struct efx_rx_queue *rx_queue,
                                                   unsigned int index)
 {
-        return (&rx_queue->buffer[index]);
+        return &rx_queue->buffer[index];
 }
 
 /* Set bit in a little-endian bitfield */
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index 6c5c0cefa9d8..41c36b9a4244 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -104,7 +104,7 @@ static inline void efx_write_buf_tbl(struct efx_nic *efx, efx_qword_t *value,
 static inline efx_qword_t *efx_event(struct efx_channel *channel,
                                      unsigned int index)
 {
-        return (((efx_qword_t *) (channel->eventq.addr)) + index);
+        return ((efx_qword_t *) (channel->eventq.addr)) + index;
 }
 
 /* See if an event is present
@@ -119,8 +119,8 @@ static inline efx_qword_t *efx_event(struct efx_channel *channel,
  */
 static inline int efx_event_present(efx_qword_t *event)
 {
-        return (!(EFX_DWORD_IS_ALL_ONES(event->dword[0]) |
-                  EFX_DWORD_IS_ALL_ONES(event->dword[1])));
+        return !(EFX_DWORD_IS_ALL_ONES(event->dword[0]) |
+                  EFX_DWORD_IS_ALL_ONES(event->dword[1]));
 }
 
 static bool efx_masked_compare_oword(const efx_oword_t *a, const efx_oword_t *b,
@@ -347,7 +347,7 @@ void efx_nic_free_buffer(struct efx_nic *efx, struct efx_buffer *buffer)
 static inline efx_qword_t *
 efx_tx_desc(struct efx_tx_queue *tx_queue, unsigned int index)
 {
-        return (((efx_qword_t *) (tx_queue->txd.addr)) + index);
+        return ((efx_qword_t *) (tx_queue->txd.addr)) + index;
 }
 
 /* This writes to the TX_DESC_WPTR; write pointer for TX descriptor ring */
@@ -502,7 +502,7 @@ void efx_nic_remove_tx(struct efx_tx_queue *tx_queue)
 static inline efx_qword_t *
 efx_rx_desc(struct efx_rx_queue *rx_queue, unsigned int index)
 {
-        return (((efx_qword_t *) (rx_queue->rxd.addr)) + index);
+        return ((efx_qword_t *) (rx_queue->rxd.addr)) + index;
 }
 
 /* This creates an entry in the RX descriptor queue */
@@ -653,7 +653,7 @@ void efx_nic_eventq_read_ack(struct efx_channel *channel)
 }
 
 /* Use HW to insert a SW defined event */
-void efx_generate_event(struct efx_channel *channel, efx_qword_t *event)
+static void efx_generate_event(struct efx_channel *channel, efx_qword_t *event)
 {
         efx_oword_t drv_ev_reg;
 
@@ -1849,8 +1849,7 @@ static const struct efx_nic_reg_table efx_nic_reg_tables[] = {
         REGISTER_TABLE_BB_CZ(TX_DESC_PTR_TBL),
         REGISTER_TABLE_AA(EVQ_PTR_TBL_KER),
         REGISTER_TABLE_BB_CZ(EVQ_PTR_TBL),
-        /* The register buffer is allocated with slab, so we can't
-         * reasonably read all of the buffer table (up to 8MB!).
+        /* We can't reasonably read all of the buffer table (up to 8MB!).
          * However this driver will only use a few entries.  Reading
          * 1K entries allows for some expansion of queue count and
          * size before we need to change the version. */
@@ -1858,7 +1857,6 @@ static const struct efx_nic_reg_table efx_nic_reg_tables[] = {
                                   A, A, 8, 1024),
         REGISTER_TABLE_DIMENSIONS(BUF_FULL_TBL, FR_BZ_BUF_FULL_TBL,
                                   B, Z, 8, 1024),
-        /* RX_FILTER_TBL{0,1} is huge and not used by this driver */
         REGISTER_TABLE_CZ(RX_MAC_FILTER_TBL0),
         REGISTER_TABLE_BB_CZ(TIMER_TBL),
         REGISTER_TABLE_BB_CZ(TX_PACE_TBL),
@@ -1868,6 +1866,7 @@ static const struct efx_nic_reg_table efx_nic_reg_tables[] = {
         REGISTER_TABLE_CZ(MC_TREG_SMEM),
         /* MSIX_PBA_TABLE is not mapped */
         /* SRM_DBG is not mapped (and is redundant with BUF_FLL_TBL) */
+        REGISTER_TABLE_BZ(RX_FILTER_TBL0),
 };
 
 size_t efx_nic_get_regs_len(struct efx_nic *efx)
diff --git a/drivers/net/sfc/phy.h b/drivers/net/sfc/phy.h
index 5bc26137257b..1dab609757fb 100644
--- a/drivers/net/sfc/phy.h
+++ b/drivers/net/sfc/phy.h
@@ -11,17 +11,12 @@
 #define EFX_PHY_H
 
 /****************************************************************************
- * 10Xpress (SFX7101 and SFT9001) PHYs
+ * 10Xpress (SFX7101) PHY
  */
 extern struct efx_phy_operations falcon_sfx7101_phy_ops;
-extern struct efx_phy_operations falcon_sft9001_phy_ops;
 
 extern void tenxpress_set_id_led(struct efx_nic *efx, enum efx_led_mode mode);
 
-/* Wait for the PHY to boot. Return 0 on success, -EINVAL if the PHY failed
- * to boot due to corrupt flash, or some other negative error code. */
-extern int sft9001_wait_boot(struct efx_nic *efx);
-
 /****************************************************************************
  * AMCC/Quake QT202x PHYs
  */
@@ -42,6 +37,17 @@ extern struct efx_phy_operations falcon_qt202x_phy_ops;
 extern void falcon_qt202x_set_led(struct efx_nic *p, int led, int state);
 
 /****************************************************************************
+* Transwitch CX4 retimer
+*/
+extern struct efx_phy_operations falcon_txc_phy_ops;
+
+#define TXC_GPIO_DIR_INPUT      0
+#define TXC_GPIO_DIR_OUTPUT     1
+
+extern void falcon_txc_set_gpio_dir(struct efx_nic *efx, int pin, int dir);
+extern void falcon_txc_set_gpio_val(struct efx_nic *efx, int pin, int val);
+
+/****************************************************************************
  * Siena managed PHYs
  */
 extern struct efx_phy_operations efx_mcdi_phy_ops;
diff --git a/drivers/net/sfc/regs.h b/drivers/net/sfc/regs.h
index 18a3be428348..96430ed81c36 100644
--- a/drivers/net/sfc/regs.h
+++ b/drivers/net/sfc/regs.h
@@ -2893,6 +2893,20 @@
 #define FRF_AB_XX_FORCE_SIG_WIDTH 8
 #define FFE_AB_XX_FORCE_SIG_ALL_LANES 0xff
 
+/* RX_MAC_FILTER_TBL0 */
+/* RMFT_DEST_MAC is wider than 32 bits */
+#define FRF_CZ_RMFT_DEST_MAC_LO_LBN 12
+#define FRF_CZ_RMFT_DEST_MAC_LO_WIDTH 32
+#define FRF_CZ_RMFT_DEST_MAC_HI_LBN 44
+#define FRF_CZ_RMFT_DEST_MAC_HI_WIDTH 16
+
+/* TX_MAC_FILTER_TBL0 */
+/* TMFT_SRC_MAC is wider than 32 bits */
+#define FRF_CZ_TMFT_SRC_MAC_LO_LBN 12
+#define FRF_CZ_TMFT_SRC_MAC_LO_WIDTH 32
+#define FRF_CZ_TMFT_SRC_MAC_HI_LBN 44
+#define FRF_CZ_TMFT_SRC_MAC_HI_WIDTH 16
+
 /* DRIVER_EV */
 /* Sub-fields of an RX flush completion event */
 #define FSF_AZ_DRIVER_EV_RX_FLUSH_FAIL_LBN 12
diff --git a/drivers/net/sfc/selftest.c b/drivers/net/sfc/selftest.c
index da4473b71058..0ebfb99f1299 100644
--- a/drivers/net/sfc/selftest.c
+++ b/drivers/net/sfc/selftest.c
@@ -48,6 +48,16 @@ static const unsigned char payload_source[ETH_ALEN] = {
 static const char payload_msg[] =
         "Hello world! This is an Efx loopback test in progress!";
 
+/* Interrupt mode names */
+static const unsigned int efx_interrupt_mode_max = EFX_INT_MODE_MAX;
+static const char *efx_interrupt_mode_names[] = {
+        [EFX_INT_MODE_MSIX]   = "MSI-X",
+        [EFX_INT_MODE_MSI]    = "MSI",
+        [EFX_INT_MODE_LEGACY] = "legacy",
+};
+#define INT_MODE(efx) \
+        STRING_TABLE_LOOKUP(efx->interrupt_mode, efx_interrupt_mode)
+
 /**
  * efx_loopback_state - persistent state during a loopback selftest
  * @flush:              Drop all packets in efx_loopback_rx_packet
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 9f5368049694..45236f58a258 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -129,7 +129,7 @@ static int siena_probe_port(struct efx_nic *efx)
         return 0;
 }
 
-void siena_remove_port(struct efx_nic *efx)
+static void siena_remove_port(struct efx_nic *efx)
 {
         efx->phy_op->remove(efx);
         efx_nic_free_buffer(efx, &efx->stats_buffer);
@@ -651,6 +651,6 @@ struct efx_nic_type siena_a0_nic_type = {
         .tx_dc_base = 0x88000,
         .rx_dc_base = 0x68000,
         .offload_features = (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                             NETIF_F_RXHASH),
+                             NETIF_F_RXHASH | NETIF_F_NTUPLE),
         .reset_world_flags = ETH_RESET_MGMT << ETH_RESET_SHARED_SHIFT,
 };
diff --git a/drivers/net/sfc/tenxpress.c b/drivers/net/sfc/tenxpress.c
index 6791be90c2fe..1bc6c48c96ee 100644
--- a/drivers/net/sfc/tenxpress.c
+++ b/drivers/net/sfc/tenxpress.c
@@ -19,10 +19,7 @@
 #include "workarounds.h"
 #include "selftest.h"
 
-/* We expect these MMDs to be in the package.  SFT9001 also has a
- * clause 22 extension MMD, but since it doesn't have all the generic
- * MMD registers it is pointless to include it here.
- */
+/* We expect these MMDs to be in the package. */
 #define TENXPRESS_REQUIRED_DEVS (MDIO_DEVS_PMAPMD       | \
                                  MDIO_DEVS_PCS          | \
                                  MDIO_DEVS_PHYXS        | \
@@ -33,12 +30,6 @@
                            (1 << LOOPBACK_PMAPMD) |     \
                            (1 << LOOPBACK_PHYXS_WS))
 
-#define SFT9001_LOOPBACKS ((1 << LOOPBACK_GPHY) |       \
-                           (1 << LOOPBACK_PHYXS) |      \
-                           (1 << LOOPBACK_PCS) |        \
-                           (1 << LOOPBACK_PMAPMD) |     \
-                           (1 << LOOPBACK_PHYXS_WS))
-
 /* We complain if we fail to see the link partner as 10G capable this many
  * times in a row (must be > 1 as sampling the autoneg. registers is racy)
  */
@@ -50,9 +41,8 @@
 #define PMA_PMD_EXT_GMII_EN_WIDTH 1
 #define PMA_PMD_EXT_CLK_OUT_LBN 2
 #define PMA_PMD_EXT_CLK_OUT_WIDTH 1
-#define PMA_PMD_LNPGA_POWERDOWN_LBN 8   /* SFX7101 only */
+#define PMA_PMD_LNPGA_POWERDOWN_LBN 8
 #define PMA_PMD_LNPGA_POWERDOWN_WIDTH 1
-#define PMA_PMD_EXT_CLK312_LBN  8       /* SFT9001 only */
 #define PMA_PMD_EXT_CLK312_WIDTH 1
 #define PMA_PMD_EXT_LPOWER_LBN  12
 #define PMA_PMD_EXT_LPOWER_WIDTH 1
@@ -84,7 +74,6 @@
 #define PMA_PMD_LED_FLASH       (3)
 #define PMA_PMD_LED_MASK        3
 /* All LEDs under hardware control */
-#define SFT9001_PMA_PMD_LED_DEFAULT 0
 /* Green and Amber under hardware control, Red off */
 #define SFX7101_PMA_PMD_LED_DEFAULT (PMA_PMD_LED_OFF << PMA_PMD_LED_RX_LBN)
 
@@ -98,31 +87,7 @@
 #define PMA_PMD_SPEED_LBN        4
 #define PMA_PMD_SPEED_WIDTH      4
 
-/* Cable diagnostics - SFT9001 only */
-#define PMA_PMD_CDIAG_CTRL_REG  49213
-#define CDIAG_CTRL_IMMED_LBN    15
-#define CDIAG_CTRL_BRK_LINK_LBN 12
-#define CDIAG_CTRL_IN_PROG_LBN  11
-#define CDIAG_CTRL_LEN_UNIT_LBN 10
-#define CDIAG_CTRL_LEN_METRES   1
-#define PMA_PMD_CDIAG_RES_REG   49174
-#define CDIAG_RES_A_LBN         12
-#define CDIAG_RES_B_LBN         8
-#define CDIAG_RES_C_LBN         4
-#define CDIAG_RES_D_LBN         0
-#define CDIAG_RES_WIDTH         4
-#define CDIAG_RES_OPEN          2
-#define CDIAG_RES_OK            1
-#define CDIAG_RES_INVALID       0
-/* Set of 4 registers for pairs A-D */
-#define PMA_PMD_CDIAG_LEN_REG   49175
-
-/* Serdes control registers - SFT9001 only */
-#define PMA_PMD_CSERDES_CTRL_REG 64258
-/* Set the 156.25 MHz output to 312.5 MHz to drive Falcon's XMAC */
-#define PMA_PMD_CSERDES_DEFAULT 0x000f
-
-/* Misc register defines - SFX7101 only */
+/* Misc register defines */
 #define PCS_CLOCK_CTRL_REG      55297
 #define PLL312_RST_N_LBN 2
 
@@ -185,121 +150,17 @@ struct tenxpress_phy_data {
         int bad_lp_tries;
 };
 
-static ssize_t show_phy_short_reach(struct device *dev,
-                                    struct device_attribute *attr, char *buf)
-{
-        struct efx_nic *efx = pci_get_drvdata(to_pci_dev(dev));
-        int reg;
-
-        reg = efx_mdio_read(efx, MDIO_MMD_PMAPMD, MDIO_PMA_10GBT_TXPWR);
-        return sprintf(buf, "%d\n", !!(reg & MDIO_PMA_10GBT_TXPWR_SHORT));
-}
-
-static ssize_t set_phy_short_reach(struct device *dev,
-                                   struct device_attribute *attr,
-                                   const char *buf, size_t count)
-{
-        struct efx_nic *efx = pci_get_drvdata(to_pci_dev(dev));
-        int rc;
-
-        rtnl_lock();
-        if (efx->state != STATE_RUNNING) {
-                rc = -EBUSY;
-        } else {
-                efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, MDIO_PMA_10GBT_TXPWR,
-                                  MDIO_PMA_10GBT_TXPWR_SHORT,
-                                  count != 0 && *buf != '0');
-                rc = efx_reconfigure_port(efx);
-        }
-        rtnl_unlock();
-
-        return rc < 0 ? rc : (ssize_t)count;
-}
-
-static DEVICE_ATTR(phy_short_reach, 0644, show_phy_short_reach,
-                   set_phy_short_reach);
-
-int sft9001_wait_boot(struct efx_nic *efx)
-{
-        unsigned long timeout = jiffies + HZ + 1;
-        int boot_stat;
-
-        for (;;) {
-                boot_stat = efx_mdio_read(efx, MDIO_MMD_PCS,
-                                          PCS_BOOT_STATUS_REG);
-                if (boot_stat >= 0) {
-                        netif_dbg(efx, hw, efx->net_dev,
-                                  "PHY boot status = %#x\n", boot_stat);
-                        switch (boot_stat &
-                                ((1 << PCS_BOOT_FATAL_ERROR_LBN) |
-                                 (3 << PCS_BOOT_PROGRESS_LBN) |
-                                 (1 << PCS_BOOT_DOWNLOAD_WAIT_LBN) |
-                                 (1 << PCS_BOOT_CODE_STARTED_LBN))) {
-                        case ((1 << PCS_BOOT_FATAL_ERROR_LBN) |
-                              (PCS_BOOT_PROGRESS_CHECKSUM <<
-                               PCS_BOOT_PROGRESS_LBN)):
-                        case ((1 << PCS_BOOT_FATAL_ERROR_LBN) |
-                              (PCS_BOOT_PROGRESS_INIT <<
-                               PCS_BOOT_PROGRESS_LBN) |
-                              (1 << PCS_BOOT_DOWNLOAD_WAIT_LBN)):
-                                return -EINVAL;
-                        case ((PCS_BOOT_PROGRESS_WAIT_MDIO <<
-                               PCS_BOOT_PROGRESS_LBN) |
-                              (1 << PCS_BOOT_DOWNLOAD_WAIT_LBN)):
-                                return (efx->phy_mode & PHY_MODE_SPECIAL) ?
-                                        0 : -EIO;
-                        case ((PCS_BOOT_PROGRESS_JUMP <<
-                               PCS_BOOT_PROGRESS_LBN) |
-                              (1 << PCS_BOOT_CODE_STARTED_LBN)):
-                        case ((PCS_BOOT_PROGRESS_JUMP <<
-                               PCS_BOOT_PROGRESS_LBN) |
-                              (1 << PCS_BOOT_DOWNLOAD_WAIT_LBN) |
-                              (1 << PCS_BOOT_CODE_STARTED_LBN)):
-                                return (efx->phy_mode & PHY_MODE_SPECIAL) ?
-                                        -EIO : 0;
-                        default:
-                                if (boot_stat & (1 << PCS_BOOT_FATAL_ERROR_LBN))
-                                        return -EIO;
-                                break;
-                        }
-                }
-
-                if (time_after_eq(jiffies, timeout))
-                        return -ETIMEDOUT;
-
-                msleep(50);
-        }
-}
-
 static int tenxpress_init(struct efx_nic *efx)
 {
-        int reg;
-
-        if (efx->phy_type == PHY_TYPE_SFX7101) {
-                /* Enable 312.5 MHz clock */
-                efx_mdio_write(efx, MDIO_MMD_PCS, PCS_TEST_SELECT_REG,
-                               1 << CLK312_EN_LBN);
-        } else {
-                /* Enable 312.5 MHz clock and GMII */
-                reg = efx_mdio_read(efx, MDIO_MMD_PMAPMD, PMA_PMD_XCONTROL_REG);
-                reg |= ((1 << PMA_PMD_EXT_GMII_EN_LBN) |
-                        (1 << PMA_PMD_EXT_CLK_OUT_LBN) |
-                        (1 << PMA_PMD_EXT_CLK312_LBN) |
-                        (1 << PMA_PMD_EXT_ROBUST_LBN));
-
-                efx_mdio_write(efx, MDIO_MMD_PMAPMD, PMA_PMD_XCONTROL_REG, reg);
-                efx_mdio_set_flag(efx, MDIO_MMD_C22EXT,
-                              GPHY_XCONTROL_REG, 1 << GPHY_ISOLATE_LBN,
-                              false);
-        }
+        /* Enable 312.5 MHz clock */
+        efx_mdio_write(efx, MDIO_MMD_PCS, PCS_TEST_SELECT_REG,
+                       1 << CLK312_EN_LBN);
 
         /* Set the LEDs up as: Green = Link, Amber = Link/Act, Red = Off */
-        if (efx->phy_type == PHY_TYPE_SFX7101) {
-                efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, PMA_PMD_LED_CTRL_REG,
-                                  1 << PMA_PMA_LED_ACTIVITY_LBN, true);
-                efx_mdio_write(efx, MDIO_MMD_PMAPMD, PMA_PMD_LED_OVERR_REG,
-                               SFX7101_PMA_PMD_LED_DEFAULT);
-        }
+        efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, PMA_PMD_LED_CTRL_REG,
+                          1 << PMA_PMA_LED_ACTIVITY_LBN, true);
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD, PMA_PMD_LED_OVERR_REG,
+                       SFX7101_PMA_PMD_LED_DEFAULT);
 
         return 0;
 }
@@ -307,7 +168,6 @@ static int tenxpress_init(struct efx_nic *efx)
 static int tenxpress_phy_probe(struct efx_nic *efx)
 {
         struct tenxpress_phy_data *phy_data;
-        int rc;
 
         /* Allocate phy private storage */
         phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
@@ -316,42 +176,15 @@ static int tenxpress_phy_probe(struct efx_nic *efx)
         efx->phy_data = phy_data;
         phy_data->phy_mode = efx->phy_mode;
 
-        /* Create any special files */
-        if (efx->phy_type == PHY_TYPE_SFT9001B) {
-                rc = device_create_file(&efx->pci_dev->dev,
-                                        &dev_attr_phy_short_reach);
-                if (rc)
-                        goto fail;
-        }
-
-        if (efx->phy_type == PHY_TYPE_SFX7101) {
-                efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
-                efx->mdio.mode_support = MDIO_SUPPORTS_C45;
-
-                efx->loopback_modes = SFX7101_LOOPBACKS | FALCON_XMAC_LOOPBACKS;
+        efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
+        efx->mdio.mode_support = MDIO_SUPPORTS_C45;
 
-                efx->link_advertising = (ADVERTISED_TP | ADVERTISED_Autoneg |
-                                         ADVERTISED_10000baseT_Full);
-        } else {
-                efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
-                efx->mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
+        efx->loopback_modes = SFX7101_LOOPBACKS | FALCON_XMAC_LOOPBACKS;
 
-                efx->loopback_modes = (SFT9001_LOOPBACKS |
-                                       FALCON_XMAC_LOOPBACKS | 
-                                       FALCON_GMAC_LOOPBACKS);
-
-                efx->link_advertising = (ADVERTISED_TP | ADVERTISED_Autoneg |
-                                         ADVERTISED_10000baseT_Full |
-                                         ADVERTISED_1000baseT_Full |
-                                         ADVERTISED_100baseT_Full);
-        }
+        efx->link_advertising = (ADVERTISED_TP | ADVERTISED_Autoneg |
+                                 ADVERTISED_10000baseT_Full);
 
         return 0;
-
-fail:
-        kfree(efx->phy_data);
-        efx->phy_data = NULL;
-        return rc;
 }
 
 static int tenxpress_phy_init(struct efx_nic *efx)
@@ -361,16 +194,6 @@ static int tenxpress_phy_init(struct efx_nic *efx)
         falcon_board(efx)->type->init_phy(efx);
 
         if (!(efx->phy_mode & PHY_MODE_SPECIAL)) {
-                if (efx->phy_type == PHY_TYPE_SFT9001A) {
-                        int reg;
-                        reg = efx_mdio_read(efx, MDIO_MMD_PMAPMD,
-                                            PMA_PMD_XCONTROL_REG);
-                        reg |= (1 << PMA_PMD_EXT_SSR_LBN);
-                        efx_mdio_write(efx, MDIO_MMD_PMAPMD,
-                                       PMA_PMD_XCONTROL_REG, reg);
-                        mdelay(200);
-                }
-
                 rc = efx_mdio_wait_reset_mmds(efx, TENXPRESS_REQUIRED_DEVS);
                 if (rc < 0)
                         return rc;
@@ -403,7 +226,7 @@ static int tenxpress_special_reset(struct efx_nic *efx)
 {
         int rc, reg;
 
-        /* The XGMAC clock is driven from the SFC7101/SFT9001 312MHz clock, so
+        /* The XGMAC clock is driven from the SFX7101 312MHz clock, so
          * a special software reset can glitch the XGMAC sufficiently for stats
          * requests to fail. */
         falcon_stop_nic_stats(efx);
@@ -484,53 +307,18 @@ static bool sfx7101_link_ok(struct efx_nic *efx)
                                  MDIO_DEVS_PHYXS);
 }
 
-static bool sft9001_link_ok(struct efx_nic *efx, struct ethtool_cmd *ecmd)
-{
-        u32 reg;
-
-        if (efx_phy_mode_disabled(efx->phy_mode))
-                return false;
-        else if (efx->loopback_mode == LOOPBACK_GPHY)
-                return true;
-        else if (efx->loopback_mode)
-                return efx_mdio_links_ok(efx,
-                                         MDIO_DEVS_PMAPMD |
-                                         MDIO_DEVS_PHYXS);
-
-        /* We must use the same definition of link state as LASI,
-         * otherwise we can miss a link state transition
-         */
-        if (ecmd->speed == 10000) {
-                reg = efx_mdio_read(efx, MDIO_MMD_PCS, MDIO_PCS_10GBRT_STAT1);
-                return reg & MDIO_PCS_10GBRT_STAT1_BLKLK;
-        } else {
-                reg = efx_mdio_read(efx, MDIO_MMD_C22EXT, C22EXT_STATUS_REG);
-                return reg & (1 << C22EXT_STATUS_LINK_LBN);
-        }
-}
-
 static void tenxpress_ext_loopback(struct efx_nic *efx)
 {
         efx_mdio_set_flag(efx, MDIO_MMD_PHYXS, PHYXS_TEST1,
                           1 << LOOPBACK_NEAR_LBN,
                           efx->loopback_mode == LOOPBACK_PHYXS);
-        if (efx->phy_type != PHY_TYPE_SFX7101)
-                efx_mdio_set_flag(efx, MDIO_MMD_C22EXT, GPHY_XCONTROL_REG,
-                                  1 << GPHY_LOOPBACK_NEAR_LBN,
-                                  efx->loopback_mode == LOOPBACK_GPHY);
 }
 
 static void tenxpress_low_power(struct efx_nic *efx)
 {
-        if (efx->phy_type == PHY_TYPE_SFX7101)
-                efx_mdio_set_mmds_lpower(
-                        efx, !!(efx->phy_mode & PHY_MODE_LOW_POWER),
-                        TENXPRESS_REQUIRED_DEVS);
-        else
-                efx_mdio_set_flag(
-                        efx, MDIO_MMD_PMAPMD, PMA_PMD_XCONTROL_REG,
-                        1 << PMA_PMD_EXT_LPOWER_LBN,
-                        !!(efx->phy_mode & PHY_MODE_LOW_POWER));
+        efx_mdio_set_mmds_lpower(
+                efx, !!(efx->phy_mode & PHY_MODE_LOW_POWER),
+                TENXPRESS_REQUIRED_DEVS);
 }
 
 static int tenxpress_phy_reconfigure(struct efx_nic *efx)
@@ -550,12 +338,7 @@ static int tenxpress_phy_reconfigure(struct efx_nic *efx)
 
         if (loop_reset || phy_mode_change) {
                 tenxpress_special_reset(efx);
-
-                /* Reset XAUI if we were in 10G, and are staying
-                 * in 10G. If we're moving into and out of 10G
-                 * then xaui will be reset anyway */
-                if (EFX_IS10G(efx))
-                        falcon_reset_xaui(efx);
+                falcon_reset_xaui(efx);
         }
 
         tenxpress_low_power(efx);
@@ -578,29 +361,12 @@ static bool tenxpress_phy_poll(struct efx_nic *efx)
 {
         struct efx_link_state old_state = efx->link_state;
 
-        if (efx->phy_type == PHY_TYPE_SFX7101) {
-                efx->link_state.up = sfx7101_link_ok(efx);
-                efx->link_state.speed = 10000;
-                efx->link_state.fd = true;
-                efx->link_state.fc = efx_mdio_get_pause(efx);
-
-                sfx7101_check_bad_lp(efx, efx->link_state.up);
-        } else {
-                struct ethtool_cmd ecmd;
-
-                /* Check the LASI alarm first */
-                if (efx->loopback_mode == LOOPBACK_NONE &&
-                    !(efx_mdio_read(efx, MDIO_MMD_PMAPMD, MDIO_PMA_LASI_STAT) &
-                      MDIO_PMA_LASI_LSALARM))
-                        return false;
+        efx->link_state.up = sfx7101_link_ok(efx);
+        efx->link_state.speed = 10000;
+        efx->link_state.fd = true;
+        efx->link_state.fc = efx_mdio_get_pause(efx);
 
-                tenxpress_get_settings(efx, &ecmd);
-
-                efx->link_state.up = sft9001_link_ok(efx, &ecmd);
-                efx->link_state.speed = ecmd.speed;
-                efx->link_state.fd = (ecmd.duplex == DUPLEX_FULL);
-                efx->link_state.fc = efx_mdio_get_pause(efx);
-        }
+        sfx7101_check_bad_lp(efx, efx->link_state.up);
 
         return !efx_link_state_equal(&efx->link_state, &old_state);
 }
@@ -621,10 +387,6 @@ static void sfx7101_phy_fini(struct efx_nic *efx)
 
 static void tenxpress_phy_remove(struct efx_nic *efx)
 {
-        if (efx->phy_type == PHY_TYPE_SFT9001B)
-                device_remove_file(&efx->pci_dev->dev,
-                                   &dev_attr_phy_short_reach);
-
         kfree(efx->phy_data);
         efx->phy_data = NULL;
 }
@@ -647,10 +409,7 @@ void tenxpress_set_id_led(struct efx_nic *efx, enum efx_led_mode mode)
                         (PMA_PMD_LED_ON << PMA_PMD_LED_LINK_LBN);
                 break;
         default:
-                if (efx->phy_type == PHY_TYPE_SFX7101)
-                        reg = SFX7101_PMA_PMD_LED_DEFAULT;
-                else
-                        reg = SFT9001_PMA_PMD_LED_DEFAULT;
+                reg = SFX7101_PMA_PMD_LED_DEFAULT;
                 break;
         }
 
@@ -685,102 +444,12 @@ sfx7101_run_tests(struct efx_nic *efx, int *results, unsigned flags)
         return rc;
 }
 
-static const char *const sft9001_test_names[] = {
-        "bist",
-        "cable.pairA.status",
-        "cable.pairB.status",
-        "cable.pairC.status",
-        "cable.pairD.status",
-        "cable.pairA.length",
-        "cable.pairB.length",
-        "cable.pairC.length",
-        "cable.pairD.length",
-};
-
-static const char *sft9001_test_name(struct efx_nic *efx, unsigned int index)
-{
-        if (index < ARRAY_SIZE(sft9001_test_names))
-                return sft9001_test_names[index];
-        return NULL;
-}
-
-static int sft9001_run_tests(struct efx_nic *efx, int *results, unsigned flags)
-{
-        int rc = 0, rc2, i, ctrl_reg, res_reg;
-
-        /* Initialise cable diagnostic results to unknown failure */
-        for (i = 1; i < 9; ++i)
-                results[i] = -1;
-
-        /* Run cable diagnostics; wait up to 5 seconds for them to complete.
-         * A cable fault is not a self-test failure, but a timeout is. */
-        ctrl_reg = ((1 << CDIAG_CTRL_IMMED_LBN) |
-                    (CDIAG_CTRL_LEN_METRES << CDIAG_CTRL_LEN_UNIT_LBN));
-        if (flags & ETH_TEST_FL_OFFLINE) {
-                /* Break the link in order to run full diagnostics.  We
-                 * must reset the PHY to resume normal service. */
-                ctrl_reg |= (1 << CDIAG_CTRL_BRK_LINK_LBN);
-        }
-        efx_mdio_write(efx, MDIO_MMD_PMAPMD, PMA_PMD_CDIAG_CTRL_REG,
-                       ctrl_reg);
-        i = 0;
-        while (efx_mdio_read(efx, MDIO_MMD_PMAPMD, PMA_PMD_CDIAG_CTRL_REG) &
-               (1 << CDIAG_CTRL_IN_PROG_LBN)) {
-                if (++i == 50) {
-                        rc = -ETIMEDOUT;
-                        goto out;
-                }
-                msleep(100);
-        }
-        res_reg = efx_mdio_read(efx, MDIO_MMD_PMAPMD, PMA_PMD_CDIAG_RES_REG);
-        for (i = 0; i < 4; i++) {
-                int pair_res =
-                        (res_reg >> (CDIAG_RES_A_LBN - i * CDIAG_RES_WIDTH))
-                        & ((1 << CDIAG_RES_WIDTH) - 1);
-                int len_reg = efx_mdio_read(efx, MDIO_MMD_PMAPMD,
-                                            PMA_PMD_CDIAG_LEN_REG + i);
-                if (pair_res == CDIAG_RES_OK)
-                        results[1 + i] = 1;
-                else if (pair_res == CDIAG_RES_INVALID)
-                        results[1 + i] = -1;
-                else
-                        results[1 + i] = -pair_res;
-                if (pair_res != CDIAG_RES_INVALID &&
-                    pair_res != CDIAG_RES_OPEN &&
-                    len_reg != 0xffff)
-                        results[5 + i] = len_reg;
-        }
-
-out:
-        if (flags & ETH_TEST_FL_OFFLINE) {
-                /* Reset, running the BIST and then resuming normal service. */
-                rc2 = tenxpress_special_reset(efx);
-                results[0] = rc2 ? -1 : 1;
-                if (!rc)
-                        rc = rc2;
-
-                efx_mdio_an_reconfigure(efx);
-        }
-
-        return rc;
-}
-
 static void
 tenxpress_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
 {
         u32 adv = 0, lpa = 0;
         int reg;
 
-        if (efx->phy_type != PHY_TYPE_SFX7101) {
-                reg = efx_mdio_read(efx, MDIO_MMD_C22EXT, C22EXT_MSTSLV_CTRL);
-                if (reg & (1 << C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN))
-                        adv |= ADVERTISED_1000baseT_Full;
-                reg = efx_mdio_read(efx, MDIO_MMD_C22EXT, C22EXT_MSTSLV_STATUS);
-                if (reg & (1 << C22EXT_MSTSLV_STATUS_LP_1000_HD_LBN))
-                        lpa |= ADVERTISED_1000baseT_Half;
-                if (reg & (1 << C22EXT_MSTSLV_STATUS_LP_1000_FD_LBN))
-                        lpa |= ADVERTISED_1000baseT_Full;
-        }
         reg = efx_mdio_read(efx, MDIO_MMD_AN, MDIO_AN_10GBT_CTRL);
         if (reg & MDIO_AN_10GBT_CTRL_ADV10G)
                 adv |= ADVERTISED_10000baseT_Full;
@@ -790,23 +459,9 @@ tenxpress_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
 
         mdio45_ethtool_gset_npage(&efx->mdio, ecmd, adv, lpa);
 
-        if (efx->phy_type != PHY_TYPE_SFX7101) {
-                ecmd->supported |= (SUPPORTED_100baseT_Full |
-                                    SUPPORTED_1000baseT_Full);
-                if (ecmd->speed != SPEED_10000) {
-                        ecmd->eth_tp_mdix =
-                                (efx_mdio_read(efx, MDIO_MMD_PMAPMD,
-                                               PMA_PMD_XSTATUS_REG) &
-                                 (1 << PMA_PMD_XSTAT_MDIX_LBN))
-                                ? ETH_TP_MDI_X : ETH_TP_MDI;
-                }
-        }
-
         /* In loopback, the PHY automatically brings up the correct interface,
          * but doesn't advertise the correct speed. So override it */
-        if (efx->loopback_mode == LOOPBACK_GPHY)
-                ecmd->speed = SPEED_1000;
-        else if (LOOPBACK_EXTERNAL(efx))
+        if (LOOPBACK_EXTERNAL(efx))
                 ecmd->speed = SPEED_10000;
 }
 
@@ -825,16 +480,6 @@ static void sfx7101_set_npage_adv(struct efx_nic *efx, u32 advertising)
                           advertising & ADVERTISED_10000baseT_Full);
 }
 
-static void sft9001_set_npage_adv(struct efx_nic *efx, u32 advertising)
-{
-        efx_mdio_set_flag(efx, MDIO_MMD_C22EXT, C22EXT_MSTSLV_CTRL,
-                          1 << C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN,
-                          advertising & ADVERTISED_1000baseT_Full);
-        efx_mdio_set_flag(efx, MDIO_MMD_AN, MDIO_AN_10GBT_CTRL,
-                          MDIO_AN_10GBT_CTRL_ADV10G,
-                          advertising & ADVERTISED_10000baseT_Full);
-}
-
 struct efx_phy_operations falcon_sfx7101_phy_ops = {
         .probe            = tenxpress_phy_probe,
         .init             = tenxpress_phy_init,
@@ -849,18 +494,3 @@ struct efx_phy_operations falcon_sfx7101_phy_ops = {
         .test_name        = sfx7101_test_name,
         .run_tests        = sfx7101_run_tests,
 };
-
-struct efx_phy_operations falcon_sft9001_phy_ops = {
-        .probe            = tenxpress_phy_probe,
-        .init             = tenxpress_phy_init,
-        .reconfigure      = tenxpress_phy_reconfigure,
-        .poll             = tenxpress_phy_poll,
-        .fini             = efx_port_dummy_op_void,
-        .remove           = tenxpress_phy_remove,
-        .get_settings     = tenxpress_get_settings,
-        .set_settings     = tenxpress_set_settings,
-        .set_npage_adv    = sft9001_set_npage_adv,
-        .test_alive       = efx_mdio_test_alive,
-        .test_name        = sft9001_test_name,
-        .run_tests        = sft9001_run_tests,
-};
diff --git a/drivers/net/sfc/txc43128_phy.c b/drivers/net/sfc/txc43128_phy.c
new file mode 100644
index 000000000000..351794a79215
--- /dev/null
+++ b/drivers/net/sfc/txc43128_phy.c
@@ -0,0 +1,560 @@
+/****************************************************************************
+ * Driver for Solarflare Solarstorm network controllers and boards
+ * Copyright 2006-2010 Solarflare Communications Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation, incorporated herein by reference.
+ */
+
+/*
+ * Driver for Transwitch/Mysticom CX4 retimer
+ * see www.transwitch.com, part is TXC-43128
+ */
+
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include "efx.h"
+#include "mdio_10g.h"
+#include "phy.h"
+#include "nic.h"
+
+/* We expect these MMDs to be in the package */
+#define TXC_REQUIRED_DEVS (MDIO_DEVS_PCS |      \
+                           MDIO_DEVS_PMAPMD |   \
+                           MDIO_DEVS_PHYXS)
+
+#define TXC_LOOPBACKS ((1 << LOOPBACK_PCS) |    \
+                       (1 << LOOPBACK_PMAPMD) | \
+                       (1 << LOOPBACK_PHYXS_WS))
+
+/**************************************************************************
+ *
+ * Compile-time config
+ *
+ **************************************************************************
+ */
+#define TXCNAME "TXC43128"
+/* Total length of time we'll wait for the PHY to come out of reset (ms) */
+#define TXC_MAX_RESET_TIME      500
+/* Interval between checks (ms) */
+#define TXC_RESET_WAIT          10
+/* How long to run BIST (us) */
+#define TXC_BIST_DURATION       50
+
+/**************************************************************************
+ *
+ * Register definitions
+ *
+ **************************************************************************
+ */
+
+/* Command register */
+#define TXC_GLRGS_GLCMD         0xc004
+/* Useful bits in command register */
+/* Lane power-down */
+#define TXC_GLCMD_L01PD_LBN     5
+#define TXC_GLCMD_L23PD_LBN     6
+/* Limited SW reset: preserves configuration but
+ * initiates a logic reset. Self-clearing */
+#define TXC_GLCMD_LMTSWRST_LBN  14
+
+/* Signal Quality Control */
+#define TXC_GLRGS_GSGQLCTL      0xc01a
+/* Enable bit */
+#define TXC_GSGQLCT_SGQLEN_LBN  15
+/* Lane selection */
+#define TXC_GSGQLCT_LNSL_LBN    13
+#define TXC_GSGQLCT_LNSL_WIDTH  2
+
+/* Analog TX control */
+#define TXC_ALRGS_ATXCTL        0xc040
+/* Lane power-down */
+#define TXC_ATXCTL_TXPD3_LBN    15
+#define TXC_ATXCTL_TXPD2_LBN    14
+#define TXC_ATXCTL_TXPD1_LBN    13
+#define TXC_ATXCTL_TXPD0_LBN    12
+
+/* Amplitude on lanes 0, 1 */
+#define TXC_ALRGS_ATXAMP0       0xc041
+/* Amplitude on lanes 2, 3 */
+#define TXC_ALRGS_ATXAMP1       0xc042
+/* Bit position of value for lane 0 (or 2) */
+#define TXC_ATXAMP_LANE02_LBN   3
+/* Bit position of value for lane 1 (or 3) */
+#define TXC_ATXAMP_LANE13_LBN   11
+
+#define TXC_ATXAMP_1280_mV      0
+#define TXC_ATXAMP_1200_mV      8
+#define TXC_ATXAMP_1120_mV      12
+#define TXC_ATXAMP_1060_mV      14
+#define TXC_ATXAMP_0820_mV      25
+#define TXC_ATXAMP_0720_mV      26
+#define TXC_ATXAMP_0580_mV      27
+#define TXC_ATXAMP_0440_mV      28
+
+#define TXC_ATXAMP_0820_BOTH                                    \
+        ((TXC_ATXAMP_0820_mV << TXC_ATXAMP_LANE02_LBN)          \
+         | (TXC_ATXAMP_0820_mV << TXC_ATXAMP_LANE13_LBN))
+
+#define TXC_ATXAMP_DEFAULT      0x6060 /* From databook */
+
+/* Preemphasis on lanes 0, 1 */
+#define TXC_ALRGS_ATXPRE0       0xc043
+/* Preemphasis on lanes 2, 3 */
+#define TXC_ALRGS_ATXPRE1       0xc044
+
+#define TXC_ATXPRE_NONE 0
+#define TXC_ATXPRE_DEFAULT      0x1010 /* From databook */
+
+#define TXC_ALRGS_ARXCTL        0xc045
+/* Lane power-down */
+#define TXC_ARXCTL_RXPD3_LBN    15
+#define TXC_ARXCTL_RXPD2_LBN    14
+#define TXC_ARXCTL_RXPD1_LBN    13
+#define TXC_ARXCTL_RXPD0_LBN    12
+
+/* Main control */
+#define TXC_MRGS_CTL            0xc340
+/* Bits in main control */
+#define TXC_MCTL_RESET_LBN      15      /* Self clear */
+#define TXC_MCTL_TXLED_LBN      14      /* 1 to show align status */
+#define TXC_MCTL_RXLED_LBN      13      /* 1 to show align status */
+
+/* GPIO output */
+#define TXC_GPIO_OUTPUT         0xc346
+#define TXC_GPIO_DIR            0xc348
+
+/* Vendor-specific BIST registers */
+#define TXC_BIST_CTL            0xc280
+#define TXC_BIST_TXFRMCNT       0xc281
+#define TXC_BIST_RX0FRMCNT      0xc282
+#define TXC_BIST_RX1FRMCNT      0xc283
+#define TXC_BIST_RX2FRMCNT      0xc284
+#define TXC_BIST_RX3FRMCNT      0xc285
+#define TXC_BIST_RX0ERRCNT      0xc286
+#define TXC_BIST_RX1ERRCNT      0xc287
+#define TXC_BIST_RX2ERRCNT      0xc288
+#define TXC_BIST_RX3ERRCNT      0xc289
+
+/* BIST type (controls bit patter in test) */
+#define TXC_BIST_CTRL_TYPE_LBN  10
+#define TXC_BIST_CTRL_TYPE_TSD  0       /* TranSwitch Deterministic */
+#define TXC_BIST_CTRL_TYPE_CRP  1       /* CRPAT standard */
+#define TXC_BIST_CTRL_TYPE_CJP  2       /* CJPAT standard */
+#define TXC_BIST_CTRL_TYPE_TSR  3       /* TranSwitch pseudo-random */
+/* Set this to 1 for 10 bit and 0 for 8 bit */
+#define TXC_BIST_CTRL_B10EN_LBN 12
+/* Enable BIST (write 0 to disable) */
+#define TXC_BIST_CTRL_ENAB_LBN  13
+/* Stop BIST (self-clears when stop complete) */
+#define TXC_BIST_CTRL_STOP_LBN  14
+/* Start BIST (cleared by writing 1 to STOP) */
+#define TXC_BIST_CTRL_STRT_LBN  15
+
+/* Mt. Diablo test configuration */
+#define TXC_MTDIABLO_CTRL       0xc34f
+#define TXC_MTDIABLO_CTRL_PMA_LOOP_LBN  10
+
+struct txc43128_data {
+        unsigned long bug10934_timer;
+        enum efx_phy_mode phy_mode;
+        enum efx_loopback_mode loopback_mode;
+};
+
+/* The PHY sometimes needs a reset to bring the link back up.  So long as
+ * it reports link down, we reset it every 5 seconds.
+ */
+#define BUG10934_RESET_INTERVAL (5 * HZ)
+
+/* Perform a reset that doesn't clear configuration changes */
+static void txc_reset_logic(struct efx_nic *efx);
+
+/* Set the output value of a gpio */
+void falcon_txc_set_gpio_val(struct efx_nic *efx, int pin, int on)
+{
+        efx_mdio_set_flag(efx, MDIO_MMD_PHYXS, TXC_GPIO_OUTPUT, 1 << pin, on);
+}
+
+/* Set up the GPIO direction register */
+void falcon_txc_set_gpio_dir(struct efx_nic *efx, int pin, int dir)
+{
+        efx_mdio_set_flag(efx, MDIO_MMD_PHYXS, TXC_GPIO_DIR, 1 << pin, dir);
+}
+
+/* Reset the PMA/PMD MMD. The documentation is explicit that this does a
+ * global reset (it's less clear what reset of other MMDs does).*/
+static int txc_reset_phy(struct efx_nic *efx)
+{
+        int rc = efx_mdio_reset_mmd(efx, MDIO_MMD_PMAPMD,
+                                    TXC_MAX_RESET_TIME / TXC_RESET_WAIT,
+                                    TXC_RESET_WAIT);
+        if (rc < 0)
+                goto fail;
+
+        /* Check that all the MMDs we expect are present and responding. */
+        rc = efx_mdio_check_mmds(efx, TXC_REQUIRED_DEVS, 0);
+        if (rc < 0)
+                goto fail;
+
+        return 0;
+
+fail:
+        netif_err(efx, hw, efx->net_dev, TXCNAME ": reset timed out!\n");
+        return rc;
+}
+
+/* Run a single BIST on one MMD */
+static int txc_bist_one(struct efx_nic *efx, int mmd, int test)
+{
+        int ctrl, bctl;
+        int lane;
+        int rc = 0;
+
+        /* Set PMA to test into loopback using Mt Diablo reg as per app note */
+        ctrl = efx_mdio_read(efx, MDIO_MMD_PCS, TXC_MTDIABLO_CTRL);
+        ctrl |= (1 << TXC_MTDIABLO_CTRL_PMA_LOOP_LBN);
+        efx_mdio_write(efx, MDIO_MMD_PCS, TXC_MTDIABLO_CTRL, ctrl);
+
+        /* The BIST app. note lists these  as 3 distinct steps. */
+        /* Set the BIST type */
+        bctl = (test << TXC_BIST_CTRL_TYPE_LBN);
+        efx_mdio_write(efx, mmd, TXC_BIST_CTL, bctl);
+
+        /* Set the BSTEN bit in the BIST Control register to enable */
+        bctl |= (1 << TXC_BIST_CTRL_ENAB_LBN);
+        efx_mdio_write(efx, mmd, TXC_BIST_CTL, bctl);
+
+        /* Set the BSTRT bit in the BIST Control register */
+        efx_mdio_write(efx, mmd, TXC_BIST_CTL,
+                       bctl | (1 << TXC_BIST_CTRL_STRT_LBN));
+
+        /* Wait. */
+        udelay(TXC_BIST_DURATION);
+
+        /* Set the BSTOP bit in the BIST Control register */
+        bctl |= (1 << TXC_BIST_CTRL_STOP_LBN);
+        efx_mdio_write(efx, mmd, TXC_BIST_CTL, bctl);
+
+        /* The STOP bit should go off when things have stopped */
+        while (bctl & (1 << TXC_BIST_CTRL_STOP_LBN))
+                bctl = efx_mdio_read(efx, mmd, TXC_BIST_CTL);
+
+        /* Check all the error counts are 0 and all the frame counts are
+           non-zero */
+        for (lane = 0; lane < 4; lane++) {
+                int count = efx_mdio_read(efx, mmd, TXC_BIST_RX0ERRCNT + lane);
+                if (count != 0) {
+                        netif_err(efx, hw, efx->net_dev, TXCNAME": BIST error. "
+                                  "Lane %d had %d errs\n", lane, count);
+                        rc = -EIO;
+                }
+                count = efx_mdio_read(efx, mmd, TXC_BIST_RX0FRMCNT + lane);
+                if (count == 0) {
+                        netif_err(efx, hw, efx->net_dev, TXCNAME": BIST error. "
+                                  "Lane %d got 0 frames\n", lane);
+                        rc = -EIO;
+                }
+        }
+
+        if (rc == 0)
+                netif_info(efx, hw, efx->net_dev, TXCNAME": BIST pass\n");
+
+        /* Disable BIST */
+        efx_mdio_write(efx, mmd, TXC_BIST_CTL, 0);
+
+        /* Turn off loopback */
+        ctrl &= ~(1 << TXC_MTDIABLO_CTRL_PMA_LOOP_LBN);
+        efx_mdio_write(efx, MDIO_MMD_PCS, TXC_MTDIABLO_CTRL, ctrl);
+
+        return rc;
+}
+
+static int txc_bist(struct efx_nic *efx)
+{
+        return txc_bist_one(efx, MDIO_MMD_PCS, TXC_BIST_CTRL_TYPE_TSD);
+}
+
+/* Push the non-configurable defaults into the PHY. This must be
+ * done after every full reset */
+static void txc_apply_defaults(struct efx_nic *efx)
+{
+        int mctrl;
+
+        /* Turn amplitude down and preemphasis off on the host side
+         * (PHY<->MAC) as this is believed less likely to upset Falcon
+         * and no adverse effects have been noted. It probably also
+         * saves a picowatt or two */
+
+        /* Turn off preemphasis */
+        efx_mdio_write(efx, MDIO_MMD_PHYXS, TXC_ALRGS_ATXPRE0, TXC_ATXPRE_NONE);
+        efx_mdio_write(efx, MDIO_MMD_PHYXS, TXC_ALRGS_ATXPRE1, TXC_ATXPRE_NONE);
+
+        /* Turn down the amplitude */
+        efx_mdio_write(efx, MDIO_MMD_PHYXS,
+                       TXC_ALRGS_ATXAMP0, TXC_ATXAMP_0820_BOTH);
+        efx_mdio_write(efx, MDIO_MMD_PHYXS,
+                       TXC_ALRGS_ATXAMP1, TXC_ATXAMP_0820_BOTH);
+
+        /* Set the line side amplitude and preemphasis to the databook
+         * defaults as an erratum causes them to be 0 on at least some
+         * PHY rev.s */
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD,
+                       TXC_ALRGS_ATXPRE0, TXC_ATXPRE_DEFAULT);
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD,
+                       TXC_ALRGS_ATXPRE1, TXC_ATXPRE_DEFAULT);
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD,
+                       TXC_ALRGS_ATXAMP0, TXC_ATXAMP_DEFAULT);
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD,
+                       TXC_ALRGS_ATXAMP1, TXC_ATXAMP_DEFAULT);
+
+        /* Set up the LEDs  */
+        mctrl = efx_mdio_read(efx, MDIO_MMD_PHYXS, TXC_MRGS_CTL);
+
+        /* Set the Green and Red LEDs to their default modes */
+        mctrl &= ~((1 << TXC_MCTL_TXLED_LBN) | (1 << TXC_MCTL_RXLED_LBN));
+        efx_mdio_write(efx, MDIO_MMD_PHYXS, TXC_MRGS_CTL, mctrl);
+
+        /* Databook recommends doing this after configuration changes */
+        txc_reset_logic(efx);
+
+        falcon_board(efx)->type->init_phy(efx);
+}
+
+static int txc43128_phy_probe(struct efx_nic *efx)
+{
+        struct txc43128_data *phy_data;
+
+        /* Allocate phy private storage */
+        phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
+        if (!phy_data)
+                return -ENOMEM;
+        efx->phy_data = phy_data;
+        phy_data->phy_mode = efx->phy_mode;
+
+        efx->mdio.mmds = TXC_REQUIRED_DEVS;
+        efx->mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
+
+        efx->loopback_modes = TXC_LOOPBACKS | FALCON_XMAC_LOOPBACKS;
+
+        return 0;
+}
+
+/* Initialisation entry point for this PHY driver */
+static int txc43128_phy_init(struct efx_nic *efx)
+{
+        int rc;
+
+        rc = txc_reset_phy(efx);
+        if (rc < 0)
+                return rc;
+
+        rc = txc_bist(efx);
+        if (rc < 0)
+                return rc;
+
+        txc_apply_defaults(efx);
+
+        return 0;
+}
+
+/* Set the lane power down state in the global registers */
+static void txc_glrgs_lane_power(struct efx_nic *efx, int mmd)
+{
+        int pd = (1 << TXC_GLCMD_L01PD_LBN) | (1 << TXC_GLCMD_L23PD_LBN);
+        int ctl = efx_mdio_read(efx, mmd, TXC_GLRGS_GLCMD);
+
+        if (!(efx->phy_mode & PHY_MODE_LOW_POWER))
+                ctl &= ~pd;
+        else
+                ctl |= pd;
+
+        efx_mdio_write(efx, mmd, TXC_GLRGS_GLCMD, ctl);
+}
+
+/* Set the lane power down state in the analog control registers */
+static void txc_analog_lane_power(struct efx_nic *efx, int mmd)
+{
+        int txpd = (1 << TXC_ATXCTL_TXPD3_LBN) | (1 << TXC_ATXCTL_TXPD2_LBN)
+                | (1 << TXC_ATXCTL_TXPD1_LBN) | (1 << TXC_ATXCTL_TXPD0_LBN);
+        int rxpd = (1 << TXC_ARXCTL_RXPD3_LBN) | (1 << TXC_ARXCTL_RXPD2_LBN)
+                | (1 << TXC_ARXCTL_RXPD1_LBN) | (1 << TXC_ARXCTL_RXPD0_LBN);
+        int txctl = efx_mdio_read(efx, mmd, TXC_ALRGS_ATXCTL);
+        int rxctl = efx_mdio_read(efx, mmd, TXC_ALRGS_ARXCTL);
+
+        if (!(efx->phy_mode & PHY_MODE_LOW_POWER)) {
+                txctl &= ~txpd;
+                rxctl &= ~rxpd;
+        } else {
+                txctl |= txpd;
+                rxctl |= rxpd;
+        }
+
+        efx_mdio_write(efx, mmd, TXC_ALRGS_ATXCTL, txctl);
+        efx_mdio_write(efx, mmd, TXC_ALRGS_ARXCTL, rxctl);
+}
+
+static void txc_set_power(struct efx_nic *efx)
+{
+        /* According to the data book, all the MMDs can do low power */
+        efx_mdio_set_mmds_lpower(efx,
+                                 !!(efx->phy_mode & PHY_MODE_LOW_POWER),
+                                 TXC_REQUIRED_DEVS);
+
+        /* Global register bank is in PCS, PHY XS. These control the host
+         * side and line side settings respectively. */
+        txc_glrgs_lane_power(efx, MDIO_MMD_PCS);
+        txc_glrgs_lane_power(efx, MDIO_MMD_PHYXS);
+
+        /* Analog register bank in PMA/PMD, PHY XS */
+        txc_analog_lane_power(efx, MDIO_MMD_PMAPMD);
+        txc_analog_lane_power(efx, MDIO_MMD_PHYXS);
+}
+
+static void txc_reset_logic_mmd(struct efx_nic *efx, int mmd)
+{
+        int val = efx_mdio_read(efx, mmd, TXC_GLRGS_GLCMD);
+        int tries = 50;
+
+        val |= (1 << TXC_GLCMD_LMTSWRST_LBN);
+        efx_mdio_write(efx, mmd, TXC_GLRGS_GLCMD, val);
+        while (tries--) {
+                val = efx_mdio_read(efx, mmd, TXC_GLRGS_GLCMD);
+                if (!(val & (1 << TXC_GLCMD_LMTSWRST_LBN)))
+                        break;
+                udelay(1);
+        }
+        if (!tries)
+                netif_info(efx, hw, efx->net_dev,
+                           TXCNAME " Logic reset timed out!\n");
+}
+
+/* Perform a logic reset. This preserves the configuration registers
+ * and is needed for some configuration changes to take effect */
+static void txc_reset_logic(struct efx_nic *efx)
+{
+        /* The data sheet claims we can do the logic reset on either the
+         * PCS or the PHYXS and the result is a reset of both host- and
+         * line-side logic. */
+        txc_reset_logic_mmd(efx, MDIO_MMD_PCS);
+}
+
+static bool txc43128_phy_read_link(struct efx_nic *efx)
+{
+        return efx_mdio_links_ok(efx, TXC_REQUIRED_DEVS);
+}
+
+static int txc43128_phy_reconfigure(struct efx_nic *efx)
+{
+        struct txc43128_data *phy_data = efx->phy_data;
+        enum efx_phy_mode mode_change = efx->phy_mode ^ phy_data->phy_mode;
+        bool loop_change = LOOPBACK_CHANGED(phy_data, efx, TXC_LOOPBACKS);
+
+        if (efx->phy_mode & mode_change & PHY_MODE_TX_DISABLED) {
+                txc_reset_phy(efx);
+                txc_apply_defaults(efx);
+                falcon_reset_xaui(efx);
+                mode_change &= ~PHY_MODE_TX_DISABLED;
+        }
+
+        efx_mdio_transmit_disable(efx);
+        efx_mdio_phy_reconfigure(efx);
+        if (mode_change & PHY_MODE_LOW_POWER)
+                txc_set_power(efx);
+
+        /* The data sheet claims this is required after every reconfiguration
+         * (note at end of 7.1), but we mustn't do it when nothing changes as
+         * it glitches the link, and reconfigure gets called on link change,
+         * so we get an IRQ storm on link up. */
+        if (loop_change || mode_change)
+                txc_reset_logic(efx);
+
+        phy_data->phy_mode = efx->phy_mode;
+        phy_data->loopback_mode = efx->loopback_mode;
+
+        return 0;
+}
+
+static void txc43128_phy_fini(struct efx_nic *efx)
+{
+        /* Disable link events */
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD, MDIO_PMA_LASI_CTRL, 0);
+}
+
+static void txc43128_phy_remove(struct efx_nic *efx)
+{
+        kfree(efx->phy_data);
+        efx->phy_data = NULL;
+}
+
+/* Periodic callback: this exists mainly to poll link status as we
+ * don't use LASI interrupts */
+static bool txc43128_phy_poll(struct efx_nic *efx)
+{
+        struct txc43128_data *data = efx->phy_data;
+        bool was_up = efx->link_state.up;
+
+        efx->link_state.up = txc43128_phy_read_link(efx);
+        efx->link_state.speed = 10000;
+        efx->link_state.fd = true;
+        efx->link_state.fc = efx->wanted_fc;
+
+        if (efx->link_state.up || (efx->loopback_mode != LOOPBACK_NONE)) {
+                data->bug10934_timer = jiffies;
+        } else {
+                if (time_after_eq(jiffies, (data->bug10934_timer +
+                                            BUG10934_RESET_INTERVAL))) {
+                        data->bug10934_timer = jiffies;
+                        txc_reset_logic(efx);
+                }
+        }
+
+        return efx->link_state.up != was_up;
+}
+
+static const char *txc43128_test_names[] = {
+        "bist"
+};
+
+static const char *txc43128_test_name(struct efx_nic *efx, unsigned int index)
+{
+        if (index < ARRAY_SIZE(txc43128_test_names))
+                return txc43128_test_names[index];
+        return NULL;
+}
+
+static int txc43128_run_tests(struct efx_nic *efx, int *results, unsigned flags)
+{
+        int rc;
+
+        if (!(flags & ETH_TEST_FL_OFFLINE))
+                return 0;
+
+        rc = txc_reset_phy(efx);
+        if (rc < 0)
+                return rc;
+
+        rc = txc_bist(efx);
+        txc_apply_defaults(efx);
+        results[0] = rc ? -1 : 1;
+        return rc;
+}
+
+static void txc43128_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+{
+        mdio45_ethtool_gset(&efx->mdio, ecmd);
+}
+
+struct efx_phy_operations falcon_txc_phy_ops = {
+        .probe          = txc43128_phy_probe,
+        .init           = txc43128_phy_init,
+        .reconfigure    = txc43128_phy_reconfigure,
+        .poll           = txc43128_phy_poll,
+        .fini           = txc43128_phy_fini,
+        .remove         = txc43128_phy_remove,
+        .get_settings   = txc43128_get_settings,
+        .set_settings   = efx_mdio_set_settings,
+        .test_alive     = efx_mdio_test_alive,
+        .run_tests      = txc43128_run_tests,
+        .test_name      = txc43128_test_name,
+};
diff --git a/drivers/net/sfc/workarounds.h b/drivers/net/sfc/workarounds.h
index 782e45a613d6..e0d63083c3a8 100644
--- a/drivers/net/sfc/workarounds.h
+++ b/drivers/net/sfc/workarounds.h
@@ -19,9 +19,7 @@
 #define EFX_WORKAROUND_FALCON_A(efx) (efx_nic_rev(efx) <= EFX_REV_FALCON_A1)
 #define EFX_WORKAROUND_FALCON_AB(efx) (efx_nic_rev(efx) <= EFX_REV_FALCON_B0)
 #define EFX_WORKAROUND_SIENA(efx) (efx_nic_rev(efx) == EFX_REV_SIENA_A0)
-#define EFX_WORKAROUND_10G(efx) EFX_IS10G(efx)
-#define EFX_WORKAROUND_SFT9001(efx) ((efx)->phy_type == PHY_TYPE_SFT9001A || \
-                                     (efx)->phy_type == PHY_TYPE_SFT9001B)
+#define EFX_WORKAROUND_10G(efx) 1
 
 /* XAUI resets if link not detected */
 #define EFX_WORKAROUND_5147 EFX_WORKAROUND_ALWAYS
@@ -58,9 +56,4 @@
 /* Leak overlength packets rather than free */
 #define EFX_WORKAROUND_8071 EFX_WORKAROUND_FALCON_A
 
-/* Need to send XNP pages for 100BaseT */
-#define EFX_WORKAROUND_13204 EFX_WORKAROUND_SFT9001
-/* Don't restart AN in near-side loopback */
-#define EFX_WORKAROUND_15195 EFX_WORKAROUND_SFT9001
-
 #endif /* EFX_WORKAROUNDS_H */
diff --git a/drivers/net/sgiseeq.c b/drivers/net/sgiseeq.c
index cc4bd8c65f8b..9265315baa0b 100644
--- a/drivers/net/sgiseeq.c
+++ b/drivers/net/sgiseeq.c
@@ -804,7 +804,7 @@ static int __devinit sgiseeq_probe(struct platform_device *pdev)
 err_out_free_page:
         free_page((unsigned long) sp->srings);
 err_out_free_dev:
-        kfree(dev);
+        free_netdev(dev);
 
 err_out:
         return err;
diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index ffdd8591d4bc..581836867098 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -832,7 +832,7 @@ static u16 __devinit read_eeprom(long ioaddr, int location)
         outl(0, ee_addr);
         eeprom_delay();
 
-        return (retval);
+        return retval;
 }
 
 /* Read and write the MII management registers using software-generated
@@ -2247,9 +2247,9 @@ static inline u16 sis900_mcast_bitnr(u8 *addr, u8 revision)
 
         /* leave 8 or 7 most siginifant bits */
         if ((revision >= SIS635A_900_REV) || (revision == SIS900B_900_REV))
-                return ((int)(crc >> 24));
+                return (int)(crc >> 24);
         else
-                return ((int)(crc >> 25));
+                return (int)(crc >> 25);
 }
 
 /**
diff --git a/drivers/net/skfp/cfm.c b/drivers/net/skfp/cfm.c
index 5310d39b5737..e395ace3120b 100644
--- a/drivers/net/skfp/cfm.c
+++ b/drivers/net/skfp/cfm.c
@@ -542,8 +542,8 @@ static void cfm_fsm(struct s_smc *smc, int cmd)
  */
 int cfm_get_mac_input(struct s_smc *smc)
 {
-        return((smc->mib.fddiSMTCF_State == SC10_C_WRAP_B ||
-                smc->mib.fddiSMTCF_State == SC5_THRU_B) ? PB : PA) ;
+        return (smc->mib.fddiSMTCF_State == SC10_C_WRAP_B ||
+                smc->mib.fddiSMTCF_State == SC5_THRU_B) ? PB : PA;
 }
 
 /*
@@ -553,8 +553,8 @@ int cfm_get_mac_input(struct s_smc *smc)
  */
 int cfm_get_mac_output(struct s_smc *smc)
 {
-        return((smc->mib.fddiSMTCF_State == SC10_C_WRAP_B ||
-                smc->mib.fddiSMTCF_State == SC4_THRU_A) ? PB : PA) ;
+        return (smc->mib.fddiSMTCF_State == SC10_C_WRAP_B ||
+                smc->mib.fddiSMTCF_State == SC4_THRU_A) ? PB : PA;
 }
 
 static char path_iso[] = {
@@ -623,5 +623,5 @@ int cem_build_path(struct s_smc *smc, char *to, int path_index)
 
         LINT_USE(path_index);
 
-        return(len) ;
+        return len;
 }
diff --git a/drivers/net/skfp/drvfbi.c b/drivers/net/skfp/drvfbi.c
index c77cc14b3227..07da97c303d6 100644
--- a/drivers/net/skfp/drvfbi.c
+++ b/drivers/net/skfp/drvfbi.c
@@ -267,7 +267,7 @@ void timer_irq(struct s_smc *smc)
 int pcm_get_s_port(struct s_smc *smc)
 {
         SK_UNUSED(smc) ;
-        return(PS) ;
+        return PS;
 }
 
 /*
@@ -366,7 +366,7 @@ void sm_pm_bypass_req(struct s_smc *smc, int mode)
  */
 int sm_pm_bypass_present(struct s_smc *smc)
 {
-        return( (inp(ADDR(B0_DAS)) & DAS_BYP_ST) ? TRUE: FALSE) ;
+        return (inp(ADDR(B0_DAS)) & DAS_BYP_ST) ? TRUE : FALSE;
 }
 
 void plc_clear_irq(struct s_smc *smc, int p)
@@ -483,9 +483,9 @@ static int is_equal_num(char comp1[], char comp2[], int num)
 
         for (i = 0 ; i < num ; i++) {
                 if (comp1[i] != comp2[i])
-                        return (0) ;
+                        return 0;
         }
-                return (1) ;
+                return 1;
 }       /* is_equal_num */
 
 
@@ -522,18 +522,18 @@ int set_oi_id_def(struct s_smc *smc)
                         i++ ;
                         break ;                 /* entry ok */
                 default:
-                        return (1) ;            /* invalid oi_status */
+                        return 1;               /* invalid oi_status */
                 }
         }
 
         if (i == 0)
-                return (2) ;
+                return 2;
         if (!act_entries)
-                return (3) ;
+                return 3;
 
         /* ok, we have a valid OEM data base with an active entry */
         smc->hw.oem_id = (struct s_oem_ids *)  &oem_ids[sel_id] ;
-        return (0) ;
+        return 0;
 }
 #endif  /* MULT_OEM */
 
diff --git a/drivers/net/skfp/ess.c b/drivers/net/skfp/ess.c
index e8387d25f24a..8639a0884f5c 100644
--- a/drivers/net/skfp/ess.c
+++ b/drivers/net/skfp/ess.c
@@ -135,7 +135,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
          */
         if (!(p = (void *) sm_to_para(smc,sm,SMT_P0015))) {
                 DB_ESS("ESS: RAF frame error, parameter type not found\n",0,0) ;
-                return(fs) ;
+                return fs;
         }
         msg_res_type = ((struct smt_p_0015 *)p)->res_type ;
 
@@ -147,7 +147,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  * error in frame: para ESS command was not found
                  */
                  DB_ESS("ESS: RAF frame error, parameter command not found\n",0,0);
-                 return(fs) ;
+                 return fs;
         }
 
         DB_ESSN(2,"fc %x        ft %x\n",sm->smt_class,sm->smt_type) ;
@@ -175,12 +175,12 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                          * local and no static allocation is used
                          */
                         if (!local || smc->mib.fddiESSPayload)
-                                return(fs) ;
+                                return fs;
                         
                         p = (void *) sm_to_para(smc,sm,SMT_P0019)  ;
                         for (i = 0; i < 5; i++) {
                                 if (((struct smt_p_0019 *)p)->alloc_addr.a[i]) {
-                                        return(fs) ;
+                                        return fs;
                                 }
                         }
 
@@ -199,10 +199,10 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                         sm->smt_dest = smt_sba_da ;
 
                         if (smc->ess.local_sba_active)
-                                return(fs | I_INDICATOR) ;
+                                return fs | I_INDICATOR;
 
                         if (!(db = smt_get_mbuf(smc)))
-                                return(fs) ;
+                                return fs;
 
                         db->sm_len = mb->sm_len ;
                         db->sm_off = mb->sm_off ;
@@ -212,7 +212,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                                 (struct smt_header *)(db->sm_data+db->sm_off),
                                 "RAF") ;
                         smt_send_frame(smc,db,FC_SMT_INFO,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -221,7 +221,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 if (smt_check_para(smc,sm,plist_raf_alc_res)) {
                         DB_ESS("ESS: RAF with para problem, ignoring\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -242,7 +242,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                         (sm->smt_tid != smc->ess.alloc_trans_id)) {
 
                         DB_ESS("ESS: Allocation Responce not accepted\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -268,7 +268,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 (void)process_bw_alloc(smc,(long)payload,(long)overhead) ;
 
-                return(fs) ;
+                return fs;
                 /* end of Process Allocation Request */
 
         /*
@@ -280,7 +280,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 if (sm->smt_type != SMT_REQUEST) {
                         DB_ESS("ESS: Do not process Change Responses\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -288,7 +288,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 if (smt_check_para(smc,sm,plist_raf_chg_req)) {
                         DB_ESS("ESS: RAF with para problem, ignoring\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -300,7 +300,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                 if ((((struct smt_p_320b *)sm_to_para(smc,sm,SMT_P320B))->path_index
                         != PRIMARY_RING) || (msg_res_type != SYNC_BW)) {
                         DB_ESS("ESS: RAF frame with para problem, ignoring\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -319,14 +319,14 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  * process the bandwidth allocation
                  */
                 if(!process_bw_alloc(smc,(long)payload,(long)overhead))
-                        return(fs) ;
+                        return fs;
 
                 /*
                  * send an RAF Change Reply
                  */
                 ess_send_response(smc,sm,CHANGE_ALLOCATION) ;
 
-                return(fs) ;
+                return fs;
                 /* end of Process Change Request */
 
         /*
@@ -338,7 +338,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 if (sm->smt_type != SMT_REQUEST) {
                         DB_ESS("ESS: Do not process a Report Reply\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 DB_ESSN(2,"ESS: Report Request from %s\n",
@@ -349,7 +349,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 if (msg_res_type != SYNC_BW) {
                         DB_ESS("ESS: ignoring RAF with para problem\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -357,7 +357,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 ess_send_response(smc,sm,REPORT_ALLOCATION) ;
 
-                return(fs) ;
+                return fs;
                 /* end of Process Report Request */
 
         default:
@@ -368,7 +368,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                 break ;
         }
 
-        return(fs) ;
+        return fs;
 }
 
 /*
@@ -418,17 +418,17 @@ static int process_bw_alloc(struct s_smc *smc, long int payload, long int overhe
          */
 /*      if (smt_set_obj(smc,SMT_P320F,payload,S_SET)) {
                 DB_ESS("ESS: SMT does not accept the payload value\n",0,0) ;
-                return(FALSE) ;
+                return FALSE;
         }
         if (smt_set_obj(smc,SMT_P3210,overhead,S_SET)) {
                 DB_ESS("ESS: SMT does not accept the overhead value\n",0,0) ;
-                return(FALSE) ;
+                return FALSE;
         } */
 
         /* premliminary */
         if (payload > MAX_PAYLOAD || overhead > 5000) {
                 DB_ESS("ESS: payload / overhead not accepted\n",0,0) ;
-                return(FALSE) ;
+                return FALSE;
         }
 
         /*
@@ -468,7 +468,7 @@ static int process_bw_alloc(struct s_smc *smc, long int payload, long int overhe
 
         ess_config_fifo(smc) ;
         set_formac_tsync(smc,smc->ess.sync_bw) ;
-        return(TRUE) ;
+        return TRUE;
 }
 
 static void ess_send_response(struct s_smc *smc, struct smt_header *sm,
diff --git a/drivers/net/skfp/fplustm.c b/drivers/net/skfp/fplustm.c
index 9d8d1ac48176..ca4e7bb6a5a8 100644
--- a/drivers/net/skfp/fplustm.c
+++ b/drivers/net/skfp/fplustm.c
@@ -112,8 +112,8 @@ static u_long mac_get_tneg(struct s_smc *smc)
         u_long  tneg ;
 
         tneg = (u_long)((long)inpw(FM_A(FM_TNEG))<<5) ;
-        return((u_long)((tneg + ((inpw(FM_A(FM_TMRS))>>10)&0x1f)) |
-                0xffe00000L)) ;
+        return (u_long)((tneg + ((inpw(FM_A(FM_TMRS))>>10)&0x1f)) |
+                0xffe00000L) ;
 }
 
 void mac_update_counter(struct s_smc *smc)
@@ -163,7 +163,7 @@ static u_long read_mdr(struct s_smc *smc, unsigned int addr)
                         /* is used */
         p = (u_long)inpw(FM_A(FM_MDRU))<<16 ;
         p += (u_long)inpw(FM_A(FM_MDRL)) ;
-        return(p) ;
+        return p;
 }
 #endif
 
@@ -887,7 +887,7 @@ int init_fplus(struct s_smc *smc)
         /* make sure all PCI settings are correct */
         mac_do_pci_fix(smc) ;
 
-        return(init_mac(smc,1)) ;
+        return init_mac(smc, 1);
         /* enable_formac(smc) ; */
 }
 
@@ -989,7 +989,7 @@ static int init_mac(struct s_smc *smc, int all)
         }
         smc->hw.hw_state = STARTED ;
 
-        return(0) ;
+        return 0;
 }
 
 
@@ -1049,7 +1049,7 @@ void sm_ma_control(struct s_smc *smc, int mode)
 
 int sm_mac_get_tx_state(struct s_smc *smc)
 {
-        return((inpw(FM_A(FM_STMCHN))>>4)&7) ;
+        return (inpw(FM_A(FM_STMCHN))>>4) & 7;
 }
 
 /*
@@ -1084,9 +1084,9 @@ static struct s_fpmc* mac_get_mc_table(struct s_smc *smc,
                 }
                 if (memcmp((char *)&tb->a,(char *)own,6))
                         continue ;
-                return(tb) ;
+                return tb;
         }
-        return(slot) ;                  /* return first free or NULL */
+        return slot;                    /* return first free or NULL */
 }
 
 /*
@@ -1152,12 +1152,12 @@ int mac_add_multicast(struct s_smc *smc, struct fddi_addr *addr, int can)
          */
         if (can & 0x80) {
                 if (smc->hw.fp.smt_slots_used >= SMT_MAX_MULTI) {
-                        return(1) ;
+                        return 1;
                 }
         }
         else {
                 if (smc->hw.fp.os_slots_used >= FPMAX_MULTICAST-SMT_MAX_MULTI) {
-                        return(1) ;
+                        return 1;
                 }
         }
 
@@ -1165,7 +1165,7 @@ int mac_add_multicast(struct s_smc *smc, struct fddi_addr *addr, int can)
          * find empty slot
          */
         if (!(tb = mac_get_mc_table(smc,addr,&own,0,can & ~0x80)))
-                return(1) ;
+                return 1;
         tb->n++ ;
         tb->a = own ;
         tb->perm = (can & 0x80) ? 1 : 0 ;
@@ -1175,7 +1175,7 @@ int mac_add_multicast(struct s_smc *smc, struct fddi_addr *addr, int can)
         else
                 smc->hw.fp.os_slots_used++ ;
 
-        return(0) ;
+        return 0;
 }
 
 /*
diff --git a/drivers/net/skfp/hwmtm.c b/drivers/net/skfp/hwmtm.c
index d322f1b702ac..af5a755e269d 100644
--- a/drivers/net/skfp/hwmtm.c
+++ b/drivers/net/skfp/hwmtm.c
@@ -232,16 +232,16 @@ u_int mac_drv_check_space(void)
 #ifdef  COMMON_MB_POOL
         call_count++ ;
         if (call_count == 1) {
-                return(EXT_VIRT_MEM) ;
+                return EXT_VIRT_MEM;
         }
         else {
-                return(EXT_VIRT_MEM_2) ;
+                return EXT_VIRT_MEM_2;
         }
 #else
-        return (EXT_VIRT_MEM) ;
+        return EXT_VIRT_MEM;
 #endif
 #else
-        return (0) ;
+        return 0;
 #endif
 }
 
@@ -271,7 +271,7 @@ int mac_drv_init(struct s_smc *smc)
         if (!(smc->os.hwm.descr_p = (union s_fp_descr volatile *)
                 mac_drv_get_desc_mem(smc,(u_int)
                 (RXD_TXD_COUNT+1)*sizeof(struct s_smt_fp_txd)))) {
-                return(1) ;     /* no space the hwm modul can't work */
+                return 1;       /* no space the hwm modul can't work */
         }
 
         /*
@@ -283,18 +283,18 @@ int mac_drv_init(struct s_smc *smc)
 #ifndef COMMON_MB_POOL
         if (!(smc->os.hwm.mbuf_pool.mb_start = (SMbuf *) mac_drv_get_space(smc,
                 MAX_MBUF*sizeof(SMbuf)))) {
-                return(1) ;     /* no space the hwm modul can't work */
+                return 1;       /* no space the hwm modul can't work */
         }
 #else
         if (!mb_start) {
                 if (!(mb_start = (SMbuf *) mac_drv_get_space(smc,
                         MAX_MBUF*sizeof(SMbuf)))) {
-                        return(1) ;     /* no space the hwm modul can't work */
+                        return 1;       /* no space the hwm modul can't work */
                 }
         }
 #endif
 #endif
-        return (0) ;
+        return 0;
 }
 
 /*
@@ -349,7 +349,7 @@ static u_long init_descr_ring(struct s_smc *smc,
                 DRV_BUF_FLUSH(&d1->r,DDI_DMA_SYNC_FORDEV) ;
                 d1++;
         }
-        return(phys) ;
+        return phys;
 }
 
 static void init_txd_ring(struct s_smc *smc)
@@ -502,7 +502,7 @@ SMbuf *smt_get_mbuf(struct s_smc *smc)
                 mb->sm_use_count = 1 ;
         }
         DB_GEN("get SMbuf: mb = %x",(void *)mb,0,3) ;
-        return (mb) ;   /* May be NULL */
+        return mb;      /* May be NULL */
 }
 
 void smt_free_mbuf(struct s_smc *smc, SMbuf *mb)
@@ -621,7 +621,7 @@ static u_long repair_txd_ring(struct s_smc *smc, struct s_smt_tx_queue *queue)
                 t = t->txd_next ;
                 tx_used-- ;
         }
-        return(phys) ;
+        return phys;
 }
 
 /*
@@ -673,7 +673,7 @@ static u_long repair_rxd_ring(struct s_smc *smc, struct s_smt_rx_queue *queue)
                 r = r->rxd_next ;
                 rx_used-- ;
         }
-        return(phys) ;
+        return phys;
 }
 
 
@@ -1595,7 +1595,7 @@ int hwm_tx_init(struct s_smc *smc, u_char fc, int frag_count, int frame_len,
         }
         DB_TX("frame_status = %x",frame_status,0,3) ;
         NDD_TRACE("THiE",frame_status,smc->os.hwm.tx_p->tx_free,0) ;
-        return(frame_status) ;
+        return frame_status;
 }
 
 /*
@@ -1764,7 +1764,7 @@ static SMbuf *get_llc_rx(struct s_smc *smc)
                 smc->os.hwm.llc_rx_pipe = mb->sm_next ;
         }
         DB_GEN("get_llc_rx: mb = 0x%x",(void *)mb,0,4) ;
-        return(mb) ;
+        return mb;
 }
 
 /*
@@ -1797,7 +1797,7 @@ static SMbuf *get_txd_mb(struct s_smc *smc)
                 smc->os.hwm.txd_tx_pipe = mb->sm_next ;
         }
         DB_GEN("get_txd_mb: mb = 0x%x",(void *)mb,0,4) ;
-        return(mb) ;
+        return mb;
 }
 
 /*
diff --git a/drivers/net/skfp/hwt.c b/drivers/net/skfp/hwt.c
index 053151468f93..e6baa53307c7 100644
--- a/drivers/net/skfp/hwt.c
+++ b/drivers/net/skfp/hwt.c
@@ -179,7 +179,7 @@ u_long hwt_read(struct s_smc *smc)
                 else
                         smc->hw.t_stop = smc->hw.t_start - tr ;
         }
-        return (smc->hw.t_stop) ;
+        return smc->hw.t_stop;
 }
 
 #ifdef  PCI
@@ -208,7 +208,7 @@ u_long hwt_quick_read(struct s_smc *smc)
         outpw(ADDR(B2_TI_CRTL), TIM_START) ;
         outpd(ADDR(B2_TI_INI),interval) ;
 
-        return(time) ;
+        return time;
 }
 
 /************************
diff --git a/drivers/net/skfp/pcmplc.c b/drivers/net/skfp/pcmplc.c
index ba45bc794d77..112d35b1bf0e 100644
--- a/drivers/net/skfp/pcmplc.c
+++ b/drivers/net/skfp/pcmplc.c
@@ -504,7 +504,7 @@ int sm_pm_get_ls(struct s_smc *smc, int phy)
 
 #ifdef  CONCENTRATOR
         if (!plc_is_installed(smc,phy))
-                return(PC_QLS) ;
+                return PC_QLS;
 #endif
 
         state = inpw(PLC(phy,PL_STATUS_A)) & PL_LINE_ST ;
@@ -528,7 +528,7 @@ int sm_pm_get_ls(struct s_smc *smc, int phy)
         default :
                 state = PC_LS_NONE ;
         }
-        return(state) ;
+        return state;
 }
 
 static int plc_send_bits(struct s_smc *smc, struct s_phy *phy, int len)
@@ -547,7 +547,7 @@ static int plc_send_bits(struct s_smc *smc, struct s_phy *phy, int len)
 #if     0
                 printf("PL_PCM_SIGNAL is set\n") ;
 #endif
-                return(1) ;
+                return 1;
         }
         /* write bit[n] & length = 1 to regs */
         outpw(PLC(np,PL_VECTOR_LEN),len-1) ;    /* len=nr-1 */
@@ -562,7 +562,7 @@ static int plc_send_bits(struct s_smc *smc, struct s_phy *phy, int len)
                 printf("SIGNALING bit %d .. %d\n",phy->bitn,phy->bitn+len-1) ;
 #endif
 #endif
-        return(0) ;
+        return 0;
 }
 
 /*
@@ -1590,12 +1590,12 @@ int pcm_status_twisted(struct s_smc *smc)
 {
         int     twist = 0 ;
         if (smc->s.sas != SMT_DAS)
-                return(0) ;
+                return 0;
         if (smc->y[PA].twisted && (smc->y[PA].mib->fddiPORTPCMState == PC8_ACTIVE))
                 twist |= 1 ;
         if (smc->y[PB].twisted && (smc->y[PB].mib->fddiPORTPCMState == PC8_ACTIVE))
                 twist |= 2 ;
-        return(twist) ;
+        return twist;
 }
 
 /*
@@ -1636,9 +1636,9 @@ int pcm_rooted_station(struct s_smc *smc)
         for (n = 0 ; n < NUMPHYS ; n++) {
                 if (smc->y[n].mib->fddiPORTPCMState == PC8_ACTIVE &&
                     smc->y[n].mib->fddiPORTNeighborType == TM)
-                        return(0) ;
+                        return 0;
         }
-        return(1) ;
+        return 1;
 }
 
 /*
@@ -1915,7 +1915,7 @@ int get_pcm_state(struct s_smc *smc, int np)
                 case PL_PC9 :   pcs = PC_MAINT ;        break ;
                 default :       pcs = PC_DISABLE ;      break ;
         }
-        return(pcs) ;
+        return pcs;
 }
 
 char *get_linestate(struct s_smc *smc, int np)
@@ -1937,7 +1937,7 @@ char *get_linestate(struct s_smc *smc, int np)
                 default:        ls = "unknown" ; break ;
 #endif
         }
-        return(ls) ;
+        return ls;
 }
 
 char *get_pcmstate(struct s_smc *smc, int np)
@@ -1959,7 +1959,7 @@ char *get_pcmstate(struct s_smc *smc, int np)
                 case PL_PC9 :   pcs = "MAINT" ;         break ;
                 default :       pcs = "UNKNOWN" ;       break ;
         }
-        return(pcs) ;
+        return pcs;
 }
 
 void list_phy(struct s_smc *smc)
diff --git a/drivers/net/skfp/pmf.c b/drivers/net/skfp/pmf.c
index a320fdb3727d..9ac4665d7411 100644
--- a/drivers/net/skfp/pmf.c
+++ b/drivers/net/skfp/pmf.c
@@ -328,7 +328,7 @@ static SMbuf *smt_build_pmf_response(struct s_smc *smc, struct smt_header *req,
          * build SMT header
          */
         if (!(mb = smt_get_mbuf(smc)))
-                return(mb) ;
+                return mb;
 
         smt = smtod(mb, struct smt_header *) ;
         smt->smt_dest = req->smt_source ;       /* DA == source of request */
@@ -493,7 +493,7 @@ static SMbuf *smt_build_pmf_response(struct s_smc *smc, struct smt_header *req,
                 smt_add_para(smc,&set_pcon,(u_short) SMT_P1035,0,0) ;
                 smt_add_para(smc,&set_pcon,(u_short) SMT_P1036,0,0) ;
         }
-        return(mb) ;
+        return mb;
 }
 
 static int smt_authorize(struct s_smc *smc, struct smt_header *sm)
@@ -511,7 +511,7 @@ static int smt_authorize(struct s_smc *smc, struct smt_header *sm)
         if (i != 8) {
                 if (memcmp((char *) &sm->smt_sid,
                         (char *) &smc->mib.fddiPRPMFStation,8))
-                        return(1) ;
+                        return 1;
         }
         /*
          * check authoriziation parameter if passwd not zero
@@ -522,13 +522,13 @@ static int smt_authorize(struct s_smc *smc, struct smt_header *sm)
         if (i != 8) {
                 pa = (struct smt_para *) sm_to_para(smc,sm,SMT_P_AUTHOR) ;
                 if (!pa)
-                        return(1) ;
+                        return 1;
                 if (pa->p_len != 8)
-                        return(1) ;
+                        return 1;
                 if (memcmp((char *)(pa+1),(char *)smc->mib.fddiPRPMFPasswd,8))
-                        return(1) ;
+                        return 1;
         }
-        return(0) ;
+        return 0;
 }
 
 static int smt_check_set_count(struct s_smc *smc, struct smt_header *sm)
@@ -542,9 +542,9 @@ static int smt_check_set_count(struct s_smc *smc, struct smt_header *sm)
                 if ((smc->mib.fddiSMTSetCount.count != sc->count) ||
                         memcmp((char *) smc->mib.fddiSMTSetCount.timestamp,
                         (char *)sc->timestamp,8))
-                        return(1) ;
+                        return 1;
         }
-        return(0) ;
+        return 0;
 }
 
 void smt_add_para(struct s_smc *smc, struct s_pcon *pcon, u_short para,
@@ -1109,7 +1109,7 @@ static int smt_set_para(struct s_smc *smc, struct smt_para *pa, int index,
                 break ;
         case 0x2000 :
                 if (mac < 0 || mac >= NUMMACS) {
-                        return(SMT_RDF_NOPARAM) ;
+                        return SMT_RDF_NOPARAM;
                 }
                 mib_m = &smc->mib.m[mac] ;
                 mib_addr = (char *) mib_m ;
@@ -1118,7 +1118,7 @@ static int smt_set_para(struct s_smc *smc, struct smt_para *pa, int index,
                 break ;
         case 0x3000 :
                 if (path < 0 || path >= NUMPATHS) {
-                        return(SMT_RDF_NOPARAM) ;
+                        return SMT_RDF_NOPARAM;
                 }
                 mib_a = &smc->mib.a[path] ;
                 mib_addr = (char *) mib_a ;
@@ -1127,7 +1127,7 @@ static int smt_set_para(struct s_smc *smc, struct smt_para *pa, int index,
                 break ;
         case 0x4000 :
                 if (port < 0 || port >= smt_mib_phys(smc)) {
-                        return(SMT_RDF_NOPARAM) ;
+                        return SMT_RDF_NOPARAM;
                 }
                 mib_p = &smc->mib.p[port_to_mib(smc,port)] ;
                 mib_addr = (char *) mib_p ;
@@ -1151,22 +1151,20 @@ static int smt_set_para(struct s_smc *smc, struct smt_para *pa, int index,
         case SMT_P10F9 :
 #endif
         case SMT_P20F1 :
-                if (!local) {
-                        return(SMT_RDF_NOPARAM) ;
-                }
+                if (!local)
+                        return SMT_RDF_NOPARAM;
                 break ;
         }
         pt = smt_get_ptab(pa->p_type) ;
-        if (!pt) {
-                return( (pa->p_type & 0xff00) ? SMT_RDF_NOPARAM :
-                                                SMT_RDF_ILLEGAL ) ;
-        }
+        if (!pt)
+                return (pa->p_type & 0xff00) ? SMT_RDF_NOPARAM :
+                                               SMT_RDF_ILLEGAL;
         switch (pt->p_access) {
         case AC_GR :
         case AC_S :
                 break ;
         default :
-                return(SMT_RDF_ILLEGAL) ;
+                return SMT_RDF_ILLEGAL;
         }
         to = mib_addr + pt->p_offset ;
         swap = pt->p_swap ;             /* pointer to swap string */
@@ -1292,7 +1290,7 @@ static int smt_set_para(struct s_smc *smc, struct smt_para *pa, int index,
                         break ;
                 default :
                         SMT_PANIC(smc,SMT_E0120, SMT_E0120_MSG) ;
-                        return(SMT_RDF_ILLEGAL) ;
+                        return SMT_RDF_ILLEGAL;
                 }
         }
         /*
@@ -1501,15 +1499,15 @@ change_mac_para:
         default :
                 break ;
         }
-        return(0) ;
+        return 0;
 
 val_error:
         /* parameter value in frame is out of range */
-        return(SMT_RDF_RANGE) ;
+        return SMT_RDF_RANGE;
 
 len_error:
         /* parameter value in frame is too short */
-        return(SMT_RDF_LENGTH) ;
+        return SMT_RDF_LENGTH;
 
 #if     0
 no_author_error:
@@ -1518,7 +1516,7 @@ no_author_error:
          *  because SBA denied is not a valid return code in the
          * PMF protocol.
          */
-        return(SMT_RDF_AUTHOR) ;
+        return SMT_RDF_AUTHOR;
 #endif
 }
 
@@ -1527,7 +1525,7 @@ static const struct s_p_tab *smt_get_ptab(u_short para)
         const struct s_p_tab    *pt ;
         for (pt = p_tab ; pt->p_num && pt->p_num != para ; pt++)
                 ;
-        return(pt->p_num ? pt : NULL) ;
+        return pt->p_num ? pt : NULL;
 }
 
 static int smt_mib_phys(struct s_smc *smc)
@@ -1535,11 +1533,11 @@ static int smt_mib_phys(struct s_smc *smc)
 #ifdef  CONCENTRATOR
         SK_UNUSED(smc) ;
 
-        return(NUMPHYS) ;
+        return NUMPHYS;
 #else
         if (smc->s.sas == SMT_SAS)
-                return(1) ;
-        return(NUMPHYS) ;
+                return 1;
+        return NUMPHYS;
 #endif
 }
 
@@ -1548,11 +1546,11 @@ static int port_to_mib(struct s_smc *smc, int p)
 #ifdef  CONCENTRATOR
         SK_UNUSED(smc) ;
 
-        return(p) ;
+        return p;
 #else
         if (smc->s.sas == SMT_SAS)
-                return(PS) ;
-        return(p) ;
+                return PS;
+        return p;
 #endif
 }
 
diff --git a/drivers/net/skfp/queue.c b/drivers/net/skfp/queue.c
index 09adb3d68b7c..c1a0df455a59 100644
--- a/drivers/net/skfp/queue.c
+++ b/drivers/net/skfp/queue.c
@@ -128,7 +128,7 @@ u_short smt_online(struct s_smc *smc, int on)
 {
         queue_event(smc,EVENT_ECM,on ? EC_CONNECT : EC_DISCONNECT) ;
         ev_dispatcher(smc) ;
-        return(smc->mib.fddiSMTCF_State) ;
+        return smc->mib.fddiSMTCF_State;
 }
 
 /*
diff --git a/drivers/net/skfp/skfddi.c b/drivers/net/skfp/skfddi.c
index 8a12bd9d28ba..ba2e8339fe90 100644
--- a/drivers/net/skfp/skfddi.c
+++ b/drivers/net/skfp/skfddi.c
@@ -440,7 +440,7 @@ static  int skfp_driver_init(struct net_device *dev)
 
         smt_reset_defaults(smc, 0);
 
-        return (0);
+        return 0;
 
 fail:
         if (bp->SharedMemAddr) {
@@ -516,7 +516,7 @@ static int skfp_open(struct net_device *dev)
         mac_drv_rx_mode(smc, RX_DISABLE_PROMISC);
 
         netif_start_queue(dev);
-        return (0);
+        return 0;
 }                               // skfp_open
 
 
@@ -565,7 +565,7 @@ static int skfp_close(struct net_device *dev)
         skb_queue_purge(&bp->SendSkbQueue);
         bp->QueueSkb = MAX_TX_QUEUE_LEN;
 
-        return (0);
+        return 0;
 }                               // skfp_close
 
 
@@ -794,7 +794,7 @@ static struct net_device_stats *skfp_ctl_get_stats(struct net_device *dev)
         bp->stats.port_lem_cts[1] = bp->cmd_rsp_virt->cntrs_get.cntrs.link_errors[1].ls;
 
 #endif
-        return ((struct net_device_stats *) &bp->os.MacStat);
+        return (struct net_device_stats *)&bp->os.MacStat;
 }                               // ctl_get_stat
 
 
@@ -932,7 +932,7 @@ static int skfp_ctl_set_mac_address(struct net_device *dev, void *addr)
         ResetAdapter(smc);
         spin_unlock_irqrestore(&bp->DriverLock, Flags);
 
-        return (0);             /* always return zero */
+        return 0;               /* always return zero */
 }                               // skfp_ctl_set_mac_address
 
 
@@ -1313,7 +1313,7 @@ void *mac_drv_get_space(struct s_smc *smc, unsigned int size)
 
         if ((smc->os.SharedMemHeap + size) > smc->os.SharedMemSize) {
                 printk("Unexpected SMT memory size requested: %d\n", size);
-                return (NULL);
+                return NULL;
         }
         smc->os.SharedMemHeap += size;  // Move heap pointer.
 
@@ -1322,7 +1322,7 @@ void *mac_drv_get_space(struct s_smc *smc, unsigned int size)
         pr_debug("bus  addr: %lx\n", (ulong)
                (smc->os.SharedMemDMA +
                 ((char *) virt - (char *)smc->os.SharedMemAddr)));
-        return (virt);
+        return virt;
 }                               // mac_drv_get_space
 
 
@@ -1363,9 +1363,9 @@ void *mac_drv_get_desc_mem(struct s_smc *smc, unsigned int size)
 
         if (!mac_drv_get_space(smc, size)) {
                 printk("fddi: Unable to align descriptor memory.\n");
-                return (NULL);
+                return NULL;
         }
-        return (virt + size);
+        return virt + size;
 }                               // mac_drv_get_desc_mem
 
 
@@ -1384,8 +1384,8 @@ void *mac_drv_get_desc_mem(struct s_smc *smc, unsigned int size)
  ************************/
 unsigned long mac_drv_virt2phys(struct s_smc *smc, void *virt)
 {
-        return (smc->os.SharedMemDMA +
-                ((char *) virt - (char *)smc->os.SharedMemAddr));
+        return smc->os.SharedMemDMA +
+                ((char *) virt - (char *)smc->os.SharedMemAddr);
 }                               // mac_drv_virt2phys
 
 
@@ -1419,8 +1419,8 @@ unsigned long mac_drv_virt2phys(struct s_smc *smc, void *virt)
  ************************/
 u_long dma_master(struct s_smc * smc, void *virt, int len, int flag)
 {
-        return (smc->os.SharedMemDMA +
-                ((char *) virt - (char *)smc->os.SharedMemAddr));
+        return smc->os.SharedMemDMA +
+                ((char *) virt - (char *)smc->os.SharedMemAddr);
 }                               // dma_master
 
 
@@ -1904,12 +1904,12 @@ int mac_drv_rx_init(struct s_smc *smc, int len, int fc,
                 pr_debug("fddi: Discard invalid local SMT frame\n");
                 pr_debug("  len=%d, la_len=%d, (ULONG) look_ahead=%08lXh.\n",
                        len, la_len, (unsigned long) look_ahead);
-                return (0);
+                return 0;
         }
         skb = alloc_skb(len + 3, GFP_ATOMIC);
         if (!skb) {
                 pr_debug("fddi: Local SMT: skb memory exhausted.\n");
-                return (0);
+                return 0;
         }
         skb_reserve(skb, 3);
         skb_put(skb, len);
@@ -1919,7 +1919,7 @@ int mac_drv_rx_init(struct s_smc *smc, int len, int fc,
         skb->protocol = fddi_type_trans(skb, smc->os.dev);
         netif_rx(skb);
 
-        return (0);
+        return 0;
 }                               // mac_drv_rx_init
 
 
diff --git a/drivers/net/skfp/smt.c b/drivers/net/skfp/smt.c
index 6f35bb77595f..2d9941c045bc 100644
--- a/drivers/net/skfp/smt.c
+++ b/drivers/net/skfp/smt.c
@@ -127,22 +127,22 @@ static inline int is_my_addr(const struct s_smc *smc,
 
 static inline int is_broadcast(const struct fddi_addr *addr)
 {
-        return(*(u_short *)(&addr->a[0]) == 0xffff &&
+        return *(u_short *)(&addr->a[0]) == 0xffff &&
                *(u_short *)(&addr->a[2]) == 0xffff &&
-               *(u_short *)(&addr->a[4]) == 0xffff ) ;
+               *(u_short *)(&addr->a[4]) == 0xffff;
 }
 
 static inline int is_individual(const struct fddi_addr *addr)
 {
-        return(!(addr->a[0] & GROUP_ADDR)) ;
+        return !(addr->a[0] & GROUP_ADDR);
 }
 
 static inline int is_equal(const struct fddi_addr *addr1, 
                            const struct fddi_addr *addr2)
 {
-        return(*(u_short *)(&addr1->a[0]) == *(u_short *)(&addr2->a[0]) &&
+        return *(u_short *)(&addr1->a[0]) == *(u_short *)(&addr2->a[0]) &&
                *(u_short *)(&addr1->a[2]) == *(u_short *)(&addr2->a[2]) &&
-               *(u_short *)(&addr1->a[4]) == *(u_short *)(&addr2->a[4]) ) ;
+               *(u_short *)(&addr1->a[4]) == *(u_short *)(&addr2->a[4]);
 }
 
 /*
@@ -457,8 +457,8 @@ static int div_ratio(u_long upper, u_long lower)
         else
                 upper <<= 16L ;
         if (!lower)
-                return(0) ;
-        return((int)(upper/lower)) ;
+                return 0;
+        return (int)(upper/lower) ;
 }
 
 #ifndef SLIM_SMT
@@ -1111,11 +1111,11 @@ SMbuf *smt_build_frame(struct s_smc *smc, int class, int type,
 
 #if     0
         if (!smc->r.sm_ma_avail) {
-                return(0) ;
+                return 0;
         }
 #endif
         if (!(mb = smt_get_mbuf(smc)))
-                return(mb) ;
+                return mb;
 
         mb->sm_len = length ;
         smt = smtod(mb, struct smt_header *) ;
@@ -1136,7 +1136,7 @@ SMbuf *smt_build_frame(struct s_smc *smc, int class, int type,
         smt->smt_tid = smt_get_tid(smc) ;       /* set transaction ID */
         smt->smt_pad = 0 ;
         smt->smt_len = length - sizeof(struct smt_header) ;
-        return(mb) ;
+        return mb;
 }
 
 static void smt_add_frame_len(SMbuf *mb, int len)
@@ -1375,7 +1375,7 @@ static int smt_fill_path(struct s_smc *smc, struct smt_p_path *path)
         pd_mac = (struct smt_mac_rec *) phy ;
         pd_mac->mac_addr = smc->mib.m[MAC0].fddiMACSMTAddress ;
         pd_mac->mac_resource_idx = mac_con_resource_index(smc,1) ;
-        return(len) ;
+        return len;
 }
 
 /*
@@ -1563,7 +1563,7 @@ u_long smt_get_tid(struct s_smc *smc)
         u_long  tid ;
         while ((tid = ++(smc->sm.smt_tid) ^ SMT_TID_MAGIC) == 0)
                 ;
-        return(tid & 0x3fffffffL) ;
+        return tid & 0x3fffffffL;
 }
 
 
@@ -1654,11 +1654,11 @@ int smt_check_para(struct s_smc *smc, struct smt_header	*sm,
         while (*p) {
                 if (!sm_to_para(smc,sm,(int) *p)) {
                         DB_SMT("SMT: smt_check_para - missing para %x\n",*p,0);
-                        return(-1) ;
+                        return -1;
                 }
                 p++ ;
         }
-        return(0) ;
+        return 0;
 }
 
 void *sm_to_para(struct s_smc *smc, struct smt_header *sm, int para)
@@ -1687,7 +1687,7 @@ void *sm_to_para(struct s_smc *smc, struct smt_header *sm, int para)
                         return NULL;
                 }
                 if (found)
-                        return(found) ;
+                        return found;
         }
         return NULL;
 }
@@ -1732,7 +1732,7 @@ char *addr_to_string(struct fddi_addr *addr)
                 string[i * 3 + 2] = ':';
         }
         string[5 * 3 + 2] = 0;
-        return(string);
+        return string;
 }
 #endif
 
@@ -1742,9 +1742,9 @@ int smt_ifconfig(int argc, char *argv[])
         if (argc >= 2 && !strcmp(argv[0],"opt_bypass") &&
             !strcmp(argv[1],"yes")) {
                 smc->mib.fddiSMTBypassPresent = 1 ;
-                return(0) ;
+                return 0;
         }
-        return(amdfddi_config(0,argc,argv)) ;
+        return amdfddi_config(0, argc, argv);
 }
 #endif
 
@@ -1756,9 +1756,9 @@ static int mac_index(struct s_smc *smc, int mac)
         SK_UNUSED(mac) ;
 #ifdef  CONCENTRATOR
         SK_UNUSED(smc) ;
-        return(NUMPHYS+1) ;
+        return NUMPHYS + 1;
 #else
-        return((smc->s.sas == SMT_SAS) ? 2 : 3) ;
+        return (smc->s.sas == SMT_SAS) ? 2 : 3;
 #endif
 }
 
@@ -1768,7 +1768,7 @@ static int mac_index(struct s_smc *smc, int mac)
 static int phy_index(struct s_smc *smc, int phy)
 {
         SK_UNUSED(smc) ;
-        return(phy+1);
+        return phy + 1;
 }
 
 /*
@@ -1779,19 +1779,19 @@ static int mac_con_resource_index(struct s_smc *smc, int mac)
 #ifdef  CONCENTRATOR
         SK_UNUSED(smc) ;
         SK_UNUSED(mac) ;
-        return(entity_to_index(smc,cem_get_downstream(smc,ENTITY_MAC))) ;
+        return entity_to_index(smc, cem_get_downstream(smc, ENTITY_MAC));
 #else
         SK_UNUSED(mac) ;
         switch (smc->mib.fddiSMTCF_State) {
         case SC9_C_WRAP_A :
         case SC5_THRU_B :
         case SC11_C_WRAP_S :
-                return(1) ;
+                return 1;
         case SC10_C_WRAP_B :
         case SC4_THRU_A :
-                return(2) ;
+                return 2;
         }
-        return(smc->s.sas == SMT_SAS ? 2 : 3) ;
+        return smc->s.sas == SMT_SAS ? 2 : 3;
 #endif
 }
 
@@ -1801,21 +1801,21 @@ static int mac_con_resource_index(struct s_smc *smc, int mac)
 static int phy_con_resource_index(struct s_smc *smc, int phy)
 {
 #ifdef  CONCENTRATOR
-        return(entity_to_index(smc,cem_get_downstream(smc,ENTITY_PHY(phy)))) ;
+        return entity_to_index(smc, cem_get_downstream(smc, ENTITY_PHY(phy))) ;
 #else
         switch (smc->mib.fddiSMTCF_State) {
         case SC9_C_WRAP_A :
-                return(phy == PA ? 3 : 2) ;
+                return phy == PA ? 3 : 2;
         case SC10_C_WRAP_B :
-                return(phy == PA ? 1 : 3) ;
+                return phy == PA ? 1 : 3;
         case SC4_THRU_A :
-                return(phy == PA ? 3 : 1) ;
+                return phy == PA ? 3 : 1;
         case SC5_THRU_B :
-                return(phy == PA ? 2 : 3) ;
+                return phy == PA ? 2 : 3;
         case SC11_C_WRAP_S :
-                return(2) ;
+                return 2;
         }
-        return(phy) ;
+        return phy;
 #endif
 }
 
@@ -1823,16 +1823,16 @@ static int phy_con_resource_index(struct s_smc *smc, int phy)
 static int entity_to_index(struct s_smc *smc, int e)
 {
         if (e == ENTITY_MAC)
-                return(mac_index(smc,1)) ;
+                return mac_index(smc, 1);
         else
-                return(phy_index(smc,e - ENTITY_PHY(0))) ;
+                return phy_index(smc, e - ENTITY_PHY(0));
 }
 #endif
 
 #ifdef  LITTLE_ENDIAN
 static int smt_swap_short(u_short s)
 {
-        return(((s>>8)&0xff)|((s&0xff)<<8)) ;
+        return ((s>>8)&0xff) | ((s&0xff)<<8);
 }
 
 void smt_swap_para(struct smt_header *sm, int len, int direction)
@@ -1996,7 +1996,7 @@ int smt_action(struct s_smc *smc, int class, int code, int index)
                         }
                         break ;
                 default :
-                        return(1) ;
+                        return 1;
                 }
                 break ;
         case SMT_PORT_ACTION :
@@ -2017,14 +2017,14 @@ int smt_action(struct s_smc *smc, int class, int code, int index)
                         event = PC_STOP ;
                         break ;
                 default :
-                        return(1) ;
+                        return 1;
                 }
                 queue_event(smc,EVENT_PCM+index,event) ;
                 break ;
         default :
-                return(1) ;
+                return 1;
         }
-        return(0) ;
+        return 0;
 }
 
 /*
diff --git a/drivers/net/skfp/smtdef.c b/drivers/net/skfp/smtdef.c
index 4e07ff7073f1..1acab0b368e3 100644
--- a/drivers/net/skfp/smtdef.c
+++ b/drivers/net/skfp/smtdef.c
@@ -303,7 +303,7 @@ int smt_set_mac_opvalues(struct s_smc *smc)
                         FDDI_SMT_EVENT, (u_long) FDDI_REMOTE_T_REQ,
                         smt_get_event_word(smc));
         }
-        return(st) ;
+        return st;
 }
 
 void smt_fixup_mib(struct s_smc *smc)
@@ -350,6 +350,6 @@ static int set_min_max(int maxflag, u_long mib, u_long limit, u_long *oper)
                 *oper = limit ;
         else
                 *oper = mib ;
-        return(old != *oper) ;
+        return old != *oper;
 }
 
diff --git a/drivers/net/skfp/smtinit.c b/drivers/net/skfp/smtinit.c
index 3c8964ce1837..e3a0c0bc2233 100644
--- a/drivers/net/skfp/smtinit.c
+++ b/drivers/net/skfp/smtinit.c
@@ -120,6 +120,6 @@ int init_smt(struct s_smc *smc, u_char *mac_addr)
 
         PNMI_INIT(smc) ;                /* PNMI initialization */
 
-        return(0) ;
+        return 0;
 }
 
diff --git a/drivers/net/skfp/srf.c b/drivers/net/skfp/srf.c
index 40882b3faba6..f6f7baf9f27a 100644
--- a/drivers/net/skfp/srf.c
+++ b/drivers/net/skfp/srf.c
@@ -165,7 +165,7 @@ static struct s_srf_evc *smt_get_evc(struct s_smc *smc, int code, int index)
 
         for (i = 0, evc = smc->evcs ; (unsigned) i < MAX_EVCS ; i++, evc++) {
                 if (evc->evc_code == code && evc->evc_index == index)
-                        return(evc) ;
+                        return evc;
         }
         return NULL;
 }
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index a8a63581d63d..bfec2e0f5275 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -43,6 +43,7 @@
 #include <linux/seq_file.h>
 #include <linux/mii.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 #include <asm/irq.h>
 
 #include "skge.h"
@@ -3869,6 +3870,8 @@ static void __devinit skge_show_addr(struct net_device *dev)
         netif_info(skge, probe, skge->netdev, "addr %pM\n", dev->dev_addr);
 }
 
+static int only_32bit_dma;
+
 static int __devinit skge_probe(struct pci_dev *pdev,
                                 const struct pci_device_id *ent)
 {
@@ -3890,7 +3893,7 @@ static int __devinit skge_probe(struct pci_dev *pdev,
 
         pci_set_master(pdev);
 
-        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
+        if (!only_32bit_dma && !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
                 using_dac = 1;
                 err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
         } else if (!(err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))) {
@@ -4148,8 +4151,21 @@ static struct pci_driver skge_driver = {
         .shutdown =     skge_shutdown,
 };
 
+static struct dmi_system_id skge_32bit_dma_boards[] = {
+        {
+                .ident = "Gigabyte nForce boards",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co"),
+                        DMI_MATCH(DMI_BOARD_NAME, "nForce"),
+                },
+        },
+        {}
+};
+
 static int __init skge_init_module(void)
 {
+        if (dmi_check_system(skge_32bit_dma_boards))
+                only_32bit_dma = 1;
         skge_debug_init();
         return pci_register_driver(&skge_driver);
 }
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 194e5cf8c763..d6577084ce70 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1782,7 +1782,7 @@ static netdev_tx_t sky2_xmit_frame(struct sk_buff *skb,
         ctrl = 0;
 #ifdef SKY2_VLAN_TAG_USED
         /* Add VLAN tag, can piggyback on LRGLEN or ADDR64 */
-        if (sky2->vlgrp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 if (!le) {
                         le = get_tx_le(sky2, &slot);
                         le->addr = 0;
@@ -4581,7 +4581,8 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
 
         sky2->port = port;
 
-        dev->features |= NETIF_F_TSO | NETIF_F_IP_CSUM | NETIF_F_SG;
+        dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG
+                | NETIF_F_TSO  | NETIF_F_GRO;
         if (highmem)
                 dev->features |= NETIF_F_HIGHDMA;
 
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index 38547a8938fe..86cbb9ea2f26 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -944,7 +944,7 @@ static int slip_esc(unsigned char *s, unsigned char *d, int len)
                 }
         }
         *ptr++ = END;
-        return (ptr - d);
+        return ptr - d;
 }
 
 static void slip_unesc(struct slip *sl, unsigned char s)
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index 13ddcd487200..a8e5856ce882 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -58,6 +58,7 @@
 
 MODULE_LICENSE("GPL");
 MODULE_VERSION(SMSC_DRV_VERSION);
+MODULE_ALIAS("platform:smsc911x");
 
 #if USE_DEBUG > 0
 static int debug = 16;
diff --git a/drivers/net/stmmac/Kconfig b/drivers/net/stmmac/Kconfig
index 3c2af7c6a39b..7df7df4e79c5 100644
--- a/drivers/net/stmmac/Kconfig
+++ b/drivers/net/stmmac/Kconfig
@@ -3,7 +3,7 @@ config STMMAC_ETH
         select MII
         select PHYLIB
         select CRC32
-        depends on NETDEVICES
+        depends on NETDEVICES && HAS_IOMEM
         help
           This is the driver for the Ethernet IPs are built around a
           Synopsys IP Core and only tested on the STMicroelectronics
diff --git a/drivers/net/stmmac/common.h b/drivers/net/stmmac/common.h
index e8cbcb5c206e..375ea193e139 100644
--- a/drivers/net/stmmac/common.h
+++ b/drivers/net/stmmac/common.h
@@ -102,8 +102,6 @@ struct stmmac_extra_stats {
 
 #define SF_DMA_MODE 1 /* DMA STORE-AND-FORWARD Operation Mode */
 
-#define HW_CSUM 1
-#define NO_HW_CSUM 0
 enum rx_frame_status { /* IPC status */
         good_frame = 0,
         discard_frame = 1,
@@ -205,6 +203,8 @@ struct stmmac_dma_ops {
 struct stmmac_ops {
         /* MAC core initialization */
         void (*core_init) (void __iomem *ioaddr) ____cacheline_aligned;
+        /* Support checksum offload engine */
+        int  (*rx_coe) (void __iomem *ioaddr);
         /* Dump MAC registers */
         void (*dump_regs) (void __iomem *ioaddr);
         /* Handle extra events on specific interrupts hw dependent */
@@ -235,10 +235,9 @@ struct mii_regs {
 };
 
 struct mac_device_info {
-        struct stmmac_ops       *mac;
-        struct stmmac_desc_ops  *desc;
-        struct stmmac_dma_ops   *dma;
-        unsigned int pmt;       /* support Power-Down */
+        const struct stmmac_ops         *mac;
+        const struct stmmac_desc_ops    *desc;
+        const struct stmmac_dma_ops     *dma;
         struct mii_regs mii;    /* MII register Addresses */
         struct mac_link link;
 };
diff --git a/drivers/net/stmmac/dwmac100.h b/drivers/net/stmmac/dwmac100.h
index 97956cbf1cb4..7c6d857a9cc7 100644
--- a/drivers/net/stmmac/dwmac100.h
+++ b/drivers/net/stmmac/dwmac100.h
@@ -118,4 +118,4 @@ enum ttc_control {
 #define DMA_MISSED_FRAME_OVE_M  0x00010000      /* Missed Frame Overflow */
 #define DMA_MISSED_FRAME_M_CNTR 0x0000ffff      /* Missed Frame Couinter */
 
-extern struct stmmac_dma_ops dwmac100_dma_ops;
+extern const struct stmmac_dma_ops dwmac100_dma_ops;
diff --git a/drivers/net/stmmac/dwmac1000.h b/drivers/net/stmmac/dwmac1000.h
index 8b20b19971cb..cfcef0ea0fa5 100644
--- a/drivers/net/stmmac/dwmac1000.h
+++ b/drivers/net/stmmac/dwmac1000.h
@@ -99,7 +99,7 @@ enum inter_frame_gap {
 #define GMAC_CONTROL_RE         0x00000004 /* Receiver Enable */
 
 #define GMAC_CORE_INIT (GMAC_CONTROL_JD | GMAC_CONTROL_PS | GMAC_CONTROL_ACS | \
-                        GMAC_CONTROL_IPC | GMAC_CONTROL_JE | GMAC_CONTROL_BE)
+                        GMAC_CONTROL_JE | GMAC_CONTROL_BE)
 
 /* GMAC Frame Filter defines */
 #define GMAC_FRAME_FILTER_PR    0x00000001      /* Promiscuous Mode */
@@ -205,4 +205,4 @@ enum rtc_control {
 #define GMAC_MMC_TX_INTR   0x108
 #define GMAC_MMC_RX_CSUM_OFFLOAD   0x208
 
-extern struct stmmac_dma_ops dwmac1000_dma_ops;
+extern const struct stmmac_dma_ops dwmac1000_dma_ops;
diff --git a/drivers/net/stmmac/dwmac1000_core.c b/drivers/net/stmmac/dwmac1000_core.c
index f1f426146f40..6ae4c3f4c63c 100644
--- a/drivers/net/stmmac/dwmac1000_core.c
+++ b/drivers/net/stmmac/dwmac1000_core.c
@@ -50,6 +50,18 @@ static void dwmac1000_core_init(void __iomem *ioaddr)
 #endif
 }
 
+static int dwmac1000_rx_coe_supported(void __iomem *ioaddr)
+{
+        u32 value = readl(ioaddr + GMAC_CONTROL);
+
+        value |= GMAC_CONTROL_IPC;
+        writel(value, ioaddr + GMAC_CONTROL);
+
+        value = readl(ioaddr + GMAC_CONTROL);
+
+        return !!(value & GMAC_CONTROL_IPC);
+}
+
 static void dwmac1000_dump_regs(void __iomem *ioaddr)
 {
         int i;
@@ -200,8 +212,9 @@ static void dwmac1000_irq_status(void __iomem *ioaddr)
         }
 }
 
-struct stmmac_ops dwmac1000_ops = {
+static const struct stmmac_ops dwmac1000_ops = {
         .core_init = dwmac1000_core_init,
+        .rx_coe = dwmac1000_rx_coe_supported,
         .dump_regs = dwmac1000_dump_regs,
         .host_irq_status = dwmac1000_irq_status,
         .set_filter = dwmac1000_set_filter,
@@ -226,7 +239,6 @@ struct mac_device_info *dwmac1000_setup(void __iomem *ioaddr)
         mac->mac = &dwmac1000_ops;
         mac->dma = &dwmac1000_dma_ops;
 
-        mac->pmt = PMT_SUPPORTED;
         mac->link.port = GMAC_CONTROL_PS;
         mac->link.duplex = GMAC_CONTROL_DM;
         mac->link.speed = GMAC_CONTROL_FES;
diff --git a/drivers/net/stmmac/dwmac1000_dma.c b/drivers/net/stmmac/dwmac1000_dma.c
index 2ef5a56370e9..2c47712d45d0 100644
--- a/drivers/net/stmmac/dwmac1000_dma.c
+++ b/drivers/net/stmmac/dwmac1000_dma.c
@@ -33,10 +33,18 @@ static int dwmac1000_dma_init(void __iomem *ioaddr, int pbl, u32 dma_tx,
                               u32 dma_rx)
 {
         u32 value = readl(ioaddr + DMA_BUS_MODE);
+        int limit;
+
         /* DMA SW reset */
         value |= DMA_BUS_MODE_SFT_RESET;
         writel(value, ioaddr + DMA_BUS_MODE);
-        do {} while ((readl(ioaddr + DMA_BUS_MODE) & DMA_BUS_MODE_SFT_RESET));
+        limit = 15000;
+        while (limit--) {
+                if (!(readl(ioaddr + DMA_BUS_MODE) & DMA_BUS_MODE_SFT_RESET))
+                        break;
+        }
+        if (limit < 0)
+                return -EBUSY;
 
         value = /* DMA_BUS_MODE_FB | */ DMA_BUS_MODE_4PBL |
             ((pbl << DMA_BUS_MODE_PBL_SHIFT) |
@@ -130,7 +138,7 @@ static void dwmac1000_dump_dma_regs(void __iomem *ioaddr)
         }
 }
 
-struct stmmac_dma_ops dwmac1000_dma_ops = {
+const struct stmmac_dma_ops dwmac1000_dma_ops = {
         .init = dwmac1000_dma_init,
         .dump_regs = dwmac1000_dump_dma_regs,
         .dma_mode = dwmac1000_dma_operation_mode,
diff --git a/drivers/net/stmmac/dwmac100_core.c b/drivers/net/stmmac/dwmac100_core.c
index db06c04ce480..c724fc36a24f 100644
--- a/drivers/net/stmmac/dwmac100_core.c
+++ b/drivers/net/stmmac/dwmac100_core.c
@@ -42,6 +42,11 @@ static void dwmac100_core_init(void __iomem *ioaddr)
 #endif
 }
 
+static int dwmac100_rx_coe_supported(void __iomem *ioaddr)
+{
+        return 0;
+}
+
 static void dwmac100_dump_mac_regs(void __iomem *ioaddr)
 {
         pr_info("\t----------------------------------------------\n"
@@ -163,8 +168,9 @@ static void dwmac100_pmt(void __iomem *ioaddr, unsigned long mode)
         return;
 }
 
-struct stmmac_ops dwmac100_ops = {
+static const struct stmmac_ops dwmac100_ops = {
         .core_init = dwmac100_core_init,
+        .rx_coe = dwmac100_rx_coe_supported,
         .dump_regs = dwmac100_dump_mac_regs,
         .host_irq_status = dwmac100_irq_status,
         .set_filter = dwmac100_set_filter,
@@ -187,7 +193,6 @@ struct mac_device_info *dwmac100_setup(void __iomem *ioaddr)
         mac->mac = &dwmac100_ops;
         mac->dma = &dwmac100_dma_ops;
 
-        mac->pmt = PMT_NOT_SUPPORTED;
         mac->link.port = MAC_CONTROL_PS;
         mac->link.duplex = MAC_CONTROL_F;
         mac->link.speed = 0;
diff --git a/drivers/net/stmmac/dwmac100_dma.c b/drivers/net/stmmac/dwmac100_dma.c
index c7279d2b946b..e3e224b7d9e2 100644
--- a/drivers/net/stmmac/dwmac100_dma.c
+++ b/drivers/net/stmmac/dwmac100_dma.c
@@ -35,10 +35,18 @@ static int dwmac100_dma_init(void __iomem *ioaddr, int pbl, u32 dma_tx,
                              u32 dma_rx)
 {
         u32 value = readl(ioaddr + DMA_BUS_MODE);
+        int limit;
+
         /* DMA SW reset */
         value |= DMA_BUS_MODE_SFT_RESET;
         writel(value, ioaddr + DMA_BUS_MODE);
-        do {} while ((readl(ioaddr + DMA_BUS_MODE) & DMA_BUS_MODE_SFT_RESET));
+        limit = 15000;
+        while (limit--) {
+                if (!(readl(ioaddr + DMA_BUS_MODE) & DMA_BUS_MODE_SFT_RESET))
+                        break;
+        }
+        if (limit < 0)
+                return -EBUSY;
 
         /* Enable Application Access by writing to DMA CSR0 */
         writel(DMA_BUS_MODE_DEFAULT | (pbl << DMA_BUS_MODE_PBL_SHIFT),
@@ -118,7 +126,7 @@ static void dwmac100_dma_diagnostic_fr(void *data, struct stmmac_extra_stats *x,
         }
 }
 
-struct stmmac_dma_ops dwmac100_dma_ops = {
+const struct stmmac_dma_ops dwmac100_dma_ops = {
         .init = dwmac100_dma_init,
         .dump_regs = dwmac100_dump_dma_regs,
         .dma_mode = dwmac100_dma_operation_mode,
diff --git a/drivers/net/stmmac/enh_desc.c b/drivers/net/stmmac/enh_desc.c
index 77ff88c3958b..e5dfb6a30182 100644
--- a/drivers/net/stmmac/enh_desc.c
+++ b/drivers/net/stmmac/enh_desc.c
@@ -284,7 +284,7 @@ static void enh_desc_release_tx_desc(struct dma_desc *p)
 {
         int ter = p->des01.etx.end_ring;
 
-        memset(p, 0, sizeof(struct dma_desc));
+        memset(p, 0, offsetof(struct dma_desc, des2));
         p->des01.etx.end_ring = ter;
 }
 
@@ -318,7 +318,7 @@ static int enh_desc_get_rx_frame_len(struct dma_desc *p)
         return p->des01.erx.frame_length;
 }
 
-struct stmmac_desc_ops enh_desc_ops = {
+const struct stmmac_desc_ops enh_desc_ops = {
         .tx_status = enh_desc_get_tx_status,
         .rx_status = enh_desc_get_rx_status,
         .get_tx_len = enh_desc_get_tx_len,
diff --git a/drivers/net/stmmac/norm_desc.c b/drivers/net/stmmac/norm_desc.c
index 51f4440ab98b..cd0cc76f7a1c 100644
--- a/drivers/net/stmmac/norm_desc.c
+++ b/drivers/net/stmmac/norm_desc.c
@@ -174,22 +174,7 @@ static void ndesc_release_tx_desc(struct dma_desc *p)
 {
         int ter = p->des01.tx.end_ring;
 
-        /* clean field used within the xmit */
-        p->des01.tx.first_segment = 0;
-        p->des01.tx.last_segment = 0;
-        p->des01.tx.buffer1_size = 0;
-
-        /* clean status reported */
-        p->des01.tx.error_summary = 0;
-        p->des01.tx.underflow_error = 0;
-        p->des01.tx.no_carrier = 0;
-        p->des01.tx.loss_carrier = 0;
-        p->des01.tx.excessive_deferral = 0;
-        p->des01.tx.excessive_collisions = 0;
-        p->des01.tx.late_collision = 0;
-        p->des01.tx.heartbeat_fail = 0;
-        p->des01.tx.deferred = 0;
-
+        memset(p, 0, offsetof(struct dma_desc, des2));
         /* set termination field */
         p->des01.tx.end_ring = ter;
 }
@@ -217,7 +202,7 @@ static int ndesc_get_rx_frame_len(struct dma_desc *p)
         return p->des01.rx.frame_length;
 }
 
-struct stmmac_desc_ops ndesc_ops = {
+const struct stmmac_desc_ops ndesc_ops = {
         .tx_status = ndesc_get_tx_status,
         .rx_status = ndesc_get_rx_status,
         .get_tx_len = ndesc_get_tx_len,
diff --git a/drivers/net/stmmac/stmmac.h b/drivers/net/stmmac/stmmac.h
index d0ddab0d21c2..79bdc2e13224 100644
--- a/drivers/net/stmmac/stmmac.h
+++ b/drivers/net/stmmac/stmmac.h
@@ -51,7 +51,6 @@ struct stmmac_priv {
         int is_gmac;
         dma_addr_t dma_rx_phy;
         unsigned int dma_rx_size;
-        int rx_csum;
         unsigned int dma_buf_sz;
         struct device *device;
         struct mac_device_info *hw;
@@ -78,6 +77,7 @@ struct stmmac_priv {
         unsigned int flow_ctrl;
         unsigned int pause;
         struct mii_bus *mii;
+        int mii_clk_csr;
 
         u32 msg_enable;
         spinlock_t lock;
@@ -91,6 +91,9 @@ struct stmmac_priv {
         struct vlan_group *vlgrp;
 #endif
         int enh_desc;
+        int rx_coe;
+        int bugged_jumbo;
+        int no_csum_insertion;
 };
 
 #ifdef CONFIG_STM_DRIVERS
@@ -118,5 +121,5 @@ static inline int stmmac_claim_resource(struct platform_device *pdev)
 extern int stmmac_mdio_unregister(struct net_device *ndev);
 extern int stmmac_mdio_register(struct net_device *ndev);
 extern void stmmac_set_ethtool_ops(struct net_device *netdev);
-extern struct stmmac_desc_ops enh_desc_ops;
-extern struct stmmac_desc_ops ndesc_ops;
+extern const struct stmmac_desc_ops enh_desc_ops;
+extern const struct stmmac_desc_ops ndesc_ops;
diff --git a/drivers/net/stmmac/stmmac_ethtool.c b/drivers/net/stmmac/stmmac_ethtool.c
index 63b68e61afce..6d65482e789a 100644
--- a/drivers/net/stmmac/stmmac_ethtool.c
+++ b/drivers/net/stmmac/stmmac_ethtool.c
@@ -89,8 +89,8 @@ static const struct  stmmac_stats stmmac_gstrings_stats[] = {
 };
 #define STMMAC_STATS_LEN ARRAY_SIZE(stmmac_gstrings_stats)
 
-void stmmac_ethtool_getdrvinfo(struct net_device *dev,
-                               struct ethtool_drvinfo *info)
+static void stmmac_ethtool_getdrvinfo(struct net_device *dev,
+                                      struct ethtool_drvinfo *info)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
 
@@ -104,7 +104,8 @@ void stmmac_ethtool_getdrvinfo(struct net_device *dev,
         info->n_stats = STMMAC_STATS_LEN;
 }
 
-int stmmac_ethtool_getsettings(struct net_device *dev, struct ethtool_cmd *cmd)
+static int stmmac_ethtool_getsettings(struct net_device *dev,
+                                      struct ethtool_cmd *cmd)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
         struct phy_device *phy = priv->phydev;
@@ -126,7 +127,8 @@ int stmmac_ethtool_getsettings(struct net_device *dev, struct ethtool_cmd *cmd)
         return rc;
 }
 
-int stmmac_ethtool_setsettings(struct net_device *dev, struct ethtool_cmd *cmd)
+static int stmmac_ethtool_setsettings(struct net_device *dev,
+                                      struct ethtool_cmd *cmd)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
         struct phy_device *phy = priv->phydev;
@@ -139,32 +141,32 @@ int stmmac_ethtool_setsettings(struct net_device *dev, struct ethtool_cmd *cmd)
         return rc;
 }
 
-u32 stmmac_ethtool_getmsglevel(struct net_device *dev)
+static u32 stmmac_ethtool_getmsglevel(struct net_device *dev)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
         return priv->msg_enable;
 }
 
-void stmmac_ethtool_setmsglevel(struct net_device *dev, u32 level)
+static void stmmac_ethtool_setmsglevel(struct net_device *dev, u32 level)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
         priv->msg_enable = level;
 
 }
 
-int stmmac_check_if_running(struct net_device *dev)
+static int stmmac_check_if_running(struct net_device *dev)
 {
         if (!netif_running(dev))
                 return -EBUSY;
         return 0;
 }
 
-int stmmac_ethtool_get_regs_len(struct net_device *dev)
+static int stmmac_ethtool_get_regs_len(struct net_device *dev)
 {
         return REG_SPACE_SIZE;
 }
 
-void stmmac_ethtool_gregs(struct net_device *dev,
+static void stmmac_ethtool_gregs(struct net_device *dev,
                           struct ethtool_regs *regs, void *space)
 {
         int i;
@@ -195,7 +197,7 @@ void stmmac_ethtool_gregs(struct net_device *dev,
         }
 }
 
-int stmmac_ethtool_set_tx_csum(struct net_device *netdev, u32 data)
+static int stmmac_ethtool_set_tx_csum(struct net_device *netdev, u32 data)
 {
         if (data)
                 netdev->features |= NETIF_F_HW_CSUM;
@@ -205,11 +207,11 @@ int stmmac_ethtool_set_tx_csum(struct net_device *netdev, u32 data)
         return 0;
 }
 
-u32 stmmac_ethtool_get_rx_csum(struct net_device *dev)
+static u32 stmmac_ethtool_get_rx_csum(struct net_device *dev)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
 
-        return priv->rx_csum;
+        return priv->rx_coe;
 }
 
 static void
@@ -322,7 +324,7 @@ static void stmmac_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         struct stmmac_priv *priv = netdev_priv(dev);
 
         spin_lock_irq(&priv->lock);
-        if (priv->wolenabled == PMT_SUPPORTED) {
+        if (device_can_wakeup(priv->device)) {
                 wol->supported = WAKE_MAGIC;
                 wol->wolopts = priv->wolopts;
         }
@@ -334,16 +336,20 @@ static int stmmac_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         struct stmmac_priv *priv = netdev_priv(dev);
         u32 support = WAKE_MAGIC;
 
-        if (priv->wolenabled == PMT_NOT_SUPPORTED)
+        if (!device_can_wakeup(priv->device))
                 return -EINVAL;
 
         if (wol->wolopts & ~support)
                 return -EINVAL;
 
-        if (wol->wolopts == 0)
-                device_set_wakeup_enable(priv->device, 0);
-        else
+        if (wol->wolopts) {
+                pr_info("stmmac: wakeup enable\n");
                 device_set_wakeup_enable(priv->device, 1);
+                enable_irq_wake(dev->irq);
+        } else {
+                device_set_wakeup_enable(priv->device, 0);
+                disable_irq_wake(dev->irq);
+        }
 
         spin_lock_irq(&priv->lock);
         priv->wolopts = wol->wolopts;
@@ -374,10 +380,8 @@ static struct ethtool_ops stmmac_ethtool_ops = {
         .get_wol = stmmac_get_wol,
         .set_wol = stmmac_set_wol,
         .get_sset_count = stmmac_get_sset_count,
-#ifdef NETIF_F_TSO
         .get_tso = ethtool_op_get_tso,
         .set_tso = ethtool_op_set_tso,
-#endif
 };
 
 void stmmac_set_ethtool_ops(struct net_device *netdev)
diff --git a/drivers/net/stmmac/stmmac_main.c b/drivers/net/stmmac/stmmac_main.c
index 03c160c6d75c..823b9e6431d5 100644
--- a/drivers/net/stmmac/stmmac_main.c
+++ b/drivers/net/stmmac/stmmac_main.c
@@ -134,13 +134,6 @@ static int buf_sz = DMA_BUFFER_SIZE;
 module_param(buf_sz, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(buf_sz, "DMA buffer size");
 
-/* In case of Giga ETH, we can enable/disable the COE for the
- * transmit HW checksum computation.
- * Note that, if tx csum is off in HW, SG will be still supported. */
-static int tx_coe = HW_CSUM;
-module_param(tx_coe, int, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(tx_coe, "GMAC COE type 2 [on/off]");
-
 static const u32 default_msg_level = (NETIF_MSG_DRV | NETIF_MSG_PROBE |
                                       NETIF_MSG_LINK | NETIF_MSG_IFUP |
                                       NETIF_MSG_IFDOWN | NETIF_MSG_TIMER);
@@ -569,29 +562,22 @@ static void free_dma_desc_resources(struct stmmac_priv *priv)
  *  stmmac_dma_operation_mode - HW DMA operation mode
  *  @priv : pointer to the private device structure.
  *  Description: it sets the DMA operation mode: tx/rx DMA thresholds
- *  or Store-And-Forward capability. It also verifies the COE for the
- *  transmission in case of Giga ETH.
+ *  or Store-And-Forward capability.
  */
 static void stmmac_dma_operation_mode(struct stmmac_priv *priv)
 {
-        if (!priv->is_gmac) {
-                /* MAC 10/100 */
-                priv->hw->dma->dma_mode(priv->ioaddr, tc, 0);
-                priv->tx_coe = NO_HW_CSUM;
-        } else {
-                if ((priv->dev->mtu <= ETH_DATA_LEN) && (tx_coe)) {
-                        priv->hw->dma->dma_mode(priv->ioaddr,
-                                                SF_DMA_MODE, SF_DMA_MODE);
-                        tc = SF_DMA_MODE;
-                        priv->tx_coe = HW_CSUM;
-                } else {
-                        /* Checksum computation is performed in software. */
-                        priv->hw->dma->dma_mode(priv->ioaddr, tc,
-                                                SF_DMA_MODE);
-                        priv->tx_coe = NO_HW_CSUM;
-                }
-        }
-        tx_coe = priv->tx_coe;
+        if (likely((priv->tx_coe) && (!priv->no_csum_insertion))) {
+                /* In case of GMAC, SF mode has to be enabled
+                 * to perform the TX COE. This depends on:
+                 * 1) TX COE if actually supported
+                 * 2) There is no bugged Jumbo frame support
+                 *    that needs to not insert csum in the TDES.
+                 */
+                priv->hw->dma->dma_mode(priv->ioaddr,
+                                        SF_DMA_MODE, SF_DMA_MODE);
+                tc = SF_DMA_MODE;
+        } else
+                priv->hw->dma->dma_mode(priv->ioaddr, tc, SF_DMA_MODE);
 }
 
 /**
@@ -858,6 +844,12 @@ static int stmmac_open(struct net_device *dev)
         /* Initialize the MAC Core */
         priv->hw->mac->core_init(priv->ioaddr);
 
+        priv->rx_coe = priv->hw->mac->rx_coe(priv->ioaddr);
+        if (priv->rx_coe)
+                pr_info("stmmac: Rx Checksum Offload Engine supported\n");
+        if (priv->tx_coe)
+                pr_info("\tTX Checksum insertion supported\n");
+
         priv->shutdown = 0;
 
         /* Initialise the MMC (if present) to disable all interrupts. */
@@ -1066,7 +1058,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 return stmmac_sw_tso(priv, skb);
 
         if (likely((skb->ip_summed == CHECKSUM_PARTIAL))) {
-                if (likely(priv->tx_coe == NO_HW_CSUM))
+                if (unlikely((!priv->tx_coe) || (priv->no_csum_insertion)))
                         skb_checksum_help(skb);
                 else
                         csum_insertion = 1;
@@ -1390,6 +1382,15 @@ static int stmmac_change_mtu(struct net_device *dev, int new_mtu)
                 return -EINVAL;
         }
 
+        /* Some GMAC devices have a bugged Jumbo frame support that
+         * needs to have the Tx COE disabled for oversized frames
+         * (due to limited buffer sizes). In this case we disable
+         * the TX csum insertionin the TDES and not use SF. */
+        if ((priv->bugged_jumbo) && (priv->dev->mtu > ETH_DATA_LEN))
+                priv->no_csum_insertion = 1;
+        else
+                priv->no_csum_insertion = 0;
+
         dev->mtu = new_mtu;
 
         return 0;
@@ -1510,9 +1511,6 @@ static int stmmac_probe(struct net_device *dev)
 #endif
         priv->msg_enable = netif_msg_init(debug, default_msg_level);
 
-        if (priv->is_gmac)
-                priv->rx_csum = 1;
-
         if (flow_ctrl)
                 priv->flow_ctrl = FLOW_AUTO;    /* RX/TX pause on */
 
@@ -1570,9 +1568,8 @@ static int stmmac_mac_device_setup(struct net_device *dev)
 
         priv->hw = device;
 
-        priv->wolenabled = priv->hw->pmt;       /* PMT supported */
-        if (priv->wolenabled == PMT_SUPPORTED)
-                priv->wolopts = WAKE_MAGIC;             /* Magic Frame */
+        if (device_can_wakeup(priv->device))
+                priv->wolopts = WAKE_MAGIC; /* Magic Frame as default */
 
         return 0;
 }
@@ -1662,7 +1659,7 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
                 ret = -ENODEV;
                 goto out;
         }
-        pr_info("done!\n");
+        pr_info("\tdone!\n");
 
         if (!request_mem_region(res->start, resource_size(res),
                                 pdev->name)) {
@@ -1704,10 +1701,19 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
         plat_dat = pdev->dev.platform_data;
         priv->bus_id = plat_dat->bus_id;
         priv->pbl = plat_dat->pbl;      /* TLI */
+        priv->mii_clk_csr = plat_dat->clk_csr;
+        priv->tx_coe = plat_dat->tx_coe;
+        priv->bugged_jumbo = plat_dat->bugged_jumbo;
         priv->is_gmac = plat_dat->has_gmac;     /* GMAC is on board */
         priv->enh_desc = plat_dat->enh_desc;
         priv->ioaddr = addr;
 
+        /* PMT module is not integrated in all the MAC devices. */
+        if (plat_dat->pmt) {
+                pr_info("\tPMT module supported\n");
+                device_set_wakeup_capable(&pdev->dev, 1);
+        }
+
         platform_set_drvdata(pdev, ndev);
 
         /* Set the I/O base addr */
@@ -1835,13 +1841,11 @@ static int stmmac_suspend(struct platform_device *pdev, pm_message_t state)
 
                 stmmac_mac_disable_tx(priv->ioaddr);
 
-                if (device_may_wakeup(&(pdev->dev))) {
-                        /* Enable Power down mode by programming the PMT regs */
-                        if (priv->wolenabled == PMT_SUPPORTED)
-                                priv->hw->mac->pmt(priv->ioaddr, priv->wolopts);
-                } else {
+                /* Enable Power down mode by programming the PMT regs */
+                if (device_can_wakeup(priv->device))
+                        priv->hw->mac->pmt(priv->ioaddr, priv->wolopts);
+                else
                         stmmac_mac_disable_rx(priv->ioaddr);
-                }
         } else {
                 priv->shutdown = 1;
                 /* Although this can appear slightly redundant it actually
@@ -1876,9 +1880,8 @@ static int stmmac_resume(struct platform_device *pdev)
          * is received. Anyway, it's better to manually clear
          * this bit because it can generate problems while resuming
          * from another devices (e.g. serial console). */
-        if (device_may_wakeup(&(pdev->dev)))
-                if (priv->wolenabled == PMT_SUPPORTED)
-                        priv->hw->mac->pmt(priv->ioaddr, 0);
+        if (device_can_wakeup(priv->device))
+                priv->hw->mac->pmt(priv->ioaddr, 0);
 
         netif_device_attach(dev);
 
@@ -1965,8 +1968,6 @@ static int __init stmmac_cmdline_opt(char *str)
                         strict_strtoul(opt + 7, 0, (unsigned long *)&buf_sz);
                 else if (!strncmp(opt, "tc:", 3))
                         strict_strtoul(opt + 3, 0, (unsigned long *)&tc);
-                else if (!strncmp(opt, "tx_coe:", 7))
-                        strict_strtoul(opt + 7, 0, (unsigned long *)&tx_coe);
                 else if (!strncmp(opt, "watchdog:", 9))
                         strict_strtoul(opt + 9, 0, (unsigned long *)&watchdog);
                 else if (!strncmp(opt, "flow_ctrl:", 10))
diff --git a/drivers/net/stmmac/stmmac_mdio.c b/drivers/net/stmmac/stmmac_mdio.c
index 03dea1401571..d7441616357d 100644
--- a/drivers/net/stmmac/stmmac_mdio.c
+++ b/drivers/net/stmmac/stmmac_mdio.c
@@ -53,7 +53,7 @@ static int stmmac_mdio_read(struct mii_bus *bus, int phyaddr, int phyreg)
         int data;
         u16 regValue = (((phyaddr << 11) & (0x0000F800)) |
                         ((phyreg << 6) & (0x000007C0)));
-        regValue |= MII_BUSY;   /* in case of GMAC */
+        regValue |= MII_BUSY | ((priv->mii_clk_csr & 7) << 2);
 
         do {} while (((readl(priv->ioaddr + mii_address)) & MII_BUSY) == 1);
         writel(regValue, priv->ioaddr + mii_address);
@@ -85,7 +85,8 @@ static int stmmac_mdio_write(struct mii_bus *bus, int phyaddr, int phyreg,
             (((phyaddr << 11) & (0x0000F800)) | ((phyreg << 6) & (0x000007C0)))
             | MII_WRITE;
 
-        value |= MII_BUSY;
+        value |= MII_BUSY | ((priv->mii_clk_csr & 7) << 2);
+
 
         /* Wait until any existing MII operation is complete */
         do {} while (((readl(priv->ioaddr + mii_address)) & MII_BUSY) == 1);
diff --git a/drivers/net/sun3lance.c b/drivers/net/sun3lance.c
index 358c22f9acbe..7d9ec23aabf6 100644
--- a/drivers/net/sun3lance.c
+++ b/drivers/net/sun3lance.c
@@ -436,7 +436,7 @@ static int lance_open( struct net_device *dev )
                 DPRINTK( 2, ( "lance_open(): opening %s failed, i=%d, csr0=%04x\n",
                                           dev->name, i, DREG ));
                 DREG = CSR0_STOP;
-                return( -EIO );
+                return -EIO;
         }
 
         DREG = CSR0_IDON | CSR0_STRT | CSR0_INEA;
@@ -445,7 +445,7 @@ static int lance_open( struct net_device *dev )
 
         DPRINTK( 2, ( "%s: LANCE is open, csr0 %04x\n", dev->name, DREG ));
 
-        return( 0 );
+        return 0;
 }
 
 
diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
index 7dfdbee878e8..3ed2a67bd6d3 100644
--- a/drivers/net/sundance.c
+++ b/drivers/net/sundance.c
@@ -96,16 +96,10 @@ static char *media[MAX_UNITS];
 #include <asm/io.h>
 #include <linux/delay.h>
 #include <linux/spinlock.h>
-#ifndef _COMPAT_WITH_OLD_KERNEL
+#include <linux/dma-mapping.h>
 #include <linux/crc32.h>
 #include <linux/ethtool.h>
 #include <linux/mii.h>
-#else
-#include "crc32.h"
-#include "ethtool.h"
-#include "mii.h"
-#include "compat.h"
-#endif
 
 /* These identify the driver base version and may not be removed. */
 static const char version[] __devinitconst =
@@ -369,9 +363,21 @@ struct netdev_private {
         dma_addr_t tx_ring_dma;
         dma_addr_t rx_ring_dma;
         struct timer_list timer;                /* Media monitoring timer. */
+        /* ethtool extra stats */
+        struct {
+                u64 tx_multiple_collisions;
+                u64 tx_single_collisions;
+                u64 tx_late_collisions;
+                u64 tx_deferred;
+                u64 tx_deferred_excessive;
+                u64 tx_aborted;
+                u64 tx_bcasts;
+                u64 rx_bcasts;
+                u64 tx_mcasts;
+                u64 rx_mcasts;
+        } xstats;
         /* Frequently used values: keep some adjacent for cache effect. */
         spinlock_t lock;
-        spinlock_t rx_lock;                     /* Group with Tx control cache line. */
         int msg_enable;
         int chip_id;
         unsigned int cur_rx, dirty_rx;          /* Producer/consumer ring indices */
@@ -396,6 +402,7 @@ struct netdev_private {
         unsigned char phys[MII_CNT];            /* MII device addresses, only first one used. */
         struct pci_dev *pci_dev;
         void __iomem *base;
+        spinlock_t statlock;
 };
 
 /* The station address location in the EEPROM. */
@@ -520,16 +527,19 @@ static int __devinit sundance_probe1 (struct pci_dev *pdev,
         np->chip_id = chip_idx;
         np->msg_enable = (1 << debug) - 1;
         spin_lock_init(&np->lock);
+        spin_lock_init(&np->statlock);
         tasklet_init(&np->rx_tasklet, rx_poll, (unsigned long)dev);
         tasklet_init(&np->tx_tasklet, tx_poll, (unsigned long)dev);
 
-        ring_space = pci_alloc_consistent(pdev, TX_TOTAL_SIZE, &ring_dma);
+        ring_space = dma_alloc_coherent(&pdev->dev, TX_TOTAL_SIZE,
+                        &ring_dma, GFP_KERNEL);
         if (!ring_space)
                 goto err_out_cleardev;
         np->tx_ring = (struct netdev_desc *)ring_space;
         np->tx_ring_dma = ring_dma;
 
-        ring_space = pci_alloc_consistent(pdev, RX_TOTAL_SIZE, &ring_dma);
+        ring_space = dma_alloc_coherent(&pdev->dev, RX_TOTAL_SIZE,
+                        &ring_dma, GFP_KERNEL);
         if (!ring_space)
                 goto err_out_unmap_tx;
         np->rx_ring = (struct netdev_desc *)ring_space;
@@ -663,9 +673,11 @@ static int __devinit sundance_probe1 (struct pci_dev *pdev,
 err_out_unregister:
         unregister_netdev(dev);
 err_out_unmap_rx:
-        pci_free_consistent(pdev, RX_TOTAL_SIZE, np->rx_ring, np->rx_ring_dma);
+        dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE,
+                np->rx_ring, np->rx_ring_dma);
 err_out_unmap_tx:
-        pci_free_consistent(pdev, TX_TOTAL_SIZE, np->tx_ring, np->tx_ring_dma);
+        dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE,
+                np->tx_ring, np->tx_ring_dma);
 err_out_cleardev:
         pci_set_drvdata(pdev, NULL);
         pci_iounmap(pdev, ioaddr);
@@ -1011,8 +1023,14 @@ static void init_ring(struct net_device *dev)
                 skb->dev = dev;         /* Mark as being used by this device. */
                 skb_reserve(skb, 2);    /* 16 byte align the IP header. */
                 np->rx_ring[i].frag[0].addr = cpu_to_le32(
-                        pci_map_single(np->pci_dev, skb->data, np->rx_buf_sz,
-                                PCI_DMA_FROMDEVICE));
+                        dma_map_single(&np->pci_dev->dev, skb->data,
+                                np->rx_buf_sz, DMA_FROM_DEVICE));
+                if (dma_mapping_error(&np->pci_dev->dev,
+                                        np->rx_ring[i].frag[0].addr)) {
+                        dev_kfree_skb(skb);
+                        np->rx_skbuff[i] = NULL;
+                        break;
+                }
                 np->rx_ring[i].frag[0].length = cpu_to_le32(np->rx_buf_sz | LastFrag);
         }
         np->dirty_rx = (unsigned int)(i - RX_RING_SIZE);
@@ -1063,9 +1081,11 @@ start_tx (struct sk_buff *skb, struct net_device *dev)
 
         txdesc->next_desc = 0;
         txdesc->status = cpu_to_le32 ((entry << 2) | DisableAlign);
-        txdesc->frag[0].addr = cpu_to_le32 (pci_map_single (np->pci_dev, skb->data,
-                                                        skb->len,
-                                                        PCI_DMA_TODEVICE));
+        txdesc->frag[0].addr = cpu_to_le32(dma_map_single(&np->pci_dev->dev,
+                                skb->data, skb->len, DMA_TO_DEVICE));
+        if (dma_mapping_error(&np->pci_dev->dev,
+                                txdesc->frag[0].addr))
+                        goto drop_frame;
         txdesc->frag[0].length = cpu_to_le32 (skb->len | LastFrag);
 
         /* Increment cur_tx before tasklet_schedule() */
@@ -1087,6 +1107,12 @@ start_tx (struct sk_buff *skb, struct net_device *dev)
                         dev->name, np->cur_tx, entry);
         }
         return NETDEV_TX_OK;
+
+drop_frame:
+        dev_kfree_skb(skb);
+        np->tx_skbuff[entry] = NULL;
+        dev->stats.tx_dropped++;
+        return NETDEV_TX_OK;
 }
 
 /* Reset hardware tx and free all of tx buffers */
@@ -1097,7 +1123,6 @@ reset_tx (struct net_device *dev)
         void __iomem *ioaddr = np->base;
         struct sk_buff *skb;
         int i;
-        int irq = in_interrupt();
 
         /* Reset tx logic, TxListPtr will be cleaned */
         iowrite16 (TxDisable, ioaddr + MACCtrl1);
@@ -1109,13 +1134,10 @@ reset_tx (struct net_device *dev)
 
                 skb = np->tx_skbuff[i];
                 if (skb) {
-                        pci_unmap_single(np->pci_dev,
+                        dma_unmap_single(&np->pci_dev->dev,
                                 le32_to_cpu(np->tx_ring[i].frag[0].addr),
-                                skb->len, PCI_DMA_TODEVICE);
-                        if (irq)
-                                dev_kfree_skb_irq (skb);
-                        else
-                                dev_kfree_skb (skb);
+                                skb->len, DMA_TO_DEVICE);
+                        dev_kfree_skb_any(skb);
                         np->tx_skbuff[i] = NULL;
                         dev->stats.tx_dropped++;
                 }
@@ -1233,9 +1255,9 @@ static irqreturn_t intr_handler(int irq, void *dev_instance)
                                                 break;
                                 skb = np->tx_skbuff[entry];
                                 /* Free the original skb. */
-                                pci_unmap_single(np->pci_dev,
+                                dma_unmap_single(&np->pci_dev->dev,
                                         le32_to_cpu(np->tx_ring[entry].frag[0].addr),
-                                        skb->len, PCI_DMA_TODEVICE);
+                                        skb->len, DMA_TO_DEVICE);
                                 dev_kfree_skb_irq (np->tx_skbuff[entry]);
                                 np->tx_skbuff[entry] = NULL;
                                 np->tx_ring[entry].frag[0].addr = 0;
@@ -1252,9 +1274,9 @@ static irqreturn_t intr_handler(int irq, void *dev_instance)
                                         break;
                                 skb = np->tx_skbuff[entry];
                                 /* Free the original skb. */
-                                pci_unmap_single(np->pci_dev,
+                                dma_unmap_single(&np->pci_dev->dev,
                                         le32_to_cpu(np->tx_ring[entry].frag[0].addr),
-                                        skb->len, PCI_DMA_TODEVICE);
+                                        skb->len, DMA_TO_DEVICE);
                                 dev_kfree_skb_irq (np->tx_skbuff[entry]);
                                 np->tx_skbuff[entry] = NULL;
                                 np->tx_ring[entry].frag[0].addr = 0;
@@ -1334,22 +1356,18 @@ static void rx_poll(unsigned long data)
                         if (pkt_len < rx_copybreak &&
                             (skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
-                                pci_dma_sync_single_for_cpu(np->pci_dev,
-                                                            le32_to_cpu(desc->frag[0].addr),
-                                                            np->rx_buf_sz,
-                                                            PCI_DMA_FROMDEVICE);
-
+                                dma_sync_single_for_cpu(&np->pci_dev->dev,
+                                                le32_to_cpu(desc->frag[0].addr),
+                                                np->rx_buf_sz, DMA_FROM_DEVICE);
                                 skb_copy_to_linear_data(skb, np->rx_skbuff[entry]->data, pkt_len);
-                                pci_dma_sync_single_for_device(np->pci_dev,
-                                                               le32_to_cpu(desc->frag[0].addr),
-                                                               np->rx_buf_sz,
-                                                               PCI_DMA_FROMDEVICE);
+                                dma_sync_single_for_device(&np->pci_dev->dev,
+                                                le32_to_cpu(desc->frag[0].addr),
+                                                np->rx_buf_sz, DMA_FROM_DEVICE);
                                 skb_put(skb, pkt_len);
                         } else {
-                                pci_unmap_single(np->pci_dev,
+                                dma_unmap_single(&np->pci_dev->dev,
                                         le32_to_cpu(desc->frag[0].addr),
-                                        np->rx_buf_sz,
-                                        PCI_DMA_FROMDEVICE);
+                                        np->rx_buf_sz, DMA_FROM_DEVICE);
                                 skb_put(skb = np->rx_skbuff[entry], pkt_len);
                                 np->rx_skbuff[entry] = NULL;
                         }
@@ -1396,8 +1414,14 @@ static void refill_rx (struct net_device *dev)
                         skb->dev = dev;         /* Mark as being used by this device. */
                         skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                         np->rx_ring[entry].frag[0].addr = cpu_to_le32(
-                                pci_map_single(np->pci_dev, skb->data,
-                                        np->rx_buf_sz, PCI_DMA_FROMDEVICE));
+                                dma_map_single(&np->pci_dev->dev, skb->data,
+                                        np->rx_buf_sz, DMA_FROM_DEVICE));
+                        if (dma_mapping_error(&np->pci_dev->dev,
+                                    np->rx_ring[entry].frag[0].addr)) {
+                            dev_kfree_skb_irq(skb);
+                            np->rx_skbuff[entry] = NULL;
+                            break;
+                        }
                 }
                 /* Perhaps we need not reset this field. */
                 np->rx_ring[entry].frag[0].length =
@@ -1475,27 +1499,41 @@ static struct net_device_stats *get_stats(struct net_device *dev)
 {
         struct netdev_private *np = netdev_priv(dev);
         void __iomem *ioaddr = np->base;
-        int i;
+        unsigned long flags;
+        u8 late_coll, single_coll, mult_coll;
 
-        /* We should lock this segment of code for SMP eventually, although
-           the vulnerability window is very small and statistics are
-           non-critical. */
+        spin_lock_irqsave(&np->statlock, flags);
         /* The chip only need report frame silently dropped. */
         dev->stats.rx_missed_errors     += ioread8(ioaddr + RxMissed);
         dev->stats.tx_packets += ioread16(ioaddr + TxFramesOK);
         dev->stats.rx_packets += ioread16(ioaddr + RxFramesOK);
-        dev->stats.collisions += ioread8(ioaddr + StatsLateColl);
-        dev->stats.collisions += ioread8(ioaddr + StatsMultiColl);
-        dev->stats.collisions += ioread8(ioaddr + StatsOneColl);
         dev->stats.tx_carrier_errors += ioread8(ioaddr + StatsCarrierError);
-        ioread8(ioaddr + StatsTxDefer);
-        for (i = StatsTxDefer; i <= StatsMcastRx; i++)
-                ioread8(ioaddr + i);
+
+        mult_coll = ioread8(ioaddr + StatsMultiColl);
+        np->xstats.tx_multiple_collisions += mult_coll;
+        single_coll = ioread8(ioaddr + StatsOneColl);
+        np->xstats.tx_single_collisions += single_coll;
+        late_coll = ioread8(ioaddr + StatsLateColl);
+        np->xstats.tx_late_collisions += late_coll;
+        dev->stats.collisions += mult_coll
+                + single_coll
+                + late_coll;
+
+        np->xstats.tx_deferred += ioread8(ioaddr + StatsTxDefer);
+        np->xstats.tx_deferred_excessive += ioread8(ioaddr + StatsTxXSDefer);
+        np->xstats.tx_aborted += ioread8(ioaddr + StatsTxAbort);
+        np->xstats.tx_bcasts += ioread8(ioaddr + StatsBcastTx);
+        np->xstats.rx_bcasts += ioread8(ioaddr + StatsBcastRx);
+        np->xstats.tx_mcasts += ioread8(ioaddr + StatsMcastTx);
+        np->xstats.rx_mcasts += ioread8(ioaddr + StatsMcastRx);
+
         dev->stats.tx_bytes += ioread16(ioaddr + TxOctetsLow);
         dev->stats.tx_bytes += ioread16(ioaddr + TxOctetsHigh) << 16;
         dev->stats.rx_bytes += ioread16(ioaddr + RxOctetsLow);
         dev->stats.rx_bytes += ioread16(ioaddr + RxOctetsHigh) << 16;
 
+        spin_unlock_irqrestore(&np->statlock, flags);
+
         return &dev->stats;
 }
 
@@ -1554,6 +1592,21 @@ static int __set_mac_addr(struct net_device *dev)
         return 0;
 }
 
+static const struct {
+        const char name[ETH_GSTRING_LEN];
+} sundance_stats[] = {
+        { "tx_multiple_collisions" },
+        { "tx_single_collisions" },
+        { "tx_late_collisions" },
+        { "tx_deferred" },
+        { "tx_deferred_excessive" },
+        { "tx_aborted" },
+        { "tx_bcasts" },
+        { "rx_bcasts" },
+        { "tx_mcasts" },
+        { "rx_mcasts" },
+};
+
 static int check_if_running(struct net_device *dev)
 {
         if (!netif_running(dev))
@@ -1612,6 +1665,42 @@ static void set_msglevel(struct net_device *dev, u32 val)
         np->msg_enable = val;
 }
 
+static void get_strings(struct net_device *dev, u32 stringset,
+                u8 *data)
+{
+        if (stringset == ETH_SS_STATS)
+                memcpy(data, sundance_stats, sizeof(sundance_stats));
+}
+
+static int get_sset_count(struct net_device *dev, int sset)
+{
+        switch (sset) {
+        case ETH_SS_STATS:
+                return ARRAY_SIZE(sundance_stats);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
+static void get_ethtool_stats(struct net_device *dev,
+                struct ethtool_stats *stats, u64 *data)
+{
+        struct netdev_private *np = netdev_priv(dev);
+        int i = 0;
+
+        get_stats(dev);
+        data[i++] = np->xstats.tx_multiple_collisions;
+        data[i++] = np->xstats.tx_single_collisions;
+        data[i++] = np->xstats.tx_late_collisions;
+        data[i++] = np->xstats.tx_deferred;
+        data[i++] = np->xstats.tx_deferred_excessive;
+        data[i++] = np->xstats.tx_aborted;
+        data[i++] = np->xstats.tx_bcasts;
+        data[i++] = np->xstats.rx_bcasts;
+        data[i++] = np->xstats.tx_mcasts;
+        data[i++] = np->xstats.rx_mcasts;
+}
+
 static const struct ethtool_ops ethtool_ops = {
         .begin = check_if_running,
         .get_drvinfo = get_drvinfo,
@@ -1621,6 +1710,9 @@ static const struct ethtool_ops ethtool_ops = {
         .get_link = get_link,
         .get_msglevel = get_msglevel,
         .set_msglevel = set_msglevel,
+        .get_strings = get_strings,
+        .get_sset_count = get_sset_count,
+        .get_ethtool_stats = get_ethtool_stats,
 };
 
 static int netdev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
@@ -1715,9 +1807,9 @@ static int netdev_close(struct net_device *dev)
                 np->rx_ring[i].status = 0;
                 skb = np->rx_skbuff[i];
                 if (skb) {
-                        pci_unmap_single(np->pci_dev,
+                        dma_unmap_single(&np->pci_dev->dev,
                                 le32_to_cpu(np->rx_ring[i].frag[0].addr),
-                                np->rx_buf_sz, PCI_DMA_FROMDEVICE);
+                                np->rx_buf_sz, DMA_FROM_DEVICE);
                         dev_kfree_skb(skb);
                         np->rx_skbuff[i] = NULL;
                 }
@@ -1727,9 +1819,9 @@ static int netdev_close(struct net_device *dev)
                 np->tx_ring[i].next_desc = 0;
                 skb = np->tx_skbuff[i];
                 if (skb) {
-                        pci_unmap_single(np->pci_dev,
+                        dma_unmap_single(&np->pci_dev->dev,
                                 le32_to_cpu(np->tx_ring[i].frag[0].addr),
-                                skb->len, PCI_DMA_TODEVICE);
+                                skb->len, DMA_TO_DEVICE);
                         dev_kfree_skb(skb);
                         np->tx_skbuff[i] = NULL;
                 }
@@ -1743,17 +1835,16 @@ static void __devexit sundance_remove1 (struct pci_dev *pdev)
         struct net_device *dev = pci_get_drvdata(pdev);
 
         if (dev) {
-                struct netdev_private *np = netdev_priv(dev);
-
-                unregister_netdev(dev);
-                pci_free_consistent(pdev, RX_TOTAL_SIZE, np->rx_ring,
-                        np->rx_ring_dma);
-                pci_free_consistent(pdev, TX_TOTAL_SIZE, np->tx_ring,
-                        np->tx_ring_dma);
-                pci_iounmap(pdev, np->base);
-                pci_release_regions(pdev);
-                free_netdev(dev);
-                pci_set_drvdata(pdev, NULL);
+            struct netdev_private *np = netdev_priv(dev);
+            unregister_netdev(dev);
+            dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE,
+                    np->rx_ring, np->rx_ring_dma);
+            dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE,
+                    np->tx_ring, np->tx_ring_dma);
+            pci_iounmap(pdev, np->base);
+            pci_release_regions(pdev);
+            free_netdev(dev);
+            pci_set_drvdata(pdev, NULL);
         }
 }
 
diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c
index 4a4fac630337..d16880d7099b 100644
--- a/drivers/net/sungem_phy.c
+++ b/drivers/net/sungem_phy.c
@@ -88,7 +88,7 @@ static int reset_one_mii_phy(struct mii_phy* phy, int phy_id)
         if ((val & BMCR_ISOLATE) && limit > 0)
                 __phy_write(phy, phy_id, MII_BMCR, val & ~BMCR_ISOLATE);
 
-        return (limit <= 0);
+        return limit <= 0;
 }
 
 static int bcm5201_init(struct mii_phy* phy)
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index 45f315ed1868..5e28c414421a 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -2497,7 +2497,7 @@ static u32 hme_get_link(struct net_device *dev)
         hp->sw_bmcr = happy_meal_tcvr_read(hp, hp->tcvregs, MII_BMCR);
         spin_unlock_irq(&hp->happy_lock);
 
-        return (hp->sw_bmsr & BMSR_LSTATUS);
+        return hp->sw_bmsr & BMSR_LSTATUS;
 }
 
 static const struct ethtool_ops hme_ethtool_ops = {
diff --git a/drivers/net/sunqe.c b/drivers/net/sunqe.c
index 72e65d4666ef..9536b2f010be 100644
--- a/drivers/net/sunqe.c
+++ b/drivers/net/sunqe.c
@@ -711,7 +711,7 @@ static u32 qe_get_link(struct net_device *dev)
         phyconfig = sbus_readb(mregs + MREGS_PHYCONFIG);
         spin_unlock_irq(&qep->lock);
 
-        return (phyconfig & MREGS_PHYCONFIG_LSTAT);
+        return phyconfig & MREGS_PHYCONFIG_LSTAT;
 }
 
 static const struct ethtool_ops qe_ethtool_ops = {
diff --git a/drivers/net/tc35815.c b/drivers/net/tc35815.c
index 99e423a5b9f1..b6eec8cea209 100644
--- a/drivers/net/tc35815.c
+++ b/drivers/net/tc35815.c
@@ -1167,7 +1167,7 @@ static void print_eth(const u8 *add)
 static int tc35815_tx_full(struct net_device *dev)
 {
         struct tc35815_local *lp = netdev_priv(dev);
-        return ((lp->tfd_start + 1) % TX_FD_NUM == lp->tfd_end);
+        return (lp->tfd_start + 1) % TX_FD_NUM == lp->tfd_end;
 }
 
 static void tc35815_restart(struct net_device *dev)
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 9f6ffffc8376..22720eeabddb 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -69,10 +69,10 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define TG3_MAJ_NUM                     3
-#define TG3_MIN_NUM                     113
+#define TG3_MIN_NUM                     115
 #define DRV_MODULE_VERSION      \
         __stringify(TG3_MAJ_NUM) "." __stringify(TG3_MIN_NUM)
-#define DRV_MODULE_RELDATE      "August 2, 2010"
+#define DRV_MODULE_RELDATE      "October 14, 2010"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -101,9 +101,15 @@
  * You can't change the ring sizes, but you can change where you place
  * them in the NIC onboard memory.
  */
-#define TG3_RX_RING_SIZE                512
+#define TG3_RX_STD_RING_SIZE(tp) \
+        ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 || \
+          GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719) ? \
+         RX_STD_MAX_SIZE_5717 : 512)
 #define TG3_DEF_RX_RING_PENDING         200
-#define TG3_RX_JUMBO_RING_SIZE          256
+#define TG3_RX_JMB_RING_SIZE(tp) \
+        ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 || \
+          GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719) ? \
+         1024 : 256)
 #define TG3_DEF_RX_JUMBO_RING_PENDING   100
 #define TG3_RSS_INDIR_TBL_SIZE          128
 
@@ -113,19 +119,16 @@
  * hw multiply/modulo instructions.  Another solution would be to
  * replace things like '% foo' with '& (foo - 1)'.
  */
-#define TG3_RX_RCB_RING_SIZE(tp)        \
-        (((tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE) && \
-          !(tp->tg3_flags2 & TG3_FLG2_5780_CLASS)) ? 1024 : 512)
 
 #define TG3_TX_RING_SIZE                512
 #define TG3_DEF_TX_RING_PENDING         (TG3_TX_RING_SIZE - 1)
 
-#define TG3_RX_RING_BYTES       (sizeof(struct tg3_rx_buffer_desc) * \
-                                 TG3_RX_RING_SIZE)
-#define TG3_RX_JUMBO_RING_BYTES (sizeof(struct tg3_ext_rx_buffer_desc) * \
-                                 TG3_RX_JUMBO_RING_SIZE)
-#define TG3_RX_RCB_RING_BYTES(tp) (sizeof(struct tg3_rx_buffer_desc) * \
-                                 TG3_RX_RCB_RING_SIZE(tp))
+#define TG3_RX_STD_RING_BYTES(tp) \
+        (sizeof(struct tg3_rx_buffer_desc) * TG3_RX_STD_RING_SIZE(tp))
+#define TG3_RX_JMB_RING_BYTES(tp) \
+        (sizeof(struct tg3_ext_rx_buffer_desc) * TG3_RX_JMB_RING_SIZE(tp))
+#define TG3_RX_RCB_RING_BYTES(tp) \
+        (sizeof(struct tg3_rx_buffer_desc) * (tp->rx_ret_ring_mask + 1))
 #define TG3_TX_RING_BYTES       (sizeof(struct tg3_tx_buffer_desc) * \
                                  TG3_TX_RING_SIZE)
 #define NEXT_TX(N)              (((N) + 1) & (TG3_TX_RING_SIZE - 1))
@@ -143,11 +146,11 @@
 #define TG3_RX_STD_MAP_SZ               TG3_RX_DMA_TO_MAP_SZ(TG3_RX_STD_DMA_SZ)
 #define TG3_RX_JMB_MAP_SZ               TG3_RX_DMA_TO_MAP_SZ(TG3_RX_JMB_DMA_SZ)
 
-#define TG3_RX_STD_BUFF_RING_SIZE \
-        (sizeof(struct ring_info) * TG3_RX_RING_SIZE)
+#define TG3_RX_STD_BUFF_RING_SIZE(tp) \
+        (sizeof(struct ring_info) * TG3_RX_STD_RING_SIZE(tp))
 
-#define TG3_RX_JMB_BUFF_RING_SIZE \
-        (sizeof(struct ring_info) * TG3_RX_JUMBO_RING_SIZE)
+#define TG3_RX_JMB_BUFF_RING_SIZE(tp) \
+        (sizeof(struct ring_info) * TG3_RX_JMB_RING_SIZE(tp))
 
 /* Due to a hardware bug, the 5701 can only DMA to memory addresses
  * that are at least dword aligned when used in PCIX mode.  The driver
@@ -264,7 +267,6 @@ static DEFINE_PCI_DEVICE_TABLE(tg3_pci_tbl) = {
         {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57788)},
         {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_5717)},
         {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_5718)},
-        {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_5724)},
         {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57781)},
         {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57785)},
         {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57761)},
@@ -752,42 +754,6 @@ static void tg3_int_reenable(struct tg3_napi *tnapi)
                      HOSTCC_MODE_ENABLE | tnapi->coal_now);
 }
 
-static void tg3_napi_disable(struct tg3 *tp)
-{
-        int i;
-
-        for (i = tp->irq_cnt - 1; i >= 0; i--)
-                napi_disable(&tp->napi[i].napi);
-}
-
-static void tg3_napi_enable(struct tg3 *tp)
-{
-        int i;
-
-        for (i = 0; i < tp->irq_cnt; i++)
-                napi_enable(&tp->napi[i].napi);
-}
-
-static inline void tg3_netif_stop(struct tg3 *tp)
-{
-        tp->dev->trans_start = jiffies; /* prevent tx timeout */
-        tg3_napi_disable(tp);
-        netif_tx_disable(tp->dev);
-}
-
-static inline void tg3_netif_start(struct tg3 *tp)
-{
-        /* NOTE: unconditional netif_tx_wake_all_queues is only
-         * appropriate so long as all callers are assured to
-         * have free tx slots (such as after tg3_init_hw)
-         */
-        netif_tx_wake_all_queues(tp->dev);
-
-        tg3_napi_enable(tp);
-        tp->napi[0].hw_status->status |= SD_STATUS_UPDATED;
-        tg3_enable_ints(tp);
-}
-
 static void tg3_switch_clocks(struct tg3 *tp)
 {
         u32 clock_ctrl;
@@ -1196,6 +1162,52 @@ static void tg3_mdio_fini(struct tg3 *tp)
         }
 }
 
+static int tg3_phy_cl45_write(struct tg3 *tp, u32 devad, u32 addr, u32 val)
+{
+        int err;
+
+        err = tg3_writephy(tp, MII_TG3_MMD_CTRL, devad);
+        if (err)
+                goto done;
+
+        err = tg3_writephy(tp, MII_TG3_MMD_ADDRESS, addr);
+        if (err)
+                goto done;
+
+        err = tg3_writephy(tp, MII_TG3_MMD_CTRL,
+                           MII_TG3_MMD_CTRL_DATA_NOINC | devad);
+        if (err)
+                goto done;
+
+        err = tg3_writephy(tp, MII_TG3_MMD_ADDRESS, val);
+
+done:
+        return err;
+}
+
+static int tg3_phy_cl45_read(struct tg3 *tp, u32 devad, u32 addr, u32 *val)
+{
+        int err;
+
+        err = tg3_writephy(tp, MII_TG3_MMD_CTRL, devad);
+        if (err)
+                goto done;
+
+        err = tg3_writephy(tp, MII_TG3_MMD_ADDRESS, addr);
+        if (err)
+                goto done;
+
+        err = tg3_writephy(tp, MII_TG3_MMD_CTRL,
+                           MII_TG3_MMD_CTRL_DATA_NOINC | devad);
+        if (err)
+                goto done;
+
+        err = tg3_readphy(tp, MII_TG3_MMD_ADDRESS, val);
+
+done:
+        return err;
+}
+
 /* tp->lock is held. */
 static inline void tg3_generate_fw_event(struct tg3 *tp)
 {
@@ -1572,6 +1584,17 @@ static void tg3_phy_fini(struct tg3 *tp)
         }
 }
 
+static int tg3_phydsp_read(struct tg3 *tp, u32 reg, u32 *val)
+{
+        int err;
+
+        err = tg3_writephy(tp, MII_TG3_DSP_ADDRESS, reg);
+        if (!err)
+                err = tg3_readphy(tp, MII_TG3_DSP_RW_PORT, val);
+
+        return err;
+}
+
 static int tg3_phydsp_write(struct tg3 *tp, u32 reg, u32 val)
 {
         int err;
@@ -1735,6 +1758,42 @@ static void tg3_phy_apply_otp(struct tg3 *tp)
         tg3_writephy(tp, MII_TG3_AUX_CTRL, phy);
 }
 
+static void tg3_phy_eee_adjust(struct tg3 *tp, u32 current_link_up)
+{
+        u32 val;
+
+        if (!(tp->phy_flags & TG3_PHYFLG_EEE_CAP))
+                return;
+
+        tp->setlpicnt = 0;
+
+        if (tp->link_config.autoneg == AUTONEG_ENABLE &&
+            current_link_up == 1 &&
+            (tp->link_config.active_speed == SPEED_1000 ||
+             (tp->link_config.active_speed == SPEED_100 &&
+              tp->link_config.active_duplex == DUPLEX_FULL))) {
+                u32 eeectl;
+
+                if (tp->link_config.active_speed == SPEED_1000)
+                        eeectl = TG3_CPMU_EEE_CTRL_EXIT_16_5_US;
+                else
+                        eeectl = TG3_CPMU_EEE_CTRL_EXIT_36_US;
+
+                tw32(TG3_CPMU_EEE_CTRL, eeectl);
+
+                tg3_phy_cl45_read(tp, 0x7, TG3_CL45_D7_EEERES_STAT, &val);
+
+                if (val == TG3_CL45_D7_EEERES_STAT_LP_1000T ||
+                    val == TG3_CL45_D7_EEERES_STAT_LP_100TX)
+                        tp->setlpicnt = 2;
+        }
+
+        if (!tp->setlpicnt) {
+                val = tr32(TG3_CPMU_EEE_MODE);
+                tw32(TG3_CPMU_EEE_MODE, val & ~TG3_CPMU_EEEMD_LPI_ENABLE);
+        }
+}
+
 static int tg3_wait_macro_done(struct tg3 *tp)
 {
         int limit = 100;
@@ -1917,19 +1976,16 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
  */
 static int tg3_phy_reset(struct tg3 *tp)
 {
-        u32 cpmuctrl;
-        u32 phy_status;
+        u32 val, cpmuctrl;
         int err;
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
-                u32 val;
-
                 val = tr32(GRC_MISC_CFG);
                 tw32_f(GRC_MISC_CFG, val & ~GRC_MISC_CFG_EPHY_IDDQ);
                 udelay(40);
         }
-        err  = tg3_readphy(tp, MII_BMSR, &phy_status);
-        err |= tg3_readphy(tp, MII_BMSR, &phy_status);
+        err  = tg3_readphy(tp, MII_BMSR, &val);
+        err |= tg3_readphy(tp, MII_BMSR, &val);
         if (err != 0)
                 return -EBUSY;
 
@@ -1961,18 +2017,14 @@ static int tg3_phy_reset(struct tg3 *tp)
                 return err;
 
         if (cpmuctrl & CPMU_CTRL_GPHY_10MB_RXONLY) {
-                u32 phy;
-
-                phy = MII_TG3_DSP_EXP8_AEDW | MII_TG3_DSP_EXP8_REJ2MHz;
-                tg3_phydsp_write(tp, MII_TG3_DSP_EXP8, phy);
+                val = MII_TG3_DSP_EXP8_AEDW | MII_TG3_DSP_EXP8_REJ2MHz;
+                tg3_phydsp_write(tp, MII_TG3_DSP_EXP8, val);
 
                 tw32(TG3_CPMU_CTRL, cpmuctrl);
         }
 
         if (GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5784_AX ||
             GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5761_AX) {
-                u32 val;
-
                 val = tr32(TG3_CPMU_LSPD_1000MB_CLK);
                 if ((val & CPMU_LSPD_1000MB_MACCLK_MASK) ==
                     CPMU_LSPD_1000MB_MACCLK_12_5) {
@@ -2028,23 +2080,19 @@ out:
                 /* Cannot do read-modify-write on 5401 */
                 tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x4c20);
         } else if (tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE) {
-                u32 phy_reg;
-
                 /* Set bit 14 with read-modify-write to preserve other bits */
                 if (!tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x0007) &&
-                    !tg3_readphy(tp, MII_TG3_AUX_CTRL, &phy_reg))
-                        tg3_writephy(tp, MII_TG3_AUX_CTRL, phy_reg | 0x4000);
+                    !tg3_readphy(tp, MII_TG3_AUX_CTRL, &val))
+                        tg3_writephy(tp, MII_TG3_AUX_CTRL, val | 0x4000);
         }
 
         /* Set phy register 0x10 bit 0 to high fifo elasticity to support
          * jumbo frames transmission.
          */
         if (tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE) {
-                u32 phy_reg;
-
-                if (!tg3_readphy(tp, MII_TG3_EXT_CTRL, &phy_reg))
+                if (!tg3_readphy(tp, MII_TG3_EXT_CTRL, &val))
                         tg3_writephy(tp, MII_TG3_EXT_CTRL,
-                                     phy_reg | MII_TG3_EXT_CTRL_FIFO_ELASTIC);
+                                     val | MII_TG3_EXT_CTRL_FIFO_ELASTIC);
         }
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
@@ -2920,6 +2968,44 @@ static void tg3_phy_copper_begin(struct tg3 *tp)
                 tg3_writephy(tp, MII_TG3_CTRL, new_adv);
         }
 
+        if (tp->phy_flags & TG3_PHYFLG_EEE_CAP) {
+                u32 val = 0;
+
+                tw32(TG3_CPMU_EEE_MODE,
+                     tr32(TG3_CPMU_EEE_MODE) & ~TG3_CPMU_EEEMD_LPI_ENABLE);
+
+                /* Enable SM_DSP clock and tx 6dB coding. */
+                val = MII_TG3_AUXCTL_SHDWSEL_AUXCTL |
+                      MII_TG3_AUXCTL_ACTL_SMDSP_ENA |
+                      MII_TG3_AUXCTL_ACTL_TX_6DB;
+                tg3_writephy(tp, MII_TG3_AUX_CTRL, val);
+
+                if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 ||
+                     GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765) &&
+                    !tg3_phydsp_read(tp, MII_TG3_DSP_CH34TP2, &val))
+                        tg3_phydsp_write(tp, MII_TG3_DSP_CH34TP2,
+                                         val | MII_TG3_DSP_CH34TP2_HIBW01);
+
+                if (tp->link_config.autoneg == AUTONEG_ENABLE) {
+                        /* Advertise 100-BaseTX EEE ability */
+                        if (tp->link_config.advertising &
+                            (ADVERTISED_100baseT_Half |
+                             ADVERTISED_100baseT_Full))
+                                val |= TG3_CL45_D7_EEEADV_CAP_100TX;
+                        /* Advertise 1000-BaseT EEE ability */
+                        if (tp->link_config.advertising &
+                            (ADVERTISED_1000baseT_Half |
+                             ADVERTISED_1000baseT_Full))
+                                val |= TG3_CL45_D7_EEEADV_CAP_1000T;
+                }
+                tg3_phy_cl45_write(tp, 0x7, TG3_CL45_D7_EEEADV_CAP, val);
+
+                /* Turn off SM_DSP clock. */
+                val = MII_TG3_AUXCTL_SHDWSEL_AUXCTL |
+                      MII_TG3_AUXCTL_ACTL_TX_6DB;
+                tg3_writephy(tp, MII_TG3_AUX_CTRL, val);
+        }
+
         if (tp->link_config.autoneg == AUTONEG_DISABLE &&
             tp->link_config.speed != SPEED_INVALID) {
                 u32 bmcr, orig_bmcr;
@@ -3060,7 +3146,7 @@ static int tg3_adv_1000T_flowctrl_ok(struct tg3 *tp, u32 *lcladv, u32 *rmtadv)
 static int tg3_setup_copper_phy(struct tg3 *tp, int force_reset)
 {
         int current_link_up;
-        u32 bmsr, dummy;
+        u32 bmsr, val;
         u32 lcl_adv, rmt_adv;
         u16 current_speed;
         u8 current_duplex;
@@ -3140,8 +3226,8 @@ static int tg3_setup_copper_phy(struct tg3 *tp, int force_reset)
         }
 
         /* Clear pending interrupts... */
-        tg3_readphy(tp, MII_TG3_ISTAT, &dummy);
-        tg3_readphy(tp, MII_TG3_ISTAT, &dummy);
+        tg3_readphy(tp, MII_TG3_ISTAT, &val);
+        tg3_readphy(tp, MII_TG3_ISTAT, &val);
 
         if (tp->phy_flags & TG3_PHYFLG_USE_MI_INTERRUPT)
                 tg3_writephy(tp, MII_TG3_IMASK, ~MII_TG3_INT_LINKCHG);
@@ -3162,8 +3248,6 @@ static int tg3_setup_copper_phy(struct tg3 *tp, int force_reset)
         current_duplex = DUPLEX_INVALID;
 
         if (tp->phy_flags & TG3_PHYFLG_CAPACITIVE_COUPLING) {
-                u32 val;
-
                 tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x4007);
                 tg3_readphy(tp, MII_TG3_AUX_CTRL, &val);
                 if (!(val & (1 << 10))) {
@@ -3238,13 +3322,11 @@ static int tg3_setup_copper_phy(struct tg3 *tp, int force_reset)
 
 relink:
         if (current_link_up == 0 || (tp->phy_flags & TG3_PHYFLG_IS_LOW_POWER)) {
-                u32 tmp;
-
                 tg3_phy_copper_begin(tp);
 
-                tg3_readphy(tp, MII_BMSR, &tmp);
-                if (!tg3_readphy(tp, MII_BMSR, &tmp) &&
-                    (tmp & BMSR_LSTATUS))
+                tg3_readphy(tp, MII_BMSR, &bmsr);
+                if (!tg3_readphy(tp, MII_BMSR, &bmsr) &&
+                    (bmsr & BMSR_LSTATUS))
                         current_link_up = 1;
         }
 
@@ -3285,6 +3367,8 @@ relink:
         tw32_f(MAC_MODE, tp->mac_mode);
         udelay(40);
 
+        tg3_phy_eee_adjust(tp, current_link_up);
+
         if (tp->tg3_flags & TG3_FLAG_USE_LINKCHG_REG) {
                 /* Polled via timer. */
                 tw32_f(MAC_EVENT, 0);
@@ -4353,6 +4437,11 @@ static int tg3_setup_phy(struct tg3 *tp, int force_reset)
         return err;
 }
 
+static inline int tg3_irq_sync(struct tg3 *tp)
+{
+        return tp->irq_sync;
+}
+
 /* This is called whenever we suspect that the system chipset is re-
  * ordering the sequence of MMIO to the tx send mailbox. The symptom
  * is bogus tx completions. We try to recover by setting the
@@ -4484,22 +4573,21 @@ static int tg3_alloc_rx_skb(struct tg3 *tp, struct tg3_rx_prodring_set *tpr,
                             u32 opaque_key, u32 dest_idx_unmasked)
 {
         struct tg3_rx_buffer_desc *desc;
-        struct ring_info *map, *src_map;
+        struct ring_info *map;
         struct sk_buff *skb;
         dma_addr_t mapping;
         int skb_size, dest_idx;
 
-        src_map = NULL;
         switch (opaque_key) {
         case RXD_OPAQUE_RING_STD:
-                dest_idx = dest_idx_unmasked % TG3_RX_RING_SIZE;
+                dest_idx = dest_idx_unmasked & tp->rx_std_ring_mask;
                 desc = &tpr->rx_std[dest_idx];
                 map = &tpr->rx_std_buffers[dest_idx];
                 skb_size = tp->rx_pkt_map_sz;
                 break;
 
         case RXD_OPAQUE_RING_JUMBO:
-                dest_idx = dest_idx_unmasked % TG3_RX_JUMBO_RING_SIZE;
+                dest_idx = dest_idx_unmasked & tp->rx_jmb_ring_mask;
                 desc = &tpr->rx_jmb[dest_idx].std;
                 map = &tpr->rx_jmb_buffers[dest_idx];
                 skb_size = TG3_RX_JMB_MAP_SZ;
@@ -4549,12 +4637,12 @@ static void tg3_recycle_rx(struct tg3_napi *tnapi,
         struct tg3 *tp = tnapi->tp;
         struct tg3_rx_buffer_desc *src_desc, *dest_desc;
         struct ring_info *src_map, *dest_map;
-        struct tg3_rx_prodring_set *spr = &tp->prodring[0];
+        struct tg3_rx_prodring_set *spr = &tp->napi[0].prodring;
         int dest_idx;
 
         switch (opaque_key) {
         case RXD_OPAQUE_RING_STD:
-                dest_idx = dest_idx_unmasked % TG3_RX_RING_SIZE;
+                dest_idx = dest_idx_unmasked & tp->rx_std_ring_mask;
                 dest_desc = &dpr->rx_std[dest_idx];
                 dest_map = &dpr->rx_std_buffers[dest_idx];
                 src_desc = &spr->rx_std[src_idx];
@@ -4562,7 +4650,7 @@ static void tg3_recycle_rx(struct tg3_napi *tnapi,
                 break;
 
         case RXD_OPAQUE_RING_JUMBO:
-                dest_idx = dest_idx_unmasked % TG3_RX_JUMBO_RING_SIZE;
+                dest_idx = dest_idx_unmasked & tp->rx_jmb_ring_mask;
                 dest_desc = &dpr->rx_jmb[dest_idx].std;
                 dest_map = &dpr->rx_jmb_buffers[dest_idx];
                 src_desc = &spr->rx_jmb[src_idx].std;
@@ -4619,7 +4707,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
         u32 sw_idx = tnapi->rx_rcb_ptr;
         u16 hw_idx;
         int received;
-        struct tg3_rx_prodring_set *tpr = tnapi->prodring;
+        struct tg3_rx_prodring_set *tpr = &tnapi->prodring;
 
         hw_idx = *(tnapi->rx_rcb_prod_idx);
         /*
@@ -4644,13 +4732,13 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                 desc_idx = desc->opaque & RXD_OPAQUE_INDEX_MASK;
                 opaque_key = desc->opaque & RXD_OPAQUE_RING_MASK;
                 if (opaque_key == RXD_OPAQUE_RING_STD) {
-                        ri = &tp->prodring[0].rx_std_buffers[desc_idx];
+                        ri = &tp->napi[0].prodring.rx_std_buffers[desc_idx];
                         dma_addr = dma_unmap_addr(ri, mapping);
                         skb = ri->skb;
                         post_ptr = &std_prod_idx;
                         rx_std_posted++;
                 } else if (opaque_key == RXD_OPAQUE_RING_JUMBO) {
-                        ri = &tp->prodring[0].rx_jmb_buffers[desc_idx];
+                        ri = &tp->napi[0].prodring.rx_jmb_buffers[desc_idx];
                         dma_addr = dma_unmap_addr(ri, mapping);
                         skb = ri->skb;
                         post_ptr = &jmb_prod_idx;
@@ -4762,7 +4850,8 @@ next_pkt:
                 (*post_ptr)++;
 
                 if (unlikely(rx_std_posted >= tp->rx_std_max_post)) {
-                        tpr->rx_std_prod_idx = std_prod_idx % TG3_RX_RING_SIZE;
+                        tpr->rx_std_prod_idx = std_prod_idx &
+                                               tp->rx_std_ring_mask;
                         tw32_rx_mbox(TG3_RX_STD_PROD_IDX_REG,
                                      tpr->rx_std_prod_idx);
                         work_mask &= ~RXD_OPAQUE_RING_STD;
@@ -4770,7 +4859,7 @@ next_pkt:
                 }
 next_pkt_nopost:
                 sw_idx++;
-                sw_idx &= (TG3_RX_RCB_RING_SIZE(tp) - 1);
+                sw_idx &= tp->rx_ret_ring_mask;
 
                 /* Refresh hw_idx to see if there is new work */
                 if (sw_idx == hw_idx) {
@@ -4786,13 +4875,14 @@ next_pkt_nopost:
         /* Refill RX ring(s). */
         if (!(tp->tg3_flags3 & TG3_FLG3_ENABLE_RSS)) {
                 if (work_mask & RXD_OPAQUE_RING_STD) {
-                        tpr->rx_std_prod_idx = std_prod_idx % TG3_RX_RING_SIZE;
+                        tpr->rx_std_prod_idx = std_prod_idx &
+                                               tp->rx_std_ring_mask;
                         tw32_rx_mbox(TG3_RX_STD_PROD_IDX_REG,
                                      tpr->rx_std_prod_idx);
                 }
                 if (work_mask & RXD_OPAQUE_RING_JUMBO) {
-                        tpr->rx_jmb_prod_idx = jmb_prod_idx %
-                                               TG3_RX_JUMBO_RING_SIZE;
+                        tpr->rx_jmb_prod_idx = jmb_prod_idx &
+                                               tp->rx_jmb_ring_mask;
                         tw32_rx_mbox(TG3_RX_JMB_PROD_IDX_REG,
                                      tpr->rx_jmb_prod_idx);
                 }
@@ -4803,8 +4893,8 @@ next_pkt_nopost:
                  */
                 smp_wmb();
 
-                tpr->rx_std_prod_idx = std_prod_idx % TG3_RX_RING_SIZE;
-                tpr->rx_jmb_prod_idx = jmb_prod_idx % TG3_RX_JUMBO_RING_SIZE;
+                tpr->rx_std_prod_idx = std_prod_idx & tp->rx_std_ring_mask;
+                tpr->rx_jmb_prod_idx = jmb_prod_idx & tp->rx_jmb_ring_mask;
 
                 if (tnapi != &tp->napi[1])
                         napi_schedule(&tp->napi[1].napi);
@@ -4860,9 +4950,11 @@ static int tg3_rx_prodring_xfer(struct tg3 *tp,
                 if (spr->rx_std_cons_idx < src_prod_idx)
                         cpycnt = src_prod_idx - spr->rx_std_cons_idx;
                 else
-                        cpycnt = TG3_RX_RING_SIZE - spr->rx_std_cons_idx;
+                        cpycnt = tp->rx_std_ring_mask + 1 -
+                                 spr->rx_std_cons_idx;
 
-                cpycnt = min(cpycnt, TG3_RX_RING_SIZE - dpr->rx_std_prod_idx);
+                cpycnt = min(cpycnt,
+                             tp->rx_std_ring_mask + 1 - dpr->rx_std_prod_idx);
 
                 si = spr->rx_std_cons_idx;
                 di = dpr->rx_std_prod_idx;
@@ -4896,10 +4988,10 @@ static int tg3_rx_prodring_xfer(struct tg3 *tp,
                         dbd->addr_lo = sbd->addr_lo;
                 }
 
-                spr->rx_std_cons_idx = (spr->rx_std_cons_idx + cpycnt) %
-                                       TG3_RX_RING_SIZE;
-                dpr->rx_std_prod_idx = (dpr->rx_std_prod_idx + cpycnt) %
-                                       TG3_RX_RING_SIZE;
+                spr->rx_std_cons_idx = (spr->rx_std_cons_idx + cpycnt) &
+                                       tp->rx_std_ring_mask;
+                dpr->rx_std_prod_idx = (dpr->rx_std_prod_idx + cpycnt) &
+                                       tp->rx_std_ring_mask;
         }
 
         while (1) {
@@ -4916,10 +5008,11 @@ static int tg3_rx_prodring_xfer(struct tg3 *tp,
                 if (spr->rx_jmb_cons_idx < src_prod_idx)
                         cpycnt = src_prod_idx - spr->rx_jmb_cons_idx;
                 else
-                        cpycnt = TG3_RX_JUMBO_RING_SIZE - spr->rx_jmb_cons_idx;
+                        cpycnt = tp->rx_jmb_ring_mask + 1 -
+                                 spr->rx_jmb_cons_idx;
 
                 cpycnt = min(cpycnt,
-                             TG3_RX_JUMBO_RING_SIZE - dpr->rx_jmb_prod_idx);
+                             tp->rx_jmb_ring_mask + 1 - dpr->rx_jmb_prod_idx);
 
                 si = spr->rx_jmb_cons_idx;
                 di = dpr->rx_jmb_prod_idx;
@@ -4953,10 +5046,10 @@ static int tg3_rx_prodring_xfer(struct tg3 *tp,
                         dbd->addr_lo = sbd->addr_lo;
                 }
 
-                spr->rx_jmb_cons_idx = (spr->rx_jmb_cons_idx + cpycnt) %
-                                       TG3_RX_JUMBO_RING_SIZE;
-                dpr->rx_jmb_prod_idx = (dpr->rx_jmb_prod_idx + cpycnt) %
-                                       TG3_RX_JUMBO_RING_SIZE;
+                spr->rx_jmb_cons_idx = (spr->rx_jmb_cons_idx + cpycnt) &
+                                       tp->rx_jmb_ring_mask;
+                dpr->rx_jmb_prod_idx = (dpr->rx_jmb_prod_idx + cpycnt) &
+                                       tp->rx_jmb_ring_mask;
         }
 
         return err;
@@ -4981,14 +5074,14 @@ static int tg3_poll_work(struct tg3_napi *tnapi, int work_done, int budget)
                 work_done += tg3_rx(tnapi, budget - work_done);
 
         if ((tp->tg3_flags3 & TG3_FLG3_ENABLE_RSS) && tnapi == &tp->napi[1]) {
-                struct tg3_rx_prodring_set *dpr = &tp->prodring[0];
+                struct tg3_rx_prodring_set *dpr = &tp->napi[0].prodring;
                 int i, err = 0;
                 u32 std_prod_idx = dpr->rx_std_prod_idx;
                 u32 jmb_prod_idx = dpr->rx_jmb_prod_idx;
 
                 for (i = 1; i < tp->irq_cnt; i++)
                         err |= tg3_rx_prodring_xfer(tp, dpr,
-                                                    tp->napi[i].prodring);
+                                                    &tp->napi[i].prodring);
 
                 wmb();
 
@@ -5098,6 +5191,59 @@ tx_recovery:
         return work_done;
 }
 
+static void tg3_napi_disable(struct tg3 *tp)
+{
+        int i;
+
+        for (i = tp->irq_cnt - 1; i >= 0; i--)
+                napi_disable(&tp->napi[i].napi);
+}
+
+static void tg3_napi_enable(struct tg3 *tp)
+{
+        int i;
+
+        for (i = 0; i < tp->irq_cnt; i++)
+                napi_enable(&tp->napi[i].napi);
+}
+
+static void tg3_napi_init(struct tg3 *tp)
+{
+        int i;
+
+        netif_napi_add(tp->dev, &tp->napi[0].napi, tg3_poll, 64);
+        for (i = 1; i < tp->irq_cnt; i++)
+                netif_napi_add(tp->dev, &tp->napi[i].napi, tg3_poll_msix, 64);
+}
+
+static void tg3_napi_fini(struct tg3 *tp)
+{
+        int i;
+
+        for (i = 0; i < tp->irq_cnt; i++)
+                netif_napi_del(&tp->napi[i].napi);
+}
+
+static inline void tg3_netif_stop(struct tg3 *tp)
+{
+        tp->dev->trans_start = jiffies; /* prevent tx timeout */
+        tg3_napi_disable(tp);
+        netif_tx_disable(tp->dev);
+}
+
+static inline void tg3_netif_start(struct tg3 *tp)
+{
+        /* NOTE: unconditional netif_tx_wake_all_queues is only
+         * appropriate so long as all callers are assured to
+         * have free tx slots (such as after tg3_init_hw)
+         */
+        netif_tx_wake_all_queues(tp->dev);
+
+        tg3_napi_enable(tp);
+        tp->napi[0].hw_status->status |= SD_STATUS_UPDATED;
+        tg3_enable_ints(tp);
+}
+
 static void tg3_irq_quiesce(struct tg3 *tp)
 {
         int i;
@@ -5111,11 +5257,6 @@ static void tg3_irq_quiesce(struct tg3 *tp)
                 synchronize_irq(tp->napi[i].irq_vec);
 }
 
-static inline int tg3_irq_sync(struct tg3 *tp)
-{
-        return tp->irq_sync;
-}
-
 /* Fully shutdown all tg3 driver activity elsewhere in the system.
  * If irq_sync is non-zero, then the IRQ handler must be synchronized
  * with as well.  Most of the time, this is not necessary except when
@@ -5404,8 +5545,7 @@ static inline int tg3_4g_overflow_test(dma_addr_t mapping, int len)
 {
         u32 base = (u32) mapping & 0xffffffff;
 
-        return ((base > 0xffffdcc0) &&
-                (base + len + 8 < base));
+        return (base > 0xffffdcc0) && (base + len + 8 < base);
 }
 
 /* Test for DMA addresses > 40-bit */
@@ -5414,7 +5554,7 @@ static inline int tg3_40bit_overflow_test(struct tg3 *tp, dma_addr_t mapping,
 {
 #if defined(CONFIG_HIGHMEM) && (BITS_PER_LONG == 64)
         if (tp->tg3_flags & TG3_FLAG_40BIT_DMA_BUG)
-                return (((u64) mapping + len) > DMA_BIT_MASK(40));
+                return ((u64) mapping + len) > DMA_BIT_MASK(40);
         return 0;
 #else
         return 0;
@@ -5574,9 +5714,9 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb,
                         goto out_unlock;
                 }
 
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                if (skb_is_gso_v6(skb)) {
                         hdrlen = skb_headlen(skb) - ETH_HLEN;
-                else {
+                } else {
                         struct iphdr *iph = ip_hdr(skb);
 
                         tcp_opt_len = tcp_optlen(skb);
@@ -5605,7 +5745,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb,
         }
 
 #if TG3_VLAN_TAG_USED
-        if (tp->vlgrp != NULL && vlan_tx_tag_present(skb))
+        if (vlan_tx_tag_present(skb))
                 base_flags |= (TXD_FLAG_VLAN |
                                (vlan_tx_tag_get(skb) << 16));
 #endif
@@ -5798,7 +5938,7 @@ static netdev_tx_t tg3_start_xmit_dma_bug(struct sk_buff *skb,
                 iph = ip_hdr(skb);
                 tcp_opt_len = tcp_optlen(skb);
 
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
+                if (skb_is_gso_v6(skb)) {
                         hdr_len = skb_headlen(skb) - ETH_HLEN;
                 } else {
                         u32 ip_tcp_len;
@@ -5851,7 +5991,7 @@ static netdev_tx_t tg3_start_xmit_dma_bug(struct sk_buff *skb,
                 }
         }
 #if TG3_VLAN_TAG_USED
-        if (tp->vlgrp != NULL && vlan_tx_tag_present(skb))
+        if (vlan_tx_tag_present(skb))
                 base_flags |= (TXD_FLAG_VLAN |
                                (vlan_tx_tag_get(skb) << 16));
 #endif
@@ -6057,16 +6197,16 @@ static void tg3_rx_prodring_free(struct tg3 *tp,
 {
         int i;
 
-        if (tpr != &tp->prodring[0]) {
+        if (tpr != &tp->napi[0].prodring) {
                 for (i = tpr->rx_std_cons_idx; i != tpr->rx_std_prod_idx;
-                     i = (i + 1) % TG3_RX_RING_SIZE)
+                     i = (i + 1) & tp->rx_std_ring_mask)
                         tg3_rx_skb_free(tp, &tpr->rx_std_buffers[i],
                                         tp->rx_pkt_map_sz);
 
                 if (tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE) {
                         for (i = tpr->rx_jmb_cons_idx;
                              i != tpr->rx_jmb_prod_idx;
-                             i = (i + 1) % TG3_RX_JUMBO_RING_SIZE) {
+                             i = (i + 1) & tp->rx_jmb_ring_mask) {
                                 tg3_rx_skb_free(tp, &tpr->rx_jmb_buffers[i],
                                                 TG3_RX_JMB_MAP_SZ);
                         }
@@ -6075,12 +6215,13 @@ static void tg3_rx_prodring_free(struct tg3 *tp,
                 return;
         }
 
-        for (i = 0; i < TG3_RX_RING_SIZE; i++)
+        for (i = 0; i <= tp->rx_std_ring_mask; i++)
                 tg3_rx_skb_free(tp, &tpr->rx_std_buffers[i],
                                 tp->rx_pkt_map_sz);
 
-        if (tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE) {
-                for (i = 0; i < TG3_RX_JUMBO_RING_SIZE; i++)
+        if ((tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE) &&
+            !(tp->tg3_flags2 & TG3_FLG2_5780_CLASS)) {
+                for (i = 0; i <= tp->rx_jmb_ring_mask; i++)
                         tg3_rx_skb_free(tp, &tpr->rx_jmb_buffers[i],
                                         TG3_RX_JMB_MAP_SZ);
         }
@@ -6103,16 +6244,17 @@ static int tg3_rx_prodring_alloc(struct tg3 *tp,
         tpr->rx_jmb_cons_idx = 0;
         tpr->rx_jmb_prod_idx = 0;
 
-        if (tpr != &tp->prodring[0]) {
-                memset(&tpr->rx_std_buffers[0], 0, TG3_RX_STD_BUFF_RING_SIZE);
-                if (tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE)
+        if (tpr != &tp->napi[0].prodring) {
+                memset(&tpr->rx_std_buffers[0], 0,
+                       TG3_RX_STD_BUFF_RING_SIZE(tp));
+                if (tpr->rx_jmb_buffers)
                         memset(&tpr->rx_jmb_buffers[0], 0,
-                               TG3_RX_JMB_BUFF_RING_SIZE);
+                               TG3_RX_JMB_BUFF_RING_SIZE(tp));
                 goto done;
         }
 
         /* Zero out all descriptors. */
-        memset(tpr->rx_std, 0, TG3_RX_RING_BYTES);
+        memset(tpr->rx_std, 0, TG3_RX_STD_RING_BYTES(tp));
 
         rx_pkt_dma_sz = TG3_RX_STD_DMA_SZ;
         if ((tp->tg3_flags2 & TG3_FLG2_5780_CLASS) &&
@@ -6124,7 +6266,7 @@ static int tg3_rx_prodring_alloc(struct tg3 *tp,
          * stuff once.  This works because the card does not
          * write into the rx buffer posting rings.
          */
-        for (i = 0; i < TG3_RX_RING_SIZE; i++) {
+        for (i = 0; i <= tp->rx_std_ring_mask; i++) {
                 struct tg3_rx_buffer_desc *rxd;
 
                 rxd = &tpr->rx_std[i];
@@ -6148,15 +6290,16 @@ static int tg3_rx_prodring_alloc(struct tg3 *tp,
                 }
         }
 
-        if (!(tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE))
+        if (!(tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE) ||
+            (tp->tg3_flags2 & TG3_FLG2_5780_CLASS))
                 goto done;
 
-        memset(tpr->rx_jmb, 0, TG3_RX_JUMBO_RING_BYTES);
+        memset(tpr->rx_jmb, 0, TG3_RX_JMB_RING_BYTES(tp));
 
         if (!(tp->tg3_flags & TG3_FLAG_JUMBO_RING_ENABLE))
                 goto done;
 
-        for (i = 0; i < TG3_RX_JUMBO_RING_SIZE; i++) {
+        for (i = 0; i <= tp->rx_jmb_ring_mask; i++) {
                 struct tg3_rx_buffer_desc *rxd;
 
                 rxd = &tpr->rx_jmb[i].std;
@@ -6196,12 +6339,12 @@ static void tg3_rx_prodring_fini(struct tg3 *tp,
         kfree(tpr->rx_jmb_buffers);
         tpr->rx_jmb_buffers = NULL;
         if (tpr->rx_std) {
-                pci_free_consistent(tp->pdev, TG3_RX_RING_BYTES,
+                pci_free_consistent(tp->pdev, TG3_RX_STD_RING_BYTES(tp),
                                     tpr->rx_std, tpr->rx_std_mapping);
                 tpr->rx_std = NULL;
         }
         if (tpr->rx_jmb) {
-                pci_free_consistent(tp->pdev, TG3_RX_JUMBO_RING_BYTES,
+                pci_free_consistent(tp->pdev, TG3_RX_JMB_RING_BYTES(tp),
                                     tpr->rx_jmb, tpr->rx_jmb_mapping);
                 tpr->rx_jmb = NULL;
         }
@@ -6210,23 +6353,25 @@ static void tg3_rx_prodring_fini(struct tg3 *tp,
 static int tg3_rx_prodring_init(struct tg3 *tp,
                                 struct tg3_rx_prodring_set *tpr)
 {
-        tpr->rx_std_buffers = kzalloc(TG3_RX_STD_BUFF_RING_SIZE, GFP_KERNEL);
+        tpr->rx_std_buffers = kzalloc(TG3_RX_STD_BUFF_RING_SIZE(tp),
+                                      GFP_KERNEL);
         if (!tpr->rx_std_buffers)
                 return -ENOMEM;
 
-        tpr->rx_std = pci_alloc_consistent(tp->pdev, TG3_RX_RING_BYTES,
+        tpr->rx_std = pci_alloc_consistent(tp->pdev, TG3_RX_STD_RING_BYTES(tp),
                                            &tpr->rx_std_mapping);
         if (!tpr->rx_std)
                 goto err_out;
 
-        if (tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE) {
-                tpr->rx_jmb_buffers = kzalloc(TG3_RX_JMB_BUFF_RING_SIZE,
+        if ((tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE) &&
+            !(tp->tg3_flags2 & TG3_FLG2_5780_CLASS)) {
+                tpr->rx_jmb_buffers = kzalloc(TG3_RX_JMB_BUFF_RING_SIZE(tp),
                                               GFP_KERNEL);
                 if (!tpr->rx_jmb_buffers)
                         goto err_out;
 
                 tpr->rx_jmb = pci_alloc_consistent(tp->pdev,
-                                                   TG3_RX_JUMBO_RING_BYTES,
+                                                   TG3_RX_JMB_RING_BYTES(tp),
                                                    &tpr->rx_jmb_mapping);
                 if (!tpr->rx_jmb)
                         goto err_out;
@@ -6253,7 +6398,7 @@ static void tg3_free_rings(struct tg3 *tp)
         for (j = 0; j < tp->irq_cnt; j++) {
                 struct tg3_napi *tnapi = &tp->napi[j];
 
-                tg3_rx_prodring_free(tp, &tp->prodring[j]);
+                tg3_rx_prodring_free(tp, &tnapi->prodring);
 
                 if (!tnapi->tx_buffers)
                         continue;
@@ -6325,7 +6470,7 @@ static int tg3_init_rings(struct tg3 *tp)
                 if (tnapi->rx_rcb)
                         memset(tnapi->rx_rcb, 0, TG3_RX_RCB_RING_BYTES(tp));
 
-                if (tg3_rx_prodring_alloc(tp, &tp->prodring[i])) {
+                if (tg3_rx_prodring_alloc(tp, &tnapi->prodring)) {
                         tg3_free_rings(tp);
                         return -ENOMEM;
                 }
@@ -6361,6 +6506,8 @@ static void tg3_free_consistent(struct tg3 *tp)
                         tnapi->rx_rcb = NULL;
                 }
 
+                tg3_rx_prodring_fini(tp, &tnapi->prodring);
+
                 if (tnapi->hw_status) {
                         pci_free_consistent(tp->pdev, TG3_HW_STATUS_SIZE,
                                             tnapi->hw_status,
@@ -6374,9 +6521,6 @@ static void tg3_free_consistent(struct tg3 *tp)
                                     tp->hw_stats, tp->stats_mapping);
                 tp->hw_stats = NULL;
         }
-
-        for (i = 0; i < tp->irq_cnt; i++)
-                tg3_rx_prodring_fini(tp, &tp->prodring[i]);
 }
 
 /*
@@ -6387,11 +6531,6 @@ static int tg3_alloc_consistent(struct tg3 *tp)
 {
         int i;
 
-        for (i = 0; i < tp->irq_cnt; i++) {
-                if (tg3_rx_prodring_init(tp, &tp->prodring[i]))
-                        goto err_out;
-        }
-
         tp->hw_stats = pci_alloc_consistent(tp->pdev,
                                             sizeof(struct tg3_hw_stats),
                                             &tp->stats_mapping);
@@ -6413,6 +6552,9 @@ static int tg3_alloc_consistent(struct tg3 *tp)
                 memset(tnapi->hw_status, 0, TG3_HW_STATUS_SIZE);
                 sblk = tnapi->hw_status;
 
+                if (tg3_rx_prodring_init(tp, &tnapi->prodring))
+                        goto err_out;
+
                 /* If multivector TSS is enabled, vector 0 does not handle
                  * tx interrupts.  Don't allocate any resources for it.
                  */
@@ -6452,8 +6594,6 @@ static int tg3_alloc_consistent(struct tg3 *tp)
                         break;
                 }
 
-                tnapi->prodring = &tp->prodring[i];
-
                 /*
                  * If multivector RSS is enabled, vector 0 does not handle
                  * rx or tx interrupts.  Don't allocate any resources for it.
@@ -6596,6 +6736,10 @@ static void tg3_ape_send_event(struct tg3 *tp, u32 event)
         int i;
         u32 apedata;
 
+        /* NCSI does not support APE events */
+        if (tp->tg3_flags3 & TG3_FLG3_APE_HAS_NCSI)
+                return;
+
         apedata = tg3_ape_read32(tp, TG3_APE_SEG_SIG);
         if (apedata != APE_SEG_SIG_MAGIC)
                 return;
@@ -6647,6 +6791,8 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
                         APE_HOST_DRIVER_ID_MAGIC(TG3_MAJ_NUM, TG3_MIN_NUM));
                 tg3_ape_write32(tp, TG3_APE_HOST_BEHAVIOR,
                                 APE_HOST_BEHAV_NO_PHYLOCK);
+                tg3_ape_write32(tp, TG3_APE_HOST_DRVR_STATE,
+                                    TG3_APE_HOST_DRVR_STATE_START);
 
                 event = APE_EVENT_STATUS_STATE_START;
                 break;
@@ -6658,6 +6804,16 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
                  */
                 tg3_ape_write32(tp, TG3_APE_HOST_SEG_SIG, 0x0);
 
+                if (device_may_wakeup(&tp->pdev->dev) &&
+                    (tp->tg3_flags & TG3_FLAG_WOL_ENABLE)) {
+                        tg3_ape_write32(tp, TG3_APE_HOST_WOL_SPEED,
+                                            TG3_APE_HOST_WOL_SPEED_AUTO);
+                        apedata = TG3_APE_HOST_DRVR_STATE_WOL;
+                } else
+                        apedata = TG3_APE_HOST_DRVR_STATE_UNLOAD;
+
+                tg3_ape_write32(tp, TG3_APE_HOST_DRVR_STATE, apedata);
+
                 event = APE_EVENT_STATUS_STATE_UNLOAD;
                 break;
         case RESET_KIND_SUSPEND:
@@ -7515,6 +7671,9 @@ static void tg3_rings_reset(struct tg3 *tp)
         /* Disable all transmit rings but the first. */
         if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS))
                 limit = NIC_SRAM_SEND_RCB + TG3_BDINFO_SIZE * 16;
+        else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 ||
+                 GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719)
+                limit = NIC_SRAM_SEND_RCB + TG3_BDINFO_SIZE * 4;
         else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765)
                 limit = NIC_SRAM_SEND_RCB + TG3_BDINFO_SIZE * 2;
         else
@@ -7548,7 +7707,7 @@ static void tg3_rings_reset(struct tg3 *tp)
 
         /* Zero mailbox registers. */
         if (tp->tg3_flags & TG3_FLAG_SUPPORT_MSIX) {
-                for (i = 1; i < TG3_IRQ_MAX_VECS; i++) {
+                for (i = 1; i < tp->irq_max; i++) {
                         tp->napi[i].tx_prod = 0;
                         tp->napi[i].tx_cons = 0;
                         if (tp->tg3_flags3 & TG3_FLG3_ENABLE_TSS)
@@ -7594,8 +7753,8 @@ static void tg3_rings_reset(struct tg3 *tp)
 
         if (tnapi->rx_rcb) {
                 tg3_set_bdinfo(tp, rxrcb, tnapi->rx_rcb_mapping,
-                               (TG3_RX_RCB_RING_SIZE(tp) <<
-                                BDINFO_FLAGS_MAXLEN_SHIFT), 0);
+                               (tp->rx_ret_ring_mask + 1) <<
+                                BDINFO_FLAGS_MAXLEN_SHIFT, 0);
                 rxrcb += TG3_BDINFO_SIZE;
         }
 
@@ -7618,7 +7777,7 @@ static void tg3_rings_reset(struct tg3 *tp)
                 }
 
                 tg3_set_bdinfo(tp, rxrcb, tnapi->rx_rcb_mapping,
-                               (TG3_RX_RCB_RING_SIZE(tp) <<
+                               ((tp->rx_ret_ring_mask + 1) <<
                                 BDINFO_FLAGS_MAXLEN_SHIFT), 0);
 
                 stblk += 8;
@@ -7631,7 +7790,7 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
 {
         u32 val, rdmac_mode;
         int i, err, limit;
-        struct tg3_rx_prodring_set *tpr = &tp->prodring[0];
+        struct tg3_rx_prodring_set *tpr = &tp->napi[0].prodring;
 
         tg3_disable_ints(tp);
 
@@ -7720,6 +7879,22 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
                 tw32(TG3_CPMU_LSPD_10MB_CLK, val);
         }
 
+        /* Enable MAC control of LPI */
+        if (tp->phy_flags & TG3_PHYFLG_EEE_CAP) {
+                tw32_f(TG3_CPMU_EEE_LNKIDL_CTRL,
+                       TG3_CPMU_EEE_LNKIDL_PCIE_NL0 |
+                       TG3_CPMU_EEE_LNKIDL_UART_IDL);
+
+                tw32_f(TG3_CPMU_EEE_CTRL,
+                       TG3_CPMU_EEE_CTRL_EXIT_20_1_US);
+
+                tw32_f(TG3_CPMU_EEE_MODE,
+                       TG3_CPMU_EEEMD_ERLY_L1_XIT_DET |
+                       TG3_CPMU_EEEMD_LPI_IN_TX |
+                       TG3_CPMU_EEEMD_LPI_IN_RX |
+                       TG3_CPMU_EEEMD_EEE_ENABLE);
+        }
+
         /* This works around an issue with Athlon chipsets on
          * B3 tigon3 silicon.  This bit has no effect on any
          * other revision.  But do not set this on PCI Express
@@ -7845,7 +8020,10 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
         tw32(BUFMGR_DMA_HIGH_WATER,
              tp->bufmgr_config.dma_high_water);
 
-        tw32(BUFMGR_MODE, BUFMGR_MODE_ENABLE | BUFMGR_MODE_ATTN_ENABLE);
+        val = BUFMGR_MODE_ENABLE | BUFMGR_MODE_ATTN_ENABLE;
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719)
+                val |= BUFMGR_MODE_NO_TX_UNDERRUN;
+        tw32(BUFMGR_MODE, val);
         for (i = 0; i < 2000; i++) {
                 if (tr32(BUFMGR_MODE) & BUFMGR_MODE_ENABLE)
                         break;
@@ -7928,10 +8106,14 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
                              BDINFO_FLAGS_DISABLED);
                 }
 
-                if (tp->tg3_flags3 & TG3_FLG3_5717_PLUS)
-                        val = (RX_STD_MAX_SIZE_5705 << BDINFO_FLAGS_MAXLEN_SHIFT) |
-                              (TG3_RX_STD_DMA_SZ << 2);
-                else
+                if (tp->tg3_flags3 & TG3_FLG3_5717_PLUS) {
+                        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765)
+                                val = RX_STD_MAX_SIZE_5705;
+                        else
+                                val = RX_STD_MAX_SIZE_5717;
+                        val <<= BDINFO_FLAGS_MAXLEN_SHIFT;
+                        val |= (TG3_RX_STD_DMA_SZ << 2);
+                } else
                         val = TG3_RX_STD_DMA_SZ << BDINFO_FLAGS_MAXLEN_SHIFT;
         } else
                 val = RX_STD_MAX_SIZE_5705 << BDINFO_FLAGS_MAXLEN_SHIFT;
@@ -8015,6 +8197,23 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
             GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780)
                 rdmac_mode |= RDMAC_MODE_IPV6_LSO_EN;
 
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5761 ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5784 ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5785 ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780 ||
+            (tp->tg3_flags3 & TG3_FLG3_5717_PLUS)) {
+                val = tr32(TG3_RDMA_RSRVCTRL_REG);
+                tw32(TG3_RDMA_RSRVCTRL_REG,
+                     val | TG3_RDMA_RSRVCTRL_FIFO_OFLW_FIX);
+        }
+
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719) {
+                val = tr32(TG3_LSO_RD_DMA_CRPTEN_CTRL);
+                tw32(TG3_LSO_RD_DMA_CRPTEN_CTRL, val |
+                     TG3_LSO_RD_DMA_CRPTEN_CTRL_BLEN_BD_4K |
+                     TG3_LSO_RD_DMA_CRPTEN_CTRL_BLEN_LSO_4K);
+        }
+
         /* Receive/send statistics. */
         if (tp->tg3_flags2 & TG3_FLG2_5750_PLUS) {
                 val = tr32(RCVLPC_STATS_ENABLE);
@@ -8197,7 +8396,11 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
 
         tw32(SNDBDC_MODE, SNDBDC_MODE_ENABLE | SNDBDC_MODE_ATTN_ENABLE);
         tw32(RCVBDI_MODE, RCVBDI_MODE_ENABLE | RCVBDI_MODE_RCB_ATTN_ENAB);
-        tw32(RCVDBDI_MODE, RCVDBDI_MODE_ENABLE | RCVDBDI_MODE_INV_RING_SZ);
+        val = RCVDBDI_MODE_ENABLE | RCVDBDI_MODE_INV_RING_SZ;
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719)
+                val |= RCVDBDI_MODE_LRG_RING_SZ;
+        tw32(RCVDBDI_MODE, val);
         tw32(SNDDATAI_MODE, SNDDATAI_MODE_ENABLE);
         if (tp->tg3_flags2 & TG3_FLG2_HW_TSO)
                 tw32(SNDDATAI_MODE, SNDDATAI_MODE_ENABLE | 0x8);
@@ -8500,6 +8703,12 @@ static void tg3_timer(unsigned long __opaque)
                 if (tp->tg3_flags2 & TG3_FLG2_5705_PLUS)
                         tg3_periodic_fetch_stats(tp);
 
+                if (tp->setlpicnt && !--tp->setlpicnt) {
+                        u32 val = tr32(TG3_CPMU_EEE_MODE);
+                        tw32(TG3_CPMU_EEE_MODE,
+                             val | TG3_CPMU_EEEMD_LPI_ENABLE);
+                }
+
                 if (tp->tg3_flags & TG3_FLAG_USE_LINKCHG_REG) {
                         u32 mac_stat;
                         int phy_event;
@@ -8816,16 +9025,14 @@ static bool tg3_enable_msix(struct tg3 *tp)
         for (i = 0; i < tp->irq_max; i++)
                 tp->napi[i].irq_vec = msix_ent[i].vector;
 
-        tp->dev->real_num_tx_queues = 1;
-        if (tp->irq_cnt > 1) {
-                tp->tg3_flags3 |= TG3_FLG3_ENABLE_RSS;
-
-                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 ||
-                    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719) {
-                        tp->tg3_flags3 |= TG3_FLG3_ENABLE_TSS;
-                        tp->dev->real_num_tx_queues = tp->irq_cnt - 1;
-                }
+        netif_set_real_num_tx_queues(tp->dev, 1);
+        rc = tp->irq_cnt > 1 ? tp->irq_cnt - 1 : 1;
+        if (netif_set_real_num_rx_queues(tp->dev, rc)) {
+                pci_disable_msix(tp->pdev);
+                return false;
         }
+        if (tp->irq_cnt > 1)
+                tp->tg3_flags3 |= TG3_FLG3_ENABLE_RSS;
 
         return true;
 }
@@ -8858,7 +9065,8 @@ defcfg:
         if (!(tp->tg3_flags2 & TG3_FLG2_USING_MSIX)) {
                 tp->irq_cnt = 1;
                 tp->napi[0].irq_vec = tp->pdev->irq;
-                tp->dev->real_num_tx_queues = 1;
+                netif_set_real_num_tx_queues(tp->dev, 1);
+                netif_set_real_num_rx_queues(tp->dev, 1);
         }
 }
 
@@ -8917,6 +9125,8 @@ static int tg3_open(struct net_device *dev)
         if (err)
                 goto err_out1;
 
+        tg3_napi_init(tp);
+
         tg3_napi_enable(tp);
 
         for (i = 0; i < tp->irq_cnt; i++) {
@@ -9004,6 +9214,7 @@ err_out3:
 
 err_out2:
         tg3_napi_disable(tp);
+        tg3_napi_fini(tp);
         tg3_free_consistent(tp);
 
 err_out1:
@@ -9051,6 +9262,8 @@ static int tg3_close(struct net_device *dev)
         memcpy(&tp->estats_prev, tg3_get_estats(tp),
                sizeof(tp->estats_prev));
 
+        tg3_napi_fini(tp);
+
         tg3_free_consistent(tp);
 
         tg3_set_power_state(tp, PCI_D3hot);
@@ -9594,6 +9807,9 @@ static int tg3_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
         if (netif_running(dev)) {
                 cmd->speed = tp->link_config.active_speed;
                 cmd->duplex = tp->link_config.active_duplex;
+        } else {
+                cmd->speed = SPEED_INVALID;
+                cmd->duplex = DUPLEX_INVALID;
         }
         cmd->phy_address = tp->phy_addr;
         cmd->transceiver = XCVR_INTERNAL;
@@ -9820,10 +10036,10 @@ static void tg3_get_ringparam(struct net_device *dev, struct ethtool_ringparam *
 {
         struct tg3 *tp = netdev_priv(dev);
 
-        ering->rx_max_pending = TG3_RX_RING_SIZE - 1;
+        ering->rx_max_pending = tp->rx_std_ring_mask;
         ering->rx_mini_max_pending = 0;
         if (tp->tg3_flags & TG3_FLAG_JUMBO_RING_ENABLE)
-                ering->rx_jumbo_max_pending = TG3_RX_JUMBO_RING_SIZE - 1;
+                ering->rx_jumbo_max_pending = tp->rx_jmb_ring_mask;
         else
                 ering->rx_jumbo_max_pending = 0;
 
@@ -9844,8 +10060,8 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
         struct tg3 *tp = netdev_priv(dev);
         int i, irq_sync = 0, err = 0;
 
-        if ((ering->rx_pending > TG3_RX_RING_SIZE - 1) ||
-            (ering->rx_jumbo_pending > TG3_RX_JUMBO_RING_SIZE - 1) ||
+        if ((ering->rx_pending > tp->rx_std_ring_mask) ||
+            (ering->rx_jumbo_pending > tp->rx_jmb_ring_mask) ||
             (ering->tx_pending > TG3_TX_RING_SIZE - 1) ||
             (ering->tx_pending <= MAX_SKB_FRAGS) ||
             ((tp->tg3_flags2 & TG3_FLG2_TSO_BUG) &&
@@ -9867,7 +10083,7 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
                 tp->rx_pending = 63;
         tp->rx_jumbo_pending = ering->rx_jumbo_pending;
 
-        for (i = 0; i < TG3_IRQ_MAX_VECS; i++)
+        for (i = 0; i < tp->irq_max; i++)
                 tp->napi[i].tx_pending = ering->tx_pending;
 
         if (netif_running(dev)) {
@@ -9915,8 +10131,7 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 
                 if (!(phydev->supported & SUPPORTED_Pause) ||
                     (!(phydev->supported & SUPPORTED_Asym_Pause) &&
-                     ((epause->rx_pause && !epause->tx_pause) ||
-                      (!epause->rx_pause && epause->tx_pause))))
+                     (epause->rx_pause != epause->tx_pause)))
                         return -EINVAL;
 
                 tp->link_config.flowctrl = 0;
@@ -10608,12 +10823,13 @@ static int tg3_run_loopback(struct tg3 *tp, int loopback_mode)
         int num_pkts, tx_len, rx_len, i, err;
         struct tg3_rx_buffer_desc *desc;
         struct tg3_napi *tnapi, *rnapi;
-        struct tg3_rx_prodring_set *tpr = &tp->prodring[0];
+        struct tg3_rx_prodring_set *tpr = &tp->napi[0].prodring;
 
         tnapi = &tp->napi[0];
         rnapi = &tp->napi[0];
         if (tp->irq_cnt > 1) {
-                rnapi = &tp->napi[1];
+                if (tp->tg3_flags3 & TG3_FLG3_ENABLE_RSS)
+                        rnapi = &tp->napi[1];
                 if (tp->tg3_flags3 & TG3_FLG3_ENABLE_TSS)
                         tnapi = &tp->napi[1];
         }
@@ -12330,6 +12546,11 @@ static int __devinit tg3_phy_probe(struct tg3 *tp)
                 }
         }
 
+        if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_5718 ||
+            (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765 &&
+             tp->pci_chip_rev_id != CHIPREV_ID_57765_A0))
+                tp->phy_flags |= TG3_PHYFLG_EEE_CAP;
+
         if (!(tp->phy_flags & TG3_PHYFLG_ANY_SERDES) &&
             !(tp->tg3_flags3 & TG3_FLG3_ENABLE_APE) &&
             !(tp->tg3_flags & TG3_FLAG_ENABLE_ASF)) {
@@ -12401,14 +12622,18 @@ skip_phy_reset:
 
 static void __devinit tg3_read_vpd(struct tg3 *tp)
 {
-        u8 vpd_data[TG3_NVM_VPD_LEN];
+        u8 *vpd_data;
         unsigned int block_end, rosize, len;
         int j, i = 0;
         u32 magic;
 
         if ((tp->tg3_flags3 & TG3_FLG3_NO_NVRAM) ||
             tg3_nvram_read(tp, 0x0, &magic))
-                goto out_not_found;
+                goto out_no_vpd;
+
+        vpd_data = kmalloc(TG3_NVM_VPD_LEN, GFP_KERNEL);
+        if (!vpd_data)
+                goto out_no_vpd;
 
         if (magic == TG3_EEPROM_MAGIC) {
                 for (i = 0; i < TG3_NVM_VPD_LEN; i += 4) {
@@ -12492,43 +12717,51 @@ partno:
 
         memcpy(tp->board_part_number, &vpd_data[i], len);
 
-        return;
-
 out_not_found:
-        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906)
+        kfree(vpd_data);
+        if (tp->board_part_number[0])
+                return;
+
+out_no_vpd:
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717) {
+                if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_5717)
+                        strcpy(tp->board_part_number, "BCM5717");
+                else if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_5718)
+                        strcpy(tp->board_part_number, "BCM5718");
+                else
+                        goto nomatch;
+        } else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780) {
+                if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_57780)
+                        strcpy(tp->board_part_number, "BCM57780");
+                else if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_57760)
+                        strcpy(tp->board_part_number, "BCM57760");
+                else if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_57790)
+                        strcpy(tp->board_part_number, "BCM57790");
+                else if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_57788)
+                        strcpy(tp->board_part_number, "BCM57788");
+                else
+                        goto nomatch;
+        } else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765) {
+                if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_57761)
+                        strcpy(tp->board_part_number, "BCM57761");
+                else if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_57765)
+                        strcpy(tp->board_part_number, "BCM57765");
+                else if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_57781)
+                        strcpy(tp->board_part_number, "BCM57781");
+                else if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_57785)
+                        strcpy(tp->board_part_number, "BCM57785");
+                else if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_57791)
+                        strcpy(tp->board_part_number, "BCM57791");
+                else if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_57795)
+                        strcpy(tp->board_part_number, "BCM57795");
+                else
+                        goto nomatch;
+        } else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
                 strcpy(tp->board_part_number, "BCM95906");
-        else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780 &&
-                 tp->pdev->device == TG3PCI_DEVICE_TIGON3_57780)
-                strcpy(tp->board_part_number, "BCM57780");
-        else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780 &&
-                 tp->pdev->device == TG3PCI_DEVICE_TIGON3_57760)
-                strcpy(tp->board_part_number, "BCM57760");
-        else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780 &&
-                 tp->pdev->device == TG3PCI_DEVICE_TIGON3_57790)
-                strcpy(tp->board_part_number, "BCM57790");
-        else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780 &&
-                 tp->pdev->device == TG3PCI_DEVICE_TIGON3_57788)
-                strcpy(tp->board_part_number, "BCM57788");
-        else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765 &&
-                 tp->pdev->device == TG3PCI_DEVICE_TIGON3_57761)
-                strcpy(tp->board_part_number, "BCM57761");
-        else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765 &&
-                 tp->pdev->device == TG3PCI_DEVICE_TIGON3_57765)
-                strcpy(tp->board_part_number, "BCM57765");
-        else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765 &&
-                 tp->pdev->device == TG3PCI_DEVICE_TIGON3_57781)
-                strcpy(tp->board_part_number, "BCM57781");
-        else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765 &&
-                 tp->pdev->device == TG3PCI_DEVICE_TIGON3_57785)
-                strcpy(tp->board_part_number, "BCM57785");
-        else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765 &&
-                 tp->pdev->device == TG3PCI_DEVICE_TIGON3_57791)
-                strcpy(tp->board_part_number, "BCM57791");
-        else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765 &&
-                 tp->pdev->device == TG3PCI_DEVICE_TIGON3_57795)
-                strcpy(tp->board_part_number, "BCM57795");
-        else
+        } else {
+nomatch:
                 strcpy(tp->board_part_number, "none");
+        }
 }
 
 static int __devinit tg3_fw_img_is_valid(struct tg3 *tp, u32 offset)
@@ -12637,6 +12870,9 @@ static void __devinit tg3_read_sb_ver(struct tg3 *tp, u32 val)
         case TG3_EEPROM_SB_REVISION_5:
                 offset = TG3_EEPROM_SB_F1R5_EDH_OFF;
                 break;
+        case TG3_EEPROM_SB_REVISION_6:
+                offset = TG3_EEPROM_SB_F1R6_EDH_OFF;
+                break;
         default:
                 return;
         }
@@ -12736,10 +12972,12 @@ static void __devinit tg3_read_dash_ver(struct tg3 *tp)
 
         apedata = tg3_ape_read32(tp, TG3_APE_FW_VERSION);
 
-        if (tg3_ape_read32(tp, TG3_APE_FW_FEATURES) & TG3_APE_FW_FEATURE_NCSI)
+        if (tg3_ape_read32(tp, TG3_APE_FW_FEATURES) & TG3_APE_FW_FEATURE_NCSI) {
+                tp->tg3_flags3 |= TG3_FLG3_APE_HAS_NCSI;
                 fwtype = "NCSI";
-        else
+        } else {
                 fwtype = "DASH";
+        }
 
         vlen = strlen(tp->fw_ver);
 
@@ -12795,6 +13033,18 @@ static void inline vlan_features_add(struct net_device *dev, unsigned long flags
 #endif
 }
 
+static inline u32 tg3_rx_ret_ring_size(struct tg3 *tp)
+{
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719)
+                return 4096;
+        else if ((tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE) &&
+                 !(tp->tg3_flags2 & TG3_FLG2_5780_CLASS))
+                return 1024;
+        else
+                return 512;
+}
+
 static int __devinit tg3_get_invariants(struct tg3 *tp)
 {
         static struct pci_device_id write_reorder_chipsets[] = {
@@ -12839,7 +13089,6 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 
                 if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_5717 ||
                     tp->pdev->device == TG3PCI_DEVICE_TIGON3_5718 ||
-                    tp->pdev->device == TG3PCI_DEVICE_TIGON3_5724 ||
                     tp->pdev->device == TG3PCI_DEVICE_TIGON3_5719)
                         pci_read_config_dword(tp->pdev,
                                               TG3PCI_GEN2_PRODID_ASICREV,
@@ -13410,10 +13659,6 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         if (err)
                 return err;
 
-        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 &&
-            tp->pci_chip_rev_id != CHIPREV_ID_5717_A0)
-                return -ENOTSUPP;
-
         /* Initialize data/descriptor byte/word swapping. */
         val = tr32(GRC_MODE);
         val &= GRC_MODE_HOST_STACKUP;
@@ -13553,7 +13798,11 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 #endif
         }
 
-        tp->rx_std_max_post = TG3_RX_RING_SIZE;
+        tp->rx_std_ring_mask = TG3_RX_STD_RING_SIZE(tp) - 1;
+        tp->rx_jmb_ring_mask = TG3_RX_JMB_RING_SIZE(tp) - 1;
+        tp->rx_ret_ring_mask = tg3_rx_ret_ring_size(tp) - 1;
+
+        tp->rx_std_max_post = tp->rx_std_ring_mask + 1;
 
         /* Increment the rx prod index on the rx std ring by at most
          * 8 for these chips to workaround hw errata.
@@ -14442,7 +14691,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         }
 
         if ((tp->tg3_flags3 & TG3_FLG3_5755_PLUS) &&
-            tp->pci_chip_rev_id != CHIPREV_ID_5717_A0 &&
+            GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5717 &&
             GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5719)
                 dev->netdev_ops = &tg3_netdev_ops;
         else
@@ -14581,7 +14830,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW;
         rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW;
         sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW;
-        for (i = 0; i < TG3_IRQ_MAX_VECS; i++) {
+        for (i = 0; i < tp->irq_max; i++) {
                 struct tg3_napi *tnapi = &tp->napi[i];
 
                 tnapi->tp = tp;
@@ -14596,13 +14845,10 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
                 tnapi->consmbox = rcvmbx;
                 tnapi->prodmbox = sndmbx;
 
-                if (i) {
+                if (i)
                         tnapi->coal_now = HOSTCC_MODE_COAL_VEC1_NOW << (i - 1);
-                        netif_napi_add(dev, &tnapi->napi, tg3_poll_msix, 64);
-                } else {
+                else
                         tnapi->coal_now = HOSTCC_MODE_NOW;
-                        netif_napi_add(dev, &tnapi->napi, tg3_poll, 64);
-                }
 
                 if (!(tp->tg3_flags & TG3_FLAG_SUPPORT_MSIX))
                         break;
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 4937bd190964..8342190df0ff 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -26,6 +26,7 @@
 #define TG3_RX_INTERNAL_RING_SZ_5906    32
 
 #define RX_STD_MAX_SIZE_5705            512
+#define RX_STD_MAX_SIZE_5717            2048
 #define RX_JUMBO_MAX_SIZE               0xdeadbeef /* XXX */
 
 /* First 256 bytes are a mirror of PCI config space. */
@@ -46,7 +47,6 @@
 #define  TG3PCI_DEVICE_TIGON3_5785_F     0x16a0 /* 10/100 only */
 #define  TG3PCI_DEVICE_TIGON3_5717       0x1655
 #define  TG3PCI_DEVICE_TIGON3_5718       0x1656
-#define  TG3PCI_DEVICE_TIGON3_5724       0x165c
 #define  TG3PCI_DEVICE_TIGON3_57781      0x16b1
 #define  TG3PCI_DEVICE_TIGON3_57785      0x16b5
 #define  TG3PCI_DEVICE_TIGON3_57761      0x16b0
@@ -973,6 +973,7 @@
 #define  RCVDBDI_MODE_JUMBOBD_NEEDED     0x00000004
 #define  RCVDBDI_MODE_FRM_TOO_BIG        0x00000008
 #define  RCVDBDI_MODE_INV_RING_SZ        0x00000010
+#define  RCVDBDI_MODE_LRG_RING_SZ        0x00010000
 #define RCVDBDI_STATUS                  0x00002404
 #define  RCVDBDI_STATUS_JUMBOBD_NEEDED   0x00000004
 #define  RCVDBDI_STATUS_FRM_TOO_BIG      0x00000008
@@ -1090,7 +1091,26 @@
 #define  CPMU_MUTEX_GNT_DRIVER           0x00001000
 #define TG3_CPMU_PHY_STRAP              0x00003664
 #define TG3_CPMU_PHY_STRAP_IS_SERDES     0x00000020
-/* 0x3664 --> 0x3800 unused */
+/* 0x3664 --> 0x36b0 unused */
+
+#define TG3_CPMU_EEE_MODE               0x000036b0
+#define TG3_CPMU_EEEMD_ERLY_L1_XIT_DET   0x00000008
+#define TG3_CPMU_EEEMD_LPI_ENABLE        0x00000080
+#define TG3_CPMU_EEEMD_LPI_IN_TX         0x00000100
+#define TG3_CPMU_EEEMD_LPI_IN_RX         0x00000200
+#define TG3_CPMU_EEEMD_EEE_ENABLE        0x00100000
+/* 0x36b4 --> 0x36b8 unused */
+
+#define TG3_CPMU_EEE_LNKIDL_CTRL        0x000036bc
+#define  TG3_CPMU_EEE_LNKIDL_PCIE_NL0    0x01000000
+#define  TG3_CPMU_EEE_LNKIDL_UART_IDL    0x00000004
+/* 0x36c0 --> 0x36d0 unused */
+
+#define TG3_CPMU_EEE_CTRL               0x000036d0
+#define TG3_CPMU_EEE_CTRL_EXIT_16_5_US   0x0000019d
+#define TG3_CPMU_EEE_CTRL_EXIT_36_US     0x00000384
+#define TG3_CPMU_EEE_CTRL_EXIT_20_1_US   0x000001f8
+/* 0x36d4 --> 0x3800 unused */
 
 /* Mbuf cluster free registers */
 #define MBFREE_MODE                     0x00003800
@@ -1225,6 +1245,7 @@
 #define  BUFMGR_MODE_ATTN_ENABLE         0x00000004
 #define  BUFMGR_MODE_BM_TEST             0x00000008
 #define  BUFMGR_MODE_MBLOW_ATTN_ENAB     0x00000010
+#define  BUFMGR_MODE_NO_TX_UNDERRUN      0x80000000
 #define BUFMGR_STATUS                   0x00004404
 #define  BUFMGR_STATUS_ERROR             0x00000004
 #define  BUFMGR_STATUS_MBLOW             0x00000010
@@ -1302,7 +1323,16 @@
 #define  RDMAC_STATUS_FIFOURUN           0x00000080
 #define  RDMAC_STATUS_FIFOOREAD          0x00000100
 #define  RDMAC_STATUS_LNGREAD            0x00000200
-/* 0x4808 --> 0x4c00 unused */
+/* 0x4808 --> 0x4900 unused */
+
+#define TG3_RDMA_RSRVCTRL_REG           0x00004900
+#define TG3_RDMA_RSRVCTRL_FIFO_OFLW_FIX  0x00000004
+/* 0x4904 --> 0x4910 unused */
+
+#define TG3_LSO_RD_DMA_CRPTEN_CTRL      0x00004910
+#define TG3_LSO_RD_DMA_CRPTEN_CTRL_BLEN_BD_4K    0x00030000
+#define TG3_LSO_RD_DMA_CRPTEN_CTRL_BLEN_LSO_4K   0x000c0000
+/* 0x4914 --> 0x4c00 unused */
 
 /* Write DMA control registers */
 #define WDMAC_MODE                      0x00004c00
@@ -1904,6 +1934,7 @@
 #define TG3_EEPROM_SB_REVISION_3        0x00030000
 #define TG3_EEPROM_SB_REVISION_4        0x00040000
 #define TG3_EEPROM_SB_REVISION_5        0x00050000
+#define TG3_EEPROM_SB_REVISION_6        0x00060000
 #define TG3_EEPROM_MAGIC_HW             0xabcd
 #define TG3_EEPROM_MAGIC_HW_MSK         0xffff
 
@@ -1923,6 +1954,7 @@
 #define TG3_EEPROM_SB_F1R3_EDH_OFF      0x18
 #define TG3_EEPROM_SB_F1R4_EDH_OFF      0x1c
 #define TG3_EEPROM_SB_F1R5_EDH_OFF      0x20
+#define TG3_EEPROM_SB_F1R6_EDH_OFF      0x4c
 #define TG3_EEPROM_SB_EDH_MAJ_MASK      0x00000700
 #define TG3_EEPROM_SB_EDH_MAJ_SHFT      8
 #define TG3_EEPROM_SB_EDH_MIN_MASK      0x000000ff
@@ -2048,6 +2080,10 @@
 #define  MII_TG3_CTRL_AS_MASTER         0x0800
 #define  MII_TG3_CTRL_ENABLE_AS_MASTER  0x1000
 
+#define MII_TG3_MMD_CTRL                0x0d /* MMD Access Control register */
+#define MII_TG3_MMD_CTRL_DATA_NOINC     0x4000
+#define MII_TG3_MMD_ADDRESS             0x0e /* MMD Address Data register */
+
 #define MII_TG3_EXT_CTRL                0x10 /* Extended control register */
 #define  MII_TG3_EXT_CTRL_FIFO_ELASTIC  0x0001
 #define  MII_TG3_EXT_CTRL_LNK3_LED_MODE 0x0002
@@ -2065,6 +2101,8 @@
 #define MII_TG3_DSP_TAP1                0x0001
 #define  MII_TG3_DSP_TAP1_AGCTGT_DFLT   0x0007
 #define MII_TG3_DSP_AADJ1CH0            0x001f
+#define MII_TG3_DSP_CH34TP2             0x4022
+#define MII_TG3_DSP_CH34TP2_HIBW01      0x0010
 #define MII_TG3_DSP_AADJ1CH3            0x601f
 #define  MII_TG3_DSP_AADJ1CH3_ADCCKADJ  0x0002
 #define MII_TG3_DSP_EXP1_INT_STAT       0x0f01
@@ -2131,6 +2169,14 @@
 #define MII_TG3_TEST1_TRIM_EN           0x0010
 #define MII_TG3_TEST1_CRC_EN            0x8000
 
+/* Clause 45 expansion registers */
+#define TG3_CL45_D7_EEEADV_CAP          0x003c
+#define TG3_CL45_D7_EEEADV_CAP_100TX    0x0002
+#define TG3_CL45_D7_EEEADV_CAP_1000T    0x0004
+#define TG3_CL45_D7_EEERES_STAT         0x803e
+#define TG3_CL45_D7_EEERES_STAT_LP_100TX        0x0002
+#define TG3_CL45_D7_EEERES_STAT_LP_1000T        0x0004
+
 
 /* Fast Ethernet Tranceiver definitions */
 #define MII_TG3_FET_PTEST               0x17
@@ -2176,7 +2222,7 @@
 #define TG3_APE_HOST_SEG_SIG            0x4200
 #define  APE_HOST_SEG_SIG_MAGIC          0x484f5354
 #define TG3_APE_HOST_SEG_LEN            0x4204
-#define  APE_HOST_SEG_LEN_MAGIC          0x0000001c
+#define  APE_HOST_SEG_LEN_MAGIC          0x00000020
 #define TG3_APE_HOST_INIT_COUNT         0x4208
 #define TG3_APE_HOST_DRIVER_ID          0x420c
 #define  APE_HOST_DRIVER_ID_LINUX        0xf0000000
@@ -2188,6 +2234,12 @@
 #define  APE_HOST_HEARTBEAT_INT_DISABLE  0
 #define  APE_HOST_HEARTBEAT_INT_5SEC     5000
 #define TG3_APE_HOST_HEARTBEAT_COUNT    0x4218
+#define TG3_APE_HOST_DRVR_STATE         0x421c
+#define TG3_APE_HOST_DRVR_STATE_START    0x00000001
+#define TG3_APE_HOST_DRVR_STATE_UNLOAD   0x00000002
+#define TG3_APE_HOST_DRVR_STATE_WOL      0x00000003
+#define TG3_APE_HOST_WOL_SPEED          0x4224
+#define TG3_APE_HOST_WOL_SPEED_AUTO      0x00008000
 
 #define TG3_APE_EVENT_STATUS            0x4300
 
@@ -2649,7 +2701,8 @@ struct tg3_rx_prodring_set {
         dma_addr_t                      rx_jmb_mapping;
 };
 
-#define TG3_IRQ_MAX_VECS 5
+#define TG3_IRQ_MAX_VECS_RSS            5
+#define TG3_IRQ_MAX_VECS                TG3_IRQ_MAX_VECS_RSS
 
 struct tg3_napi {
         struct napi_struct              napi    ____cacheline_aligned;
@@ -2668,7 +2721,7 @@ struct tg3_napi {
         u32                             consmbox;
         u32                             rx_rcb_ptr;
         u16                             *rx_rcb_prod_idx;
-        struct tg3_rx_prodring_set      *prodring;
+        struct tg3_rx_prodring_set      prodring;
 
         struct tg3_rx_buffer_desc       *rx_rcb;
         struct tg3_tx_buffer_desc       *tx_ring;
@@ -2746,6 +2799,9 @@ struct tg3 {
         void                            (*write32_rx_mbox) (struct tg3 *, u32,
                                                             u32);
         u32                             rx_copy_thresh;
+        u32                             rx_std_ring_mask;
+        u32                             rx_jmb_ring_mask;
+        u32                             rx_ret_ring_mask;
         u32                             rx_pending;
         u32                             rx_jumbo_pending;
         u32                             rx_std_max_post;
@@ -2755,8 +2811,6 @@ struct tg3 {
         struct vlan_group               *vlgrp;
 #endif
 
-        struct tg3_rx_prodring_set      prodring[TG3_IRQ_MAX_VECS];
-
 
         /* begin "everything else" cacheline(s) section */
         struct rtnl_link_stats64        net_stats;
@@ -2850,6 +2904,7 @@ struct tg3 {
 #define TG3_FLG3_USE_JUMBO_BDFLAG       0x00400000
 #define TG3_FLG3_L1PLLPD_EN             0x00800000
 #define TG3_FLG3_5717_PLUS              0x01000000
+#define TG3_FLG3_APE_HAS_NCSI           0x02000000
 
         struct timer_list               timer;
         u16                             timer_counter;
@@ -2966,9 +3021,11 @@ struct tg3 {
 #define TG3_PHYFLG_BER_BUG              0x00008000
 #define TG3_PHYFLG_SERDES_PREEMPHASIS   0x00010000
 #define TG3_PHYFLG_PARALLEL_DETECT      0x00020000
+#define TG3_PHYFLG_EEE_CAP              0x00040000
 
         u32                             led_ctrl;
         u32                             phy_otp;
+        u32                             setlpicnt;
 
 #define TG3_BPN_SIZE                    24
         char                            board_part_number[TG3_BPN_SIZE];
diff --git a/drivers/net/tlan.c b/drivers/net/tlan.c
index 0564ca05963d..ec8c804a795d 100644
--- a/drivers/net/tlan.c
+++ b/drivers/net/tlan.c
@@ -3187,7 +3187,7 @@ static int TLan_EeSendByte( u16 io_base, u8 data, int stop )
                 TLan_SetBit( TLAN_NET_SIO_EDATA, sio );
         }
 
-        return ( err );
+        return err;
 
 } /* TLan_EeSendByte */
 
diff --git a/drivers/net/tlan.h b/drivers/net/tlan.h
index d13ff12d7500..3315ced774e2 100644
--- a/drivers/net/tlan.h
+++ b/drivers/net/tlan.h
@@ -442,7 +442,7 @@ typedef struct tlan_private_tag {
 static inline u8 TLan_DioRead8(u16 base_addr, u16 internal_addr)
 {
         outw(internal_addr, base_addr + TLAN_DIO_ADR);
-        return (inb((base_addr + TLAN_DIO_DATA) + (internal_addr & 0x3)));
+        return inb((base_addr + TLAN_DIO_DATA) + (internal_addr & 0x3));
 
 } /* TLan_DioRead8 */
 
@@ -452,7 +452,7 @@ static inline u8 TLan_DioRead8(u16 base_addr, u16 internal_addr)
 static inline u16 TLan_DioRead16(u16 base_addr, u16 internal_addr)
 {
         outw(internal_addr, base_addr + TLAN_DIO_ADR);
-        return (inw((base_addr + TLAN_DIO_DATA) + (internal_addr & 0x2)));
+        return inw((base_addr + TLAN_DIO_DATA) + (internal_addr & 0x2));
 
 } /* TLan_DioRead16 */
 
@@ -462,7 +462,7 @@ static inline u16 TLan_DioRead16(u16 base_addr, u16 internal_addr)
 static inline u32 TLan_DioRead32(u16 base_addr, u16 internal_addr)
 {
         outw(internal_addr, base_addr + TLAN_DIO_ADR);
-        return (inl(base_addr + TLAN_DIO_DATA));
+        return inl(base_addr + TLAN_DIO_DATA);
 
 } /* TLan_DioRead32 */
 
@@ -537,6 +537,6 @@ static inline u32 TLan_HashFunc( const u8 *a )
         hash ^= ((a[2]^a[5])<<4);       /* & 060 */
         hash ^= ((a[2]^a[5])>>2);       /* & 077 */
 
-        return (hash & 077);
+        return hash & 077;
 }
 #endif
diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c
index 16e8783ee9cd..8d362e64a40e 100644
--- a/drivers/net/tokenring/proteon.c
+++ b/drivers/net/tokenring/proteon.c
@@ -110,7 +110,7 @@ static int __init proteon_probe1(struct net_device *dev, int ioaddr)
         }
 
         dev->base_addr = ioaddr;
-        return (0);
+        return 0;
 nodev:
         release_region(ioaddr, PROTEON_IO_EXTENT); 
         return -ENODEV;
diff --git a/drivers/net/tokenring/smctr.c b/drivers/net/tokenring/smctr.c
index 0929fff5982c..63db5a6762ae 100644
--- a/drivers/net/tokenring/smctr.c
+++ b/drivers/net/tokenring/smctr.c
@@ -435,7 +435,7 @@ static int smctr_alloc_shared_memory(struct net_device *dev)
                 RX_DATA_BUFFER_SIZE * tp->num_rx_bdbs[NON_MAC_QUEUE]);
         tp->rx_buff_end[NON_MAC_QUEUE] = (__u16 *)smctr_malloc(dev, 0);
 
-        return (0);
+        return 0;
 }
 
 /* Enter Bypass state. */
@@ -448,7 +448,7 @@ static int smctr_bypass_state(struct net_device *dev)
 
         err = smctr_setup_single_cmd(dev, ACB_CMD_CHANGE_JOIN_STATE, JS_BYPASS_STATE);
 
-        return (err);
+        return err;
 }
 
 static int smctr_checksum_firmware(struct net_device *dev)
@@ -471,9 +471,9 @@ static int smctr_checksum_firmware(struct net_device *dev)
         smctr_disable_adapter_ctrl_store(dev);
 
         if(checksum)
-                return (checksum);
+                return checksum;
 
-        return (0);
+        return 0;
 }
 
 static int __init smctr_chk_mca(struct net_device *dev)
@@ -485,7 +485,7 @@ static int __init smctr_chk_mca(struct net_device *dev)
 
         current_slot = mca_find_unused_adapter(smctr_posid, 0);
         if(current_slot == MCA_NOTFOUND)
-                return (-ENODEV);
+                return -ENODEV;
 
         mca_set_adapter_name(current_slot, smctr_name);
         mca_mark_as_used(current_slot);
@@ -622,9 +622,9 @@ static int __init smctr_chk_mca(struct net_device *dev)
                         break;
         }
 
-        return (0);
+        return 0;
 #else
-        return (-1);
+        return -1;
 #endif /* CONFIG_MCA_LEGACY */
 }
 
@@ -677,18 +677,18 @@ static int smctr_chg_rx_mask(struct net_device *dev)
         if((err = smctr_issue_write_word_cmd(dev, RW_CONFIG_REGISTER_0,
                 &tp->config_word0)))
         {
-                return (err);
+                return err;
         }
 
         if((err = smctr_issue_write_word_cmd(dev, RW_CONFIG_REGISTER_1,
                 &tp->config_word1)))
         {
-                return (err);
+                return err;
         }
 
         smctr_disable_16bit(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_clear_int(struct net_device *dev)
@@ -697,7 +697,7 @@ static int smctr_clear_int(struct net_device *dev)
 
         outb((tp->trc_mask | CSR_CLRTINT), dev->base_addr + CSR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_clear_trc_reset(int ioaddr)
@@ -707,7 +707,7 @@ static int smctr_clear_trc_reset(int ioaddr)
         r = inb(ioaddr + MSR);
         outb(~MSR_RST & r, ioaddr + MSR);
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -725,7 +725,7 @@ static int smctr_close(struct net_device *dev)
 
         /* Check to see if adapter is already in a closed state. */
         if(tp->status != OPEN)
-                return (0);
+                return 0;
 
         smctr_enable_16bit(dev);
         smctr_set_page(dev, (__u8 *)tp->ram_access);
@@ -733,7 +733,7 @@ static int smctr_close(struct net_device *dev)
         if((err = smctr_issue_remove_cmd(dev)))
         {
                 smctr_disable_16bit(dev);
-                return (err);
+                return err;
         }
 
         for(;;)
@@ -746,7 +746,7 @@ static int smctr_close(struct net_device *dev)
         }
 
 
-        return (0);
+        return 0;
 }
 
 static int smctr_decode_firmware(struct net_device *dev,
@@ -807,12 +807,12 @@ static int smctr_decode_firmware(struct net_device *dev,
         if(buff)
                 *(mem++) = SWAP_BYTES(buff);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_disable_16bit(struct net_device *dev)
 {
-        return (0);
+        return 0;
 }
 
 /*
@@ -832,7 +832,7 @@ static int smctr_disable_adapter_ctrl_store(struct net_device *dev)
         tp->trc_mask |= CSR_WCSS;
         outb(tp->trc_mask, ioaddr + CSR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_disable_bic_int(struct net_device *dev)
@@ -844,7 +844,7 @@ static int smctr_disable_bic_int(struct net_device *dev)
                 | CSR_MSKTINT | CSR_WCSS;
         outb(tp->trc_mask, ioaddr + CSR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_enable_16bit(struct net_device *dev)
@@ -858,7 +858,7 @@ static int smctr_enable_16bit(struct net_device *dev)
                 outb((r | LAAR_MEM16ENB), dev->base_addr + LAAR);
         }
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -881,7 +881,7 @@ static int smctr_enable_adapter_ctrl_store(struct net_device *dev)
         tp->trc_mask &= ~CSR_WCSS;
         outb(tp->trc_mask, ioaddr + CSR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_enable_adapter_ram(struct net_device *dev)
@@ -895,7 +895,7 @@ static int smctr_enable_adapter_ram(struct net_device *dev)
         r = inb(ioaddr + MSR);
         outb(MSR_MEMB | r, ioaddr + MSR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_enable_bic_int(struct net_device *dev)
@@ -921,7 +921,7 @@ static int smctr_enable_bic_int(struct net_device *dev)
                         break;
         }
 
-        return (0);
+        return 0;
 }
 
 static int __init smctr_chk_isa(struct net_device *dev)
@@ -1145,7 +1145,7 @@ static int __init smctr_chk_isa(struct net_device *dev)
                 */
         }
 
-        return (0);
+        return 0;
 
 out2:
         release_region(ioaddr, SMCTR_IO_EXTENT);
@@ -1199,7 +1199,7 @@ static int __init smctr_get_boardid(struct net_device *dev, int mca)
          *      return;
          */
         if(IdByte & 0xF8)
-                return (-1);
+                return -1;
 
         r1 = inb(ioaddr + BID_REG_1);
         r1 &= BID_ICR_MASK;
@@ -1250,21 +1250,21 @@ static int __init smctr_get_boardid(struct net_device *dev, int mca)
         while(r1 & BID_RECALL_DONE_MASK)
                 r1 = inb(ioaddr + BID_REG_1);
 
-        return (BoardIdMask);
+        return BoardIdMask;
 }
 
 static int smctr_get_group_address(struct net_device *dev)
 {
         smctr_issue_read_word_cmd(dev, RW_INDIVIDUAL_GROUP_ADDR);
 
-        return(smctr_wait_cmd(dev));
+        return smctr_wait_cmd(dev);
 }
 
 static int smctr_get_functional_address(struct net_device *dev)
 {
         smctr_issue_read_word_cmd(dev, RW_FUNCTIONAL_ADDR);
 
-        return(smctr_wait_cmd(dev));
+        return smctr_wait_cmd(dev);
 }
 
 /* Calculate number of Non-MAC receive BDB's and data buffers.
@@ -1346,14 +1346,14 @@ static unsigned int smctr_get_num_rx_bdbs(struct net_device *dev)
          */
         mem_used += 0x100;
 
-        return((0xffff - mem_used) / (RX_DATA_BUFFER_SIZE + sizeof(BDBlock)));
+        return (0xffff - mem_used) / (RX_DATA_BUFFER_SIZE + sizeof(BDBlock));
 }
 
 static int smctr_get_physical_drop_number(struct net_device *dev)
 {
         smctr_issue_read_word_cmd(dev, RW_PHYSICAL_DROP_NUMBER);
 
-        return(smctr_wait_cmd(dev));
+        return smctr_wait_cmd(dev);
 }
 
 static __u8 * smctr_get_rx_pointer(struct net_device *dev, short queue)
@@ -1366,14 +1366,14 @@ static __u8 * smctr_get_rx_pointer(struct net_device *dev, short queue)
 
         tp->rx_fcb_curr[queue]->bdb_ptr = bdb;
 
-        return ((__u8 *)bdb->data_block_ptr);
+        return (__u8 *)bdb->data_block_ptr;
 }
 
 static int smctr_get_station_id(struct net_device *dev)
 {
         smctr_issue_read_word_cmd(dev, RW_INDIVIDUAL_MAC_ADDRESS);
 
-        return(smctr_wait_cmd(dev));
+        return smctr_wait_cmd(dev);
 }
 
 /*
@@ -1384,7 +1384,7 @@ static struct net_device_stats *smctr_get_stats(struct net_device *dev)
 {
         struct net_local *tp = netdev_priv(dev);
 
-        return ((struct net_device_stats *)&tp->MacStat);
+        return (struct net_device_stats *)&tp->MacStat;
 }
 
 static FCBlock *smctr_get_tx_fcb(struct net_device *dev, __u16 queue,
@@ -1401,14 +1401,14 @@ static FCBlock *smctr_get_tx_fcb(struct net_device *dev, __u16 queue,
 
         /* check if there is enough FCB blocks */
         if(tp->num_tx_fcbs_used[queue] >= tp->num_tx_fcbs[queue])
-                return ((FCBlock *)(-1L));
+                return (FCBlock *)(-1L);
 
         /* round off the input pkt size to the nearest even number */
         alloc_size = (bytes_count + 1) & 0xfffe;
 
         /* check if enough mem */
         if((tp->tx_buff_used[queue] + alloc_size) > tp->tx_buff_size[queue])
-                return ((FCBlock *)(-1L));
+                return (FCBlock *)(-1L);
 
         /* check if past the end ;
          * if exactly enough mem to end of ring, alloc from front.
@@ -1425,7 +1425,7 @@ static FCBlock *smctr_get_tx_fcb(struct net_device *dev, __u16 queue,
                 if((tp->tx_buff_used[queue] + alloc_size)
                         > tp->tx_buff_size[queue])
                 {
-                        return ((FCBlock *)(-1L));
+                        return (FCBlock *)(-1L);
                 }
 
                 /* ring wrap */
@@ -1448,14 +1448,14 @@ static FCBlock *smctr_get_tx_fcb(struct net_device *dev, __u16 queue,
         pFCB = tp->tx_fcb_curr[queue];
         tp->tx_fcb_curr[queue] = tp->tx_fcb_curr[queue]->next_ptr;
 
-        return (pFCB);
+        return pFCB;
 }
 
 static int smctr_get_upstream_neighbor_addr(struct net_device *dev)
 {
         smctr_issue_read_word_cmd(dev, RW_UPSTREAM_NEIGHBOR_ADDRESS);
 
-        return(smctr_wait_cmd(dev));
+        return smctr_wait_cmd(dev);
 }
 
 static int smctr_hardware_send_packet(struct net_device *dev,
@@ -1469,21 +1469,22 @@ static int smctr_hardware_send_packet(struct net_device *dev,
                 printk(KERN_DEBUG"%s: smctr_hardware_send_packet\n", dev->name);
 
         if(tp->status != OPEN)
-                return (-1);
+                return -1;
 
         if(tp->monitor_state_ready != 1)
-                return (-1);
+                return -1;
 
         for(;;)
         {
                 /* Send first buffer from queue */
                 skb = skb_dequeue(&tp->SendSkbQueue);
                 if(skb == NULL)
-                        return (-1);
+                        return -1;
 
                 tp->QueueSkb++;
 
-                if(skb->len < SMC_HEADER_SIZE || skb->len > tp->max_packet_size)                        return (-1);
+                if(skb->len < SMC_HEADER_SIZE || skb->len > tp->max_packet_size)
+                        return -1;
 
                 smctr_enable_16bit(dev);
                 smctr_set_page(dev, (__u8 *)tp->ram_access);
@@ -1492,7 +1493,7 @@ static int smctr_hardware_send_packet(struct net_device *dev,
                         == (FCBlock *)(-1L))
                 {
                         smctr_disable_16bit(dev);
-                        return (-1);
+                        return -1;
                 }
 
                 smctr_tx_move_frame(dev, skb,
@@ -1508,7 +1509,7 @@ static int smctr_hardware_send_packet(struct net_device *dev,
                 smctr_disable_16bit(dev);
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_acbs(struct net_device *dev)
@@ -1552,7 +1553,7 @@ static int smctr_init_acbs(struct net_device *dev)
         tp->acb_curr            = tp->acb_head->next_ptr;
         tp->num_acbs_used       = 0;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_adapter(struct net_device *dev)
@@ -1590,13 +1591,14 @@ static int smctr_init_adapter(struct net_device *dev)
 
         if(smctr_checksum_firmware(dev))
         {
-                printk(KERN_ERR "%s: Previously loaded firmware is missing\n",dev->name);                return (-ENOENT);
+                printk(KERN_ERR "%s: Previously loaded firmware is missing\n",dev->name);
+                return -ENOENT;
         }
 
         if((err = smctr_ram_memory_test(dev)))
         {
                 printk(KERN_ERR "%s: RAM memory test failed.\n", dev->name);
-                return (-EIO);
+                return -EIO;
         }
 
         smctr_set_rx_look_ahead(dev);
@@ -1608,7 +1610,7 @@ static int smctr_init_adapter(struct net_device *dev)
         {
                 printk(KERN_ERR "%s: Initialization of card failed (%d)\n",
                         dev->name, err);
-                return (-EINVAL);
+                return -EINVAL;
         }
 
         /* This routine clobbers the TRC's internal registers. */
@@ -1616,7 +1618,7 @@ static int smctr_init_adapter(struct net_device *dev)
         {
                 printk(KERN_ERR "%s: Card failed internal self test (%d)\n",
                         dev->name, err);
-                return (-EINVAL);
+                return -EINVAL;
         }
 
         /* Re-Initialize adapter's internal registers */
@@ -1625,17 +1627,17 @@ static int smctr_init_adapter(struct net_device *dev)
         {
                 printk(KERN_ERR "%s: Initialization of card failed (%d)\n",
                         dev->name, err);
-                return (-EINVAL);
+                return -EINVAL;
         }
 
         smctr_enable_bic_int(dev);
 
         if((err = smctr_issue_enable_int_cmd(dev, TRC_INTERRUPT_ENABLE_MASK)))
-                return (err);
+                return err;
 
         smctr_disable_16bit(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_card_real(struct net_device *dev)
@@ -1703,15 +1705,15 @@ static int smctr_init_card_real(struct net_device *dev)
         smctr_init_shared_memory(dev);
 
         if((err = smctr_issue_init_timers_cmd(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_issue_init_txrx_cmd(dev)))
         {
                 printk(KERN_ERR "%s: Hardware failure\n", dev->name);
-                return (err);
+                return err;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_rx_bdbs(struct net_device *dev)
@@ -1763,7 +1765,7 @@ static int smctr_init_rx_bdbs(struct net_device *dev)
                 tp->rx_bdb_curr[i]              = tp->rx_bdb_head[i]->next_ptr;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_rx_fcbs(struct net_device *dev)
@@ -1813,7 +1815,7 @@ static int smctr_init_rx_fcbs(struct net_device *dev)
                 tp->rx_fcb_curr[i]              = tp->rx_fcb_head[i]->next_ptr;
         }
 
-        return(0);
+        return 0;
 }
 
 static int smctr_init_shared_memory(struct net_device *dev)
@@ -1871,7 +1873,7 @@ static int smctr_init_shared_memory(struct net_device *dev)
         smctr_init_rx_bdbs(dev);
         smctr_init_rx_fcbs(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_tx_bdbs(struct net_device *dev)
@@ -1901,7 +1903,7 @@ static int smctr_init_tx_bdbs(struct net_device *dev)
                 tp->tx_bdb_head[i]->back_ptr = bdb;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_tx_fcbs(struct net_device *dev)
@@ -1940,7 +1942,7 @@ static int smctr_init_tx_fcbs(struct net_device *dev)
                 tp->num_tx_fcbs_used[i]         = 0;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_internal_self_test(struct net_device *dev)
@@ -1949,33 +1951,33 @@ static int smctr_internal_self_test(struct net_device *dev)
         int err;
 
         if((err = smctr_issue_test_internal_rom_cmd(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         if(tp->acb_head->cmd_done_status & 0xff)
-                return (-1);
+                return -1;
 
         if((err = smctr_issue_test_hic_cmd(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         if(tp->acb_head->cmd_done_status & 0xff)
-                return (-1);
+                return -1;
 
         if((err = smctr_issue_test_mac_reg_cmd(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         if(tp->acb_head->cmd_done_status & 0xff)
-                return (-1);
+                return -1;
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -2468,14 +2470,14 @@ static int smctr_issue_enable_int_cmd(struct net_device *dev,
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         tp->sclb_ptr->int_mask_control  = interrupt_enable_mask;
         tp->sclb_ptr->valid_command     = SCLB_VALID | SCLB_CMD_CLEAR_INTERRUPT_MASK;
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_int_ack(struct net_device *dev, __u16 iack_code, __u16 ibits)
@@ -2483,7 +2485,7 @@ static int smctr_issue_int_ack(struct net_device *dev, __u16 iack_code, __u16 ib
         struct net_local *tp = netdev_priv(dev);
 
         if(smctr_wait_while_cbusy(dev))
-                return (-1);
+                return -1;
 
         tp->sclb_ptr->int_mask_control = ibits;
         tp->sclb_ptr->iack_code = iack_code << 1; /* use the offset from base */        tp->sclb_ptr->resume_control = 0;
@@ -2491,7 +2493,7 @@ static int smctr_issue_int_ack(struct net_device *dev, __u16 iack_code, __u16 ib
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_init_timers_cmd(struct net_device *dev)
@@ -2502,10 +2504,10 @@ static int smctr_issue_init_timers_cmd(struct net_device *dev)
         __u16 *pTimer_Struc = (__u16 *)tp->misc_command_data;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         tp->config_word0 = THDREN | DMA_TRIGGER | USETPT | NO_AUTOREMOVE;
         tp->config_word1 = 0;
@@ -2648,7 +2650,7 @@ static int smctr_issue_init_timers_cmd(struct net_device *dev)
 
         err = smctr_setup_single_cmd_w_data(dev, ACB_CMD_INIT_TRC_TIMERS, 0);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_init_txrx_cmd(struct net_device *dev)
@@ -2659,12 +2661,12 @@ static int smctr_issue_init_txrx_cmd(struct net_device *dev)
         void **txrx_ptrs = (void *)tp->misc_command_data;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
         {
                 printk(KERN_ERR "%s: Hardware failure\n", dev->name);
-                return (err);
+                return err;
         }
 
         /* Initialize Transmit Queue Pointers that are used, to point to
@@ -2695,7 +2697,7 @@ static int smctr_issue_init_txrx_cmd(struct net_device *dev)
 
         err = smctr_setup_single_cmd_w_data(dev, ACB_CMD_INIT_TX_RX, 0);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_insert_cmd(struct net_device *dev)
@@ -2704,7 +2706,7 @@ static int smctr_issue_insert_cmd(struct net_device *dev)
 
         err = smctr_setup_single_cmd(dev, ACB_CMD_INSERT, ACB_SUB_CMD_NOP);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_read_ring_status_cmd(struct net_device *dev)
@@ -2712,15 +2714,15 @@ static int smctr_issue_read_ring_status_cmd(struct net_device *dev)
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         err = smctr_setup_single_cmd_w_data(dev, ACB_CMD_READ_TRC_STATUS,
                 RW_TRC_STATUS_BLOCK);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_read_word_cmd(struct net_device *dev, __u16 aword_cnt)
@@ -2728,15 +2730,15 @@ static int smctr_issue_read_word_cmd(struct net_device *dev, __u16 aword_cnt)
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         err = smctr_setup_single_cmd_w_data(dev, ACB_CMD_MCT_READ_VALUE,
                 aword_cnt);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_remove_cmd(struct net_device *dev)
@@ -2745,14 +2747,14 @@ static int smctr_issue_remove_cmd(struct net_device *dev)
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         tp->sclb_ptr->resume_control    = 0;
         tp->sclb_ptr->valid_command     = SCLB_VALID | SCLB_CMD_REMOVE;
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_resume_acb_cmd(struct net_device *dev)
@@ -2761,7 +2763,7 @@ static int smctr_issue_resume_acb_cmd(struct net_device *dev)
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         tp->sclb_ptr->resume_control = SCLB_RC_ACB;
         tp->sclb_ptr->valid_command  = SCLB_VALID | SCLB_RESUME_CONTROL_VALID;
@@ -2770,7 +2772,7 @@ static int smctr_issue_resume_acb_cmd(struct net_device *dev)
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_resume_rx_bdb_cmd(struct net_device *dev, __u16 queue)
@@ -2779,7 +2781,7 @@ static int smctr_issue_resume_rx_bdb_cmd(struct net_device *dev, __u16 queue)
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if(queue == MAC_QUEUE)
                 tp->sclb_ptr->resume_control = SCLB_RC_RX_MAC_BDB;
@@ -2790,7 +2792,7 @@ static int smctr_issue_resume_rx_bdb_cmd(struct net_device *dev, __u16 queue)
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_resume_rx_fcb_cmd(struct net_device *dev, __u16 queue)
@@ -2801,7 +2803,7 @@ static int smctr_issue_resume_rx_fcb_cmd(struct net_device *dev, __u16 queue)
                 printk(KERN_DEBUG "%s: smctr_issue_resume_rx_fcb_cmd\n", dev->name);
 
         if(smctr_wait_while_cbusy(dev))
-                return (-1);
+                return -1;
 
         if(queue == MAC_QUEUE)
                 tp->sclb_ptr->resume_control = SCLB_RC_RX_MAC_FCB;
@@ -2812,7 +2814,7 @@ static int smctr_issue_resume_rx_fcb_cmd(struct net_device *dev, __u16 queue)
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_resume_tx_fcb_cmd(struct net_device *dev, __u16 queue)
@@ -2823,14 +2825,14 @@ static int smctr_issue_resume_tx_fcb_cmd(struct net_device *dev, __u16 queue)
                 printk(KERN_DEBUG "%s: smctr_issue_resume_tx_fcb_cmd\n", dev->name);
 
         if(smctr_wait_while_cbusy(dev))
-                return (-1);
+                return -1;
 
         tp->sclb_ptr->resume_control = (SCLB_RC_TFCB0 << queue);
         tp->sclb_ptr->valid_command = SCLB_RESUME_CONTROL_VALID | SCLB_VALID;
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_test_internal_rom_cmd(struct net_device *dev)
@@ -2840,7 +2842,7 @@ static int smctr_issue_test_internal_rom_cmd(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_MCT_TEST,
                 TRC_INTERNAL_ROM_TEST);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_test_hic_cmd(struct net_device *dev)
@@ -2850,7 +2852,7 @@ static int smctr_issue_test_hic_cmd(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_HIC_TEST,
                 TRC_HOST_INTERFACE_REG_TEST);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_test_mac_reg_cmd(struct net_device *dev)
@@ -2860,7 +2862,7 @@ static int smctr_issue_test_mac_reg_cmd(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_MCT_TEST,
                 TRC_MAC_REGISTERS_TEST);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_trc_loopback_cmd(struct net_device *dev)
@@ -2870,7 +2872,7 @@ static int smctr_issue_trc_loopback_cmd(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_MCT_TEST,
                 TRC_INTERNAL_LOOPBACK);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_tri_loopback_cmd(struct net_device *dev)
@@ -2880,7 +2882,7 @@ static int smctr_issue_tri_loopback_cmd(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_MCT_TEST,
                 TRC_TRI_LOOPBACK);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_write_byte_cmd(struct net_device *dev,
@@ -2891,10 +2893,10 @@ static int smctr_issue_write_byte_cmd(struct net_device *dev,
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         for(iword = 0, ibyte = 0; iword < (unsigned int)(aword_cnt & 0xff);
                 iword++, ibyte += 2)
@@ -2903,8 +2905,8 @@ static int smctr_issue_write_byte_cmd(struct net_device *dev,
                         | (*((__u8 *)byte + ibyte + 1));
         }
 
-        return (smctr_setup_single_cmd_w_data(dev, ACB_CMD_MCT_WRITE_VALUE, 
-                aword_cnt));
+        return smctr_setup_single_cmd_w_data(dev, ACB_CMD_MCT_WRITE_VALUE,
+                aword_cnt);
 }
 
 static int smctr_issue_write_word_cmd(struct net_device *dev,
@@ -2914,10 +2916,10 @@ static int smctr_issue_write_word_cmd(struct net_device *dev,
         unsigned int i, err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         for(i = 0; i < (unsigned int)(aword_cnt & 0xff); i++)
                 tp->misc_command_data[i] = *((__u16 *)word + i);
@@ -2925,7 +2927,7 @@ static int smctr_issue_write_word_cmd(struct net_device *dev,
         err = smctr_setup_single_cmd_w_data(dev, ACB_CMD_MCT_WRITE_VALUE,
                 aword_cnt);
 
-        return (err);
+        return err;
 }
 
 static int smctr_join_complete_state(struct net_device *dev)
@@ -2935,7 +2937,7 @@ static int smctr_join_complete_state(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_CHANGE_JOIN_STATE,
                 JS_JOIN_COMPLETE_STATE);
 
-        return (err);
+        return err;
 }
 
 static int smctr_link_tx_fcbs_to_bdbs(struct net_device *dev)
@@ -2959,7 +2961,7 @@ static int smctr_link_tx_fcbs_to_bdbs(struct net_device *dev)
                 }
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_load_firmware(struct net_device *dev)
@@ -2974,7 +2976,7 @@ static int smctr_load_firmware(struct net_device *dev)
 
         if (request_firmware(&fw, "tr_smctr.bin", &dev->dev)) {
                 printk(KERN_ERR "%s: firmware not found\n", dev->name);
-                return (UCODE_NOT_PRESENT);
+                return UCODE_NOT_PRESENT;
         }
 
         tp->num_of_tx_buffs     = 4;
@@ -3036,7 +3038,7 @@ static int smctr_load_firmware(struct net_device *dev)
         smctr_disable_16bit(dev);
  out:
         release_firmware(fw);
-        return (err);
+        return err;
 }
 
 static int smctr_load_node_addr(struct net_device *dev)
@@ -3052,7 +3054,7 @@ static int smctr_load_node_addr(struct net_device *dev)
         }
         dev->addr_len = 6;
 
-        return (0);
+        return 0;
 }
 
 /* Lobe Media Test.
@@ -3146,14 +3148,14 @@ static int smctr_lobe_media_test_cmd(struct net_device *dev)
                 if(smctr_wait_cmd(dev))
                 {
                         printk(KERN_ERR "Lobe Failed test state\n");
-                        return (LOBE_MEDIA_TEST_FAILED);
+                        return LOBE_MEDIA_TEST_FAILED;
                 }
         }
 
         err = smctr_setup_single_cmd(dev, ACB_CMD_MCT_TEST,
                 TRC_LOBE_MEDIA_TEST);
 
-        return (err);
+        return err;
 }
 
 static int smctr_lobe_media_test_state(struct net_device *dev)
@@ -3163,7 +3165,7 @@ static int smctr_lobe_media_test_state(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_CHANGE_JOIN_STATE,
                 JS_LOBE_TEST_STATE);
 
-        return (err);
+        return err;
 }
 
 static int smctr_make_8025_hdr(struct net_device *dev,
@@ -3212,7 +3214,7 @@ static int smctr_make_8025_hdr(struct net_device *dev,
                         break;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_access_pri(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3225,7 +3227,7 @@ static int smctr_make_access_pri(struct net_device *dev, MAC_SUB_VECTOR *tsv)
         tsv->svv[0] = MSB(tp->authorized_access_priority);
         tsv->svv[1] = LSB(tp->authorized_access_priority);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_addr_mod(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3236,7 +3238,7 @@ static int smctr_make_addr_mod(struct net_device *dev, MAC_SUB_VECTOR *tsv)
         tsv->svv[0] = 0;
         tsv->svv[1] = 0;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_auth_funct_class(struct net_device *dev,
@@ -3250,7 +3252,7 @@ static int smctr_make_auth_funct_class(struct net_device *dev,
         tsv->svv[0] = MSB(tp->authorized_function_classes);
         tsv->svv[1] = LSB(tp->authorized_function_classes);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_corr(struct net_device *dev,
@@ -3262,7 +3264,7 @@ static int smctr_make_corr(struct net_device *dev,
         tsv->svv[0] = MSB(correlator);
         tsv->svv[1] = LSB(correlator);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_funct_addr(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3280,7 +3282,7 @@ static int smctr_make_funct_addr(struct net_device *dev, MAC_SUB_VECTOR *tsv)
         tsv->svv[2] = MSB(tp->misc_command_data[1]);
         tsv->svv[3] = LSB(tp->misc_command_data[1]);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_group_addr(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3305,7 +3307,7 @@ static int smctr_make_group_addr(struct net_device *dev, MAC_SUB_VECTOR *tsv)
            tsv->svv[2] == 0x00 && tsv->svv[3] == 0x00)
                 tsv->svv[0] = 0x00;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_phy_drop_num(struct net_device *dev,
@@ -3324,7 +3326,7 @@ static int smctr_make_phy_drop_num(struct net_device *dev,
         tsv->svv[2] = MSB(tp->misc_command_data[1]);
         tsv->svv[3] = LSB(tp->misc_command_data[1]);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_product_id(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3337,7 +3339,7 @@ static int smctr_make_product_id(struct net_device *dev, MAC_SUB_VECTOR *tsv)
         for(i = 0; i < 18; i++)
                 tsv->svv[i] = 0xF0;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_station_id(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3358,7 +3360,7 @@ static int smctr_make_station_id(struct net_device *dev, MAC_SUB_VECTOR *tsv)
         tsv->svv[4] = MSB(tp->misc_command_data[2]);
         tsv->svv[5] = LSB(tp->misc_command_data[2]);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_ring_station_status(struct net_device *dev,
@@ -3374,7 +3376,7 @@ static int smctr_make_ring_station_status(struct net_device *dev,
         tsv->svv[4] = 0;
         tsv->svv[5] = 0;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_ring_station_version(struct net_device *dev,
@@ -3400,7 +3402,7 @@ static int smctr_make_ring_station_version(struct net_device *dev,
         else
                 tsv->svv[9] = 0xc4;    /* EBCDIC - D */
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_tx_status_code(struct net_device *dev,
@@ -3414,7 +3416,7 @@ static int smctr_make_tx_status_code(struct net_device *dev,
         /* Stripped frame status of Transmitted Frame */
         tsv->svv[1] = tx_fstatus & 0xff;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_upstream_neighbor_addr(struct net_device *dev,
@@ -3436,7 +3438,7 @@ static int smctr_make_upstream_neighbor_addr(struct net_device *dev,
         tsv->svv[4] = MSB(tp->misc_command_data[2]);
         tsv->svv[5] = LSB(tp->misc_command_data[2]);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_wrap_data(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3444,7 +3446,7 @@ static int smctr_make_wrap_data(struct net_device *dev, MAC_SUB_VECTOR *tsv)
         tsv->svi = WRAP_DATA;
         tsv->svl = S_WRAP_DATA;
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -3464,9 +3466,9 @@ static int smctr_open(struct net_device *dev)
 
         err = smctr_init_adapter(dev);
         if(err < 0)
-                return (err);
+                return err;
 
-        return (err);
+        return err;
 }
 
 /* Interrupt driven open of Token card. */
@@ -3481,9 +3483,9 @@ static int smctr_open_tr(struct net_device *dev)
 
         /* Now we can actually open the adapter. */
         if(tp->status == OPEN)
-                return (0);
+                return 0;
         if(tp->status != INITIALIZED)
-                return (-1);
+                return -1;
 
         /* FIXME: it would work a lot better if we masked the irq sources
            on the card here, then we could skip the locking and poll nicely */
@@ -3560,7 +3562,7 @@ static int smctr_open_tr(struct net_device *dev)
 out:
         spin_unlock_irqrestore(&tp->lock, flags);
 
-        return (err);
+        return err;
 }
 
 /* Check for a network adapter of this type, 
@@ -3675,7 +3677,7 @@ static int __init smctr_probe1(struct net_device *dev, int ioaddr)
 
         dev->netdev_ops = &smctr_netdev_ops;
         dev->watchdog_timeo     = HZ;
-        return (0);
+        return 0;
 
 out:
         return err;
@@ -3699,13 +3701,13 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                         case INIT:
                                 if((rcode = smctr_rcv_init(dev, rmf, &correlator)) == HARDWARE_FAILED)
                                 {
-                                        return (rcode);
+                                        return rcode;
                                 }
 
                                 if((err = smctr_send_rsp(dev, rmf, rcode,
                                         correlator)))
                                 {
-                                        return (err);
+                                        return err;
                                 }
                                 break;
 
@@ -3713,13 +3715,13 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                 if((rcode = smctr_rcv_chg_param(dev, rmf,
                                         &correlator)) ==HARDWARE_FAILED)
                                 {
-                                        return (rcode);
+                                        return rcode;
                                 }
 
                                 if((err = smctr_send_rsp(dev, rmf, rcode,
                                         correlator)))
                                 {
-                                        return (err);
+                                        return err;
                                 }
                                 break;
 
@@ -3728,16 +3730,16 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                         rmf, &correlator)) != POSITIVE_ACK)
                                 {
                                         if(rcode == HARDWARE_FAILED)
-                                                return (rcode);
+                                                return rcode;
                                         else
-                                                return (smctr_send_rsp(dev, rmf,
-                                                        rcode, correlator));
+                                                return smctr_send_rsp(dev, rmf,
+                                                        rcode, correlator);
                                 }
 
                                 if((err = smctr_send_rpt_addr(dev, rmf,
                                         correlator)))
                                 {
-                                        return (err);
+                                        return err;
                                 }
                                 break;
 
@@ -3746,17 +3748,17 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                         rmf, &correlator)) != POSITIVE_ACK)
                                 {
                                         if(rcode == HARDWARE_FAILED)
-                                                return (rcode);
+                                                return rcode;
                                         else
-                                                return (smctr_send_rsp(dev, rmf,
+                                                return smctr_send_rsp(dev, rmf,
                                                         rcode,
-                                                        correlator));
+                                                        correlator);
                                 }
 
                                 if((err = smctr_send_rpt_attch(dev, rmf,
                                         correlator)))
                                 {
-                                        return (err);
+                                        return err;
                                 }
                                 break;
 
@@ -3765,17 +3767,17 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                         rmf, &correlator)) != POSITIVE_ACK)
                                 {
                                         if(rcode == HARDWARE_FAILED)
-                                                return (rcode);
+                                                return rcode;
                                         else
-                                                return (smctr_send_rsp(dev, rmf,
+                                                return smctr_send_rsp(dev, rmf,
                                                         rcode,
-                                                        correlator));
+                                                        correlator);
                                 }
 
                                 if((err = smctr_send_rpt_state(dev, rmf,
                                         correlator)))
                                 {
-                                        return (err);
+                                        return err;
                                 }
                                 break;
 
@@ -3786,17 +3788,17 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                         != POSITIVE_ACK)
                                 {
                                         if(rcode == HARDWARE_FAILED)
-                                                return (rcode);
+                                                return rcode;
                                         else
-                                                return (smctr_send_rsp(dev, rmf,
+                                                return smctr_send_rsp(dev, rmf,
                                                         rcode,
-                                                        correlator));
+                                                        correlator);
                                 }
 
                                 if((err = smctr_send_tx_forward(dev, rmf,
                                         &tx_fstatus)) == HARDWARE_FAILED)
                                 {
-                                        return (err);
+                                        return err;
                                 }
 
                                 if(err == A_FRAME_WAS_FORWARDED)
@@ -3805,7 +3807,7 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                                 rmf, tx_fstatus))
                                                 == HARDWARE_FAILED)
                                         {
-                                                return (err);
+                                                return err;
                                         }
                                 }
                                 break;
@@ -3834,7 +3836,7 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                         if((err = smctr_send_rsp(dev, rmf,rcode,
                                                 correlator)))
                                         {
-                                                return (err);
+                                                return err;
                                         }
                                 }
 
@@ -3899,7 +3901,7 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                 err = 0;
         }
 
-        return (err);
+        return err;
 }
 
 /* Adapter RAM test. Incremental word ODD boundary data test. */
@@ -3942,7 +3944,7 @@ static int smctr_ram_memory_test(struct net_device *dev)
                                 err_offset      = j;
                                 err_word        = word_read;
                                 err_pattern     = word_pattern;
-                                return (RAM_TEST_FAILED);
+                                return RAM_TEST_FAILED;
                         }
                 }
         }
@@ -3966,14 +3968,14 @@ static int smctr_ram_memory_test(struct net_device *dev)
                                 err_offset      = j;
                                 err_word        = word_read;
                                 err_pattern     = word_pattern;
-                                return (RAM_TEST_FAILED);
+                                return RAM_TEST_FAILED;
                         }
                 }
         }
 
         smctr_set_page(dev, (__u8 *)tp->ram_access);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_rcv_chg_param(struct net_device *dev, MAC_HEADER *rmf,
@@ -3986,7 +3988,7 @@ static int smctr_rcv_chg_param(struct net_device *dev, MAC_HEADER *rmf,
 
         /* This Frame can only come from a CRS */
         if((rmf->dc_sc & SC_MASK) != SC_CRS)
-                return(E_INAPPROPRIATE_SOURCE_CLASS);
+                return E_INAPPROPRIATE_SOURCE_CLASS;
 
         /* Remove MVID Length from total length. */
         vlen = (signed short)rmf->vl - 4;
@@ -4058,7 +4060,7 @@ static int smctr_rcv_chg_param(struct net_device *dev, MAC_HEADER *rmf,
                 }
         }
 
-        return (rcode);
+        return rcode;
 }
 
 static int smctr_rcv_init(struct net_device *dev, MAC_HEADER *rmf,
@@ -4071,7 +4073,7 @@ static int smctr_rcv_init(struct net_device *dev, MAC_HEADER *rmf,
 
         /* This Frame can only come from a RPS */
         if((rmf->dc_sc & SC_MASK) != SC_RPS)
-                return (E_INAPPROPRIATE_SOURCE_CLASS);
+                return E_INAPPROPRIATE_SOURCE_CLASS;
 
         /* Remove MVID Length from total length. */
         vlen = (signed short)rmf->vl - 4;
@@ -4133,7 +4135,7 @@ static int smctr_rcv_init(struct net_device *dev, MAC_HEADER *rmf,
                 }
         }
 
-        return (rcode);
+        return rcode;
 }
 
 static int smctr_rcv_tx_forward(struct net_device *dev, MAC_HEADER *rmf)
@@ -4145,7 +4147,7 @@ static int smctr_rcv_tx_forward(struct net_device *dev, MAC_HEADER *rmf)
 
         /* This Frame can only come from a CRS */
         if((rmf->dc_sc & SC_MASK) != SC_CRS)
-                return (E_INAPPROPRIATE_SOURCE_CLASS);
+                return E_INAPPROPRIATE_SOURCE_CLASS;
 
         /* Remove MVID Length from total length */
         vlen = (signed short)rmf->vl - 4;
@@ -4193,7 +4195,7 @@ static int smctr_rcv_tx_forward(struct net_device *dev, MAC_HEADER *rmf)
                 }
         }
 
-        return (rcode);
+        return rcode;
 }
 
 static int smctr_rcv_rq_addr_state_attch(struct net_device *dev,
@@ -4250,7 +4252,7 @@ static int smctr_rcv_rq_addr_state_attch(struct net_device *dev,
                         }
         }
 
-        return (rcode);
+        return rcode;
 }
 
 static int smctr_rcv_unknown(struct net_device *dev, MAC_HEADER *rmf,
@@ -4284,7 +4286,7 @@ static int smctr_rcv_unknown(struct net_device *dev, MAC_HEADER *rmf,
                 rsv = (MAC_SUB_VECTOR *)((__u32)rsv + rsv->svl);
         }
 
-        return (E_UNRECOGNIZED_VECTOR_ID);
+        return E_UNRECOGNIZED_VECTOR_ID;
 }
 
 /*
@@ -4311,7 +4313,7 @@ static int smctr_reset_adapter(struct net_device *dev)
          */
         outb(tp->trc_mask | CSR_CLRTINT | CSR_CLRCBUSY, ioaddr + CSR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_restart_tx_chain(struct net_device *dev, short queue)
@@ -4329,7 +4331,7 @@ static int smctr_restart_tx_chain(struct net_device *dev, short queue)
                 err = smctr_issue_resume_tx_fcb_cmd(dev, queue);
         }
 
-        return (err);
+        return err;
 }
 
 static int smctr_ring_status_chg(struct net_device *dev)
@@ -4371,7 +4373,7 @@ static int smctr_ring_status_chg(struct net_device *dev)
         }
 
         if(!(tp->ring_status_flags & RING_STATUS_CHANGED))
-                return (0);
+                return 0;
 
         switch(tp->ring_status)
         {
@@ -4421,7 +4423,7 @@ static int smctr_ring_status_chg(struct net_device *dev)
                         break;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_rx_frame(struct net_device *dev)
@@ -4486,7 +4488,7 @@ static int smctr_rx_frame(struct net_device *dev)
                         break;
         }
 
-        return (err);
+        return err;
 }
 
 static int smctr_send_dat(struct net_device *dev)
@@ -4502,7 +4504,7 @@ static int smctr_send_dat(struct net_device *dev)
         if((fcb = smctr_get_tx_fcb(dev, MAC_QUEUE,
                 sizeof(MAC_HEADER))) == (FCBlock *)(-1L))
         {
-                return (OUT_OF_RESOURCES);
+                return OUT_OF_RESOURCES;
         }
 
         /* Initialize DAT Data Fields. */
@@ -4524,7 +4526,7 @@ static int smctr_send_dat(struct net_device *dev)
 
         /* Start Transmit. */
         if((err = smctr_trc_send_packet(dev, fcb, MAC_QUEUE)))
-                return (err);
+                return err;
 
         /* Wait for Transmit to Complete */
         for(i = 0; i < 10000; i++)
@@ -4538,7 +4540,7 @@ static int smctr_send_dat(struct net_device *dev)
         if(!(fcb->frame_status &  FCB_COMMAND_DONE) ||
            fcb->frame_status & (FCB_TX_STATUS_E | FCB_TX_AC_BITS))
         {
-                return (INITIALIZE_FAILED);
+                return INITIALIZE_FAILED;
         }
 
         /* De-allocated Tx FCB and Frame Buffer
@@ -4549,7 +4551,7 @@ static int smctr_send_dat(struct net_device *dev)
         tp->tx_queue_status[MAC_QUEUE] = NOT_TRANSMITING;
         smctr_update_tx_chain(dev, fcb, MAC_QUEUE);
 
-        return (0);
+        return 0;
 }
 
 static void smctr_timeout(struct net_device *dev)
@@ -4610,7 +4612,7 @@ static int smctr_send_lobe_media_test(struct net_device *dev)
         if((fcb = smctr_get_tx_fcb(dev, MAC_QUEUE, sizeof(struct trh_hdr)
                 + S_WRAP_DATA + S_WRAP_DATA)) == (FCBlock *)(-1L))
         {
-                return (OUT_OF_RESOURCES);
+                return OUT_OF_RESOURCES;
         }
 
         /* Initialize DAT Data Fields. */
@@ -4639,7 +4641,7 @@ static int smctr_send_lobe_media_test(struct net_device *dev)
         /* Start Transmit. */
         tmf->vl = SWAP_BYTES(tmf->vl);
         if((err = smctr_trc_send_packet(dev, fcb, MAC_QUEUE)))
-                return (err);
+                return err;
 
         /* Wait for Transmit to Complete. (10 ms). */
         for(i=0; i < 10000; i++)
@@ -4653,7 +4655,7 @@ static int smctr_send_lobe_media_test(struct net_device *dev)
         if(!(fcb->frame_status & FCB_COMMAND_DONE) ||
            fcb->frame_status & (FCB_TX_STATUS_E | FCB_TX_AC_BITS))
         {
-                return (LOBE_MEDIA_TEST_FAILED);
+                return LOBE_MEDIA_TEST_FAILED;
         }
 
         /* De-allocated Tx FCB and Frame Buffer
@@ -4664,7 +4666,7 @@ static int smctr_send_lobe_media_test(struct net_device *dev)
         tp->tx_queue_status[MAC_QUEUE] = NOT_TRANSMITING;
         smctr_update_tx_chain(dev, fcb, MAC_QUEUE);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_send_rpt_addr(struct net_device *dev, MAC_HEADER *rmf,
@@ -4679,7 +4681,7 @@ static int smctr_send_rpt_addr(struct net_device *dev, MAC_HEADER *rmf,
                 + S_ADDRESS_MODIFER + S_GROUP_ADDRESS + S_FUNCTIONAL_ADDRESS))
                 == (FCBlock *)(-1L))
         {
-                return (0);
+                return 0;
         }
 
         tmf             = (MAC_HEADER *)fcb->bdb_ptr->data_block_ptr;
@@ -4722,7 +4724,7 @@ static int smctr_send_rpt_addr(struct net_device *dev, MAC_HEADER *rmf,
 */
         tmf->vl = SWAP_BYTES(tmf->vl);
 
-        return (smctr_trc_send_packet(dev, fcb, MAC_QUEUE));
+        return smctr_trc_send_packet(dev, fcb, MAC_QUEUE);
 }
 
 static int smctr_send_rpt_attch(struct net_device *dev, MAC_HEADER *rmf,
@@ -4737,7 +4739,7 @@ static int smctr_send_rpt_attch(struct net_device *dev, MAC_HEADER *rmf,
                 + S_AUTHORIZED_FUNCTION_CLASS + S_AUTHORIZED_ACCESS_PRIORITY))
                 == (FCBlock *)(-1L))
         {
-                return (0);
+                return 0;
         }
 
         tmf        = (MAC_HEADER *)fcb->bdb_ptr->data_block_ptr;
@@ -4776,7 +4778,7 @@ static int smctr_send_rpt_attch(struct net_device *dev, MAC_HEADER *rmf,
 */
         tmf->vl = SWAP_BYTES(tmf->vl);
 
-        return (smctr_trc_send_packet(dev, fcb, MAC_QUEUE));
+        return smctr_trc_send_packet(dev, fcb, MAC_QUEUE);
 }
 
 static int smctr_send_rpt_state(struct net_device *dev, MAC_HEADER *rmf,
@@ -4791,7 +4793,7 @@ static int smctr_send_rpt_state(struct net_device *dev, MAC_HEADER *rmf,
                 + S_RING_STATION_STATUS + S_STATION_IDENTIFER))
                 == (FCBlock *)(-1L))
         {
-                return (0);
+                return 0;
         }
 
         tmf        = (MAC_HEADER *)fcb->bdb_ptr->data_block_ptr;
@@ -4826,7 +4828,7 @@ static int smctr_send_rpt_state(struct net_device *dev, MAC_HEADER *rmf,
 */
         tmf->vl = SWAP_BYTES(tmf->vl);
 
-        return (smctr_trc_send_packet(dev, fcb, MAC_QUEUE));
+        return smctr_trc_send_packet(dev, fcb, MAC_QUEUE);
 }
 
 static int smctr_send_rpt_tx_forward(struct net_device *dev,
@@ -4839,7 +4841,7 @@ static int smctr_send_rpt_tx_forward(struct net_device *dev,
         if((fcb = smctr_get_tx_fcb(dev, MAC_QUEUE, sizeof(MAC_HEADER)
                 + S_TRANSMIT_STATUS_CODE)) == (FCBlock *)(-1L))
         {
-                return (0);
+                return 0;
         }
 
         tmf        = (MAC_HEADER *)fcb->bdb_ptr->data_block_ptr;
@@ -4862,7 +4864,7 @@ static int smctr_send_rpt_tx_forward(struct net_device *dev,
 */
         tmf->vl = SWAP_BYTES(tmf->vl);
 
-        return(smctr_trc_send_packet(dev, fcb, MAC_QUEUE));
+        return smctr_trc_send_packet(dev, fcb, MAC_QUEUE);
 }
 
 static int smctr_send_rsp(struct net_device *dev, MAC_HEADER *rmf,
@@ -4875,7 +4877,7 @@ static int smctr_send_rsp(struct net_device *dev, MAC_HEADER *rmf,
         if((fcb = smctr_get_tx_fcb(dev, MAC_QUEUE, sizeof(MAC_HEADER)
                 + S_CORRELATOR + S_RESPONSE_CODE)) == (FCBlock *)(-1L))
         {
-                return (0);
+                return 0;
         }
 
         tmf        = (MAC_HEADER *)fcb->bdb_ptr->data_block_ptr;
@@ -4888,7 +4890,7 @@ static int smctr_send_rsp(struct net_device *dev, MAC_HEADER *rmf,
         tsv = (MAC_SUB_VECTOR *)((__u32)tmf + sizeof(MAC_HEADER));
         smctr_make_corr(dev, tsv, correlator);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_send_rq_init(struct net_device *dev)
@@ -4907,7 +4909,7 @@ static int smctr_send_rq_init(struct net_device *dev)
                         + S_RING_STATION_VERSION_NUMBER + S_ADDRESS_MODIFER))
                         == (FCBlock *)(-1L)))
                 {
-                        return (0);
+                        return 0;
                 }
 
                 tmf        = (MAC_HEADER *)fcb->bdb_ptr->data_block_ptr;
@@ -4943,7 +4945,7 @@ static int smctr_send_rq_init(struct net_device *dev)
                 tmf->vl = SWAP_BYTES(tmf->vl);
 
                 if((err = smctr_trc_send_packet(dev, fcb, MAC_QUEUE)))
-                        return (err);
+                        return err;
 
                 /* Wait for Transmit to Complete */
                 for(i = 0; i < 10000; i++) 
@@ -4957,7 +4959,7 @@ static int smctr_send_rq_init(struct net_device *dev)
                 fstatus = fcb->frame_status;
 
                 if(!(fstatus & FCB_COMMAND_DONE))
-                        return (HARDWARE_FAILED);
+                        return HARDWARE_FAILED;
 
                 if(!(fstatus & FCB_TX_STATUS_E))
                         count++;
@@ -4971,7 +4973,7 @@ static int smctr_send_rq_init(struct net_device *dev)
                 smctr_update_tx_chain(dev, fcb, MAC_QUEUE);
         } while(count < 4 && ((fstatus & FCB_TX_AC_BITS) ^ FCB_TX_AC_BITS));
 
-        return (smctr_join_complete_state(dev));
+        return smctr_join_complete_state(dev);
 }
 
 static int smctr_send_tx_forward(struct net_device *dev, MAC_HEADER *rmf,
@@ -4984,13 +4986,13 @@ static int smctr_send_tx_forward(struct net_device *dev, MAC_HEADER *rmf,
 
         /* Check if this is the END POINT of the Transmit Forward Chain. */
         if(rmf->vl <= 18)
-                return (0);
+                return 0;
 
         /* Allocate Transmit FCB only by requesting 0 bytes
          * of data buffer.
          */
         if((fcb = smctr_get_tx_fcb(dev, MAC_QUEUE, 0)) == (FCBlock *)(-1L))
-                return (0);
+                return 0;
 
         /* Set pointer to Transmit Frame Buffer to the data
          * portion of the received TX Forward frame, making
@@ -5006,7 +5008,7 @@ static int smctr_send_tx_forward(struct net_device *dev, MAC_HEADER *rmf,
         fcb->bdb_ptr->buffer_length      = rmf->vl - 4 - 2;
 
         if((err = smctr_trc_send_packet(dev, fcb, MAC_QUEUE)))
-                return (err);
+                return err;
 
         /* Wait for Transmit to Complete */
         for(i = 0; i < 10000; i++) 
@@ -5020,7 +5022,7 @@ static int smctr_send_tx_forward(struct net_device *dev, MAC_HEADER *rmf,
         if(!(fcb->frame_status & FCB_COMMAND_DONE))
         {
                 if((err = smctr_issue_resume_tx_fcb_cmd(dev, MAC_QUEUE)))
-                        return (err);
+                        return err;
 
                 for(i = 0; i < 10000; i++) 
                 {
@@ -5030,12 +5032,12 @@ static int smctr_send_tx_forward(struct net_device *dev, MAC_HEADER *rmf,
                 }
 
                 if(!(fcb->frame_status & FCB_COMMAND_DONE))
-                        return (HARDWARE_FAILED);
+                        return HARDWARE_FAILED;
         }
 
         *tx_fstatus = fcb->frame_status;
 
-        return (A_FRAME_WAS_FORWARDED);
+        return A_FRAME_WAS_FORWARDED;
 }
 
 static int smctr_set_auth_access_pri(struct net_device *dev,
@@ -5044,11 +5046,11 @@ static int smctr_set_auth_access_pri(struct net_device *dev,
         struct net_local *tp = netdev_priv(dev);
 
         if(rsv->svl != S_AUTHORIZED_ACCESS_PRIORITY)
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         tp->authorized_access_priority = (rsv->svv[0] << 8 | rsv->svv[1]);
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 static int smctr_set_auth_funct_class(struct net_device *dev,
@@ -5057,22 +5059,22 @@ static int smctr_set_auth_funct_class(struct net_device *dev,
         struct net_local *tp = netdev_priv(dev);
 
         if(rsv->svl != S_AUTHORIZED_FUNCTION_CLASS)
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         tp->authorized_function_classes = (rsv->svv[0] << 8 | rsv->svv[1]);
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 static int smctr_set_corr(struct net_device *dev, MAC_SUB_VECTOR *rsv,
         __u16 *correlator)
 {
         if(rsv->svl != S_CORRELATOR)
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         *correlator = (rsv->svv[0] << 8 | rsv->svv[1]);
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 static int smctr_set_error_timer_value(struct net_device *dev,
@@ -5082,34 +5084,34 @@ static int smctr_set_error_timer_value(struct net_device *dev,
         int err;
 
         if(rsv->svl != S_ERROR_TIMER_VALUE)
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         err_tval = (rsv->svv[0] << 8 | rsv->svv[1])*10;
 
         smctr_issue_write_word_cmd(dev, RW_TER_THRESHOLD, &err_tval);
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 static int smctr_set_frame_forward(struct net_device *dev,
         MAC_SUB_VECTOR *rsv, __u8 dc_sc)
 {
         if((rsv->svl < 2) || (rsv->svl > S_FRAME_FORWARD))
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         if((dc_sc & DC_MASK) != DC_CRS)
         {
                 if(rsv->svl >= 2 && rsv->svl < 20)
-                        return (E_TRANSMIT_FORWARD_INVALID);
+                        return E_TRANSMIT_FORWARD_INVALID;
 
                 if((rsv->svv[0] != 0) || (rsv->svv[1] != 0))
-                        return (E_TRANSMIT_FORWARD_INVALID);
+                        return E_TRANSMIT_FORWARD_INVALID;
         }
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 static int smctr_set_local_ring_num(struct net_device *dev,
@@ -5118,13 +5120,13 @@ static int smctr_set_local_ring_num(struct net_device *dev,
         struct net_local *tp = netdev_priv(dev);
 
         if(rsv->svl != S_LOCAL_RING_NUMBER)
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         if(tp->ptr_local_ring_num)
                 *(__u16 *)(tp->ptr_local_ring_num) 
                         = (rsv->svv[0] << 8 | rsv->svv[1]);
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 static unsigned short smctr_set_ctrl_attention(struct net_device *dev)
@@ -5140,7 +5142,7 @@ static unsigned short smctr_set_ctrl_attention(struct net_device *dev)
                 outb(tp->trc_mask, ioaddr + CSR);
         }
 
-        return (0);
+        return 0;
 }
 
 static void smctr_set_multicast_list(struct net_device *dev)
@@ -5159,7 +5161,7 @@ static int smctr_set_page(struct net_device *dev, __u8 *buf)
         amask = (__u8)((tptr & PR_PAGE_MASK) >> 8);
         outb(amask, dev->base_addr + PR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_set_phy_drop(struct net_device *dev, MAC_SUB_VECTOR *rsv)
@@ -5167,13 +5169,13 @@ static int smctr_set_phy_drop(struct net_device *dev, MAC_SUB_VECTOR *rsv)
         int err;
 
         if(rsv->svl != S_PHYSICAL_DROP)
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         smctr_issue_write_byte_cmd(dev, RW_PHYSICAL_DROP_NUMBER, &rsv->svv[0]);
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 /* Reset the ring speed to the opposite of what it was. This auto-pilot
@@ -5195,16 +5197,16 @@ static int smctr_set_ring_speed(struct net_device *dev)
         smctr_reset_adapter(dev);
 
         if((err = smctr_init_card_real(dev)))
-                return (err);
+                return err;
 
         smctr_enable_bic_int(dev);
 
         if((err = smctr_issue_enable_int_cmd(dev, TRC_INTERRUPT_ENABLE_MASK)))
-                return (err);
+                return err;
 
         smctr_disable_16bit(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_set_rx_look_ahead(struct net_device *dev)
@@ -5233,7 +5235,7 @@ static int smctr_set_rx_look_ahead(struct net_device *dev)
                 *((__u16 *)(tp->ram_access)) = sword;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_set_trc_reset(int ioaddr)
@@ -5243,7 +5245,7 @@ static int smctr_set_trc_reset(int ioaddr)
         r = inb(ioaddr + MSR);
         outb(MSR_RST | r, ioaddr + MSR);
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -5259,10 +5261,10 @@ static int smctr_setup_single_cmd(struct net_device *dev,
                 printk(KERN_DEBUG "%s: smctr_setup_single_cmd\n", dev->name);
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = (unsigned int)smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         tp->acb_head->cmd_done_status   = 0;
         tp->acb_head->cmd               = command;
@@ -5270,7 +5272,7 @@ static int smctr_setup_single_cmd(struct net_device *dev,
 
         err = smctr_issue_resume_acb_cmd(dev);
 
-        return (err);
+        return err;
 }
 
 /*
@@ -5287,7 +5289,7 @@ static int smctr_setup_single_cmd_w_data(struct net_device *dev,
         tp->acb_head->data_offset_lo
                 = (__u16)TRC_POINTER(tp->misc_command_data);
 
-        return(smctr_issue_resume_acb_cmd(dev));
+        return smctr_issue_resume_acb_cmd(dev);
 }
 
 static char *smctr_malloc(struct net_device *dev, __u16 size)
@@ -5298,7 +5300,7 @@ static char *smctr_malloc(struct net_device *dev, __u16 size)
         m = (char *)(tp->ram_access + tp->sh_mem_used);
         tp->sh_mem_used += (__u32)size;
 
-        return (m);
+        return m;
 }
 
 static int smctr_status_chg(struct net_device *dev)
@@ -5333,7 +5335,7 @@ static int smctr_status_chg(struct net_device *dev)
                         break;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_trc_send_packet(struct net_device *dev, FCBlock *fcb,
@@ -5355,7 +5357,7 @@ static int smctr_trc_send_packet(struct net_device *dev, FCBlock *fcb,
                 err = smctr_issue_resume_tx_fcb_cmd(dev, queue);
         }
 
-        return (err);
+        return err;
 }
 
 static __u16 smctr_tx_complete(struct net_device *dev, __u16 queue)
@@ -5409,7 +5411,7 @@ static __u16 smctr_tx_complete(struct net_device *dev, __u16 queue)
                         break;
         }
 
-        return (err);
+        return err;
 }
 
 static unsigned short smctr_tx_move_frame(struct net_device *dev,
@@ -5450,7 +5452,7 @@ static unsigned short smctr_tx_move_frame(struct net_device *dev,
                 pbuff += len;
         }
 
-        return (0);
+        return 0;
 }
 
 /* Update the error statistic counters for this adapter. */
@@ -5493,7 +5495,7 @@ static int smctr_update_err_stats(struct net_device *dev)
         if(tstat->token_errors)
                 tstat->token_errors += *(tp->misc_command_data + 5) >> 8;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_update_rx_chain(struct net_device *dev, __u16 queue)
@@ -5530,7 +5532,7 @@ static int smctr_update_rx_chain(struct net_device *dev, __u16 queue)
         tp->rx_bdb_curr[queue]->back_ptr->info = BDB_NOT_CHAIN_END;
         tp->rx_bdb_curr[queue] = bdb;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_update_tx_chain(struct net_device *dev, FCBlock *fcb,
@@ -5542,13 +5544,13 @@ static int smctr_update_tx_chain(struct net_device *dev, FCBlock *fcb,
                 printk(KERN_DEBUG "smctr_update_tx_chain\n");
 
         if(tp->num_tx_fcbs_used[queue] <= 0)
-                return (HARDWARE_FAILED);
+                return HARDWARE_FAILED;
         else
         {
                 if(tp->tx_buff_used[queue] < fcb->memory_alloc)
                 {
                         tp->tx_buff_used[queue] = 0;
-                        return (HARDWARE_FAILED);
+                        return HARDWARE_FAILED;
                 }
 
                 tp->tx_buff_used[queue] -= fcb->memory_alloc;
@@ -5566,7 +5568,7 @@ static int smctr_update_tx_chain(struct net_device *dev, FCBlock *fcb,
                 fcb->frame_status = 0;
                 tp->tx_fcb_end[queue] = fcb->next_ptr;
                 netif_wake_queue(dev);
-                return (0);
+                return 0;
         }
 }
 
@@ -5587,12 +5589,12 @@ static int smctr_wait_cmd(struct net_device *dev)
         }
 
         if(loop_count == 0)
-                return(HARDWARE_FAILED);
+                return HARDWARE_FAILED;
 
         if(tp->acb_head->cmd_done_status & 0xff)
-                return(HARDWARE_FAILED);
+                return HARDWARE_FAILED;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_wait_while_cbusy(struct net_device *dev)
@@ -5624,9 +5626,9 @@ static int smctr_wait_while_cbusy(struct net_device *dev)
         }
 
         if(timeout)
-                return (0);
+                return 0;
         else
-                return (HARDWARE_FAILED);
+                return HARDWARE_FAILED;
 }
 
 #ifdef MODULE
diff --git a/drivers/net/tokenring/tms380tr.c b/drivers/net/tokenring/tms380tr.c
index 08182fde3dcd..c83f4f6e39e1 100644
--- a/drivers/net/tokenring/tms380tr.c
+++ b/drivers/net/tokenring/tms380tr.c
@@ -224,7 +224,7 @@ static int madgemc_sifprobe(struct net_device *dev)
                 chk2 ^= 0x0FE;
 
                 if(chk1 != chk2)
-                        return (-1);    /* No adapter */
+                        return -1;    /* No adapter */
                 chk1 -= 2;
         } while(chk1 != 0);     /* Repeat 128 times (all byte values) */
 
@@ -232,7 +232,7 @@ static int madgemc_sifprobe(struct net_device *dev)
         /* Restore the SIFADR value */
         SIFWRITEB(old, SIFADR);
 
-        return (0);
+        return 0;
 }
 #endif
 
@@ -271,7 +271,7 @@ int tms380tr_open(struct net_device *dev)
         {
                 printk(KERN_INFO "%s: Chipset initialization error\n", 
                         dev->name);
-                return (-1);
+                return -1;
         }
 
         tp->timer.expires       = jiffies + 30*HZ;
@@ -298,7 +298,7 @@ int tms380tr_open(struct net_device *dev)
         if(tp->AdapterVirtOpenFlag == 0)
         {
                 tms380tr_disable_interrupts(dev);
-                return (-1);
+                return -1;
         }
 
         tp->StartTime = jiffies;
@@ -309,7 +309,7 @@ int tms380tr_open(struct net_device *dev)
         tp->timer.data          = (unsigned long)dev;
         add_timer(&tp->timer);
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -343,23 +343,23 @@ static int tms380tr_chipset_init(struct net_device *dev)
                 printk(KERN_DEBUG "%s: Resetting adapter...\n", dev->name);
         err = tms380tr_reset_adapter(dev);
         if(err < 0)
-                return (-1);
+                return -1;
 
         if(tms380tr_debug > 3)
                 printk(KERN_DEBUG "%s: Bringup diags...\n", dev->name);
         err = tms380tr_bringup_diags(dev);
         if(err < 0)
-                return (-1);
+                return -1;
 
         if(tms380tr_debug > 3)
                 printk(KERN_DEBUG "%s: Init adapter...\n", dev->name);
         err = tms380tr_init_adapter(dev);
         if(err < 0)
-                return (-1);
+                return -1;
 
         if(tms380tr_debug > 3)
                 printk(KERN_DEBUG "%s: Done!\n", dev->name);
-        return (0);
+        return 0;
 }
 
 /*
@@ -877,7 +877,7 @@ static unsigned char tms380tr_chk_ssb(struct net_local *tp, unsigned short IrqTy
            IrqType != STS_IRQ_COMMAND_STATUS &&
            IrqType != STS_IRQ_RING_STATUS)
         {
-                return (1);     /* SSB not involved. */
+                return 1;       /* SSB not involved. */
         }
 
         /* Note: All fields of the SSB have been set to all ones (-1) after it
@@ -887,21 +887,21 @@ static unsigned char tms380tr_chk_ssb(struct net_local *tp, unsigned short IrqTy
          */
 
         if(ssb->STS == (unsigned short) -1)
-                return (0);     /* Command field not yet available. */
+                return 0;       /* Command field not yet available. */
         if(IrqType == STS_IRQ_COMMAND_STATUS)
-                return (1);     /* Status fields not always affected. */
+                return 1;       /* Status fields not always affected. */
         if(ssb->Parm[0] == (unsigned short) -1)
-                return (0);     /* Status 1 field not yet available. */
+                return 0;       /* Status 1 field not yet available. */
         if(IrqType == STS_IRQ_RING_STATUS)
-                return (1);     /* Status 2 & 3 fields not affected. */
+                return 1;       /* Status 2 & 3 fields not affected. */
 
         /* Note: At this point, the interrupt is either TRANSMIT or RECEIVE. */
         if(ssb->Parm[1] == (unsigned short) -1)
-                return (0);     /* Status 2 field not yet available. */
+                return 0;       /* Status 2 field not yet available. */
         if(ssb->Parm[2] == (unsigned short) -1)
-                return (0);     /* Status 3 field not yet available. */
+                return 0;       /* Status 3 field not yet available. */
 
-        return (1);     /* All SSB fields have been written by the adapter. */
+        return 1;       /* All SSB fields have been written by the adapter. */
 }
 
 /*
@@ -1143,7 +1143,7 @@ int tms380tr_close(struct net_device *dev)
 #endif
         tms380tr_cancel_tx_queue(tp);
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -1154,7 +1154,7 @@ static struct net_device_stats *tms380tr_get_stats(struct net_device *dev)
 {
         struct net_local *tp = netdev_priv(dev);
 
-        return ((struct net_device_stats *)&tp->MacStat);
+        return (struct net_device_stats *)&tp->MacStat;
 }
 
 /*
@@ -1256,7 +1256,7 @@ static int tms380tr_reset_adapter(struct net_device *dev)
         if (request_firmware(&fw_entry, "tms380tr.bin", tp->pdev) != 0) {
                 printk(KERN_ALERT "%s: firmware %s is missing, cannot start.\n",
                         dev->name, "tms380tr.bin");
-                return (-1);
+                return -1;
         }
 
         fw_ptr = (unsigned short *)fw_entry->data;
@@ -1322,13 +1322,13 @@ static int tms380tr_reset_adapter(struct net_device *dev)
                         /* Clear CPHALT and start BUD */
                         SIFWRITEW(c, SIFACL);
                         release_firmware(fw_entry);
-                        return (1);
+                        return 1;
                 }
         } while(count == 0);
 
         release_firmware(fw_entry);
         printk(KERN_INFO "%s: Adapter Download Failed\n", dev->name);
-        return (-1);
+        return -1;
 }
 
 MODULE_FIRMWARE("tms380tr.bin");
@@ -1363,7 +1363,7 @@ static int tms380tr_bringup_diags(struct net_device *dev)
                                 printk(KERN_DEBUG " %04X\n", Status);
                         /* BUD successfully completed */
                         if(Status == STS_INITIALIZE)
-                                return (1);
+                                return 1;
                 /* Unrecoverable hardware error, BUD not completed? */
                 } while((loop_cnt > 0) && ((Status & (STS_ERROR | STS_TEST))
                         != (STS_ERROR | STS_TEST)));
@@ -1390,7 +1390,7 @@ static int tms380tr_bringup_diags(struct net_device *dev)
         else
                 printk(KERN_INFO "%s: Bring Up Diagnostics Error (%04X) occurred\n", dev->name, Status & 0x000f);
 
-        return (-1);
+        return -1;
 }
 
 /*
@@ -1464,7 +1464,7 @@ static int tms380tr_init_adapter(struct net_device *dev)
                                 {
                                         printk(KERN_INFO "%s: DMA failed\n", dev->name);
                                         /* DMA data error: wrong data in SCB */
-                                        return (-1);
+                                        return -1;
                                 }
                                 i++;
                         } while(i < 6);
@@ -1473,11 +1473,11 @@ static int tms380tr_init_adapter(struct net_device *dev)
                         do {    /* Test if contents of SSB is valid */
                                 if(SSB_Test[i] != *(sb_ptr + i))
                                         /* DMA data error: wrong data in SSB */
-                                        return (-1);
+                                        return -1;
                                 i++;
                         } while (i < 8);
 
-                        return (1);     /* Adapter successfully initialized */
+                        return 1;       /* Adapter successfully initialized */
                 }
                 else
                 {
@@ -1488,7 +1488,7 @@ static int tms380tr_init_adapter(struct net_device *dev)
                                 Status &= STS_ERROR_MASK;
                                 /* ShowInitialisationErrorCode(Status); */
                                 printk(KERN_INFO "%s: Status error: %d\n", dev->name, Status);
-                                return (-1); /* Unrecoverable error */
+                                return -1; /* Unrecoverable error */
                         }
                         else
                         {
@@ -1503,7 +1503,7 @@ static int tms380tr_init_adapter(struct net_device *dev)
         } while(retry_cnt > 0);
 
         printk(KERN_INFO "%s: Retry exceeded\n", dev->name);
-        return (-1);
+        return -1;
 }
 
 /*
diff --git a/drivers/net/tokenring/tmspci.c b/drivers/net/tokenring/tmspci.c
index d4c7c0c0a3d6..d3e788a9cd1c 100644
--- a/drivers/net/tokenring/tmspci.c
+++ b/drivers/net/tokenring/tmspci.c
@@ -125,18 +125,16 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
         dev->irq        = pci_irq_line;
         dev->dma        = 0;
 
-        printk("%s: %s\n", dev->name, cardinfo->name);
-        printk("%s:    IO: %#4lx  IRQ: %d\n",
-               dev->name, dev->base_addr, dev->irq);
+        dev_info(&pdev->dev, "%s\n", cardinfo->name);
+        dev_info(&pdev->dev, "    IO: %#4lx  IRQ: %d\n", dev->base_addr, dev->irq);
                 
         tms_pci_read_eeprom(dev);
 
-        printk("%s:    Ring Station Address: %pM\n",
-               dev->name, dev->dev_addr);
+        dev_info(&pdev->dev, "    Ring Station Address: %pM\n", dev->dev_addr);
                 
         ret = tmsdev_init(dev, &pdev->dev);
         if (ret) {
-                printk("%s: unable to get memory for dev->priv.\n", dev->name);
+                dev_info(&pdev->dev, "unable to get memory for dev->priv.\n");
                 goto err_out_region;
         }
 
diff --git a/drivers/net/tsi108_eth.c b/drivers/net/tsi108_eth.c
index a03730bd1da5..5c633a32eaeb 100644
--- a/drivers/net/tsi108_eth.c
+++ b/drivers/net/tsi108_eth.c
@@ -219,7 +219,7 @@ static int tsi108_read_mii(struct tsi108_prv_data *data, int reg)
         if (i == 100)
                 return 0xffff;
         else
-                return (TSI_READ_PHY(TSI108_MAC_MII_DATAIN));
+                return TSI_READ_PHY(TSI108_MAC_MII_DATAIN);
 }
 
 static void tsi108_write_mii(struct tsi108_prv_data *data,
diff --git a/drivers/net/tulip/Kconfig b/drivers/net/tulip/Kconfig
index 516713fa0a05..f3035951422f 100644
--- a/drivers/net/tulip/Kconfig
+++ b/drivers/net/tulip/Kconfig
@@ -11,8 +11,8 @@ menuconfig NET_TULIP
 if NET_TULIP
 
 config DE2104X
-        tristate "Early DECchip Tulip (dc2104x) PCI support (EXPERIMENTAL)"
-        depends on PCI && EXPERIMENTAL
+        tristate "Early DECchip Tulip (dc2104x) PCI support"
+        depends on PCI
         select CRC32
         ---help---
           This driver is developed for the SMC EtherPower series Ethernet
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 5efa57757a2c..28e1ffb13db9 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -243,6 +243,7 @@ enum {
         NWayState               = (1 << 14) | (1 << 13) | (1 << 12),
         NWayRestart             = (1 << 12),
         NonselPortActive        = (1 << 9),
+        SelPortActive           = (1 << 8),
         LinkFailStatus          = (1 << 2),
         NetCxnErr               = (1 << 1),
 };
@@ -363,7 +364,9 @@ static u16 t21040_csr15[] = { 0, 0, 0x0006, 0x0000, 0x0000, };
 
 /* 21041 transceiver register settings: TP AUTO, BNC, AUI, TP, TP FD*/
 static u16 t21041_csr13[] = { 0xEF01, 0xEF09, 0xEF09, 0xEF01, 0xEF09, };
-static u16 t21041_csr14[] = { 0xFFFF, 0xF7FD, 0xF7FD, 0x6F3F, 0x6F3D, };
+static u16 t21041_csr14[] = { 0xFFFF, 0xF7FD, 0xF7FD, 0x7F3F, 0x7F3D, };
+/* If on-chip autonegotiation is broken, use half-duplex (FF3F) instead */
+static u16 t21041_csr14_brk[] = { 0xFF3F, 0xF7FD, 0xF7FD, 0x7F3F, 0x7F3D, };
 static u16 t21041_csr15[] = { 0x0008, 0x0006, 0x000E, 0x0008, 0x0008, };
 
 
@@ -945,8 +948,9 @@ static void de_set_media (struct de_private *de)
         else
                 macmode &= ~FullDuplex;
 
-        if (netif_msg_link(de)) {
+        if (netif_msg_link(de))
                 dev_info(&de->dev->dev, "set link %s\n", media_name[media]);
+        if (netif_msg_hw(de)) {
                 dev_info(&de->dev->dev, "mode 0x%x, sia 0x%x,0x%x,0x%x,0x%x\n",
                          dr32(MacMode), dr32(SIAStatus),
                          dr32(CSR13), dr32(CSR14), dr32(CSR15));
@@ -1064,6 +1068,9 @@ static void de21041_media_timer (unsigned long data)
         unsigned int carrier;
         unsigned long flags;
 
+        /* clear port active bits */
+        dw32(SIAStatus, NonselPortActive | SelPortActive);
+
         carrier = (status & NetCxnErr) ? 0 : 1;
 
         if (carrier) {
@@ -1158,14 +1165,29 @@ no_link_yet:
 static void de_media_interrupt (struct de_private *de, u32 status)
 {
         if (status & LinkPass) {
+                /* Ignore if current media is AUI or BNC and we can't use TP */
+                if ((de->media_type == DE_MEDIA_AUI ||
+                     de->media_type == DE_MEDIA_BNC) &&
+                    (de->media_lock ||
+                     !de_ok_to_advertise(de, DE_MEDIA_TP_AUTO)))
+                        return;
+                /* If current media is not TP, change it to TP */
+                if ((de->media_type == DE_MEDIA_AUI ||
+                     de->media_type == DE_MEDIA_BNC)) {
+                        de->media_type = DE_MEDIA_TP_AUTO;
+                        de_stop_rxtx(de);
+                        de_set_media(de);
+                        de_start_rxtx(de);
+                }
                 de_link_up(de);
                 mod_timer(&de->media_timer, jiffies + DE_TIMER_LINK);
                 return;
         }
 
         BUG_ON(!(status & LinkFail));
-
-        if (netif_carrier_ok(de->dev)) {
+        /* Mark the link as down only if current media is TP */
+        if (netif_carrier_ok(de->dev) && de->media_type != DE_MEDIA_AUI &&
+            de->media_type != DE_MEDIA_BNC) {
                 de_link_down(de);
                 mod_timer(&de->media_timer, jiffies + DE_TIMER_NO_LINK);
         }
@@ -1229,6 +1251,7 @@ static void de_adapter_sleep (struct de_private *de)
         if (de->de21040)
                 return;
 
+        dw32(CSR13, 0); /* Reset phy */
         pci_read_config_dword(de->pdev, PCIPM, &pmctl);
         pmctl |= PM_Sleep;
         pci_write_config_dword(de->pdev, PCIPM, pmctl);
@@ -1574,12 +1597,15 @@ static int __de_set_settings(struct de_private *de, struct ethtool_cmd *ecmd)
                 return 0; /* nothing to change */
 
         de_link_down(de);
+        mod_timer(&de->media_timer, jiffies + DE_TIMER_NO_LINK);
         de_stop_rxtx(de);
 
         de->media_type = new_media;
         de->media_lock = media_lock;
         de->media_advertise = ecmd->advertising;
         de_set_media(de);
+        if (netif_running(de->dev))
+                de_start_rxtx(de);
 
         return 0;
 }
@@ -1911,8 +1937,14 @@ fill_defaults:
         for (i = 0; i < DE_MAX_MEDIA; i++) {
                 if (de->media[i].csr13 == 0xffff)
                         de->media[i].csr13 = t21041_csr13[i];
-                if (de->media[i].csr14 == 0xffff)
-                        de->media[i].csr14 = t21041_csr14[i];
+                if (de->media[i].csr14 == 0xffff) {
+                        /* autonegotiation is broken at least on some chip
+                           revisions - rev. 0x21 works, 0x11 does not */
+                        if (de->pdev->revision < 0x20)
+                                de->media[i].csr14 = t21041_csr14_brk[i];
+                        else
+                                de->media[i].csr14 = t21041_csr14[i];
+                }
                 if (de->media[i].csr15 == 0xffff)
                         de->media[i].csr15 = t21041_csr15[i];
         }
@@ -2158,6 +2190,8 @@ static int de_resume (struct pci_dev *pdev)
                 dev_err(&dev->dev, "pci_enable_device failed in resume\n");
                 goto out;
         }
+        pci_set_master(pdev);
+        de_init_rings(de);
         de_init_hw(de);
 out_attach:
         netif_device_attach(dev);
diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
index 4f7503063446..4dbd493b996b 100644
--- a/drivers/net/tulip/de4x5.c
+++ b/drivers/net/tulip/de4x5.c
@@ -3119,7 +3119,7 @@ dc2114x_autoconf(struct net_device *dev)
           if (lp->media == _100Mb) {
               if ((slnk = test_for_100Mb(dev, 6500)) < 0) {
                   lp->media = SPD_DET;
-                  return  (slnk & ~TIMER_CB);
+                  return slnk & ~TIMER_CB;
               }
           } else {
               if (wait_for_link(dev) < 0) {
@@ -3484,7 +3484,7 @@ is_spd_100(struct net_device *dev)
         spd = ((~gep_rd(dev)) & GEP_SLNK);
     } else {
         if ((lp->ibn == 2) || !lp->asBitValid)
-            return ((lp->chipset == DC21143)?(~inl(DE4X5_SISR)&SISR_LS100):0);
+            return (lp->chipset == DC21143) ? (~inl(DE4X5_SISR)&SISR_LS100) : 0;
 
         spd = (lp->asBitValid & (lp->asPolarity ^ (gep_rd(dev) & lp->asBit))) |
                   (lp->linkOK & ~lp->asBitValid);
@@ -3502,15 +3502,15 @@ is_100_up(struct net_device *dev)
     if (lp->useMII) {
         /* Double read for sticky bits & temporary drops */
         mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII);
-        return (mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII) & MII_SR_LKS);
+        return mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII) & MII_SR_LKS;
     } else if (!lp->useSROM) {                       /* de500-xa */
-        return ((~gep_rd(dev)) & GEP_SLNK);
+        return (~gep_rd(dev)) & GEP_SLNK;
     } else {
         if ((lp->ibn == 2) || !lp->asBitValid)
-            return ((lp->chipset == DC21143)?(~inl(DE4X5_SISR)&SISR_LS100):0);
+            return (lp->chipset == DC21143) ? (~inl(DE4X5_SISR)&SISR_LS100) : 0;
 
-        return ((lp->asBitValid&(lp->asPolarity^(gep_rd(dev)&lp->asBit))) |
-                (lp->linkOK & ~lp->asBitValid));
+        return (lp->asBitValid&(lp->asPolarity^(gep_rd(dev)&lp->asBit))) |
+                (lp->linkOK & ~lp->asBitValid);
     }
 }
 
@@ -3523,17 +3523,17 @@ is_10_up(struct net_device *dev)
     if (lp->useMII) {
         /* Double read for sticky bits & temporary drops */
         mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII);
-        return (mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII) & MII_SR_LKS);
+        return mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII) & MII_SR_LKS;
     } else if (!lp->useSROM) {                       /* de500-xa */
-        return ((~gep_rd(dev)) & GEP_LNP);
+        return (~gep_rd(dev)) & GEP_LNP;
     } else {
         if ((lp->ibn == 2) || !lp->asBitValid)
-            return (((lp->chipset & ~0x00ff) == DC2114x) ?
+            return ((lp->chipset & ~0x00ff) == DC2114x) ?
                     (~inl(DE4X5_SISR)&SISR_LS10):
-                    0);
+                    0;
 
-        return ((lp->asBitValid&(lp->asPolarity^(gep_rd(dev)&lp->asBit))) |
-                (lp->linkOK & ~lp->asBitValid));
+        return  (lp->asBitValid&(lp->asPolarity^(gep_rd(dev)&lp->asBit))) |
+                (lp->linkOK & ~lp->asBitValid);
     }
 }
 
@@ -3544,7 +3544,7 @@ is_anc_capable(struct net_device *dev)
     u_long iobase = dev->base_addr;
 
     if (lp->phy[lp->active].id && (!lp->useSROM || lp->useMII)) {
-        return (mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII));
+        return mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII);
     } else if ((lp->chipset & ~0x00ff) == DC2114x) {
         return (inl(DE4X5_SISR) & SISR_LPN) >> 12;
     } else {
@@ -4930,7 +4930,7 @@ getfrom_mii(u32 command, u_long ioaddr)
     outl(command | MII_MDC, ioaddr);
     udelay(1);
 
-    return ((inl(ioaddr) >> 19) & 1);
+    return (inl(ioaddr) >> 19) & 1;
 }
 
 /*
@@ -4975,8 +4975,8 @@ mii_get_oui(u_char phyaddr, u_long ioaddr)
     a.breg[0]=a.breg[1];
     a.breg[1]=i;
 
-    return ((a.reg<<8)|ret); */                 /* SEEQ and Cypress way */
-/*    return ((r2<<6)|(u_int)(r3>>10)); */      /* NATIONAL and BROADCOM way */
+    return (a.reg<<8)|ret; */                 /* SEEQ and Cypress way */
+/*    return (r2<<6)|(u_int)(r3>>10); */      /* NATIONAL and BROADCOM way */
     return r2;                                  /* (I did it) My way */
 }
 
@@ -5144,7 +5144,7 @@ gep_rd(struct net_device *dev)
     if (lp->chipset == DC21140) {
         return inl(DE4X5_GEP);
     } else if ((lp->chipset & ~0x00ff) == DC2114x) {
-        return (inl(DE4X5_SIGR) & 0x000fffff);
+        return inl(DE4X5_SIGR) & 0x000fffff;
     }
 
     return 0;
@@ -5474,7 +5474,8 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
         tmp.lval[6] = inl(DE4X5_STRR); j+=4;
         tmp.lval[7] = inl(DE4X5_SIGR); j+=4;
         ioc->len = j;
-        if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
+        if (copy_to_user(ioc->data, tmp.lval, ioc->len))
+                return -EFAULT;
         break;
 
 #define DE4X5_DUMP              0x0f /* Dump the DE4X5 Status */
diff --git a/drivers/net/tulip/uli526x.c b/drivers/net/tulip/uli526x.c
index 1dc27a557275..74217dbf0143 100644
--- a/drivers/net/tulip/uli526x.c
+++ b/drivers/net/tulip/uli526x.c
@@ -1747,7 +1747,7 @@ static u16 phy_readby_cr10(unsigned long iobase, u8 phy_addr, u8 offset)
                 if(cr10_value&0x10000000)
                         break;
         }
-        return (cr10_value&0x0ffff);
+        return cr10_value & 0x0ffff;
 }
 
 static void phy_writeby_cr10(unsigned long iobase, u8 phy_addr, u8 offset, u16 phy_data)
diff --git a/drivers/net/typhoon.c b/drivers/net/typhoon.c
index 5dfb39539b3e..1cc67138adbf 100644
--- a/drivers/net/typhoon.c
+++ b/drivers/net/typhoon.c
@@ -541,7 +541,7 @@ cleanup:
 
         indexes->respCleared = cpu_to_le32(cleared);
         wmb();
-        return (resp_save == NULL);
+        return resp_save == NULL;
 }
 
 static inline int
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 4f123f869bdc..8110595fbbcc 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1643,6 +1643,8 @@ static int hso_get_count(struct hso_serial *serial,
         struct uart_icount cnow;
         struct hso_tiocmget  *tiocmget = serial->tiocmget;
 
+        memset(&icount, 0, sizeof(struct serial_icounter_struct));
+
         if (!tiocmget)
                  return -ENOENT;
         spin_lock_irq(&serial->serial_lock);
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index ee85c8b9a858..d1ac15c95faf 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -203,7 +203,7 @@ static inline void sierra_net_set_private(struct usbnet *dev,
 /* is packet IPv4 */
 static inline int is_ip(struct sk_buff *skb)
 {
-        return (skb->protocol == cpu_to_be16(ETH_P_IP));
+        return skb->protocol == cpu_to_be16(ETH_P_IP);
 }
 
 /*
@@ -354,7 +354,7 @@ static void sierra_net_set_ctx_index(struct sierra_net_data *priv, u8 ctx_ix)
 
 static inline int sierra_net_is_valid_addrlen(u8 len)
 {
-        return (len == sizeof(struct in_addr));
+        return len == sizeof(struct in_addr);
 }
 
 static int sierra_net_parse_lsi(struct usbnet *dev, char *data, int datalen)
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 12a3c88c5282..65cb1abfbe57 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -805,8 +805,6 @@ static int smsc95xx_reset(struct usbnet *dev)
                 return ret;
         }
 
-        smsc95xx_init_mac_address(dev);
-
         ret = smsc95xx_set_mac_address(dev);
         if (ret < 0)
                 return ret;
@@ -1047,6 +1045,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
         pdata->use_tx_csum = DEFAULT_TX_CSUM_ENABLE;
         pdata->use_rx_csum = DEFAULT_RX_CSUM_ENABLE;
 
+        smsc95xx_init_mac_address(dev);
+
         /* Init all registers */
         ret = smsc95xx_reset(dev);
 
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 5ec542dd5b50..0bbc0c323135 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -250,7 +250,7 @@ static int veth_close(struct net_device *dev)
 
 static int is_valid_veth_mtu(int new_mtu)
 {
-        return (new_mtu >= MIN_MTU && new_mtu <= MAX_MTU);
+        return new_mtu >= MIN_MTU && new_mtu <= MAX_MTU;
 }
 
 static int veth_change_mtu(struct net_device *dev, int new_mtu)
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 6884813b809c..cab96ad49e60 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -312,13 +312,14 @@ VELOCITY_PARAM(flow_control, "Enable flow control ability");
 
 #define MED_LNK_DEF 0
 #define MED_LNK_MIN 0
-#define MED_LNK_MAX 4
+#define MED_LNK_MAX 5
 /* speed_duplex[] is used for setting the speed and duplex mode of NIC.
    0: indicate autonegotiation for both speed and duplex mode
    1: indicate 100Mbps half duplex mode
    2: indicate 100Mbps full duplex mode
    3: indicate 10Mbps half duplex mode
    4: indicate 10Mbps full duplex mode
+   5: indicate 1000Mbps full duplex mode
 
    Note:
    if EEPROM have been set to the force mode, this option is ignored
@@ -617,6 +618,9 @@ static u32 velocity_get_opt_media_mode(struct velocity_info *vptr)
         case SPD_DPX_10_HALF:
                 status = VELOCITY_SPEED_10;
                 break;
+        case SPD_DPX_1000_FULL:
+                status = VELOCITY_SPEED_1000 | VELOCITY_DUPLEX_FULL;
+                break;
         }
         vptr->mii_status = status;
         return status;
@@ -922,6 +926,7 @@ static int velocity_set_media_mode(struct velocity_info *vptr, u32 mii_status)
                 /* enable AUTO-NEGO mode */
                 mii_set_auto_on(vptr);
         } else {
+                u16 CTRL1000;
                 u16 ANAR;
                 u8 CHIPGCR;
 
@@ -936,7 +941,11 @@ static int velocity_set_media_mode(struct velocity_info *vptr, u32 mii_status)
                 BYTE_REG_BITS_ON(CHIPGCR_FCMODE, &regs->CHIPGCR);
 
                 CHIPGCR = readb(&regs->CHIPGCR);
-                CHIPGCR &= ~CHIPGCR_FCGMII;
+
+                if (mii_status & VELOCITY_SPEED_1000)
+                        CHIPGCR |= CHIPGCR_FCGMII;
+                else
+                        CHIPGCR &= ~CHIPGCR_FCGMII;
 
                 if (mii_status & VELOCITY_DUPLEX_FULL) {
                         CHIPGCR |= CHIPGCR_FCFDX;
@@ -952,7 +961,13 @@ static int velocity_set_media_mode(struct velocity_info *vptr, u32 mii_status)
                                 BYTE_REG_BITS_ON(TCR_TB2BDIS, &regs->TCR);
                 }
 
-                MII_REG_BITS_OFF(ADVERTISE_1000FULL | ADVERTISE_1000HALF, MII_CTRL1000, vptr->mac_regs);
+                velocity_mii_read(vptr->mac_regs, MII_CTRL1000, &CTRL1000);
+                CTRL1000 &= ~(ADVERTISE_1000FULL | ADVERTISE_1000HALF);
+                if ((mii_status & VELOCITY_SPEED_1000) &&
+                    (mii_status & VELOCITY_DUPLEX_FULL)) {
+                        CTRL1000 |= ADVERTISE_1000FULL;
+                }
+                velocity_mii_write(vptr->mac_regs, MII_CTRL1000, CTRL1000);
 
                 if (!(mii_status & VELOCITY_DUPLEX_FULL) && (mii_status & VELOCITY_SPEED_10))
                         BYTE_REG_BITS_OFF(TESTCFG_HBDIS, &regs->TESTCFG);
@@ -967,7 +982,7 @@ static int velocity_set_media_mode(struct velocity_info *vptr, u32 mii_status)
                                 ANAR |= ADVERTISE_100FULL;
                         else
                                 ANAR |= ADVERTISE_100HALF;
-                } else {
+                } else if (mii_status & VELOCITY_SPEED_10) {
                         if (mii_status & VELOCITY_DUPLEX_FULL)
                                 ANAR |= ADVERTISE_10FULL;
                         else
@@ -1013,6 +1028,9 @@ static void velocity_print_link_status(struct velocity_info *vptr)
         } else {
                 VELOCITY_PRT(MSG_LEVEL_INFO, KERN_NOTICE "%s: Link forced", vptr->dev->name);
                 switch (vptr->options.spd_dpx) {
+                case SPD_DPX_1000_FULL:
+                        VELOCITY_PRT(MSG_LEVEL_INFO, " speed 1000M bps full duplex\n");
+                        break;
                 case SPD_DPX_100_HALF:
                         VELOCITY_PRT(MSG_LEVEL_INFO, " speed 100M bps half duplex\n");
                         break;
@@ -2574,7 +2592,7 @@ static netdev_tx_t velocity_xmit(struct sk_buff *skb,
 
         td_ptr->tdesc1.cmd = TCPLS_NORMAL + (tdinfo->nskb_dma + 1) * 16;
 
-        if (vptr->vlgrp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 td_ptr->tdesc1.vlan = cpu_to_le16(vlan_tx_tag_get(skb));
                 td_ptr->tdesc1.TCR |= TCR0_VETAG;
         }
@@ -3170,6 +3188,37 @@ static int velocity_get_settings(struct net_device *dev, struct ethtool_cmd *cmd
                         SUPPORTED_100baseT_Full |
                         SUPPORTED_1000baseT_Half |
                         SUPPORTED_1000baseT_Full;
+
+        cmd->advertising = ADVERTISED_TP | ADVERTISED_Autoneg;
+        if (vptr->options.spd_dpx == SPD_DPX_AUTO) {
+                cmd->advertising |=
+                        ADVERTISED_10baseT_Half |
+                        ADVERTISED_10baseT_Full |
+                        ADVERTISED_100baseT_Half |
+                        ADVERTISED_100baseT_Full |
+                        ADVERTISED_1000baseT_Half |
+                        ADVERTISED_1000baseT_Full;
+        } else {
+                switch (vptr->options.spd_dpx) {
+                case SPD_DPX_1000_FULL:
+                        cmd->advertising |= ADVERTISED_1000baseT_Full;
+                        break;
+                case SPD_DPX_100_HALF:
+                        cmd->advertising |= ADVERTISED_100baseT_Half;
+                        break;
+                case SPD_DPX_100_FULL:
+                        cmd->advertising |= ADVERTISED_100baseT_Full;
+                        break;
+                case SPD_DPX_10_HALF:
+                        cmd->advertising |= ADVERTISED_10baseT_Half;
+                        break;
+                case SPD_DPX_10_FULL:
+                        cmd->advertising |= ADVERTISED_10baseT_Full;
+                        break;
+                default:
+                        break;
+                }
+        }
         if (status & VELOCITY_SPEED_1000)
                 cmd->speed = SPEED_1000;
         else if (status & VELOCITY_SPEED_100)
@@ -3200,14 +3249,35 @@ static int velocity_set_settings(struct net_device *dev, struct ethtool_cmd *cmd
         curr_status &= (~VELOCITY_LINK_FAIL);
 
         new_status |= ((cmd->autoneg) ? VELOCITY_AUTONEG_ENABLE : 0);
+        new_status |= ((cmd->speed == SPEED_1000) ? VELOCITY_SPEED_1000 : 0);
         new_status |= ((cmd->speed == SPEED_100) ? VELOCITY_SPEED_100 : 0);
         new_status |= ((cmd->speed == SPEED_10) ? VELOCITY_SPEED_10 : 0);
         new_status |= ((cmd->duplex == DUPLEX_FULL) ? VELOCITY_DUPLEX_FULL : 0);
 
-        if ((new_status & VELOCITY_AUTONEG_ENABLE) && (new_status != (curr_status | VELOCITY_AUTONEG_ENABLE)))
+        if ((new_status & VELOCITY_AUTONEG_ENABLE) &&
+            (new_status != (curr_status | VELOCITY_AUTONEG_ENABLE))) {
                 ret = -EINVAL;
-        else
+        } else {
+                enum speed_opt spd_dpx;
+
+                if (new_status & VELOCITY_AUTONEG_ENABLE)
+                        spd_dpx = SPD_DPX_AUTO;
+                else if ((new_status & VELOCITY_SPEED_1000) &&
+                         (new_status & VELOCITY_DUPLEX_FULL)) {
+                        spd_dpx = SPD_DPX_1000_FULL;
+                } else if (new_status & VELOCITY_SPEED_100)
+                        spd_dpx = (new_status & VELOCITY_DUPLEX_FULL) ?
+                                SPD_DPX_100_FULL : SPD_DPX_100_HALF;
+                else if (new_status & VELOCITY_SPEED_10)
+                        spd_dpx = (new_status & VELOCITY_DUPLEX_FULL) ?
+                                SPD_DPX_10_FULL : SPD_DPX_10_HALF;
+                else
+                        return -EOPNOTSUPP;
+
+                vptr->options.spd_dpx = spd_dpx;
+
                 velocity_set_media_mode(vptr, new_status);
+        }
 
         return ret;
 }
diff --git a/drivers/net/via-velocity.h b/drivers/net/via-velocity.h
index f7b33ae7a703..aa2e69b9ff61 100644
--- a/drivers/net/via-velocity.h
+++ b/drivers/net/via-velocity.h
@@ -848,7 +848,7 @@ enum  velocity_owner {
  *      Bits in CHIPGCR register
  */
 
-#define CHIPGCR_FCGMII      0x80
+#define CHIPGCR_FCGMII      0x80        /* enable GMII mode */
 #define CHIPGCR_FCFDX       0x40
 #define CHIPGCR_FCRESV      0x20
 #define CHIPGCR_FCMODE      0x10
@@ -1390,7 +1390,8 @@ enum speed_opt {
         SPD_DPX_100_HALF = 1,
         SPD_DPX_100_FULL = 2,
         SPD_DPX_10_HALF = 3,
-        SPD_DPX_10_FULL = 4
+        SPD_DPX_10_FULL = 4,
+        SPD_DPX_1000_FULL = 5
 };
 
 enum velocity_init_type {
@@ -1504,22 +1505,25 @@ struct velocity_info {
  *      addresses on this chain then we use the first - multi-IP WOL is not
  *      supported.
  *
- *      CHECK ME: locking
  */
 
 static inline int velocity_get_ip(struct velocity_info *vptr)
 {
-        struct in_device *in_dev = (struct in_device *) vptr->dev->ip_ptr;
+        struct in_device *in_dev;
         struct in_ifaddr *ifa;
+        int res = -ENOENT;
 
+        rcu_read_lock();
+        in_dev = __in_dev_get_rcu(vptr->dev);
         if (in_dev != NULL) {
                 ifa = (struct in_ifaddr *) in_dev->ifa_list;
                 if (ifa != NULL) {
                         memcpy(vptr->ip_addr, &ifa->ifa_address, 4);
-                        return 0;
+                        res = 0;
                 }
         }
-        return -ENOENT;
+        rcu_read_unlock();
+        return res;
 }
 
 /**
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 198ce92af0c3..3f60e0e3097b 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1548,23 +1548,6 @@ vmxnet3_free_irqs(struct vmxnet3_adapter *adapter)
         }
 }
 
-
-inline void set_flag_le16(__le16 *data, u16 flag)
-{
-        *data = cpu_to_le16(le16_to_cpu(*data) | flag);
-}
-
-inline void set_flag_le64(__le64 *data, u64 flag)
-{
-        *data = cpu_to_le64(le64_to_cpu(*data) | flag);
-}
-
-inline void reset_flag_le64(__le64 *data, u64 flag)
-{
-        *data = cpu_to_le64(le64_to_cpu(*data) & ~flag);
-}
-
-
 static void
 vmxnet3_vlan_rx_register(struct net_device *netdev, struct vlan_group *grp)
 {
@@ -1634,7 +1617,7 @@ vmxnet3_restore_vlan(struct vmxnet3_adapter *adapter)
                 u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
                 bool activeVlan = false;
 
-                for (vid = 0; vid < VLAN_GROUP_ARRAY_LEN; vid++) {
+                for (vid = 0; vid < VLAN_N_VID; vid++) {
                         if (vlan_group_get_device(adapter->vlan_grp, vid)) {
                                 VMXNET3_SET_VFTABLE_ENTRY(vfTable, vid);
                                 activeVlan = true;
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 2121c735cabd..c88ea5cbba0d 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -353,9 +353,20 @@ struct vmxnet3_adapter {
 #define VMXNET3_MAX_ETH_HDR_SIZE    22
 #define VMXNET3_MAX_SKB_BUF_SIZE    (3*1024)
 
-void set_flag_le16(__le16 *data, u16 flag);
-void set_flag_le64(__le64 *data, u64 flag);
-void reset_flag_le64(__le64 *data, u64 flag);
+static inline void set_flag_le16(__le16 *data, u16 flag)
+{
+        *data = cpu_to_le16(le16_to_cpu(*data) | flag);
+}
+
+static inline void set_flag_le64(__le64 *data, u64 flag)
+{
+        *data = cpu_to_le64(le64_to_cpu(*data) | flag);
+}
+
+static inline void reset_flag_le64(__le64 *data, u64 flag)
+{
+        *data = cpu_to_le64(le64_to_cpu(*data) & ~flag);
+}
 
 int
 vmxnet3_quiesce_dev(struct vmxnet3_adapter *adapter);
diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
index 5378b849f54f..a69542ecb68d 100644
--- a/drivers/net/vxge/vxge-main.c
+++ b/drivers/net/vxge/vxge-main.c
@@ -822,7 +822,7 @@ vxge_xmit(struct sk_buff *skb, struct net_device *dev)
                 dev->name, __func__, __LINE__,
                 fifo_hw, dtr, dtr_priv);
 
-        if (vdev->vlgrp && vlan_tx_tag_present(skb)) {
+        if (vlan_tx_tag_present(skb)) {
                 u16 vlan_tag = vlan_tx_tag_get(skb);
                 vxge_hw_fifo_txdl_vlan_set(dtr, vlan_tag);
         }
@@ -1862,7 +1862,7 @@ enum vxge_hw_status vxge_restore_vpath_vid_table(struct vxge_vpath *vpath)
 
         if (vdev->vlgrp && vpath->is_open) {
 
-                for (vid = 0; vid < VLAN_GROUP_ARRAY_LEN; vid++) {
+                for (vid = 0; vid < VLAN_N_VID; vid++) {
                         if (!vlan_group_get_device(vdev->vlgrp, vid))
                                 continue;
                         /* Add these vlan to the vid table */
diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
index 421d0715310e..1481a446fefb 100644
--- a/drivers/net/wan/dlci.c
+++ b/drivers/net/wan/dlci.c
@@ -97,11 +97,11 @@ static int dlci_header(struct sk_buff *skb, struct net_device *dev,
 
         dest = skb_push(skb, hlen);
         if (!dest)
-                return(0);
+                return 0;
 
         memcpy(dest, &hdr, hlen);
 
-        return(hlen);
+        return hlen;
 }
 
 static void dlci_receive(struct sk_buff *skb, struct net_device *dev)
@@ -211,14 +211,14 @@ static int dlci_config(struct net_device *dev, struct dlci_conf __user *conf, in
                 if (copy_from_user(&config, conf, sizeof(struct dlci_conf)))
                         return -EFAULT;
                 if (config.flags & ~DLCI_VALID_FLAGS)
-                        return(-EINVAL);
+                        return -EINVAL;
                 memcpy(&dlp->config, &config, sizeof(struct dlci_conf));
                 dlp->configured = 1;
         }
 
         err = (*flp->dlci_conf)(dlp->slave, dev, get);
         if (err)
-                return(err);
+                return err;
 
         if (get)
         {
@@ -226,7 +226,7 @@ static int dlci_config(struct net_device *dev, struct dlci_conf __user *conf, in
                         return -EFAULT;
         }
 
-        return(0);
+        return 0;
 }
 
 static int dlci_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -234,7 +234,7 @@ static int dlci_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         struct dlci_local *dlp;
 
         if (!capable(CAP_NET_ADMIN))
-                return(-EPERM);
+                return -EPERM;
 
         dlp = netdev_priv(dev);
 
@@ -242,7 +242,7 @@ static int dlci_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         {
                 case DLCI_GET_SLAVE:
                         if (!*(short *)(dev->dev_addr))
-                                return(-EINVAL);
+                                return -EINVAL;
 
                         strncpy(ifr->ifr_slave, dlp->slave->name, sizeof(ifr->ifr_slave));
                         break;
@@ -250,15 +250,15 @@ static int dlci_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 case DLCI_GET_CONF:
                 case DLCI_SET_CONF:
                         if (!*(short *)(dev->dev_addr))
-                                return(-EINVAL);
+                                return -EINVAL;
 
-                        return(dlci_config(dev, ifr->ifr_data, cmd == DLCI_GET_CONF));
+                        return dlci_config(dev, ifr->ifr_data, cmd == DLCI_GET_CONF);
                         break;
 
                 default: 
-                        return(-EOPNOTSUPP);
+                        return -EOPNOTSUPP;
         }
-        return(0);
+        return 0;
 }
 
 static int dlci_change_mtu(struct net_device *dev, int new_mtu)
@@ -277,15 +277,15 @@ static int dlci_open(struct net_device *dev)
         dlp = netdev_priv(dev);
 
         if (!*(short *)(dev->dev_addr))
-                return(-EINVAL);
+                return -EINVAL;
 
         if (!netif_running(dlp->slave))
-                return(-ENOTCONN);
+                return -ENOTCONN;
 
         flp = netdev_priv(dlp->slave);
         err = (*flp->activate)(dlp->slave, dev);
         if (err)
-                return(err);
+                return err;
 
         netif_start_queue(dev);
 
@@ -365,14 +365,14 @@ static int dlci_add(struct dlci_add *dlci)
         list_add(&dlp->list, &dlci_devs);
         rtnl_unlock();
 
-        return(0);
+        return 0;
 
  err2:
         rtnl_unlock();
         free_netdev(master);
  err1:
         dev_put(slave);
-        return(err);
+        return err;
 }
 
 static int dlci_del(struct dlci_add *dlci)
@@ -385,10 +385,10 @@ static int dlci_del(struct dlci_add *dlci)
         /* validate slave device */
         master = __dev_get_by_name(&init_net, dlci->devname);
         if (!master)
-                return(-ENODEV);
+                return -ENODEV;
 
         if (netif_running(master)) {
-                return(-EBUSY);
+                return -EBUSY;
         }
 
         dlp = netdev_priv(master);
@@ -406,7 +406,7 @@ static int dlci_del(struct dlci_add *dlci)
         }
         rtnl_unlock();
 
-        return(err);
+        return err;
 }
 
 static int dlci_ioctl(unsigned int cmd, void __user *arg)
@@ -415,7 +415,7 @@ static int dlci_ioctl(unsigned int cmd, void __user *arg)
         int err;
         
         if (!capable(CAP_NET_ADMIN))
-                return(-EPERM);
+                return -EPERM;
 
         if (copy_from_user(&add, arg, sizeof(struct dlci_add)))
                 return -EFAULT;
@@ -438,7 +438,7 @@ static int dlci_ioctl(unsigned int cmd, void __user *arg)
                         err = -EINVAL;
         }
 
-        return(err);
+        return err;
 }
 
 static const struct header_ops dlci_header_ops = {
diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
index b38ffa149aba..b1e5e5b69c2a 100644
--- a/drivers/net/wan/hdlc_cisco.c
+++ b/drivers/net/wan/hdlc_cisco.c
@@ -191,7 +191,8 @@ static int cisco_rx(struct sk_buff *skb)
 
                 switch (ntohl (cisco_data->type)) {
                 case CISCO_ADDR_REQ: /* Stolen from syncppp.c :-) */
-                        in_dev = dev->ip_ptr;
+                        rcu_read_lock();
+                        in_dev = __in_dev_get_rcu(dev);
                         addr = 0;
                         mask = ~cpu_to_be32(0); /* is the mask correct? */
 
@@ -211,6 +212,7 @@ static int cisco_rx(struct sk_buff *skb)
                                 cisco_keepalive_send(dev, CISCO_ADDR_REPLY,
                                                      addr, mask);
                         }
+                        rcu_read_unlock();
                         dev_kfree_skb_any(skb);
                         return NET_RX_SUCCESS;
 
diff --git a/drivers/net/wan/lmc/lmc_main.c b/drivers/net/wan/lmc/lmc_main.c
index 43af85b8e45e..70feb84df670 100644
--- a/drivers/net/wan/lmc/lmc_main.c
+++ b/drivers/net/wan/lmc/lmc_main.c
@@ -1022,7 +1022,7 @@ static int lmc_open(struct net_device *dev)
 
     if (sc->lmc_ok){
         lmc_trace(dev, "lmc_open lmc_ok out");
-        return (0);
+        return 0;
     }
 
     lmc_softreset (sc);
@@ -1110,7 +1110,7 @@ static int lmc_open(struct net_device *dev)
 
     lmc_trace(dev, "lmc_open out");
 
-    return (0);
+    return 0;
 }
 
 /* Total reset to compensate for the AdTran DSU doing bad things
diff --git a/drivers/net/wan/n2.c b/drivers/net/wan/n2.c
index 7a3720f09ce3..17d408fe693f 100644
--- a/drivers/net/wan/n2.c
+++ b/drivers/net/wan/n2.c
@@ -379,14 +379,14 @@ static int __init n2_run(unsigned long io, unsigned long irq,
         if (request_irq(irq, sca_intr, 0, devname, card)) {
                 printk(KERN_ERR "n2: could not allocate IRQ\n");
                 n2_destroy_card(card);
-                return(-EBUSY);
+                return -EBUSY;
         }
         card->irq = irq;
 
         if (!request_mem_region(winbase, USE_WINDOWSIZE, devname)) {
                 printk(KERN_ERR "n2: could not request RAM window\n");
                 n2_destroy_card(card);
-                return(-EBUSY);
+                return -EBUSY;
         }
         card->phy_winbase = winbase;
         card->winbase = ioremap(winbase, USE_WINDOWSIZE);
diff --git a/drivers/net/wan/pc300_drv.c b/drivers/net/wan/pc300_drv.c
index fbf1175a07f1..f875cfae3093 100644
--- a/drivers/net/wan/pc300_drv.c
+++ b/drivers/net/wan/pc300_drv.c
@@ -451,11 +451,11 @@ static int dma_get_rx_frame_size(pc300_t * card, int ch)
                 if ((status & DST_EOM) || (first_bd == card->chan[ch].rx_last_bd)) {
                         /* Return the size of a good frame or incomplete bad frame 
                         * (dma_buf_read will clean the buffer descriptors in this case). */
-                        return (rcvd);
+                        return rcvd;
                 }
                 ptdescr = (card->hw.rambase + cpc_readl(&ptdescr->next));
         }
-        return (-1);
+        return -1;
 }
 
 /*
@@ -557,7 +557,7 @@ static int dma_buf_read(pc300_t * card, int ch, struct sk_buff *skb)
                 cpc_writel(card->hw.scabase + DRX_REG(EDAL, ch),
                            RX_BD_ADDR(ch, chan->rx_last_bd));
         }
-        return (rcvd);
+        return rcvd;
 }
 
 static void tx_dma_stop(pc300_t * card, int ch)
@@ -1733,7 +1733,7 @@ static u16 falc_pattern_test_error(pc300_t * card, int ch)
         pc300ch_t *chan = (pc300ch_t *) & card->chan[ch];
         falc_t *pfalc = (falc_t *) & chan->falc;
 
-        return (pfalc->bec);
+        return pfalc->bec;
 }
 
 /**********************************/
@@ -2819,7 +2819,7 @@ static int clock_rate_calc(u32 rate, u32 clock, int *br_io)
         *br_io = 0;
 
         if (rate == 0)
-                return (0);
+                return 0;
 
         for (br = 0, br_pwr = 1; br <= 9; br++, br_pwr <<= 1) {
                 if ((tc = clock / br_pwr / rate) <= 0xff) {
@@ -2832,11 +2832,11 @@ static int clock_rate_calc(u32 rate, u32 clock, int *br_io)
                 error = ((rate - (clock / br_pwr / rate)) / rate) * 1000;
                 /* Errors bigger than +/- 1% won't be tolerated */
                 if (error < -10 || error > 10)
-                        return (-1);
+                        return -1;
                 else
-                        return (tc);
+                        return tc;
         } else {
-                return (-1);
+                return -1;
         }
 }
 
@@ -3207,7 +3207,7 @@ static u32 detect_ram(pc300_t * card)
                         break;
                 }
         }
-        return (i);
+        return i;
 }
 
 static void plx_init(pc300_t * card)
diff --git a/drivers/net/wan/pc300_tty.c b/drivers/net/wan/pc300_tty.c
index 4293889e287e..515d9b8af01e 100644
--- a/drivers/net/wan/pc300_tty.c
+++ b/drivers/net/wan/pc300_tty.c
@@ -540,7 +540,7 @@ static int cpc_tty_chars_in_buffer(struct tty_struct *tty)
                 return -ENODEV; 
         }
    
-        return(0); 
+        return 0;
 } 
 
 static int pc300_tiocmset(struct tty_struct *tty, struct file *file,
diff --git a/drivers/net/wan/sdla.c b/drivers/net/wan/sdla.c
index f4125da2762f..3f4e2b5684db 100644
--- a/drivers/net/wan/sdla.c
+++ b/drivers/net/wan/sdla.c
@@ -178,7 +178,7 @@ static char sdla_byte(struct net_device *dev, int addr)
         byte = *temp;
         spin_unlock_irqrestore(&sdla_lock, flags);
 
-        return(byte);
+        return byte;
 }
 
 static void sdla_stop(struct net_device *dev)
@@ -267,7 +267,7 @@ static int sdla_z80_poll(struct net_device *dev, int z80_addr, int jiffs, char r
                         resp = *temp;
                 }
         }
-        return(time_before(jiffies, done) ? jiffies - start : -1);
+        return time_before(jiffies, done) ? jiffies - start : -1;
 }
 
 /* constants for Z80 CPU speed */
@@ -283,13 +283,13 @@ static int sdla_cpuspeed(struct net_device *dev, struct ifreq *ifr)
 
         sdla_start(dev);
         if (sdla_z80_poll(dev, 0, 3*HZ, Z80_READY, 0) < 0)
-                return(-EIO);
+                return -EIO;
 
         data = LOADER_READY;
         sdla_write(dev, 0, &data, 1);
 
         if ((jiffs = sdla_z80_poll(dev, 0, 8*HZ, Z80_SCC_OK, Z80_SCC_BAD)) < 0)
-                return(-EIO);
+                return -EIO;
 
         sdla_stop(dev);
         sdla_read(dev, 0, &data, 1);
@@ -297,11 +297,11 @@ static int sdla_cpuspeed(struct net_device *dev, struct ifreq *ifr)
         if (data == Z80_SCC_BAD)
         {
                 printk("%s: SCC bad\n", dev->name);
-                return(-EIO);
+                return -EIO;
         }
 
         if (data != Z80_SCC_OK)
-                return(-EINVAL);
+                return -EINVAL;
 
         if (jiffs < 165)
                 ifr->ifr_mtu = SDLA_CPU_16M;
@@ -316,7 +316,7 @@ static int sdla_cpuspeed(struct net_device *dev, struct ifreq *ifr)
         else
                 ifr->ifr_mtu = SDLA_CPU_3M;
  
-        return(0);
+        return 0;
 }
 
 /************************************************
@@ -493,7 +493,7 @@ static int sdla_cmd(struct net_device *dev, int cmd, short dlci, short flags,
         if (ret != SDLA_RET_OK)
                 sdla_errors(dev, cmd, dlci, ret, len, &status);
 
-        return(ret);
+        return ret;
 }
 
 /***********************************************
@@ -516,14 +516,14 @@ static int sdla_activate(struct net_device *slave, struct net_device *master)
                         break;
 
         if (i == CONFIG_DLCI_MAX)
-                return(-ENODEV);
+                return -ENODEV;
 
         flp->dlci[i] = abs(flp->dlci[i]);
 
         if (netif_running(slave) && (flp->config.station == FRAD_STATION_NODE))
                 sdla_cmd(slave, SDLA_ACTIVATE_DLCI, 0, 0, &flp->dlci[i], sizeof(short), NULL, NULL);
 
-        return(0);
+        return 0;
 }
 
 static int sdla_deactivate(struct net_device *slave, struct net_device *master)
@@ -538,14 +538,14 @@ static int sdla_deactivate(struct net_device *slave, struct net_device *master)
                         break;
 
         if (i == CONFIG_DLCI_MAX)
-                return(-ENODEV);
+                return -ENODEV;
 
         flp->dlci[i] = -abs(flp->dlci[i]);
 
         if (netif_running(slave) && (flp->config.station == FRAD_STATION_NODE))
                 sdla_cmd(slave, SDLA_DEACTIVATE_DLCI, 0, 0, &flp->dlci[i], sizeof(short), NULL, NULL);
 
-        return(0);
+        return 0;
 }
 
 static int sdla_assoc(struct net_device *slave, struct net_device *master)
@@ -554,7 +554,7 @@ static int sdla_assoc(struct net_device *slave, struct net_device *master)
         int               i;
 
         if (master->type != ARPHRD_DLCI)
-                return(-EINVAL);
+                return -EINVAL;
 
         flp = netdev_priv(slave);
 
@@ -563,11 +563,11 @@ static int sdla_assoc(struct net_device *slave, struct net_device *master)
                 if (!flp->master[i])
                         break;
                 if (abs(flp->dlci[i]) == *(short *)(master->dev_addr))
-                        return(-EADDRINUSE);
+                        return -EADDRINUSE;
         } 
 
         if (i == CONFIG_DLCI_MAX)
-                return(-EMLINK);  /* #### Alan: Comments on this ?? */
+                return -EMLINK;  /* #### Alan: Comments on this ?? */
 
 
         flp->master[i] = master;
@@ -581,7 +581,7 @@ static int sdla_assoc(struct net_device *slave, struct net_device *master)
                         sdla_cmd(slave, SDLA_ADD_DLCI, 0, 0, master->dev_addr, sizeof(short), NULL, NULL);
         }
 
-        return(0);
+        return 0;
 }
 
 static int sdla_deassoc(struct net_device *slave, struct net_device *master)
@@ -596,7 +596,7 @@ static int sdla_deassoc(struct net_device *slave, struct net_device *master)
                         break;
 
         if (i == CONFIG_DLCI_MAX)
-                return(-ENODEV);
+                return -ENODEV;
 
         flp->master[i] = NULL;
         flp->dlci[i] = 0;
@@ -609,7 +609,7 @@ static int sdla_deassoc(struct net_device *slave, struct net_device *master)
                         sdla_cmd(slave, SDLA_DELETE_DLCI, 0, 0, master->dev_addr, sizeof(short), NULL, NULL);
         }
 
-        return(0);
+        return 0;
 }
 
 static int sdla_dlci_conf(struct net_device *slave, struct net_device *master, int get)
@@ -626,7 +626,7 @@ static int sdla_dlci_conf(struct net_device *slave, struct net_device *master, i
                         break;
 
         if (i == CONFIG_DLCI_MAX)
-                return(-ENODEV);
+                return -ENODEV;
 
         dlp = netdev_priv(master);
 
@@ -641,7 +641,7 @@ static int sdla_dlci_conf(struct net_device *slave, struct net_device *master, i
                                     &dlp->config, sizeof(struct dlci_conf) - 4 * sizeof(short), NULL, NULL);
         }
 
-        return(ret == SDLA_RET_OK ? 0 : -EIO);
+        return ret == SDLA_RET_OK ? 0 : -EIO;
 }
 
 /**************************
@@ -986,7 +986,7 @@ static int sdla_close(struct net_device *dev)
 
         netif_stop_queue(dev);
         
-        return(0);
+        return 0;
 }
 
 struct conf_data {
@@ -1006,10 +1006,10 @@ static int sdla_open(struct net_device *dev)
         flp = netdev_priv(dev);
 
         if (!flp->initialized)
-                return(-EPERM);
+                return -EPERM;
 
         if (!flp->configured)
-                return(-EPERM);
+                return -EPERM;
 
         /* time to send in the configuration */
         len = 0;
@@ -1087,7 +1087,7 @@ static int sdla_open(struct net_device *dev)
 
         netif_start_queue(dev);
         
-        return(0);
+        return 0;
 }
 
 static int sdla_config(struct net_device *dev, struct frad_conf __user *conf, int get)
@@ -1098,48 +1098,48 @@ static int sdla_config(struct net_device *dev, struct frad_conf __user *conf, in
         short             size;
 
         if (dev->type == 0xFFFF)
-                return(-EUNATCH);
+                return -EUNATCH;
 
         flp = netdev_priv(dev);
 
         if (!get)
         {
                 if (netif_running(dev))
-                        return(-EBUSY);
+                        return -EBUSY;
 
                 if(copy_from_user(&data.config, conf, sizeof(struct frad_conf)))
                         return -EFAULT;
 
                 if (data.config.station & ~FRAD_STATION_NODE)
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if (data.config.flags & ~FRAD_VALID_FLAGS)
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.kbaud < 0) || 
                          ((data.config.kbaud > 128) && (flp->type != SDLA_S508)))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if (data.config.clocking & ~(FRAD_CLOCK_INT | SDLA_S508_PORT_RS232))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.mtu < 0) || (data.config.mtu > SDLA_MAX_MTU))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.T391 < 5) || (data.config.T391 > 30))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.T392 < 5) || (data.config.T392 > 30))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.N391 < 1) || (data.config.N391 > 255))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.N392 < 1) || (data.config.N392 > 10))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.N393 < 1) || (data.config.N393 > 10))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 memcpy(&flp->config, &data.config, sizeof(struct frad_conf));
                 flp->config.flags |= SDLA_DIRECT_RECV;
@@ -1171,7 +1171,7 @@ static int sdla_config(struct net_device *dev, struct frad_conf __user *conf, in
                 {
                         size = sizeof(data);
                         if (sdla_cmd(dev, SDLA_READ_DLCI_CONFIGURATION, 0, 0, NULL, 0, &data, &size) != SDLA_RET_OK)
-                                return(-EIO);
+                                return -EIO;
                 }
                 else
                         if (flp->configured)
@@ -1185,7 +1185,7 @@ static int sdla_config(struct net_device *dev, struct frad_conf __user *conf, in
                 return copy_to_user(conf, &data.config, sizeof(struct frad_conf))?-EFAULT:0;
         }
 
-        return(0);
+        return 0;
 }
 
 static int sdla_xfer(struct net_device *dev, struct sdla_mem __user *info, int read)
@@ -1200,7 +1200,7 @@ static int sdla_xfer(struct net_device *dev, struct sdla_mem __user *info, int r
         {       
                 temp = kzalloc(mem.len, GFP_KERNEL);
                 if (!temp)
-                        return(-ENOMEM);
+                        return -ENOMEM;
                 sdla_read(dev, mem.addr, temp, mem.len);
                 if(copy_to_user(mem.data, temp, mem.len))
                 {
@@ -1217,7 +1217,7 @@ static int sdla_xfer(struct net_device *dev, struct sdla_mem __user *info, int r
                 sdla_write(dev, mem.addr, temp, mem.len);
                 kfree(temp);
         }
-        return(0);
+        return 0;
 }
 
 static int sdla_reconfig(struct net_device *dev)
@@ -1241,7 +1241,7 @@ static int sdla_reconfig(struct net_device *dev)
         sdla_cmd(dev, SDLA_SET_DLCI_CONFIGURATION, 0, 0, &data, len, NULL, NULL);
         sdla_cmd(dev, SDLA_ENABLE_COMMUNICATIONS, 0, 0, NULL, 0, NULL, NULL);
 
-        return(0);
+        return 0;
 }
 
 static int sdla_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -1254,20 +1254,20 @@ static int sdla_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         flp = netdev_priv(dev);
 
         if (!flp->initialized)
-                return(-EINVAL);
+                return -EINVAL;
 
         switch (cmd)
         {
                 case FRAD_GET_CONF:
                 case FRAD_SET_CONF:
-                        return(sdla_config(dev, ifr->ifr_data, cmd == FRAD_GET_CONF));
+                        return sdla_config(dev, ifr->ifr_data, cmd == FRAD_GET_CONF);
 
                 case SDLA_IDENTIFY:
                         ifr->ifr_flags = flp->type;
                         break;
 
                 case SDLA_CPUSPEED:
-                        return(sdla_cpuspeed(dev, ifr)); 
+                        return sdla_cpuspeed(dev, ifr);
 
 /* ==========================================================
 NOTE:  This is rather a useless action right now, as the
@@ -1277,7 +1277,7 @@ NOTE:  This is rather a useless action right now, as the
 ============================================================*/
                 case SDLA_PROTOCOL:
                         if (flp->configured)
-                                return(-EALREADY);
+                                return -EALREADY;
 
                         switch (ifr->ifr_flags)
                         {
@@ -1285,7 +1285,7 @@ NOTE:  This is rather a useless action right now, as the
                                         dev->type = ifr->ifr_flags;
                                         break;
                                 default:
-                                        return(-ENOPROTOOPT);
+                                        return -ENOPROTOOPT;
                         }
                         break;
 
@@ -1297,7 +1297,7 @@ NOTE:  This is rather a useless action right now, as the
                 case SDLA_READMEM:
                         if(!capable(CAP_SYS_RAWIO))
                                 return -EPERM;
-                        return(sdla_xfer(dev, ifr->ifr_data, cmd == SDLA_READMEM));
+                        return sdla_xfer(dev, ifr->ifr_data, cmd == SDLA_READMEM);
 
                 case SDLA_START:
                         sdla_start(dev);
@@ -1308,9 +1308,9 @@ NOTE:  This is rather a useless action right now, as the
                         break;
 
                 default:
-                        return(-EOPNOTSUPP);
+                        return -EOPNOTSUPP;
         }
-        return(0);
+        return 0;
 }
 
 static int sdla_change_mtu(struct net_device *dev, int new_mtu)
@@ -1320,10 +1320,10 @@ static int sdla_change_mtu(struct net_device *dev, int new_mtu)
         flp = netdev_priv(dev);
 
         if (netif_running(dev))
-                return(-EBUSY);
+                return -EBUSY;
 
         /* for now, you can't change the MTU! */
-        return(-EOPNOTSUPP);
+        return -EOPNOTSUPP;
 }
 
 static int sdla_set_config(struct net_device *dev, struct ifmap *map)
@@ -1337,18 +1337,18 @@ static int sdla_set_config(struct net_device *dev, struct ifmap *map)
         flp = netdev_priv(dev);
 
         if (flp->initialized)
-                return(-EINVAL);
+                return -EINVAL;
 
         for(i=0; i < ARRAY_SIZE(valid_port); i++)
                 if (valid_port[i] == map->base_addr)
                         break;   
 
         if (i == ARRAY_SIZE(valid_port))
-                return(-EINVAL);
+                return -EINVAL;
 
         if (!request_region(map->base_addr, SDLA_IO_EXTENTS, dev->name)){
                 printk(KERN_WARNING "SDLA: io-port 0x%04lx in use\n", dev->base_addr);
-                return(-EINVAL);
+                return -EINVAL;
         }
         base = map->base_addr;
 
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index e47f5a986b1c..d81ad8397885 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -648,7 +648,7 @@ static int x25_asy_esc(unsigned char *s, unsigned char *d, int len)
                 }
         }
         *ptr++ = X25_END;
-        return (ptr - d);
+        return ptr - d;
 }
 
 static void x25_asy_unesc(struct x25_asy *sl, unsigned char s)
diff --git a/drivers/net/wimax/i2400m/control.c b/drivers/net/wimax/i2400m/control.c
index 9fb03082153a..12b84ed0e38a 100644
--- a/drivers/net/wimax/i2400m/control.c
+++ b/drivers/net/wimax/i2400m/control.c
@@ -98,7 +98,7 @@ MODULE_PARM_DESC(power_save_disabled,
                  "False by default (so the device is told to do power "
                  "saving).");
 
-int i2400m_passive_mode;        /* 0 (passive mode disabled) by default */
+static int i2400m_passive_mode; /* 0 (passive mode disabled) by default */
 module_param_named(passive_mode, i2400m_passive_mode, int, 0644);
 MODULE_PARM_DESC(passive_mode,
                  "If true, the driver will not do any device setup "
@@ -558,8 +558,9 @@ void i2400m_report_hook(struct i2400m *i2400m,
  * processing should be done in the function that calls the
  * command. This is here for some cases where it can't happen...
  */
-void i2400m_msg_ack_hook(struct i2400m *i2400m,
-                         const struct i2400m_l3l4_hdr *l3l4_hdr, size_t size)
+static void i2400m_msg_ack_hook(struct i2400m *i2400m,
+                                 const struct i2400m_l3l4_hdr *l3l4_hdr,
+                                 size_t size)
 {
         int result;
         struct device *dev = i2400m_dev(i2400m);
@@ -1135,7 +1136,7 @@ error_alloc:
  * i2400m_report_state_hook() to parse the answer. This will set the
  * carrier state, as well as the RF Kill switches state.
  */
-int i2400m_cmd_get_state(struct i2400m *i2400m)
+static int i2400m_cmd_get_state(struct i2400m *i2400m)
 {
         int result;
         struct device *dev = i2400m_dev(i2400m);
@@ -1177,8 +1178,6 @@ error_msg_to_dev:
 error_alloc:
         return result;
 }
-EXPORT_SYMBOL_GPL(i2400m_cmd_get_state);
-
 
 /**
  * Set basic configuration settings
@@ -1190,8 +1189,9 @@ EXPORT_SYMBOL_GPL(i2400m_cmd_get_state);
  *     right endianess (LE).
  * @arg_size: number of pointers in the @args array
  */
-int i2400m_set_init_config(struct i2400m *i2400m,
-                           const struct i2400m_tlv_hdr **arg, size_t args)
+static int i2400m_set_init_config(struct i2400m *i2400m,
+                                  const struct i2400m_tlv_hdr **arg,
+                                  size_t args)
 {
         int result;
         struct device *dev = i2400m_dev(i2400m);
@@ -1258,8 +1258,6 @@ none:
         return result;
 
 }
-EXPORT_SYMBOL_GPL(i2400m_set_init_config);
-
 
 /**
  * i2400m_set_idle_timeout - Set the device's idle mode timeout
diff --git a/drivers/net/wimax/i2400m/driver.c b/drivers/net/wimax/i2400m/driver.c
index 9c8b78d4abd2..cdedab46ba21 100644
--- a/drivers/net/wimax/i2400m/driver.c
+++ b/drivers/net/wimax/i2400m/driver.c
@@ -122,7 +122,7 @@ struct i2400m_work *__i2400m_work_setup(
  * works struct was already queued, but we have just allocated it, so
  * it should not happen.
  */
-int i2400m_schedule_work(struct i2400m *i2400m,
+static int i2400m_schedule_work(struct i2400m *i2400m,
                          void (*fn)(struct work_struct *), gfp_t gfp_flags,
                          const void *pl, size_t pl_size)
 {
diff --git a/drivers/net/wimax/i2400m/i2400m-sdio.h b/drivers/net/wimax/i2400m/i2400m-sdio.h
index 360d4fb195f4..1d63ffdedfde 100644
--- a/drivers/net/wimax/i2400m/i2400m-sdio.h
+++ b/drivers/net/wimax/i2400m/i2400m-sdio.h
@@ -140,7 +140,6 @@ void i2400ms_init(struct i2400ms *i2400ms)
 
 extern int i2400ms_rx_setup(struct i2400ms *);
 extern void i2400ms_rx_release(struct i2400ms *);
-extern ssize_t __i2400ms_rx_get_size(struct i2400ms *);
 
 extern int i2400ms_tx_setup(struct i2400ms *);
 extern void i2400ms_tx_release(struct i2400ms *);
diff --git a/drivers/net/wimax/i2400m/i2400m.h b/drivers/net/wimax/i2400m/i2400m.h
index fa74777fd65f..59ac7705e76e 100644
--- a/drivers/net/wimax/i2400m/i2400m.h
+++ b/drivers/net/wimax/i2400m/i2400m.h
@@ -910,28 +910,19 @@ struct i2400m_work {
         u8 pl[0];
 };
 
-extern int i2400m_schedule_work(struct i2400m *,
-                                void (*)(struct work_struct *), gfp_t,
-                                const void *, size_t);
-
 extern int i2400m_msg_check_status(const struct i2400m_l3l4_hdr *,
                                    char *, size_t);
 extern int i2400m_msg_size_check(struct i2400m *,
                                  const struct i2400m_l3l4_hdr *, size_t);
 extern struct sk_buff *i2400m_msg_to_dev(struct i2400m *, const void *, size_t);
 extern void i2400m_msg_to_dev_cancel_wait(struct i2400m *, int);
-extern void i2400m_msg_ack_hook(struct i2400m *,
-                                const struct i2400m_l3l4_hdr *, size_t);
 extern void i2400m_report_hook(struct i2400m *,
                                const struct i2400m_l3l4_hdr *, size_t);
 extern void i2400m_report_hook_work(struct work_struct *);
 extern int i2400m_cmd_enter_powersave(struct i2400m *);
-extern int i2400m_cmd_get_state(struct i2400m *);
 extern int i2400m_cmd_exit_idle(struct i2400m *);
 extern struct sk_buff *i2400m_get_device_info(struct i2400m *);
 extern int i2400m_firmware_check(struct i2400m *);
-extern int i2400m_set_init_config(struct i2400m *,
-                                  const struct i2400m_tlv_hdr **, size_t);
 extern int i2400m_set_idle_timeout(struct i2400m *, unsigned);
 
 static inline
diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
index 8cc9e319f435..844133b44af0 100644
--- a/drivers/net/wimax/i2400m/rx.c
+++ b/drivers/net/wimax/i2400m/rx.c
@@ -922,7 +922,7 @@ void i2400m_roq_queue_update_ws(struct i2400m *i2400m, struct i2400m_roq *roq,
  * rx_roq_refcount becomes zero. This routine gets executed when
  * rx_roq_refcount becomes zero.
  */
-void i2400m_rx_roq_destroy(struct kref *ref)
+static void i2400m_rx_roq_destroy(struct kref *ref)
 {
         unsigned itr;
         struct i2400m *i2400m
@@ -1244,16 +1244,16 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
         int i, result;
         struct device *dev = i2400m_dev(i2400m);
         const struct i2400m_msg_hdr *msg_hdr;
-        size_t pl_itr, pl_size, skb_len;
+        size_t pl_itr, pl_size;
         unsigned long flags;
-        unsigned num_pls, single_last;
+        unsigned num_pls, single_last, skb_len;
 
         skb_len = skb->len;
-        d_fnstart(4, dev, "(i2400m %p skb %p [size %zu])\n",
+        d_fnstart(4, dev, "(i2400m %p skb %p [size %u])\n",
                   i2400m, skb, skb_len);
         result = -EIO;
         msg_hdr = (void *) skb->data;
-        result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb->len);
+        result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb_len);
         if (result < 0)
                 goto error_msg_hdr_check;
         result = -EIO;
@@ -1261,10 +1261,10 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
         pl_itr = sizeof(*msg_hdr) +     /* Check payload descriptor(s) */
                 num_pls * sizeof(msg_hdr->pld[0]);
         pl_itr = ALIGN(pl_itr, I2400M_PL_ALIGN);
-        if (pl_itr > skb->len) {        /* got all the payload descriptors? */
+        if (pl_itr > skb_len) { /* got all the payload descriptors? */
                 dev_err(dev, "RX: HW BUG? message too short (%u bytes) for "
                         "%u payload descriptors (%zu each, total %zu)\n",
-                        skb->len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
+                        skb_len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
                 goto error_pl_descr_short;
         }
         /* Walk each payload payload--check we really got it */
@@ -1272,7 +1272,7 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
                 /* work around old gcc warnings */
                 pl_size = i2400m_pld_size(&msg_hdr->pld[i]);
                 result = i2400m_rx_pl_descr_check(i2400m, &msg_hdr->pld[i],
-                                                  pl_itr, skb->len);
+                                                  pl_itr, skb_len);
                 if (result < 0)
                         goto error_pl_descr_check;
                 single_last = num_pls == 1 || i == num_pls - 1;
@@ -1290,16 +1290,16 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
         if (i < i2400m->rx_pl_min)
                 i2400m->rx_pl_min = i;
         i2400m->rx_num++;
-        i2400m->rx_size_acc += skb->len;
-        if (skb->len < i2400m->rx_size_min)
-                i2400m->rx_size_min = skb->len;
-        if (skb->len > i2400m->rx_size_max)
-                i2400m->rx_size_max = skb->len;
+        i2400m->rx_size_acc += skb_len;
+        if (skb_len < i2400m->rx_size_min)
+                i2400m->rx_size_min = skb_len;
+        if (skb_len > i2400m->rx_size_max)
+                i2400m->rx_size_max = skb_len;
         spin_unlock_irqrestore(&i2400m->rx_lock, flags);
 error_pl_descr_check:
 error_pl_descr_short:
 error_msg_hdr_check:
-        d_fnend(4, dev, "(i2400m %p skb %p [size %zu]) = %d\n",
+        d_fnend(4, dev, "(i2400m %p skb %p [size %u]) = %d\n",
                 i2400m, skb, skb_len, result);
         return result;
 }
diff --git a/drivers/net/wimax/i2400m/sdio-rx.c b/drivers/net/wimax/i2400m/sdio-rx.c
index 8b809c2ead6c..fb6396dd115f 100644
--- a/drivers/net/wimax/i2400m/sdio-rx.c
+++ b/drivers/net/wimax/i2400m/sdio-rx.c
@@ -87,7 +87,7 @@ static const __le32 i2400m_ACK_BARKER[4] = {
  *
  * sdio_readl() doesn't work.
  */
-ssize_t __i2400ms_rx_get_size(struct i2400ms *i2400ms)
+static ssize_t __i2400ms_rx_get_size(struct i2400ms *i2400ms)
 {
         int ret, cnt, val;
         ssize_t rx_size;
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 174e3442d519..4de4410cd38e 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -279,6 +279,7 @@ source "drivers/net/wireless/libertas/Kconfig"
 source "drivers/net/wireless/orinoco/Kconfig"
 source "drivers/net/wireless/p54/Kconfig"
 source "drivers/net/wireless/rt2x00/Kconfig"
+source "drivers/net/wireless/wl1251/Kconfig"
 source "drivers/net/wireless/wl12xx/Kconfig"
 source "drivers/net/wireless/zd1211rw/Kconfig"
 
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index 5d4ce4d2b32b..06f8ca26c5c1 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -49,6 +49,8 @@ obj-$(CONFIG_ATH_COMMON)	+= ath/
 
 obj-$(CONFIG_MAC80211_HWSIM)    += mac80211_hwsim.o
 
+obj-$(CONFIG_WL1251)    += wl1251/
 obj-$(CONFIG_WL12XX)    += wl12xx/
+obj-$(CONFIG_WL12XX_PLATFORM_DATA)      += wl12xx/
 
 obj-$(CONFIG_IWM)       += iwmc3200wifi/
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 7d26506957d7..5a56502c4eb0 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -105,7 +105,7 @@ static struct pci_driver airo_driver = {
    of statistics in the /proc filesystem */
 
 #define IGNLABEL(comment) NULL
-static char *statsLabels[] = {
+static const char *statsLabels[] = {
         "RxOverrun",
         IGNLABEL("RxPlcpCrcErr"),
         IGNLABEL("RxPlcpFormatErr"),
@@ -217,7 +217,6 @@ static char *statsLabels[] = {
    (no spaces) list of rates (up to 8). */
 
 static int rates[8];
-static int basic_rate;
 static char *ssids[3];
 
 static int io[4];
@@ -250,7 +249,6 @@ MODULE_LICENSE("Dual BSD/GPL");
 MODULE_SUPPORTED_DEVICE("Aironet 4500, 4800 and Cisco 340/350");
 module_param_array(io, int, NULL, 0);
 module_param_array(irq, int, NULL, 0);
-module_param(basic_rate, int, 0);
 module_param_array(rates, int, NULL, 0);
 module_param_array(ssids, charp, NULL, 0);
 module_param(auto_wep, int, 0);
@@ -932,7 +930,7 @@ typedef struct aironet_ioctl {
         unsigned char __user *data;     // d-data
 } aironet_ioctl;
 
-static char swversion[] = "2.1";
+static const char swversion[] = "2.1";
 #endif /* CISCO_EXT */
 
 #define NUM_MODULES       2
@@ -1374,7 +1372,7 @@ static int micsetup(struct airo_info *ai) {
         return SUCCESS;
 }
 
-static char micsnap[] = {0xAA,0xAA,0x03,0x00,0x40,0x96,0x00,0x02};
+static const u8 micsnap[] = {0xAA,0xAA,0x03,0x00,0x40,0x96,0x00,0x02};
 
 /*===========================================================================
  * Description: Mic a packet
@@ -3883,15 +3881,6 @@ static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
                                 ai->config.rates[i] = rates[i];
                         }
                 }
-                if ( basic_rate > 0 ) {
-                        for( i = 0; i < 8; i++ ) {
-                                if ( ai->config.rates[i] == basic_rate ||
-                                     !ai->config.rates ) {
-                                        ai->config.rates[i] = basic_rate | 0x80;
-                                        break;
-                                }
-                        }
-                }
                 set_bit (FLAG_COMMIT, &ai->flags);
         }
 
@@ -5023,7 +5012,7 @@ static void proc_config_on_close(struct inode *inode, struct file *file)
         airo_config_commit(dev, NULL, NULL, NULL);
 }
 
-static char *get_rmode(__le16 mode)
+static const char *get_rmode(__le16 mode)
 {
         switch(mode & RXMODE_MASK) {
         case RXMODE_RFMON:  return "rfmon";
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 91c5f73b5ba3..1476314afa8a 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -1525,8 +1525,7 @@ static void at76_rx_tasklet(unsigned long param)
 
         if (priv->device_unplugged) {
                 at76_dbg(DBG_DEVSTART, "device unplugged");
-                if (urb)
-                        at76_dbg(DBG_DEVSTART, "urb status %d", urb->status);
+                at76_dbg(DBG_DEVSTART, "urb status %d", urb->status);
                 return;
         }
 
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index 0a75be027afa..92c216263ee9 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -25,5 +25,6 @@ config ATH_DEBUG
 source "drivers/net/wireless/ath/ath5k/Kconfig"
 source "drivers/net/wireless/ath/ath9k/Kconfig"
 source "drivers/net/wireless/ath/ar9170/Kconfig"
+source "drivers/net/wireless/ath/carl9170/Kconfig"
 
 endif
diff --git a/drivers/net/wireless/ath/Makefile b/drivers/net/wireless/ath/Makefile
index 8113a5042afa..6d711ec97ec2 100644
--- a/drivers/net/wireless/ath/Makefile
+++ b/drivers/net/wireless/ath/Makefile
@@ -1,11 +1,13 @@
 obj-$(CONFIG_ATH5K)             += ath5k/
 obj-$(CONFIG_ATH9K_HW)          += ath9k/
 obj-$(CONFIG_AR9170_USB)        += ar9170/
+obj-$(CONFIG_CARL9170)          += carl9170/
 
 obj-$(CONFIG_ATH_COMMON)        += ath.o
 
 ath-objs :=     main.o \
                 regd.o \
-                hw.o
+                hw.o \
+                key.o
 
 ath-$(CONFIG_ATH_DEBUG) += debug.o
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index a93dc18a45c3..5dbb5361fd51 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -54,8 +54,6 @@ MODULE_AUTHOR("Christian Lamparter <chunkeey@web.de>");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Atheros AR9170 802.11n USB wireless");
 MODULE_FIRMWARE("ar9170.fw");
-MODULE_FIRMWARE("ar9170-1.fw");
-MODULE_FIRMWARE("ar9170-2.fw");
 
 enum ar9170_requirements {
         AR9170_REQ_FW1_ONLY = 1,
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index a706202fa67c..501050c0296f 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -19,6 +19,7 @@
 
 #include <linux/skbuff.h>
 #include <linux/if_ether.h>
+#include <linux/spinlock.h>
 #include <net/mac80211.h>
 
 /*
@@ -35,7 +36,6 @@ static const u8 ath_bcast_mac[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 
 struct ath_ani {
         bool caldone;
-        int16_t noise_floor;
         unsigned int longcal_timer;
         unsigned int shortcal_timer;
         unsigned int resetcal_timer;
@@ -43,6 +43,13 @@ struct ath_ani {
         struct timer_list timer;
 };
 
+struct ath_cycle_counters {
+        u32 cycles;
+        u32 rx_busy;
+        u32 rx_frame;
+        u32 tx_frame;
+};
+
 enum ath_device_state {
         ATH_HW_UNAVAILABLE,
         ATH_HW_INITIALIZED,
@@ -71,20 +78,44 @@ struct ath_regulatory {
         struct reg_dmn_pair_mapping *regpair;
 };
 
+enum ath_crypt_caps {
+        ATH_CRYPT_CAP_CIPHER_AESCCM             = BIT(0),
+        ATH_CRYPT_CAP_MIC_COMBINED              = BIT(1),
+};
+
+struct ath_keyval {
+        u8 kv_type;
+        u8 kv_pad;
+        u16 kv_len;
+        u8 kv_val[16]; /* TK */
+        u8 kv_mic[8]; /* Michael MIC key */
+        u8 kv_txmic[8]; /* Michael MIC TX key (used only if the hardware
+                         * supports both MIC keys in the same key cache entry;
+                         * in that case, kv_mic is the RX key) */
+};
+
+enum ath_cipher {
+        ATH_CIPHER_WEP = 0,
+        ATH_CIPHER_AES_OCB = 1,
+        ATH_CIPHER_AES_CCM = 2,
+        ATH_CIPHER_CKIP = 3,
+        ATH_CIPHER_TKIP = 4,
+        ATH_CIPHER_CLR = 5,
+        ATH_CIPHER_MIC = 127
+};
+
 /**
  * struct ath_ops - Register read/write operations
  *
  * @read: Register read
  * @write: Register write
  * @enable_write_buffer: Enable multiple register writes
- * @disable_write_buffer: Disable multiple register writes
- * @write_flush: Flush buffered register writes
+ * @write_flush: flush buffered register writes and disable buffering
  */
 struct ath_ops {
         unsigned int (*read)(void *, u32 reg_offset);
         void (*write)(void *, u32 val, u32 reg_offset);
         void (*enable_write_buffer)(void *);
-        void (*disable_write_buffer)(void *);
         void (*write_flush) (void *);
 };
 
@@ -120,7 +151,13 @@ struct ath_common {
         u32 keymax;
         DECLARE_BITMAP(keymap, ATH_KEYMAX);
         DECLARE_BITMAP(tkip_keymap, ATH_KEYMAX);
-        u8 splitmic;
+        enum ath_crypt_caps crypt_caps;
+
+        unsigned int clockrate;
+
+        spinlock_t cc_lock;
+        struct ath_cycle_counters cc_ani;
+        struct ath_cycle_counters cc_survey;
 
         struct ath_regulatory regulatory;
         const struct ath_ops *ops;
@@ -132,5 +169,13 @@ struct sk_buff *ath_rxbuf_alloc(struct ath_common *common,
                                 gfp_t gfp_mask);
 
 void ath_hw_setbssidmask(struct ath_common *common);
+void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key);
+int ath_key_config(struct ath_common *common,
+                          struct ieee80211_vif *vif,
+                          struct ieee80211_sta *sta,
+                          struct ieee80211_key_conf *key);
+bool ath_hw_keyreset(struct ath_common *common, u16 entry);
+void ath_hw_cycle_counters_update(struct ath_common *common);
+int32_t ath_hw_get_listen_time(struct ath_common *common);
 
 #endif /* ATH_H */
diff --git a/drivers/net/wireless/ath/ath5k/ani.c b/drivers/net/wireless/ath/ath5k/ani.c
index e4a5f046bba4..f1419198a479 100644
--- a/drivers/net/wireless/ath/ath5k/ani.c
+++ b/drivers/net/wireless/ath/ath5k/ani.c
@@ -355,41 +355,28 @@ ath5k_ani_lower_immunity(struct ath5k_hw *ah, struct ath5k_ani_state *as)
 
 
 /**
- * ath5k_hw_ani_get_listen_time() - Calculate time spent listening
+ * ath5k_hw_ani_get_listen_time() - Update counters and return listening time
  *
  * Return an approximation of the time spent "listening" in milliseconds (ms)
- * since the last call of this function by deducting the cycles spent
- * transmitting and receiving from the total cycle count.
- * Save profile count values for debugging/statistics and because we might want
- * to use them later.
- *
- * We assume no one else clears these registers!
+ * since the last call of this function.
+ * Save a snapshot of the counter values for debugging/statistics.
  */
 static int
 ath5k_hw_ani_get_listen_time(struct ath5k_hw *ah, struct ath5k_ani_state *as)
 {
+        struct ath_common *common = ath5k_hw_common(ah);
         int listen;
 
-        /* freeze */
-        ath5k_hw_reg_write(ah, AR5K_MIBC_FMC, AR5K_MIBC);
-        /* read */
-        as->pfc_cycles = ath5k_hw_reg_read(ah, AR5K_PROFCNT_CYCLE);
-        as->pfc_busy = ath5k_hw_reg_read(ah, AR5K_PROFCNT_RXCLR);
-        as->pfc_tx = ath5k_hw_reg_read(ah, AR5K_PROFCNT_TX);
-        as->pfc_rx = ath5k_hw_reg_read(ah, AR5K_PROFCNT_RX);
-        /* clear */
-        ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_TX);
-        ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_RX);
-        ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_RXCLR);
-        ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_CYCLE);
-        /* un-freeze */
-        ath5k_hw_reg_write(ah, 0, AR5K_MIBC);
-
-        /* TODO: where does 44000 come from? (11g clock rate?) */
-        listen = (as->pfc_cycles - as->pfc_rx - as->pfc_tx) / 44000;
-
-        if (as->pfc_cycles == 0 || listen < 0)
-                return 0;
+        spin_lock_bh(&common->cc_lock);
+
+        ath_hw_cycle_counters_update(common);
+        memcpy(&as->last_cc, &common->cc_ani, sizeof(as->last_cc));
+
+        /* clears common->cc_ani */
+        listen = ath_hw_get_listen_time(common);
+
+        spin_unlock_bh(&common->cc_lock);
+
         return listen;
 }
 
diff --git a/drivers/net/wireless/ath/ath5k/ani.h b/drivers/net/wireless/ath/ath5k/ani.h
index 55cf26d8522c..d0a664039c87 100644
--- a/drivers/net/wireless/ath/ath5k/ani.h
+++ b/drivers/net/wireless/ath/ath5k/ani.h
@@ -75,10 +75,7 @@ struct ath5k_ani_state {
         unsigned int            cck_errors;
 
         /* debug/statistics only: numbers from last ANI calibration */
-        unsigned int            pfc_tx;
-        unsigned int            pfc_rx;
-        unsigned int            pfc_busy;
-        unsigned int            pfc_cycles;
+        struct ath_cycle_counters last_cc;
         unsigned int            last_listen;
         unsigned int            last_ofdm_errors;
         unsigned int            last_cck_errors;
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index f399c4dd8e69..4a367cdb3eb9 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -206,6 +206,8 @@
 #define ATH5K_TUNE_CALIBRATION_INTERVAL_ANI     1000    /* 1 sec */
 #define ATH5K_TUNE_CALIBRATION_INTERVAL_NF      60000   /* 60 sec */
 
+#define ATH5K_TX_COMPLETE_POLL_INT              3000    /* 3 sec */
+
 #define AR5K_INIT_CARR_SENSE_EN                 1
 
 /*Swap RX/TX Descriptor for big endian archs*/
@@ -256,8 +258,6 @@
         (AR5K_INIT_PROG_IFS_TURBO)                                      \
 )
 
-/* token to use for aifs, cwmin, cwmax in MadWiFi */
-#define AR5K_TXQ_USEDEFAULT     ((u32) -1)
 
 /* GENERIC CHIPSET DEFINITIONS */
 
@@ -528,9 +528,9 @@ struct ath5k_txq_info {
         enum ath5k_tx_queue tqi_type;
         enum ath5k_tx_queue_subtype tqi_subtype;
         u16     tqi_flags;      /* Tx queue flags (see above) */
-        u32     tqi_aifs;       /* Arbitrated Interframe Space */
-        s32     tqi_cw_min;     /* Minimum Contention Window */
-        s32     tqi_cw_max;     /* Maximum Contention Window */
+        u8      tqi_aifs;       /* Arbitrated Interframe Space */
+        u16     tqi_cw_min;     /* Minimum Contention Window */
+        u16     tqi_cw_max;     /* Maximum Contention Window */
         u32     tqi_cbr_period; /* Constant bit rate period */
         u32     tqi_cbr_overflow_limit;
         u32     tqi_burst_time;
@@ -1028,8 +1028,6 @@ struct ath5k_hw {
         bool                    ah_turbo;
         bool                    ah_calibration;
         bool                    ah_single_chip;
-        bool                    ah_aes_support;
-        bool                    ah_combined_mic;
 
         enum ath5k_version      ah_version;
         enum ath5k_radio        ah_radio;
@@ -1043,10 +1041,6 @@ struct ath5k_hw {
 #define ah_modes                ah_capabilities.cap_mode
 #define ah_ee_version           ah_capabilities.cap_eeprom.ee_version
 
-        u32                     ah_atim_window;
-        u32                     ah_aifs;
-        u32                     ah_cw_min;
-        u32                     ah_cw_max;
         u32                     ah_limit_tx_retries;
         u8                      ah_coverage_class;
 
@@ -1201,17 +1195,13 @@ u64 ath5k_hw_get_tsf64(struct ath5k_hw *ah);
 void ath5k_hw_set_tsf64(struct ath5k_hw *ah, u64 tsf64);
 void ath5k_hw_reset_tsf(struct ath5k_hw *ah);
 void ath5k_hw_init_beacon(struct ath5k_hw *ah, u32 next_beacon, u32 interval);
+bool ath5k_hw_check_beacon_timers(struct ath5k_hw *ah, int intval);
 /* ACK bit rate */
 void ath5k_hw_set_ack_bitrate_high(struct ath5k_hw *ah, bool high);
 /* Clock rate related functions */
 unsigned int ath5k_hw_htoclock(struct ath5k_hw *ah, unsigned int usec);
 unsigned int ath5k_hw_clocktoh(struct ath5k_hw *ah, unsigned int clock);
-unsigned int ath5k_hw_get_clockrate(struct ath5k_hw *ah);
-/* Key table (WEP) functions */
-int ath5k_hw_reset_key(struct ath5k_hw *ah, u16 entry);
-int ath5k_hw_set_key(struct ath5k_hw *ah, u16 entry,
-                     const struct ieee80211_key_conf *key, const u8 *mac);
-int ath5k_hw_set_key_lladdr(struct ath5k_hw *ah, u16 entry, const u8 *mac);
+void ath5k_hw_set_clockrate(struct ath5k_hw *ah);
 
 /* Queue Control Unit, DFS Control Unit Functions */
 int ath5k_hw_get_tx_queueprops(struct ath5k_hw *ah, int queue,
diff --git a/drivers/net/wireless/ath/ath5k/attach.c b/drivers/net/wireless/ath/ath5k/attach.c
index aabad4f13e2a..cd0b14a0a93a 100644
--- a/drivers/net/wireless/ath/ath5k/attach.c
+++ b/drivers/net/wireless/ath/ath5k/attach.c
@@ -118,9 +118,6 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
         ah->ah_turbo = false;
         ah->ah_txpower.txp_tpc = AR5K_TUNE_TPC_TXPOWER;
         ah->ah_imr = 0;
-        ah->ah_atim_window = 0;
-        ah->ah_aifs = AR5K_TUNE_AIFS;
-        ah->ah_cw_min = AR5K_TUNE_CWMIN;
         ah->ah_limit_tx_retries = AR5K_INIT_TX_RETRY;
         ah->ah_software_retry = false;
         ah->ah_ant_mode = AR5K_ANTMODE_DEFAULT;
@@ -314,12 +311,16 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
         }
 
         /* Crypto settings */
-        ah->ah_aes_support = srev >= AR5K_SREV_AR5212_V4 &&
-                (ee->ee_version >= AR5K_EEPROM_VERSION_5_0 &&
-                 !AR5K_EEPROM_AES_DIS(ee->ee_misc5));
+        common->keymax = (sc->ah->ah_version == AR5K_AR5210 ?
+                          AR5K_KEYTABLE_SIZE_5210 : AR5K_KEYTABLE_SIZE_5211);
+
+        if (srev >= AR5K_SREV_AR5212_V4 &&
+            (ee->ee_version >= AR5K_EEPROM_VERSION_5_0 &&
+            !AR5K_EEPROM_AES_DIS(ee->ee_misc5)))
+                common->crypt_caps |= ATH_CRYPT_CAP_CIPHER_AESCCM;
 
         if (srev >= AR5K_SREV_AR2414) {
-                ah->ah_combined_mic = true;
+                common->crypt_caps |= ATH_CRYPT_CAP_MIC_COMBINED;
                 AR5K_REG_ENABLE_BITS(ah, AR5K_MISC_MODE,
                         AR5K_MISC_MODE_COMBINED_MIC);
         }
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 116ac66c6e3e..f1ae75d35d5d 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -52,6 +52,7 @@
 #include <linux/ethtool.h>
 #include <linux/uaccess.h>
 #include <linux/slab.h>
+#include <linux/etherdevice.h>
 
 #include <net/ieee80211_radiotap.h>
 
@@ -61,6 +62,7 @@
 #include "reg.h"
 #include "debug.h"
 #include "ani.h"
+#include "../debug.h"
 
 static int modparam_nohwcrypt;
 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
@@ -70,11 +72,6 @@ static int modparam_all_channels;
 module_param_named(all_channels, modparam_all_channels, bool, S_IRUGO);
 MODULE_PARM_DESC(all_channels, "Expose all channels the device can use.");
 
-
-/******************\
-* Internal defines *
-\******************/
-
 /* Module info */
 MODULE_AUTHOR("Jiri Slaby");
 MODULE_AUTHOR("Nick Kossifidis");
@@ -83,6 +80,10 @@ MODULE_SUPPORTED_DEVICE("Atheros 5xxx WLAN cards");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION("0.6.0 (EXPERIMENTAL)");
 
+static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
+static int ath5k_beacon_update(struct ieee80211_hw *hw,
+                struct ieee80211_vif *vif);
+static void ath5k_beacon_update_timers(struct ath5k_softc *sc, u64 bc_tsf);
 
 /* Known PCI ids */
 static DEFINE_PCI_DEVICE_TABLE(ath5k_pci_id_table) = {
@@ -190,129 +191,6 @@ static const struct ieee80211_rate ath5k_rates[] = {
         /* XR missing */
 };
 
-/*
- * Prototypes - PCI stack related functions
- */
-static int __devinit    ath5k_pci_probe(struct pci_dev *pdev,
-                                const struct pci_device_id *id);
-static void __devexit   ath5k_pci_remove(struct pci_dev *pdev);
-#ifdef CONFIG_PM_SLEEP
-static int              ath5k_pci_suspend(struct device *dev);
-static int              ath5k_pci_resume(struct device *dev);
-
-static SIMPLE_DEV_PM_OPS(ath5k_pm_ops, ath5k_pci_suspend, ath5k_pci_resume);
-#define ATH5K_PM_OPS    (&ath5k_pm_ops)
-#else
-#define ATH5K_PM_OPS    NULL
-#endif /* CONFIG_PM_SLEEP */
-
-static struct pci_driver ath5k_pci_driver = {
-        .name           = KBUILD_MODNAME,
-        .id_table       = ath5k_pci_id_table,
-        .probe          = ath5k_pci_probe,
-        .remove         = __devexit_p(ath5k_pci_remove),
-        .driver.pm      = ATH5K_PM_OPS,
-};
-
-
-
-/*
- * Prototypes - MAC 802.11 stack related functions
- */
-static int ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
-static int ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
-                struct ath5k_txq *txq);
-static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
-static int ath5k_start(struct ieee80211_hw *hw);
-static void ath5k_stop(struct ieee80211_hw *hw);
-static int ath5k_add_interface(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif);
-static void ath5k_remove_interface(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif);
-static int ath5k_config(struct ieee80211_hw *hw, u32 changed);
-static u64 ath5k_prepare_multicast(struct ieee80211_hw *hw,
-                                   struct netdev_hw_addr_list *mc_list);
-static void ath5k_configure_filter(struct ieee80211_hw *hw,
-                unsigned int changed_flags,
-                unsigned int *new_flags,
-                u64 multicast);
-static int ath5k_set_key(struct ieee80211_hw *hw,
-                enum set_key_cmd cmd,
-                struct ieee80211_vif *vif, struct ieee80211_sta *sta,
-                struct ieee80211_key_conf *key);
-static int ath5k_get_stats(struct ieee80211_hw *hw,
-                struct ieee80211_low_level_stats *stats);
-static int ath5k_get_survey(struct ieee80211_hw *hw,
-                int idx, struct survey_info *survey);
-static u64 ath5k_get_tsf(struct ieee80211_hw *hw);
-static void ath5k_set_tsf(struct ieee80211_hw *hw, u64 tsf);
-static void ath5k_reset_tsf(struct ieee80211_hw *hw);
-static int ath5k_beacon_update(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif);
-static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif,
-                struct ieee80211_bss_conf *bss_conf,
-                u32 changes);
-static void ath5k_sw_scan_start(struct ieee80211_hw *hw);
-static void ath5k_sw_scan_complete(struct ieee80211_hw *hw);
-static void ath5k_set_coverage_class(struct ieee80211_hw *hw,
-                u8 coverage_class);
-
-static const struct ieee80211_ops ath5k_hw_ops = {
-        .tx             = ath5k_tx,
-        .start          = ath5k_start,
-        .stop           = ath5k_stop,
-        .add_interface  = ath5k_add_interface,
-        .remove_interface = ath5k_remove_interface,
-        .config         = ath5k_config,
-        .prepare_multicast = ath5k_prepare_multicast,
-        .configure_filter = ath5k_configure_filter,
-        .set_key        = ath5k_set_key,
-        .get_stats      = ath5k_get_stats,
-        .get_survey     = ath5k_get_survey,
-        .conf_tx        = NULL,
-        .get_tsf        = ath5k_get_tsf,
-        .set_tsf        = ath5k_set_tsf,
-        .reset_tsf      = ath5k_reset_tsf,
-        .bss_info_changed = ath5k_bss_info_changed,
-        .sw_scan_start  = ath5k_sw_scan_start,
-        .sw_scan_complete = ath5k_sw_scan_complete,
-        .set_coverage_class = ath5k_set_coverage_class,
-};
-
-/*
- * Prototypes - Internal functions
- */
-/* Attach detach */
-static int      ath5k_attach(struct pci_dev *pdev,
-                        struct ieee80211_hw *hw);
-static void     ath5k_detach(struct pci_dev *pdev,
-                        struct ieee80211_hw *hw);
-/* Channel/mode setup */
-static inline short ath5k_ieee2mhz(short chan);
-static unsigned int ath5k_copy_channels(struct ath5k_hw *ah,
-                                struct ieee80211_channel *channels,
-                                unsigned int mode,
-                                unsigned int max);
-static int      ath5k_setup_bands(struct ieee80211_hw *hw);
-static int      ath5k_chan_set(struct ath5k_softc *sc,
-                                struct ieee80211_channel *chan);
-static void     ath5k_setcurmode(struct ath5k_softc *sc,
-                                unsigned int mode);
-static void     ath5k_mode_setup(struct ath5k_softc *sc);
-
-/* Descriptor setup */
-static int      ath5k_desc_alloc(struct ath5k_softc *sc,
-                                struct pci_dev *pdev);
-static void     ath5k_desc_free(struct ath5k_softc *sc,
-                                struct pci_dev *pdev);
-/* Buffers setup */
-static int      ath5k_rxbuf_setup(struct ath5k_softc *sc,
-                                struct ath5k_buf *bf);
-static int      ath5k_txbuf_setup(struct ath5k_softc *sc,
-                                struct ath5k_buf *bf,
-                                struct ath5k_txq *txq, int padsize);
-
 static inline void ath5k_txbuf_free_skb(struct ath5k_softc *sc,
                                 struct ath5k_buf *bf)
 {
@@ -345,35 +223,6 @@ static inline void ath5k_rxbuf_free_skb(struct ath5k_softc *sc,
 }
 
 
-/* Queues setup */
-static struct   ath5k_txq *ath5k_txq_setup(struct ath5k_softc *sc,
-                                int qtype, int subtype);
-static int      ath5k_beaconq_setup(struct ath5k_hw *ah);
-static int      ath5k_beaconq_config(struct ath5k_softc *sc);
-static void     ath5k_txq_drainq(struct ath5k_softc *sc,
-                                struct ath5k_txq *txq);
-static void     ath5k_txq_cleanup(struct ath5k_softc *sc);
-static void     ath5k_txq_release(struct ath5k_softc *sc);
-/* Rx handling */
-static int      ath5k_rx_start(struct ath5k_softc *sc);
-static void     ath5k_rx_stop(struct ath5k_softc *sc);
-static unsigned int ath5k_rx_decrypted(struct ath5k_softc *sc,
-                                        struct sk_buff *skb,
-                                        struct ath5k_rx_status *rs);
-static void     ath5k_tasklet_rx(unsigned long data);
-/* Tx handling */
-static void     ath5k_tx_processq(struct ath5k_softc *sc,
-                                struct ath5k_txq *txq);
-static void     ath5k_tasklet_tx(unsigned long data);
-/* Beacon handling */
-static int      ath5k_beacon_setup(struct ath5k_softc *sc,
-                                        struct ath5k_buf *bf);
-static void     ath5k_beacon_send(struct ath5k_softc *sc);
-static void     ath5k_beacon_config(struct ath5k_softc *sc);
-static void     ath5k_beacon_update_timers(struct ath5k_softc *sc, u64 bc_tsf);
-static void     ath5k_tasklet_beacon(unsigned long data);
-static void     ath5k_tasklet_ani(unsigned long data);
-
 static inline u64 ath5k_extend_tsf(struct ath5k_hw *ah, u32 rstamp)
 {
         u64 tsf = ath5k_hw_get_tsf64(ah);
@@ -384,50 +233,6 @@ static inline u64 ath5k_extend_tsf(struct ath5k_hw *ah, u32 rstamp)
         return (tsf & ~0x7fff) | rstamp;
 }
 
-/* Interrupt handling */
-static int      ath5k_init(struct ath5k_softc *sc);
-static int      ath5k_stop_locked(struct ath5k_softc *sc);
-static int      ath5k_stop_hw(struct ath5k_softc *sc);
-static irqreturn_t ath5k_intr(int irq, void *dev_id);
-static void ath5k_reset_work(struct work_struct *work);
-
-static void     ath5k_tasklet_calibrate(unsigned long data);
-
-/*
- * Module init/exit functions
- */
-static int __init
-init_ath5k_pci(void)
-{
-        int ret;
-
-        ath5k_debug_init();
-
-        ret = pci_register_driver(&ath5k_pci_driver);
-        if (ret) {
-                printk(KERN_ERR "ath5k_pci: can't register pci driver\n");
-                return ret;
-        }
-
-        return 0;
-}
-
-static void __exit
-exit_ath5k_pci(void)
-{
-        pci_unregister_driver(&ath5k_pci_driver);
-
-        ath5k_debug_finish();
-}
-
-module_init(init_ath5k_pci);
-module_exit(exit_ath5k_pci);
-
-
-/********************\
-* PCI Initialization *
-\********************/
-
 static const char *
 ath5k_chip_name(enum ath5k_srev_type type, u_int16_t val)
 {
@@ -466,299 +271,6 @@ static const struct ath_ops ath5k_common_ops = {
         .write = ath5k_iowrite32,
 };
 
-static int __devinit
-ath5k_pci_probe(struct pci_dev *pdev,
-                const struct pci_device_id *id)
-{
-        void __iomem *mem;
-        struct ath5k_softc *sc;
-        struct ath_common *common;
-        struct ieee80211_hw *hw;
-        int ret;
-        u8 csz;
-
-        /*
-         * L0s needs to be disabled on all ath5k cards.
-         *
-         * For distributions shipping with CONFIG_PCIEASPM (this will be enabled
-         * by default in the future in 2.6.36) this will also mean both L1 and
-         * L0s will be disabled when a pre 1.1 PCIe device is detected. We do
-         * know L1 works correctly even for all ath5k pre 1.1 PCIe devices
-         * though but cannot currently undue the effect of a blacklist, for
-         * details you can read pcie_aspm_sanity_check() and see how it adjusts
-         * the device link capability.
-         *
-         * It may be possible in the future to implement some PCI API to allow
-         * drivers to override blacklists for pre 1.1 PCIe but for now it is
-         * best to accept that both L0s and L1 will be disabled completely for
-         * distributions shipping with CONFIG_PCIEASPM rather than having this
-         * issue present. Motivation for adding this new API will be to help
-         * with power consumption for some of these devices.
-         */
-        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S);
-
-        ret = pci_enable_device(pdev);
-        if (ret) {
-                dev_err(&pdev->dev, "can't enable device\n");
-                goto err;
-        }
-
-        /* XXX 32-bit addressing only */
-        ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
-        if (ret) {
-                dev_err(&pdev->dev, "32-bit DMA not available\n");
-                goto err_dis;
-        }
-
-        /*
-         * Cache line size is used to size and align various
-         * structures used to communicate with the hardware.
-         */
-        pci_read_config_byte(pdev, PCI_CACHE_LINE_SIZE, &csz);
-        if (csz == 0) {
-                /*
-                 * Linux 2.4.18 (at least) writes the cache line size
-                 * register as a 16-bit wide register which is wrong.
-                 * We must have this setup properly for rx buffer
-                 * DMA to work so force a reasonable value here if it
-                 * comes up zero.
-                 */
-                csz = L1_CACHE_BYTES >> 2;
-                pci_write_config_byte(pdev, PCI_CACHE_LINE_SIZE, csz);
-        }
-        /*
-         * The default setting of latency timer yields poor results,
-         * set it to the value used by other systems.  It may be worth
-         * tweaking this setting more.
-         */
-        pci_write_config_byte(pdev, PCI_LATENCY_TIMER, 0xa8);
-
-        /* Enable bus mastering */
-        pci_set_master(pdev);
-
-        /*
-         * Disable the RETRY_TIMEOUT register (0x41) to keep
-         * PCI Tx retries from interfering with C3 CPU state.
-         */
-        pci_write_config_byte(pdev, 0x41, 0);
-
-        ret = pci_request_region(pdev, 0, "ath5k");
-        if (ret) {
-                dev_err(&pdev->dev, "cannot reserve PCI memory region\n");
-                goto err_dis;
-        }
-
-        mem = pci_iomap(pdev, 0, 0);
-        if (!mem) {
-                dev_err(&pdev->dev, "cannot remap PCI memory region\n") ;
-                ret = -EIO;
-                goto err_reg;
-        }
-
-        /*
-         * Allocate hw (mac80211 main struct)
-         * and hw->priv (driver private data)
-         */
-        hw = ieee80211_alloc_hw(sizeof(*sc), &ath5k_hw_ops);
-        if (hw == NULL) {
-                dev_err(&pdev->dev, "cannot allocate ieee80211_hw\n");
-                ret = -ENOMEM;
-                goto err_map;
-        }
-
-        dev_info(&pdev->dev, "registered as '%s'\n", wiphy_name(hw->wiphy));
-
-        /* Initialize driver private data */
-        SET_IEEE80211_DEV(hw, &pdev->dev);
-        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
-                    IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
-                    IEEE80211_HW_SIGNAL_DBM;
-
-        hw->wiphy->interface_modes =
-                BIT(NL80211_IFTYPE_AP) |
-                BIT(NL80211_IFTYPE_STATION) |
-                BIT(NL80211_IFTYPE_ADHOC) |
-                BIT(NL80211_IFTYPE_MESH_POINT);
-
-        hw->extra_tx_headroom = 2;
-        hw->channel_change_time = 5000;
-        sc = hw->priv;
-        sc->hw = hw;
-        sc->pdev = pdev;
-
-        ath5k_debug_init_device(sc);
-
-        /*
-         * Mark the device as detached to avoid processing
-         * interrupts until setup is complete.
-         */
-        __set_bit(ATH_STAT_INVALID, sc->status);
-
-        sc->iobase = mem; /* So we can unmap it on detach */
-        sc->opmode = NL80211_IFTYPE_STATION;
-        sc->bintval = 1000;
-        mutex_init(&sc->lock);
-        spin_lock_init(&sc->rxbuflock);
-        spin_lock_init(&sc->txbuflock);
-        spin_lock_init(&sc->block);
-
-        /* Set private data */
-        pci_set_drvdata(pdev, sc);
-
-        /* Setup interrupt handler */
-        ret = request_irq(pdev->irq, ath5k_intr, IRQF_SHARED, "ath", sc);
-        if (ret) {
-                ATH5K_ERR(sc, "request_irq failed\n");
-                goto err_free;
-        }
-
-        /* If we passed the test, malloc an ath5k_hw struct */
-        sc->ah = kzalloc(sizeof(struct ath5k_hw), GFP_KERNEL);
-        if (!sc->ah) {
-                ret = -ENOMEM;
-                ATH5K_ERR(sc, "out of memory\n");
-                goto err_irq;
-        }
-
-        sc->ah->ah_sc = sc;
-        sc->ah->ah_iobase = sc->iobase;
-        common = ath5k_hw_common(sc->ah);
-        common->ops = &ath5k_common_ops;
-        common->ah = sc->ah;
-        common->hw = hw;
-        common->cachelsz = csz << 2; /* convert to bytes */
-
-        /* Initialize device */
-        ret = ath5k_hw_attach(sc);
-        if (ret) {
-                goto err_free_ah;
-        }
-
-        /* set up multi-rate retry capabilities */
-        if (sc->ah->ah_version == AR5K_AR5212) {
-                hw->max_rates = 4;
-                hw->max_rate_tries = 11;
-        }
-
-        /* Finish private driver data initialization */
-        ret = ath5k_attach(pdev, hw);
-        if (ret)
-                goto err_ah;
-
-        ATH5K_INFO(sc, "Atheros AR%s chip found (MAC: 0x%x, PHY: 0x%x)\n",
-                        ath5k_chip_name(AR5K_VERSION_MAC, sc->ah->ah_mac_srev),
-                                        sc->ah->ah_mac_srev,
-                                        sc->ah->ah_phy_revision);
-
-        if (!sc->ah->ah_single_chip) {
-                /* Single chip radio (!RF5111) */
-                if (sc->ah->ah_radio_5ghz_revision &&
-                        !sc->ah->ah_radio_2ghz_revision) {
-                        /* No 5GHz support -> report 2GHz radio */
-                        if (!test_bit(AR5K_MODE_11A,
-                                sc->ah->ah_capabilities.cap_mode)) {
-                                ATH5K_INFO(sc, "RF%s 2GHz radio found (0x%x)\n",
-                                        ath5k_chip_name(AR5K_VERSION_RAD,
-                                                sc->ah->ah_radio_5ghz_revision),
-                                                sc->ah->ah_radio_5ghz_revision);
-                        /* No 2GHz support (5110 and some
-                         * 5Ghz only cards) -> report 5Ghz radio */
-                        } else if (!test_bit(AR5K_MODE_11B,
-                                sc->ah->ah_capabilities.cap_mode)) {
-                                ATH5K_INFO(sc, "RF%s 5GHz radio found (0x%x)\n",
-                                        ath5k_chip_name(AR5K_VERSION_RAD,
-                                                sc->ah->ah_radio_5ghz_revision),
-                                                sc->ah->ah_radio_5ghz_revision);
-                        /* Multiband radio */
-                        } else {
-                                ATH5K_INFO(sc, "RF%s multiband radio found"
-                                        " (0x%x)\n",
-                                        ath5k_chip_name(AR5K_VERSION_RAD,
-                                                sc->ah->ah_radio_5ghz_revision),
-                                                sc->ah->ah_radio_5ghz_revision);
-                        }
-                }
-                /* Multi chip radio (RF5111 - RF2111) ->
-                 * report both 2GHz/5GHz radios */
-                else if (sc->ah->ah_radio_5ghz_revision &&
-                                sc->ah->ah_radio_2ghz_revision){
-                        ATH5K_INFO(sc, "RF%s 5GHz radio found (0x%x)\n",
-                                ath5k_chip_name(AR5K_VERSION_RAD,
-                                        sc->ah->ah_radio_5ghz_revision),
-                                        sc->ah->ah_radio_5ghz_revision);
-                        ATH5K_INFO(sc, "RF%s 2GHz radio found (0x%x)\n",
-                                ath5k_chip_name(AR5K_VERSION_RAD,
-                                        sc->ah->ah_radio_2ghz_revision),
-                                        sc->ah->ah_radio_2ghz_revision);
-                }
-        }
-
-
-        /* ready to process interrupts */
-        __clear_bit(ATH_STAT_INVALID, sc->status);
-
-        return 0;
-err_ah:
-        ath5k_hw_detach(sc->ah);
-err_free_ah:
-        kfree(sc->ah);
-err_irq:
-        free_irq(pdev->irq, sc);
-err_free:
-        ieee80211_free_hw(hw);
-err_map:
-        pci_iounmap(pdev, mem);
-err_reg:
-        pci_release_region(pdev, 0);
-err_dis:
-        pci_disable_device(pdev);
-err:
-        return ret;
-}
-
-static void __devexit
-ath5k_pci_remove(struct pci_dev *pdev)
-{
-        struct ath5k_softc *sc = pci_get_drvdata(pdev);
-
-        ath5k_debug_finish_device(sc);
-        ath5k_detach(pdev, sc->hw);
-        ath5k_hw_detach(sc->ah);
-        kfree(sc->ah);
-        free_irq(pdev->irq, sc);
-        pci_iounmap(pdev, sc->iobase);
-        pci_release_region(pdev, 0);
-        pci_disable_device(pdev);
-        ieee80211_free_hw(sc->hw);
-}
-
-#ifdef CONFIG_PM_SLEEP
-static int ath5k_pci_suspend(struct device *dev)
-{
-        struct ath5k_softc *sc = pci_get_drvdata(to_pci_dev(dev));
-
-        ath5k_led_off(sc);
-        return 0;
-}
-
-static int ath5k_pci_resume(struct device *dev)
-{
-        struct pci_dev *pdev = to_pci_dev(dev);
-        struct ath5k_softc *sc = pci_get_drvdata(pdev);
-
-        /*
-         * Suspend/Resume resets the PCI configuration space, so we have to
-         * re-disable the RETRY_TIMEOUT register (0x41) to keep
-         * PCI Tx retries from interfering with C3 CPU state
-         */
-        pci_write_config_byte(pdev, 0x41, 0);
-
-        ath5k_led_enable(sc);
-        return 0;
-}
-#endif /* CONFIG_PM_SLEEP */
-
-
 /***********************\
 * Driver Initialization *
 \***********************/
@@ -772,170 +284,6 @@ static int ath5k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *re
         return ath_reg_notifier_apply(wiphy, request, regulatory);
 }
 
-static int
-ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
-{
-        struct ath5k_softc *sc = hw->priv;
-        struct ath5k_hw *ah = sc->ah;
-        struct ath_regulatory *regulatory = ath5k_hw_regulatory(ah);
-        u8 mac[ETH_ALEN] = {};
-        int ret;
-
-        ATH5K_DBG(sc, ATH5K_DEBUG_ANY, "devid 0x%x\n", pdev->device);
-
-        /*
-         * Check if the MAC has multi-rate retry support.
-         * We do this by trying to setup a fake extended
-         * descriptor.  MACs that don't have support will
-         * return false w/o doing anything.  MACs that do
-         * support it will return true w/o doing anything.
-         */
-        ret = ath5k_hw_setup_mrr_tx_desc(ah, NULL, 0, 0, 0, 0, 0, 0);
-
-        if (ret < 0)
-                goto err;
-        if (ret > 0)
-                __set_bit(ATH_STAT_MRRETRY, sc->status);
-
-        /*
-         * Collect the channel list.  The 802.11 layer
-         * is resposible for filtering this list based
-         * on settings like the phy mode and regulatory
-         * domain restrictions.
-         */
-        ret = ath5k_setup_bands(hw);
-        if (ret) {
-                ATH5K_ERR(sc, "can't get channels\n");
-                goto err;
-        }
-
-        /* NB: setup here so ath5k_rate_update is happy */
-        if (test_bit(AR5K_MODE_11A, ah->ah_modes))
-                ath5k_setcurmode(sc, AR5K_MODE_11A);
-        else
-                ath5k_setcurmode(sc, AR5K_MODE_11B);
-
-        /*
-         * Allocate tx+rx descriptors and populate the lists.
-         */
-        ret = ath5k_desc_alloc(sc, pdev);
-        if (ret) {
-                ATH5K_ERR(sc, "can't allocate descriptors\n");
-                goto err;
-        }
-
-        /*
-         * Allocate hardware transmit queues: one queue for
-         * beacon frames and one data queue for each QoS
-         * priority.  Note that hw functions handle resetting
-         * these queues at the needed time.
-         */
-        ret = ath5k_beaconq_setup(ah);
-        if (ret < 0) {
-                ATH5K_ERR(sc, "can't setup a beacon xmit queue\n");
-                goto err_desc;
-        }
-        sc->bhalq = ret;
-        sc->cabq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_CAB, 0);
-        if (IS_ERR(sc->cabq)) {
-                ATH5K_ERR(sc, "can't setup cab queue\n");
-                ret = PTR_ERR(sc->cabq);
-                goto err_bhal;
-        }
-
-        sc->txq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_DATA, AR5K_WME_AC_BK);
-        if (IS_ERR(sc->txq)) {
-                ATH5K_ERR(sc, "can't setup xmit queue\n");
-                ret = PTR_ERR(sc->txq);
-                goto err_queues;
-        }
-
-        tasklet_init(&sc->rxtq, ath5k_tasklet_rx, (unsigned long)sc);
-        tasklet_init(&sc->txtq, ath5k_tasklet_tx, (unsigned long)sc);
-        tasklet_init(&sc->calib, ath5k_tasklet_calibrate, (unsigned long)sc);
-        tasklet_init(&sc->beacontq, ath5k_tasklet_beacon, (unsigned long)sc);
-        tasklet_init(&sc->ani_tasklet, ath5k_tasklet_ani, (unsigned long)sc);
-
-        INIT_WORK(&sc->reset_work, ath5k_reset_work);
-
-        ret = ath5k_eeprom_read_mac(ah, mac);
-        if (ret) {
-                ATH5K_ERR(sc, "unable to read address from EEPROM: 0x%04x\n",
-                        sc->pdev->device);
-                goto err_queues;
-        }
-
-        SET_IEEE80211_PERM_ADDR(hw, mac);
-        /* All MAC address bits matter for ACKs */
-        memcpy(sc->bssidmask, ath_bcast_mac, ETH_ALEN);
-        ath5k_hw_set_bssid_mask(sc->ah, sc->bssidmask);
-
-        regulatory->current_rd = ah->ah_capabilities.cap_eeprom.ee_regdomain;
-        ret = ath_regd_init(regulatory, hw->wiphy, ath5k_reg_notifier);
-        if (ret) {
-                ATH5K_ERR(sc, "can't initialize regulatory system\n");
-                goto err_queues;
-        }
-
-        ret = ieee80211_register_hw(hw);
-        if (ret) {
-                ATH5K_ERR(sc, "can't register ieee80211 hw\n");
-                goto err_queues;
-        }
-
-        if (!ath_is_world_regd(regulatory))
-                regulatory_hint(hw->wiphy, regulatory->alpha2);
-
-        ath5k_init_leds(sc);
-
-        ath5k_sysfs_register(sc);
-
-        return 0;
-err_queues:
-        ath5k_txq_release(sc);
-err_bhal:
-        ath5k_hw_release_tx_queue(ah, sc->bhalq);
-err_desc:
-        ath5k_desc_free(sc, pdev);
-err:
-        return ret;
-}
-
-static void
-ath5k_detach(struct pci_dev *pdev, struct ieee80211_hw *hw)
-{
-        struct ath5k_softc *sc = hw->priv;
-
-        /*
-         * NB: the order of these is important:
-         * o call the 802.11 layer before detaching ath5k_hw to
-         *   ensure callbacks into the driver to delete global
-         *   key cache entries can be handled
-         * o reclaim the tx queue data structures after calling
-         *   the 802.11 layer as we'll get called back to reclaim
-         *   node state and potentially want to use them
-         * o to cleanup the tx queues the hal is called, so detach
-         *   it last
-         * XXX: ??? detach ath5k_hw ???
-         * Other than that, it's straightforward...
-         */
-        ieee80211_unregister_hw(hw);
-        ath5k_desc_free(sc, pdev);
-        ath5k_txq_release(sc);
-        ath5k_hw_release_tx_queue(sc->ah, sc->bhalq);
-        ath5k_unregister_leds(sc);
-
-        ath5k_sysfs_unregister(sc);
-        /*
-         * NB: can't reclaim these until after ieee80211_ifdetach
-         * returns because we'll get called back to reclaim node
-         * state and potentially want to use them.
-         */
-}
-
-
-
-
 /********************\
 * Channel/mode setup *
 \********************/
@@ -1163,8 +511,101 @@ ath5k_setcurmode(struct ath5k_softc *sc, unsigned int mode)
         }
 }
 
+struct ath_vif_iter_data {
+        const u8        *hw_macaddr;
+        u8              mask[ETH_ALEN];
+        u8              active_mac[ETH_ALEN]; /* first active MAC */
+        bool            need_set_hw_addr;
+        bool            found_active;
+        bool            any_assoc;
+        enum nl80211_iftype opmode;
+};
+
+static void ath_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
+{
+        struct ath_vif_iter_data *iter_data = data;
+        int i;
+        struct ath5k_vif *avf = (void *)vif->drv_priv;
+
+        if (iter_data->hw_macaddr)
+                for (i = 0; i < ETH_ALEN; i++)
+                        iter_data->mask[i] &=
+                                ~(iter_data->hw_macaddr[i] ^ mac[i]);
+
+        if (!iter_data->found_active) {
+                iter_data->found_active = true;
+                memcpy(iter_data->active_mac, mac, ETH_ALEN);
+        }
+
+        if (iter_data->need_set_hw_addr && iter_data->hw_macaddr)
+                if (compare_ether_addr(iter_data->hw_macaddr, mac) == 0)
+                        iter_data->need_set_hw_addr = false;
+
+        if (!iter_data->any_assoc) {
+                if (avf->assoc)
+                        iter_data->any_assoc = true;
+        }
+
+        /* Calculate combined mode - when APs are active, operate in AP mode.
+         * Otherwise use the mode of the new interface. This can currently
+         * only deal with combinations of APs and STAs. Only one ad-hoc
+         * interfaces is allowed above.
+         */
+        if (avf->opmode == NL80211_IFTYPE_AP)
+                iter_data->opmode = NL80211_IFTYPE_AP;
+        else
+                if (iter_data->opmode == NL80211_IFTYPE_UNSPECIFIED)
+                        iter_data->opmode = avf->opmode;
+}
+
+static void ath_do_set_opmode(struct ath5k_softc *sc)
+{
+        struct ath5k_hw *ah = sc->ah;
+        ath5k_hw_set_opmode(ah, sc->opmode);
+        ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "mode setup opmode %d (%s)\n",
+                  sc->opmode, ath_opmode_to_string(sc->opmode));
+}
+
+void ath5k_update_bssid_mask_and_opmode(struct ath5k_softc *sc,
+                                        struct ieee80211_vif *vif)
+{
+        struct ath_common *common = ath5k_hw_common(sc->ah);
+        struct ath_vif_iter_data iter_data;
+
+        /*
+         * Use the hardware MAC address as reference, the hardware uses it
+         * together with the BSSID mask when matching addresses.
+         */
+        iter_data.hw_macaddr = common->macaddr;
+        memset(&iter_data.mask, 0xff, ETH_ALEN);
+        iter_data.found_active = false;
+        iter_data.need_set_hw_addr = true;
+        iter_data.opmode = NL80211_IFTYPE_UNSPECIFIED;
+
+        if (vif)
+                ath_vif_iter(&iter_data, vif->addr, vif);
+
+        /* Get list of all active MAC addresses */
+        ieee80211_iterate_active_interfaces_atomic(sc->hw, ath_vif_iter,
+                                                   &iter_data);
+        memcpy(sc->bssidmask, iter_data.mask, ETH_ALEN);
+
+        sc->opmode = iter_data.opmode;
+        if (sc->opmode == NL80211_IFTYPE_UNSPECIFIED)
+                /* Nothing active, default to station mode */
+                sc->opmode = NL80211_IFTYPE_STATION;
+
+        ath_do_set_opmode(sc);
+
+        if (iter_data.need_set_hw_addr && iter_data.found_active)
+                ath5k_hw_set_lladdr(sc->ah, iter_data.active_mac);
+
+        if (ath5k_hw_hasbssidmask(sc->ah))
+                ath5k_hw_set_bssid_mask(sc->ah, sc->bssidmask);
+}
+
 static void
-ath5k_mode_setup(struct ath5k_softc *sc)
+ath5k_mode_setup(struct ath5k_softc *sc, struct ieee80211_vif *vif)
 {
         struct ath5k_hw *ah = sc->ah;
         u32 rfilt;
@@ -1172,15 +613,9 @@ ath5k_mode_setup(struct ath5k_softc *sc)
         /* configure rx filter */
         rfilt = sc->filter_flags;
         ath5k_hw_set_rx_filter(ah, rfilt);
-
-        if (ath5k_hw_hasbssidmask(ah))
-                ath5k_hw_set_bssid_mask(ah, sc->bssidmask);
-
-        /* configure operational mode */
-        ath5k_hw_set_opmode(ah, sc->opmode);
-
-        ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "mode setup opmode %d\n", sc->opmode);
         ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "RX filter 0x%x\n", rfilt);
+
+        ath5k_update_bssid_mask_and_opmode(sc, vif);
 }
 
 static inline int
@@ -1352,13 +787,13 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
                 flags |= AR5K_TXDESC_RTSENA;
                 cts_rate = ieee80211_get_rts_cts_rate(sc->hw, info)->hw_value;
                 duration = le16_to_cpu(ieee80211_rts_duration(sc->hw,
-                        sc->vif, pktlen, info));
+                        info->control.vif, pktlen, info));
         }
         if (rc_flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
                 flags |= AR5K_TXDESC_CTSENA;
                 cts_rate = ieee80211_get_rts_cts_rate(sc->hw, info)->hw_value;
                 duration = le16_to_cpu(ieee80211_ctstoself_duration(sc->hw,
-                        sc->vif, pktlen, info));
+                        info->control.vif, pktlen, info));
         }
         ret = ah->ah_setup_tx_desc(ah, ds, pktlen,
                 ieee80211_get_hdrlen_from_skb(skb), padsize,
@@ -1391,6 +826,7 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
 
         spin_lock_bh(&txq->lock);
         list_add_tail(&bf->list, &txq->q);
+        txq->txq_len++;
         if (txq->link == NULL) /* is this first packet? */
                 ath5k_hw_set_txdp(ah, txq->qnum, bf->daddr);
         else /* no, so only link it */
@@ -1459,10 +895,13 @@ ath5k_desc_alloc(struct ath5k_softc *sc, struct pci_dev *pdev)
                 list_add_tail(&bf->list, &sc->txbuf);
         }
 
-        /* beacon buffer */
-        bf->desc = ds;
-        bf->daddr = da;
-        sc->bbuf = bf;
+        /* beacon buffers */
+        INIT_LIST_HEAD(&sc->bcbuf);
+        for (i = 0; i < ATH_BCBUF; i++, bf++, ds++, da += sizeof(*ds)) {
+                bf->desc = ds;
+                bf->daddr = da;
+                list_add_tail(&bf->list, &sc->bcbuf);
+        }
 
         return 0;
 err_free:
@@ -1477,11 +916,12 @@ ath5k_desc_free(struct ath5k_softc *sc, struct pci_dev *pdev)
 {
         struct ath5k_buf *bf;
 
-        ath5k_txbuf_free_skb(sc, sc->bbuf);
         list_for_each_entry(bf, &sc->txbuf, list)
                 ath5k_txbuf_free_skb(sc, bf);
         list_for_each_entry(bf, &sc->rxbuf, list)
                 ath5k_rxbuf_free_skb(sc, bf);
+        list_for_each_entry(bf, &sc->bcbuf, list)
+                ath5k_txbuf_free_skb(sc, bf);
 
         /* Free memory associated with all descriptors */
         pci_free_consistent(pdev, sc->desc_len, sc->desc, sc->desc_daddr);
@@ -1490,13 +930,9 @@ ath5k_desc_free(struct ath5k_softc *sc, struct pci_dev *pdev)
 
         kfree(sc->bufptr);
         sc->bufptr = NULL;
-        sc->bbuf = NULL;
 }
 
 
-
-
-
 /**************\
 * Queues setup *
 \**************/
@@ -1509,9 +945,11 @@ ath5k_txq_setup(struct ath5k_softc *sc,
         struct ath5k_txq *txq;
         struct ath5k_txq_info qi = {
                 .tqi_subtype = subtype,
-                .tqi_aifs = AR5K_TXQ_USEDEFAULT,
-                .tqi_cw_min = AR5K_TXQ_USEDEFAULT,
-                .tqi_cw_max = AR5K_TXQ_USEDEFAULT
+                /* XXX: default values not correct for B and XR channels,
+                 * but who cares? */
+                .tqi_aifs = AR5K_TUNE_AIFS,
+                .tqi_cw_min = AR5K_TUNE_CWMIN,
+                .tqi_cw_max = AR5K_TUNE_CWMAX
         };
         int qnum;
 
@@ -1550,6 +988,9 @@ ath5k_txq_setup(struct ath5k_softc *sc,
                 INIT_LIST_HEAD(&txq->q);
                 spin_lock_init(&txq->lock);
                 txq->setup = true;
+                txq->txq_len = 0;
+                txq->txq_poll_mark = false;
+                txq->txq_stuck = 0;
         }
         return &sc->txqs[qnum];
 }
@@ -1558,9 +999,11 @@ static int
 ath5k_beaconq_setup(struct ath5k_hw *ah)
 {
         struct ath5k_txq_info qi = {
-                .tqi_aifs = AR5K_TXQ_USEDEFAULT,
-                .tqi_cw_min = AR5K_TXQ_USEDEFAULT,
-                .tqi_cw_max = AR5K_TXQ_USEDEFAULT,
+                /* XXX: default values not correct for B and XR channels,
+                 * but who cares? */
+                .tqi_aifs = AR5K_TUNE_AIFS,
+                .tqi_cw_min = AR5K_TUNE_CWMIN,
+                .tqi_cw_max = AR5K_TUNE_CWMAX,
                 /* NB: for dynamic turbo, don't enable any other interrupts */
                 .tqi_flags = AR5K_TXQ_FLAG_TXDESCINT_ENABLE
         };
@@ -1594,7 +1037,7 @@ ath5k_beaconq_config(struct ath5k_softc *sc)
                  */
                 qi.tqi_aifs = 0;
                 qi.tqi_cw_min = 0;
-                qi.tqi_cw_max = 2 * ah->ah_cw_min;
+                qi.tqi_cw_max = 2 * AR5K_TUNE_CWMIN;
         }
 
         ATH5K_DBG(sc, ATH5K_DEBUG_BEACON,
@@ -1644,9 +1087,11 @@ ath5k_txq_drainq(struct ath5k_softc *sc, struct ath5k_txq *txq)
                 spin_lock_bh(&sc->txbuflock);
                 list_move_tail(&bf->list, &sc->txbuf);
                 sc->txbuf_len++;
+                txq->txq_len--;
                 spin_unlock_bh(&sc->txbuflock);
         }
         txq->link = NULL;
+        txq->txq_poll_mark = false;
         spin_unlock_bh(&txq->lock);
 }
 
@@ -1696,8 +1141,6 @@ ath5k_txq_release(struct ath5k_softc *sc)
 }
 
 
-
-
 /*************\
 * RX Handling *
 \*************/
@@ -1732,7 +1175,7 @@ ath5k_rx_start(struct ath5k_softc *sc)
         spin_unlock_bh(&sc->rxbuflock);
 
         ath5k_hw_start_rx_dma(ah);      /* enable recv descriptors */
-        ath5k_mode_setup(sc);           /* set filters, etc. */
+        ath5k_mode_setup(sc, NULL);             /* set filters, etc. */
         ath5k_hw_start_rx_pcu(ah);      /* re-enable PCU/DMA engine */
 
         return 0;
@@ -1840,6 +1283,15 @@ ath5k_check_ibss_tsf(struct ath5k_softc *sc, struct sk_buff *skb,
                  */
                 if (hw_tu >= sc->nexttbtt)
                         ath5k_beacon_update_timers(sc, bc_tstamp);
+
+                /* Check if the beacon timers are still correct, because a TSF
+                 * update might have created a window between them - for a
+                 * longer description see the comment of this function: */
+                if (!ath5k_hw_check_beacon_timers(sc->ah, sc->bintval)) {
+                        ath5k_beacon_update_timers(sc, bc_tstamp);
+                        ATH5K_DBG_UNLIMIT(sc, ATH5K_DEBUG_BEACON,
+                                "fixed beacon timers after beacon receive\n");
+                }
         }
 }
 
@@ -2006,6 +1458,7 @@ static bool
 ath5k_receive_frame_ok(struct ath5k_softc *sc, struct ath5k_rx_status *rs)
 {
         sc->stats.rx_all_count++;
+        sc->stats.rx_bytes_count += rs->rs_datalen;
 
         if (unlikely(rs->rs_status)) {
                 if (rs->rs_status & AR5K_RXERR_CRC)
@@ -2121,6 +1574,118 @@ unlock:
 * TX Handling *
 \*************/
 
+static int ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
+                          struct ath5k_txq *txq)
+{
+        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_buf *bf;
+        unsigned long flags;
+        int padsize;
+
+        ath5k_debug_dump_skb(sc, skb, "TX  ", 1);
+
+        /*
+         * The hardware expects the header padded to 4 byte boundaries.
+         * If this is not the case, we add the padding after the header.
+         */
+        padsize = ath5k_add_padding(skb);
+        if (padsize < 0) {
+                ATH5K_ERR(sc, "tx hdrlen not %%4: not enough"
+                          " headroom to pad");
+                goto drop_packet;
+        }
+
+        if (txq->txq_len >= ATH5K_TXQ_LEN_MAX)
+                ieee80211_stop_queue(hw, txq->qnum);
+
+        spin_lock_irqsave(&sc->txbuflock, flags);
+        if (list_empty(&sc->txbuf)) {
+                ATH5K_ERR(sc, "no further txbuf available, dropping packet\n");
+                spin_unlock_irqrestore(&sc->txbuflock, flags);
+                ieee80211_stop_queues(hw);
+                goto drop_packet;
+        }
+        bf = list_first_entry(&sc->txbuf, struct ath5k_buf, list);
+        list_del(&bf->list);
+        sc->txbuf_len--;
+        if (list_empty(&sc->txbuf))
+                ieee80211_stop_queues(hw);
+        spin_unlock_irqrestore(&sc->txbuflock, flags);
+
+        bf->skb = skb;
+
+        if (ath5k_txbuf_setup(sc, bf, txq, padsize)) {
+                bf->skb = NULL;
+                spin_lock_irqsave(&sc->txbuflock, flags);
+                list_add_tail(&bf->list, &sc->txbuf);
+                sc->txbuf_len++;
+                spin_unlock_irqrestore(&sc->txbuflock, flags);
+                goto drop_packet;
+        }
+        return NETDEV_TX_OK;
+
+drop_packet:
+        dev_kfree_skb_any(skb);
+        return NETDEV_TX_OK;
+}
+
+static void
+ath5k_tx_frame_completed(struct ath5k_softc *sc, struct sk_buff *skb,
+                         struct ath5k_tx_status *ts)
+{
+        struct ieee80211_tx_info *info;
+        int i;
+
+        sc->stats.tx_all_count++;
+        sc->stats.tx_bytes_count += skb->len;
+        info = IEEE80211_SKB_CB(skb);
+
+        ieee80211_tx_info_clear_status(info);
+        for (i = 0; i < 4; i++) {
+                struct ieee80211_tx_rate *r =
+                        &info->status.rates[i];
+
+                if (ts->ts_rate[i]) {
+                        r->idx = ath5k_hw_to_driver_rix(sc, ts->ts_rate[i]);
+                        r->count = ts->ts_retry[i];
+                } else {
+                        r->idx = -1;
+                        r->count = 0;
+                }
+        }
+
+        /* count the successful attempt as well */
+        info->status.rates[ts->ts_final_idx].count++;
+
+        if (unlikely(ts->ts_status)) {
+                sc->stats.ack_fail++;
+                if (ts->ts_status & AR5K_TXERR_FILT) {
+                        info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
+                        sc->stats.txerr_filt++;
+                }
+                if (ts->ts_status & AR5K_TXERR_XRETRY)
+                        sc->stats.txerr_retry++;
+                if (ts->ts_status & AR5K_TXERR_FIFO)
+                        sc->stats.txerr_fifo++;
+        } else {
+                info->flags |= IEEE80211_TX_STAT_ACK;
+                info->status.ack_signal = ts->ts_rssi;
+        }
+
+        /*
+        * Remove MAC header padding before giving the frame
+        * back to mac80211.
+        */
+        ath5k_remove_padding(skb);
+
+        if (ts->ts_antenna > 0 && ts->ts_antenna < 5)
+                sc->stats.antenna_tx[ts->ts_antenna]++;
+        else
+                sc->stats.antenna_tx[0]++; /* invalid */
+
+        ieee80211_tx_status(sc->hw, skb);
+}
+
 static void
 ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
 {
@@ -2128,96 +1693,51 @@ ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
         struct ath5k_buf *bf, *bf0;
         struct ath5k_desc *ds;
         struct sk_buff *skb;
-        struct ieee80211_tx_info *info;
-        int i, ret;
+        int ret;
 
         spin_lock(&txq->lock);
         list_for_each_entry_safe(bf, bf0, &txq->q, list) {
-                ds = bf->desc;
 
-                /*
-                 * It's possible that the hardware can say the buffer is
-                 * completed when it hasn't yet loaded the ds_link from
-                 * host memory and moved on.  If there are more TX
-                 * descriptors in the queue, wait for TXDP to change
-                 * before processing this one.
-                 */
-                if (ath5k_hw_get_txdp(sc->ah, txq->qnum) == bf->daddr &&
-                    !list_is_last(&bf->list, &txq->q))
-                        break;
+                txq->txq_poll_mark = false;
 
-                ret = sc->ah->ah_proc_tx_desc(sc->ah, ds, &ts);
-                if (unlikely(ret == -EINPROGRESS))
-                        break;
-                else if (unlikely(ret)) {
-                        ATH5K_ERR(sc, "error %d while processing queue %u\n",
-                                ret, txq->qnum);
-                        break;
-                }
-
-                sc->stats.tx_all_count++;
-                skb = bf->skb;
-                info = IEEE80211_SKB_CB(skb);
-                bf->skb = NULL;
+                /* skb might already have been processed last time. */
+                if (bf->skb != NULL) {
+                        ds = bf->desc;
 
-                pci_unmap_single(sc->pdev, bf->skbaddr, skb->len,
-                                PCI_DMA_TODEVICE);
-
-                ieee80211_tx_info_clear_status(info);
-                for (i = 0; i < 4; i++) {
-                        struct ieee80211_tx_rate *r =
-                                &info->status.rates[i];
-
-                        if (ts.ts_rate[i]) {
-                                r->idx = ath5k_hw_to_driver_rix(sc, ts.ts_rate[i]);
-                                r->count = ts.ts_retry[i];
-                        } else {
-                                r->idx = -1;
-                                r->count = 0;
+                        ret = sc->ah->ah_proc_tx_desc(sc->ah, ds, &ts);
+                        if (unlikely(ret == -EINPROGRESS))
+                                break;
+                        else if (unlikely(ret)) {
+                                ATH5K_ERR(sc,
+                                        "error %d while processing "
+                                        "queue %u\n", ret, txq->qnum);
+                                break;
                         }
-                }
-
-                /* count the successful attempt as well */
-                info->status.rates[ts.ts_final_idx].count++;
 
-                if (unlikely(ts.ts_status)) {
-                        sc->stats.ack_fail++;
-                        if (ts.ts_status & AR5K_TXERR_FILT) {
-                                info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
-                                sc->stats.txerr_filt++;
-                        }
-                        if (ts.ts_status & AR5K_TXERR_XRETRY)
-                                sc->stats.txerr_retry++;
-                        if (ts.ts_status & AR5K_TXERR_FIFO)
-                                sc->stats.txerr_fifo++;
-                } else {
-                        info->flags |= IEEE80211_TX_STAT_ACK;
-                        info->status.ack_signal = ts.ts_rssi;
+                        skb = bf->skb;
+                        bf->skb = NULL;
+                        pci_unmap_single(sc->pdev, bf->skbaddr, skb->len,
+                                        PCI_DMA_TODEVICE);
+                        ath5k_tx_frame_completed(sc, skb, &ts);
                 }
 
                 /*
-                 * Remove MAC header padding before giving the frame
-                 * back to mac80211.
+                 * It's possible that the hardware can say the buffer is
+                 * completed when it hasn't yet loaded the ds_link from
+                 * host memory and moved on.
+                 * Always keep the last descriptor to avoid HW races...
                  */
-                ath5k_remove_padding(skb);
-
-                if (ts.ts_antenna > 0 && ts.ts_antenna < 5)
-                        sc->stats.antenna_tx[ts.ts_antenna]++;
-                else
-                        sc->stats.antenna_tx[0]++; /* invalid */
-
-                ieee80211_tx_status(sc->hw, skb);
-
-                spin_lock(&sc->txbuflock);
-                list_move_tail(&bf->list, &sc->txbuf);
-                sc->txbuf_len++;
-                spin_unlock(&sc->txbuflock);
+                if (ath5k_hw_get_txdp(sc->ah, txq->qnum) != bf->daddr) {
+                        spin_lock(&sc->txbuflock);
+                        list_move_tail(&bf->list, &sc->txbuf);
+                        sc->txbuf_len++;
+                        txq->txq_len--;
+                        spin_unlock(&sc->txbuflock);
+                }
         }
-        if (likely(list_empty(&txq->q)))
-                txq->link = NULL;
         spin_unlock(&txq->lock);
-        if (sc->txbuf_len > ATH_TXBUF / 5)
-                ieee80211_wake_queues(sc->hw);
+        if (txq->txq_len < ATH5K_TXQ_LEN_LOW && txq->qnum < 4)
+                ieee80211_wake_queue(sc->hw, txq->qnum);
 }
 
 static void
@@ -2313,6 +1833,44 @@ err_unmap:
 }
 
 /*
+ * Updates the beacon that is sent by ath5k_beacon_send.  For adhoc,
+ * this is called only once at config_bss time, for AP we do it every
+ * SWBA interrupt so that the TIM will reflect buffered frames.
+ *
+ * Called with the beacon lock.
+ */
+static int
+ath5k_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+{
+        int ret;
+        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_vif *avf = (void *)vif->drv_priv;
+        struct sk_buff *skb;
+
+        if (WARN_ON(!vif)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        skb = ieee80211_beacon_get(hw, vif);
+
+        if (!skb) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ath5k_debug_dump_skb(sc, skb, "BC  ", 1);
+
+        ath5k_txbuf_free_skb(sc, avf->bbuf);
+        avf->bbuf->skb = skb;
+        ret = ath5k_beacon_setup(sc, avf->bbuf);
+        if (ret)
+                avf->bbuf->skb = NULL;
+out:
+        return ret;
+}
+
+/*
  * Transmit a beacon frame at SWBA.  Dynamic updates to the
  * frame contents are done as needed and the slot time is
  * also adjusted based on current state.
@@ -2323,16 +1881,14 @@ err_unmap:
 static void
 ath5k_beacon_send(struct ath5k_softc *sc)
 {
-        struct ath5k_buf *bf = sc->bbuf;
         struct ath5k_hw *ah = sc->ah;
+        struct ieee80211_vif *vif;
+        struct ath5k_vif *avf;
+        struct ath5k_buf *bf;
         struct sk_buff *skb;
 
         ATH5K_DBG_UNLIMIT(sc, ATH5K_DEBUG_BEACON, "in beacon_send\n");
 
-        if (unlikely(bf->skb == NULL || sc->opmode == NL80211_IFTYPE_STATION)) {
-                ATH5K_WARN(sc, "bf=%p bf_skb=%p\n", bf, bf ? bf->skb : NULL);
-                return;
-        }
         /*
          * Check if the previous beacon has gone out.  If
          * not, don't don't try to post another: skip this
@@ -2361,6 +1917,28 @@ ath5k_beacon_send(struct ath5k_softc *sc)
                 sc->bmisscount = 0;
         }
 
+        if (sc->opmode == NL80211_IFTYPE_AP && sc->num_ap_vifs > 1) {
+                u64 tsf = ath5k_hw_get_tsf64(ah);
+                u32 tsftu = TSF_TO_TU(tsf);
+                int slot = ((tsftu % sc->bintval) * ATH_BCBUF) / sc->bintval;
+                vif = sc->bslot[(slot + 1) % ATH_BCBUF];
+                ATH5K_DBG(sc, ATH5K_DEBUG_BEACON,
+                        "tsf %llx tsftu %x intval %u slot %u vif %p\n",
+                        (unsigned long long)tsf, tsftu, sc->bintval, slot, vif);
+        } else /* only one interface */
+                vif = sc->bslot[0];
+
+        if (!vif)
+                return;
+
+        avf = (void *)vif->drv_priv;
+        bf = avf->bbuf;
+        if (unlikely(bf->skb == NULL || sc->opmode == NL80211_IFTYPE_STATION ||
+                        sc->opmode == NL80211_IFTYPE_MONITOR)) {
+                ATH5K_WARN(sc, "bf=%p bf_skb=%p\n", bf, bf ? bf->skb : NULL);
+                return;
+        }
+
         /*
          * Stop any current dma and put the new frame on the queue.
          * This should never fail since we check above that no frames
@@ -2373,23 +1951,22 @@ ath5k_beacon_send(struct ath5k_softc *sc)
 
         /* refresh the beacon for AP mode */
         if (sc->opmode == NL80211_IFTYPE_AP)
-                ath5k_beacon_update(sc->hw, sc->vif);
+                ath5k_beacon_update(sc->hw, vif);
 
         ath5k_hw_set_txdp(ah, sc->bhalq, bf->daddr);
         ath5k_hw_start_tx_dma(ah, sc->bhalq);
         ATH5K_DBG(sc, ATH5K_DEBUG_BEACON, "TXDP[%u] = %llx (%p)\n",
                 sc->bhalq, (unsigned long long)bf->daddr, bf->desc);
 
-        skb = ieee80211_get_buffered_bc(sc->hw, sc->vif);
+        skb = ieee80211_get_buffered_bc(sc->hw, vif);
         while (skb) {
                 ath5k_tx_queue(sc->hw, skb, sc->cabq);
-                skb = ieee80211_get_buffered_bc(sc->hw, sc->vif);
+                skb = ieee80211_get_buffered_bc(sc->hw, vif);
         }
 
         sc->bsent++;
 }
 
-
 /**
  * ath5k_beacon_update_timers - update beacon timers
  *
@@ -2414,6 +1991,12 @@ ath5k_beacon_update_timers(struct ath5k_softc *sc, u64 bc_tsf)
         u64 hw_tsf;
 
         intval = sc->bintval & AR5K_BEACON_PERIOD;
+        if (sc->opmode == NL80211_IFTYPE_AP && sc->num_ap_vifs > 1) {
+                intval /= ATH_BCBUF;    /* staggered multi-bss beacons */
+                if (intval < 15)
+                        ATH5K_WARN(sc, "intval %u is too low, min 15\n",
+                                   intval);
+        }
         if (WARN_ON(!intval))
                 return;
 
@@ -2424,8 +2007,11 @@ ath5k_beacon_update_timers(struct ath5k_softc *sc, u64 bc_tsf)
         hw_tsf = ath5k_hw_get_tsf64(ah);
         hw_tu = TSF_TO_TU(hw_tsf);
 
-#define FUDGE 3
-        /* we use FUDGE to make sure the next TBTT is ahead of the current TU */
+#define FUDGE AR5K_TUNE_SW_BEACON_RESP + 3
+        /* We use FUDGE to make sure the next TBTT is ahead of the current TU.
+         * Since we later substract AR5K_TUNE_SW_BEACON_RESP (10) in the timer
+         * configuration we need to make sure it is bigger than that. */
+
         if (bc_tsf == -1) {
                 /*
                  * no beacons received, called internally.
@@ -2491,7 +2077,6 @@ ath5k_beacon_update_timers(struct ath5k_softc *sc, u64 bc_tsf)
                 intval & AR5K_BEACON_RESET_TSF ? "AR5K_BEACON_RESET_TSF" : "");
 }
 
-
 /**
  * ath5k_beacon_config - Configure the beacon queues and interrupts
  *
@@ -2570,155 +2155,6 @@ static void ath5k_tasklet_beacon(unsigned long data)
 * Interrupt handling *
 \********************/
 
-static int
-ath5k_init(struct ath5k_softc *sc)
-{
-        struct ath5k_hw *ah = sc->ah;
-        int ret, i;
-
-        mutex_lock(&sc->lock);
-
-        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "mode %d\n", sc->opmode);
-
-        /*
-         * Stop anything previously setup.  This is safe
-         * no matter this is the first time through or not.
-         */
-        ath5k_stop_locked(sc);
-
-        /*
-         * The basic interface to setting the hardware in a good
-         * state is ``reset''.  On return the hardware is known to
-         * be powered up and with interrupts disabled.  This must
-         * be followed by initialization of the appropriate bits
-         * and then setup of the interrupt mask.
-         */
-        sc->curchan = sc->hw->conf.channel;
-        sc->curband = &sc->sbands[sc->curchan->band];
-        sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
-                AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
-                AR5K_INT_FATAL | AR5K_INT_GLOBAL | AR5K_INT_MIB;
-
-        ret = ath5k_reset(sc, NULL);
-        if (ret)
-                goto done;
-
-        ath5k_rfkill_hw_start(ah);
-
-        /*
-         * Reset the key cache since some parts do not reset the
-         * contents on initial power up or resume from suspend.
-         */
-        for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
-                ath5k_hw_reset_key(ah, i);
-
-        ath5k_hw_set_ack_bitrate_high(ah, true);
-        ret = 0;
-done:
-        mmiowb();
-        mutex_unlock(&sc->lock);
-        return ret;
-}
-
-static int
-ath5k_stop_locked(struct ath5k_softc *sc)
-{
-        struct ath5k_hw *ah = sc->ah;
-
-        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "invalid %u\n",
-                        test_bit(ATH_STAT_INVALID, sc->status));
-
-        /*
-         * Shutdown the hardware and driver:
-         *    stop output from above
-         *    disable interrupts
-         *    turn off timers
-         *    turn off the radio
-         *    clear transmit machinery
-         *    clear receive machinery
-         *    drain and release tx queues
-         *    reclaim beacon resources
-         *    power down hardware
-         *
-         * Note that some of this work is not possible if the
-         * hardware is gone (invalid).
-         */
-        ieee80211_stop_queues(sc->hw);
-
-        if (!test_bit(ATH_STAT_INVALID, sc->status)) {
-                ath5k_led_off(sc);
-                ath5k_hw_set_imr(ah, 0);
-                synchronize_irq(sc->pdev->irq);
-        }
-        ath5k_txq_cleanup(sc);
-        if (!test_bit(ATH_STAT_INVALID, sc->status)) {
-                ath5k_rx_stop(sc);
-                ath5k_hw_phy_disable(ah);
-        }
-
-        return 0;
-}
-
-static void stop_tasklets(struct ath5k_softc *sc)
-{
-        tasklet_kill(&sc->rxtq);
-        tasklet_kill(&sc->txtq);
-        tasklet_kill(&sc->calib);
-        tasklet_kill(&sc->beacontq);
-        tasklet_kill(&sc->ani_tasklet);
-}
-
-/*
- * Stop the device, grabbing the top-level lock to protect
- * against concurrent entry through ath5k_init (which can happen
- * if another thread does a system call and the thread doing the
- * stop is preempted).
- */
-static int
-ath5k_stop_hw(struct ath5k_softc *sc)
-{
-        int ret;
-
-        mutex_lock(&sc->lock);
-        ret = ath5k_stop_locked(sc);
-        if (ret == 0 && !test_bit(ATH_STAT_INVALID, sc->status)) {
-                /*
-                 * Don't set the card in full sleep mode!
-                 *
-                 * a) When the device is in this state it must be carefully
-                 * woken up or references to registers in the PCI clock
-                 * domain may freeze the bus (and system).  This varies
-                 * by chip and is mostly an issue with newer parts
-                 * (madwifi sources mentioned srev >= 0x78) that go to
-                 * sleep more quickly.
-                 *
-                 * b) On older chips full sleep results a weird behaviour
-                 * during wakeup. I tested various cards with srev < 0x78
-                 * and they don't wake up after module reload, a second
-                 * module reload is needed to bring the card up again.
-                 *
-                 * Until we figure out what's going on don't enable
-                 * full chip reset on any chip (this is what Legacy HAL
-                 * and Sam's HAL do anyway). Instead Perform a full reset
-                 * on the device (same as initial state after attach) and
-                 * leave it idle (keep MAC/BB on warm reset) */
-                ret = ath5k_hw_on_hold(sc->ah);
-
-                ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
-                                "putting device to sleep\n");
-        }
-        ath5k_txbuf_free_skb(sc, sc->bbuf);
-
-        mmiowb();
-        mutex_unlock(&sc->lock);
-
-        stop_tasklets(sc);
-
-        ath5k_rfkill_hw_stop(sc->ah);
-
-        return ret;
-}
-
 static void
 ath5k_intr_calibration_poll(struct ath5k_hw *ah)
 {
@@ -2855,14 +2291,13 @@ ath5k_tasklet_calibrate(unsigned long data)
                                 sc->curchan->center_freq));
 
         /* Noise floor calibration interrupts rx/tx path while I/Q calibration
-         * doesn't. We stop the queues so that calibration doesn't interfere
-         * with TX and don't run it as often */
+         * doesn't.
+         * TODO: We should stop TX here, so that it doesn't interfere.
+         * Note that stopping the queues is not enough to stop TX! */
         if (time_is_before_eq_jiffies(ah->ah_cal_next_nf)) {
                 ah->ah_cal_next_nf = jiffies +
                         msecs_to_jiffies(ATH5K_TUNE_CALIBRATION_INTERVAL_NF);
-                ieee80211_stop_queues(sc->hw);
                 ath5k_hw_update_noise_floor(ah);
-                ieee80211_wake_queues(sc->hw);
         }
 
         ah->ah_cal_mask &= ~AR5K_CALIBRATION_FULL;
@@ -2881,68 +2316,208 @@ ath5k_tasklet_ani(unsigned long data)
 }
 
 
-/********************\
-* Mac80211 functions *
-\********************/
+static void
+ath5k_tx_complete_poll_work(struct work_struct *work)
+{
+        struct ath5k_softc *sc = container_of(work, struct ath5k_softc,
+                        tx_complete_work.work);
+        struct ath5k_txq *txq;
+        int i;
+        bool needreset = false;
+
+        for (i = 0; i < ARRAY_SIZE(sc->txqs); i++) {
+                if (sc->txqs[i].setup) {
+                        txq = &sc->txqs[i];
+                        spin_lock_bh(&txq->lock);
+                        if (txq->txq_len > 1) {
+                                if (txq->txq_poll_mark) {
+                                        ATH5K_DBG(sc, ATH5K_DEBUG_XMIT,
+                                                  "TX queue stuck %d\n",
+                                                  txq->qnum);
+                                        needreset = true;
+                                        txq->txq_stuck++;
+                                        spin_unlock_bh(&txq->lock);
+                                        break;
+                                } else {
+                                        txq->txq_poll_mark = true;
+                                }
+                        }
+                        spin_unlock_bh(&txq->lock);
+                }
+        }
+
+        if (needreset) {
+                ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
+                          "TX queues stuck, resetting\n");
+                ath5k_reset(sc, sc->curchan);
+        }
+
+        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
+                msecs_to_jiffies(ATH5K_TX_COMPLETE_POLL_INT));
+}
+
+
+/*************************\
+* Initialization routines *
+\*************************/
 
 static int
-ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+ath5k_stop_locked(struct ath5k_softc *sc)
 {
-        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_hw *ah = sc->ah;
+
+        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "invalid %u\n",
+                        test_bit(ATH_STAT_INVALID, sc->status));
+
+        /*
+         * Shutdown the hardware and driver:
+         *    stop output from above
+         *    disable interrupts
+         *    turn off timers
+         *    turn off the radio
+         *    clear transmit machinery
+         *    clear receive machinery
+         *    drain and release tx queues
+         *    reclaim beacon resources
+         *    power down hardware
+         *
+         * Note that some of this work is not possible if the
+         * hardware is gone (invalid).
+         */
+        ieee80211_stop_queues(sc->hw);
 
-        return ath5k_tx_queue(hw, skb, sc->txq);
+        if (!test_bit(ATH_STAT_INVALID, sc->status)) {
+                ath5k_led_off(sc);
+                ath5k_hw_set_imr(ah, 0);
+                synchronize_irq(sc->pdev->irq);
+        }
+        ath5k_txq_cleanup(sc);
+        if (!test_bit(ATH_STAT_INVALID, sc->status)) {
+                ath5k_rx_stop(sc);
+                ath5k_hw_phy_disable(ah);
+        }
+
+        return 0;
 }
 
-static int ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
-                          struct ath5k_txq *txq)
+static int
+ath5k_init(struct ath5k_softc *sc)
 {
-        struct ath5k_softc *sc = hw->priv;
-        struct ath5k_buf *bf;
-        unsigned long flags;
-        int padsize;
+        struct ath5k_hw *ah = sc->ah;
+        struct ath_common *common = ath5k_hw_common(ah);
+        int ret, i;
 
-        ath5k_debug_dump_skb(sc, skb, "TX  ", 1);
+        mutex_lock(&sc->lock);
+
+        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "mode %d\n", sc->opmode);
 
         /*
-         * The hardware expects the header padded to 4 byte boundaries.
-         * If this is not the case, we add the padding after the header.
+         * Stop anything previously setup.  This is safe
+         * no matter this is the first time through or not.
          */
-        padsize = ath5k_add_padding(skb);
-        if (padsize < 0) {
-                ATH5K_ERR(sc, "tx hdrlen not %%4: not enough"
-                          " headroom to pad");
-                goto drop_packet;
-        }
+        ath5k_stop_locked(sc);
 
-        spin_lock_irqsave(&sc->txbuflock, flags);
-        if (list_empty(&sc->txbuf)) {
-                ATH5K_ERR(sc, "no further txbuf available, dropping packet\n");
-                spin_unlock_irqrestore(&sc->txbuflock, flags);
-                ieee80211_stop_queue(hw, skb_get_queue_mapping(skb));
-                goto drop_packet;
-        }
-        bf = list_first_entry(&sc->txbuf, struct ath5k_buf, list);
-        list_del(&bf->list);
-        sc->txbuf_len--;
-        if (list_empty(&sc->txbuf))
-                ieee80211_stop_queues(hw);
-        spin_unlock_irqrestore(&sc->txbuflock, flags);
+        /*
+         * The basic interface to setting the hardware in a good
+         * state is ``reset''.  On return the hardware is known to
+         * be powered up and with interrupts disabled.  This must
+         * be followed by initialization of the appropriate bits
+         * and then setup of the interrupt mask.
+         */
+        sc->curchan = sc->hw->conf.channel;
+        sc->curband = &sc->sbands[sc->curchan->band];
+        sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
+                AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
+                AR5K_INT_FATAL | AR5K_INT_GLOBAL | AR5K_INT_MIB;
 
-        bf->skb = skb;
+        ret = ath5k_reset(sc, NULL);
+        if (ret)
+                goto done;
 
-        if (ath5k_txbuf_setup(sc, bf, txq, padsize)) {
-                bf->skb = NULL;
-                spin_lock_irqsave(&sc->txbuflock, flags);
-                list_add_tail(&bf->list, &sc->txbuf);
-                sc->txbuf_len++;
-                spin_unlock_irqrestore(&sc->txbuflock, flags);
-                goto drop_packet;
+        ath5k_rfkill_hw_start(ah);
+
+        /*
+         * Reset the key cache since some parts do not reset the
+         * contents on initial power up or resume from suspend.
+         */
+        for (i = 0; i < common->keymax; i++)
+                ath_hw_keyreset(common, (u16) i);
+
+        ath5k_hw_set_ack_bitrate_high(ah, true);
+
+        for (i = 0; i < ARRAY_SIZE(sc->bslot); i++)
+                sc->bslot[i] = NULL;
+
+        ret = 0;
+done:
+        mmiowb();
+        mutex_unlock(&sc->lock);
+
+        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
+                        msecs_to_jiffies(ATH5K_TX_COMPLETE_POLL_INT));
+
+        return ret;
+}
+
+static void stop_tasklets(struct ath5k_softc *sc)
+{
+        tasklet_kill(&sc->rxtq);
+        tasklet_kill(&sc->txtq);
+        tasklet_kill(&sc->calib);
+        tasklet_kill(&sc->beacontq);
+        tasklet_kill(&sc->ani_tasklet);
+}
+
+/*
+ * Stop the device, grabbing the top-level lock to protect
+ * against concurrent entry through ath5k_init (which can happen
+ * if another thread does a system call and the thread doing the
+ * stop is preempted).
+ */
+static int
+ath5k_stop_hw(struct ath5k_softc *sc)
+{
+        int ret;
+
+        mutex_lock(&sc->lock);
+        ret = ath5k_stop_locked(sc);
+        if (ret == 0 && !test_bit(ATH_STAT_INVALID, sc->status)) {
+                /*
+                 * Don't set the card in full sleep mode!
+                 *
+                 * a) When the device is in this state it must be carefully
+                 * woken up or references to registers in the PCI clock
+                 * domain may freeze the bus (and system).  This varies
+                 * by chip and is mostly an issue with newer parts
+                 * (madwifi sources mentioned srev >= 0x78) that go to
+                 * sleep more quickly.
+                 *
+                 * b) On older chips full sleep results a weird behaviour
+                 * during wakeup. I tested various cards with srev < 0x78
+                 * and they don't wake up after module reload, a second
+                 * module reload is needed to bring the card up again.
+                 *
+                 * Until we figure out what's going on don't enable
+                 * full chip reset on any chip (this is what Legacy HAL
+                 * and Sam's HAL do anyway). Instead Perform a full reset
+                 * on the device (same as initial state after attach) and
+                 * leave it idle (keep MAC/BB on warm reset) */
+                ret = ath5k_hw_on_hold(sc->ah);
+
+                ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
+                                "putting device to sleep\n");
         }
-        return NETDEV_TX_OK;
 
-drop_packet:
-        dev_kfree_skb_any(skb);
-        return NETDEV_TX_OK;
+        mmiowb();
+        mutex_unlock(&sc->lock);
+
+        stop_tasklets(sc);
+
+        cancel_delayed_work_sync(&sc->tx_complete_work);
+
+        ath5k_rfkill_hw_stop(sc->ah);
+
+        return ret;
 }
 
 /*
@@ -3019,6 +2594,208 @@ static void ath5k_reset_work(struct work_struct *work)
         mutex_unlock(&sc->lock);
 }
 
+static int
+ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
+{
+        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_hw *ah = sc->ah;
+        struct ath_regulatory *regulatory = ath5k_hw_regulatory(ah);
+        struct ath5k_txq *txq;
+        u8 mac[ETH_ALEN] = {};
+        int ret;
+
+        ATH5K_DBG(sc, ATH5K_DEBUG_ANY, "devid 0x%x\n", pdev->device);
+
+        /*
+         * Check if the MAC has multi-rate retry support.
+         * We do this by trying to setup a fake extended
+         * descriptor.  MACs that don't have support will
+         * return false w/o doing anything.  MACs that do
+         * support it will return true w/o doing anything.
+         */
+        ret = ath5k_hw_setup_mrr_tx_desc(ah, NULL, 0, 0, 0, 0, 0, 0);
+
+        if (ret < 0)
+                goto err;
+        if (ret > 0)
+                __set_bit(ATH_STAT_MRRETRY, sc->status);
+
+        /*
+         * Collect the channel list.  The 802.11 layer
+         * is resposible for filtering this list based
+         * on settings like the phy mode and regulatory
+         * domain restrictions.
+         */
+        ret = ath5k_setup_bands(hw);
+        if (ret) {
+                ATH5K_ERR(sc, "can't get channels\n");
+                goto err;
+        }
+
+        /* NB: setup here so ath5k_rate_update is happy */
+        if (test_bit(AR5K_MODE_11A, ah->ah_modes))
+                ath5k_setcurmode(sc, AR5K_MODE_11A);
+        else
+                ath5k_setcurmode(sc, AR5K_MODE_11B);
+
+        /*
+         * Allocate tx+rx descriptors and populate the lists.
+         */
+        ret = ath5k_desc_alloc(sc, pdev);
+        if (ret) {
+                ATH5K_ERR(sc, "can't allocate descriptors\n");
+                goto err;
+        }
+
+        /*
+         * Allocate hardware transmit queues: one queue for
+         * beacon frames and one data queue for each QoS
+         * priority.  Note that hw functions handle resetting
+         * these queues at the needed time.
+         */
+        ret = ath5k_beaconq_setup(ah);
+        if (ret < 0) {
+                ATH5K_ERR(sc, "can't setup a beacon xmit queue\n");
+                goto err_desc;
+        }
+        sc->bhalq = ret;
+        sc->cabq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_CAB, 0);
+        if (IS_ERR(sc->cabq)) {
+                ATH5K_ERR(sc, "can't setup cab queue\n");
+                ret = PTR_ERR(sc->cabq);
+                goto err_bhal;
+        }
+
+        /* This order matches mac80211's queue priority, so we can
+         * directly use the mac80211 queue number without any mapping */
+        txq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_DATA, AR5K_WME_AC_VO);
+        if (IS_ERR(txq)) {
+                ATH5K_ERR(sc, "can't setup xmit queue\n");
+                ret = PTR_ERR(txq);
+                goto err_queues;
+        }
+        txq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_DATA, AR5K_WME_AC_VI);
+        if (IS_ERR(txq)) {
+                ATH5K_ERR(sc, "can't setup xmit queue\n");
+                ret = PTR_ERR(txq);
+                goto err_queues;
+        }
+        txq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_DATA, AR5K_WME_AC_BE);
+        if (IS_ERR(txq)) {
+                ATH5K_ERR(sc, "can't setup xmit queue\n");
+                ret = PTR_ERR(txq);
+                goto err_queues;
+        }
+        txq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_DATA, AR5K_WME_AC_BK);
+        if (IS_ERR(txq)) {
+                ATH5K_ERR(sc, "can't setup xmit queue\n");
+                ret = PTR_ERR(txq);
+                goto err_queues;
+        }
+        hw->queues = 4;
+
+        tasklet_init(&sc->rxtq, ath5k_tasklet_rx, (unsigned long)sc);
+        tasklet_init(&sc->txtq, ath5k_tasklet_tx, (unsigned long)sc);
+        tasklet_init(&sc->calib, ath5k_tasklet_calibrate, (unsigned long)sc);
+        tasklet_init(&sc->beacontq, ath5k_tasklet_beacon, (unsigned long)sc);
+        tasklet_init(&sc->ani_tasklet, ath5k_tasklet_ani, (unsigned long)sc);
+
+        INIT_WORK(&sc->reset_work, ath5k_reset_work);
+        INIT_DELAYED_WORK(&sc->tx_complete_work, ath5k_tx_complete_poll_work);
+
+        ret = ath5k_eeprom_read_mac(ah, mac);
+        if (ret) {
+                ATH5K_ERR(sc, "unable to read address from EEPROM: 0x%04x\n",
+                        sc->pdev->device);
+                goto err_queues;
+        }
+
+        SET_IEEE80211_PERM_ADDR(hw, mac);
+        memcpy(&sc->lladdr, mac, ETH_ALEN);
+        /* All MAC address bits matter for ACKs */
+        ath5k_update_bssid_mask_and_opmode(sc, NULL);
+
+        regulatory->current_rd = ah->ah_capabilities.cap_eeprom.ee_regdomain;
+        ret = ath_regd_init(regulatory, hw->wiphy, ath5k_reg_notifier);
+        if (ret) {
+                ATH5K_ERR(sc, "can't initialize regulatory system\n");
+                goto err_queues;
+        }
+
+        ret = ieee80211_register_hw(hw);
+        if (ret) {
+                ATH5K_ERR(sc, "can't register ieee80211 hw\n");
+                goto err_queues;
+        }
+
+        if (!ath_is_world_regd(regulatory))
+                regulatory_hint(hw->wiphy, regulatory->alpha2);
+
+        ath5k_init_leds(sc);
+
+        ath5k_sysfs_register(sc);
+
+        return 0;
+err_queues:
+        ath5k_txq_release(sc);
+err_bhal:
+        ath5k_hw_release_tx_queue(ah, sc->bhalq);
+err_desc:
+        ath5k_desc_free(sc, pdev);
+err:
+        return ret;
+}
+
+static void
+ath5k_detach(struct pci_dev *pdev, struct ieee80211_hw *hw)
+{
+        struct ath5k_softc *sc = hw->priv;
+
+        /*
+         * NB: the order of these is important:
+         * o call the 802.11 layer before detaching ath5k_hw to
+         *   ensure callbacks into the driver to delete global
+         *   key cache entries can be handled
+         * o reclaim the tx queue data structures after calling
+         *   the 802.11 layer as we'll get called back to reclaim
+         *   node state and potentially want to use them
+         * o to cleanup the tx queues the hal is called, so detach
+         *   it last
+         * XXX: ??? detach ath5k_hw ???
+         * Other than that, it's straightforward...
+         */
+        ieee80211_unregister_hw(hw);
+        ath5k_desc_free(sc, pdev);
+        ath5k_txq_release(sc);
+        ath5k_hw_release_tx_queue(sc->ah, sc->bhalq);
+        ath5k_unregister_leds(sc);
+
+        ath5k_sysfs_unregister(sc);
+        /*
+         * NB: can't reclaim these until after ieee80211_ifdetach
+         * returns because we'll get called back to reclaim node
+         * state and potentially want to use them.
+         */
+}
+
+/********************\
+* Mac80211 functions *
+\********************/
+
+static int
+ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct ath5k_softc *sc = hw->priv;
+        u16 qnum = skb_get_queue_mapping(skb);
+
+        if (WARN_ON(qnum >= sc->ah->ah_capabilities.cap_queues.q_tx_num)) {
+                dev_kfree_skb_any(skb);
+                return 0;
+        }
+
+        return ath5k_tx_queue(hw, skb, &sc->txqs[qnum]);
+}
+
 static int ath5k_start(struct ieee80211_hw *hw)
 {
         return ath5k_init(hw->priv);
@@ -3034,31 +2811,78 @@ static int ath5k_add_interface(struct ieee80211_hw *hw,
 {
         struct ath5k_softc *sc = hw->priv;
         int ret;
+        struct ath5k_vif *avf = (void *)vif->drv_priv;
 
         mutex_lock(&sc->lock);
-        if (sc->vif) {
-                ret = 0;
+
+        if ((vif->type == NL80211_IFTYPE_AP ||
+             vif->type == NL80211_IFTYPE_ADHOC)
+            && (sc->num_ap_vifs + sc->num_adhoc_vifs) >= ATH_BCBUF) {
+                ret = -ELNRNG;
                 goto end;
         }
 
-        sc->vif = vif;
+        /* Don't allow other interfaces if one ad-hoc is configured.
+         * TODO: Fix the problems with ad-hoc and multiple other interfaces.
+         * We would need to operate the HW in ad-hoc mode to allow TSF updates
+         * for the IBSS, but this breaks with additional AP or STA interfaces
+         * at the moment. */
+        if (sc->num_adhoc_vifs ||
+            (sc->nvifs && vif->type == NL80211_IFTYPE_ADHOC)) {
+                ATH5K_ERR(sc, "Only one single ad-hoc interface is allowed.\n");
+                ret = -ELNRNG;
+                goto end;
+        }
 
         switch (vif->type) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
         case NL80211_IFTYPE_MESH_POINT:
-                sc->opmode = vif->type;
+                avf->opmode = vif->type;
                 break;
         default:
                 ret = -EOPNOTSUPP;
                 goto end;
         }
 
-        ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "add interface mode %d\n", sc->opmode);
+        sc->nvifs++;
+        ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "add interface mode %d\n", avf->opmode);
+
+        /* Assign the vap/adhoc to a beacon xmit slot. */
+        if ((avf->opmode == NL80211_IFTYPE_AP) ||
+            (avf->opmode == NL80211_IFTYPE_ADHOC)) {
+                int slot;
 
+                WARN_ON(list_empty(&sc->bcbuf));
+                avf->bbuf = list_first_entry(&sc->bcbuf, struct ath5k_buf,
+                                             list);
+                list_del(&avf->bbuf->list);
+
+                avf->bslot = 0;
+                for (slot = 0; slot < ATH_BCBUF; slot++) {
+                        if (!sc->bslot[slot]) {
+                                avf->bslot = slot;
+                                break;
+                        }
+                }
+                BUG_ON(sc->bslot[avf->bslot] != NULL);
+                sc->bslot[avf->bslot] = vif;
+                if (avf->opmode == NL80211_IFTYPE_AP)
+                        sc->num_ap_vifs++;
+                else
+                        sc->num_adhoc_vifs++;
+        }
+
+        /* Any MAC address is fine, all others are included through the
+         * filter.
+         */
+        memcpy(&sc->lladdr, vif->addr, ETH_ALEN);
         ath5k_hw_set_lladdr(sc->ah, vif->addr);
-        ath5k_mode_setup(sc);
+
+        memcpy(&avf->lladdr, vif->addr, ETH_ALEN);
+
+        ath5k_mode_setup(sc, vif);
 
         ret = 0;
 end:
@@ -3071,15 +2895,29 @@ ath5k_remove_interface(struct ieee80211_hw *hw,
                         struct ieee80211_vif *vif)
 {
         struct ath5k_softc *sc = hw->priv;
-        u8 mac[ETH_ALEN] = {};
+        struct ath5k_vif *avf = (void *)vif->drv_priv;
+        unsigned int i;
 
         mutex_lock(&sc->lock);
-        if (sc->vif != vif)
-                goto end;
+        sc->nvifs--;
+
+        if (avf->bbuf) {
+                ath5k_txbuf_free_skb(sc, avf->bbuf);
+                list_add_tail(&avf->bbuf->list, &sc->bcbuf);
+                for (i = 0; i < ATH_BCBUF; i++) {
+                        if (sc->bslot[i] == vif) {
+                                sc->bslot[i] = NULL;
+                                break;
+                        }
+                }
+                avf->bbuf = NULL;
+        }
+        if (avf->opmode == NL80211_IFTYPE_AP)
+                sc->num_ap_vifs--;
+        else if (avf->opmode == NL80211_IFTYPE_ADHOC)
+                sc->num_adhoc_vifs--;
 
-        ath5k_hw_set_lladdr(sc->ah, mac);
-        sc->vif = NULL;
-end:
+        ath5k_update_bssid_mask_and_opmode(sc, NULL);
         mutex_unlock(&sc->lock);
 }
 
@@ -3162,6 +3000,19 @@ static u64 ath5k_prepare_multicast(struct ieee80211_hw *hw,
         return ((u64)(mfilt[1]) << 32) | mfilt[0];
 }
 
+static bool ath_any_vif_assoc(struct ath5k_softc *sc)
+{
+        struct ath_vif_iter_data iter_data;
+        iter_data.hw_macaddr = NULL;
+        iter_data.any_assoc = false;
+        iter_data.need_set_hw_addr = false;
+        iter_data.found_active = true;
+
+        ieee80211_iterate_active_interfaces_atomic(sc->hw, ath_vif_iter,
+                                                   &iter_data);
+        return iter_data.any_assoc;
+}
+
 #define SUPPORTED_FIF_FLAGS \
         FIF_PROMISC_IN_BSS |  FIF_ALLMULTI | FIF_FCSFAIL | \
         FIF_PLCPFAIL | FIF_CONTROL | FIF_OTHER_BSS | \
@@ -3232,7 +3083,7 @@ static void ath5k_configure_filter(struct ieee80211_hw *hw,
 
         /* FIF_BCN_PRBRESP_PROMISC really means to enable beacons
         * and probes for any BSSID */
-        if (*new_flags & FIF_BCN_PRBRESP_PROMISC)
+        if ((*new_flags & FIF_BCN_PRBRESP_PROMISC) || (sc->nvifs > 1))
                 rfilt |= AR5K_RX_FILTER_BEACON;
 
         /* FIF_CONTROL doc says that if FIF_PROMISC_IN_BSS is not
@@ -3291,18 +3142,14 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         if (modparam_nohwcrypt)
                 return -EOPNOTSUPP;
 
-        if (sc->opmode == NL80211_IFTYPE_AP)
-                return -EOPNOTSUPP;
-
         switch (key->cipher) {
         case WLAN_CIPHER_SUITE_WEP40:
         case WLAN_CIPHER_SUITE_WEP104:
         case WLAN_CIPHER_SUITE_TKIP:
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
-                if (sc->ah->ah_aes_support)
+                if (common->crypt_caps & ATH_CRYPT_CAP_CIPHER_AESCCM)
                         break;
-
                 return -EOPNOTSUPP;
         default:
                 WARN_ON(1);
@@ -3313,27 +3160,25 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         switch (cmd) {
         case SET_KEY:
-                ret = ath5k_hw_set_key(sc->ah, key->keyidx, key,
-                                       sta ? sta->addr : NULL);
-                if (ret) {
-                        ATH5K_ERR(sc, "can't set the key\n");
-                        goto unlock;
+                ret = ath_key_config(common, vif, sta, key);
+                if (ret >= 0) {
+                        key->hw_key_idx = ret;
+                        /* push IV and Michael MIC generation to stack */
+                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+                        if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
+                                key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
+                        if (key->cipher == WLAN_CIPHER_SUITE_CCMP)
+                                key->flags |= IEEE80211_KEY_FLAG_SW_MGMT;
+                        ret = 0;
                 }
-                __set_bit(key->keyidx, common->keymap);
-                key->hw_key_idx = key->keyidx;
-                key->flags |= (IEEE80211_KEY_FLAG_GENERATE_IV |
-                               IEEE80211_KEY_FLAG_GENERATE_MMIC);
                 break;
         case DISABLE_KEY:
-                ath5k_hw_reset_key(sc->ah, key->keyidx);
-                __clear_bit(key->keyidx, common->keymap);
+                ath_key_delete(common, key);
                 break;
         default:
                 ret = -EINVAL;
-                goto unlock;
         }
 
-unlock:
         mmiowb();
         mutex_unlock(&sc->lock);
         return ret;
@@ -3403,43 +3248,6 @@ ath5k_reset_tsf(struct ieee80211_hw *hw)
                 ath5k_hw_reset_tsf(sc->ah);
 }
 
-/*
- * Updates the beacon that is sent by ath5k_beacon_send.  For adhoc,
- * this is called only once at config_bss time, for AP we do it every
- * SWBA interrupt so that the TIM will reflect buffered frames.
- *
- * Called with the beacon lock.
- */
-static int
-ath5k_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
-{
-        int ret;
-        struct ath5k_softc *sc = hw->priv;
-        struct sk_buff *skb;
-
-        if (WARN_ON(!vif)) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        skb = ieee80211_beacon_get(hw, vif);
-
-        if (!skb) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        ath5k_debug_dump_skb(sc, skb, "BC  ", 1);
-
-        ath5k_txbuf_free_skb(sc, sc->bbuf);
-        sc->bbuf->skb = skb;
-        ret = ath5k_beacon_setup(sc, sc->bbuf);
-        if (ret)
-                sc->bbuf->skb = NULL;
-out:
-        return ret;
-}
-
 static void
 set_beacon_filter(struct ieee80211_hw *hw, bool enable)
 {
@@ -3460,14 +3268,13 @@ static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
                                     struct ieee80211_bss_conf *bss_conf,
                                     u32 changes)
 {
+        struct ath5k_vif *avf = (void *)vif->drv_priv;
         struct ath5k_softc *sc = hw->priv;
         struct ath5k_hw *ah = sc->ah;
         struct ath_common *common = ath5k_hw_common(ah);
         unsigned long flags;
 
         mutex_lock(&sc->lock);
-        if (WARN_ON(sc->vif != vif))
-                goto unlock;
 
         if (changes & BSS_CHANGED_BSSID) {
                 /* Cache for later use during resets */
@@ -3481,7 +3288,12 @@ static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
                 sc->bintval = bss_conf->beacon_int;
 
         if (changes & BSS_CHANGED_ASSOC) {
-                sc->assoc = bss_conf->assoc;
+                avf->assoc = bss_conf->assoc;
+                if (bss_conf->assoc)
+                        sc->assoc = bss_conf->assoc;
+                else
+                        sc->assoc = ath_any_vif_assoc(sc);
+
                 if (sc->opmode == NL80211_IFTYPE_STATION)
                         set_beacon_filter(hw, sc->assoc);
                 ath5k_hw_set_ledstate(sc->ah, sc->assoc ?
@@ -3509,7 +3321,6 @@ static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
                        BSS_CHANGED_BEACON_INT))
                 ath5k_beacon_config(sc);
 
- unlock:
         mutex_unlock(&sc->lock);
 }
 
@@ -3545,3 +3356,399 @@ static void ath5k_set_coverage_class(struct ieee80211_hw *hw, u8 coverage_class)
         ath5k_hw_set_coverage_class(sc->ah, coverage_class);
         mutex_unlock(&sc->lock);
 }
+
+static int ath5k_conf_tx(struct ieee80211_hw *hw, u16 queue,
+                         const struct ieee80211_tx_queue_params *params)
+{
+        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_hw *ah = sc->ah;
+        struct ath5k_txq_info qi;
+        int ret = 0;
+
+        if (queue >= ah->ah_capabilities.cap_queues.q_tx_num)
+                return 0;
+
+        mutex_lock(&sc->lock);
+
+        ath5k_hw_get_tx_queueprops(ah, queue, &qi);
+
+        qi.tqi_aifs = params->aifs;
+        qi.tqi_cw_min = params->cw_min;
+        qi.tqi_cw_max = params->cw_max;
+        qi.tqi_burst_time = params->txop;
+
+        ATH5K_DBG(sc, ATH5K_DEBUG_ANY,
+                  "Configure tx [queue %d],  "
+                  "aifs: %d, cw_min: %d, cw_max: %d, txop: %d\n",
+                  queue, params->aifs, params->cw_min,
+                  params->cw_max, params->txop);
+
+        if (ath5k_hw_set_tx_queueprops(ah, queue, &qi)) {
+                ATH5K_ERR(sc,
+                          "Unable to update hardware queue %u!\n", queue);
+                ret = -EIO;
+        } else
+                ath5k_hw_reset_tx_queue(ah, queue);
+
+        mutex_unlock(&sc->lock);
+
+        return ret;
+}
+
+static const struct ieee80211_ops ath5k_hw_ops = {
+        .tx             = ath5k_tx,
+        .start          = ath5k_start,
+        .stop           = ath5k_stop,
+        .add_interface  = ath5k_add_interface,
+        .remove_interface = ath5k_remove_interface,
+        .config         = ath5k_config,
+        .prepare_multicast = ath5k_prepare_multicast,
+        .configure_filter = ath5k_configure_filter,
+        .set_key        = ath5k_set_key,
+        .get_stats      = ath5k_get_stats,
+        .get_survey     = ath5k_get_survey,
+        .conf_tx        = ath5k_conf_tx,
+        .get_tsf        = ath5k_get_tsf,
+        .set_tsf        = ath5k_set_tsf,
+        .reset_tsf      = ath5k_reset_tsf,
+        .bss_info_changed = ath5k_bss_info_changed,
+        .sw_scan_start  = ath5k_sw_scan_start,
+        .sw_scan_complete = ath5k_sw_scan_complete,
+        .set_coverage_class = ath5k_set_coverage_class,
+};
+
+/********************\
+* PCI Initialization *
+\********************/
+
+static int __devinit
+ath5k_pci_probe(struct pci_dev *pdev,
+                const struct pci_device_id *id)
+{
+        void __iomem *mem;
+        struct ath5k_softc *sc;
+        struct ath_common *common;
+        struct ieee80211_hw *hw;
+        int ret;
+        u8 csz;
+
+        /*
+         * L0s needs to be disabled on all ath5k cards.
+         *
+         * For distributions shipping with CONFIG_PCIEASPM (this will be enabled
+         * by default in the future in 2.6.36) this will also mean both L1 and
+         * L0s will be disabled when a pre 1.1 PCIe device is detected. We do
+         * know L1 works correctly even for all ath5k pre 1.1 PCIe devices
+         * though but cannot currently undue the effect of a blacklist, for
+         * details you can read pcie_aspm_sanity_check() and see how it adjusts
+         * the device link capability.
+         *
+         * It may be possible in the future to implement some PCI API to allow
+         * drivers to override blacklists for pre 1.1 PCIe but for now it is
+         * best to accept that both L0s and L1 will be disabled completely for
+         * distributions shipping with CONFIG_PCIEASPM rather than having this
+         * issue present. Motivation for adding this new API will be to help
+         * with power consumption for some of these devices.
+         */
+        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S);
+
+        ret = pci_enable_device(pdev);
+        if (ret) {
+                dev_err(&pdev->dev, "can't enable device\n");
+                goto err;
+        }
+
+        /* XXX 32-bit addressing only */
+        ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+        if (ret) {
+                dev_err(&pdev->dev, "32-bit DMA not available\n");
+                goto err_dis;
+        }
+
+        /*
+         * Cache line size is used to size and align various
+         * structures used to communicate with the hardware.
+         */
+        pci_read_config_byte(pdev, PCI_CACHE_LINE_SIZE, &csz);
+        if (csz == 0) {
+                /*
+                 * Linux 2.4.18 (at least) writes the cache line size
+                 * register as a 16-bit wide register which is wrong.
+                 * We must have this setup properly for rx buffer
+                 * DMA to work so force a reasonable value here if it
+                 * comes up zero.
+                 */
+                csz = L1_CACHE_BYTES >> 2;
+                pci_write_config_byte(pdev, PCI_CACHE_LINE_SIZE, csz);
+        }
+        /*
+         * The default setting of latency timer yields poor results,
+         * set it to the value used by other systems.  It may be worth
+         * tweaking this setting more.
+         */
+        pci_write_config_byte(pdev, PCI_LATENCY_TIMER, 0xa8);
+
+        /* Enable bus mastering */
+        pci_set_master(pdev);
+
+        /*
+         * Disable the RETRY_TIMEOUT register (0x41) to keep
+         * PCI Tx retries from interfering with C3 CPU state.
+         */
+        pci_write_config_byte(pdev, 0x41, 0);
+
+        ret = pci_request_region(pdev, 0, "ath5k");
+        if (ret) {
+                dev_err(&pdev->dev, "cannot reserve PCI memory region\n");
+                goto err_dis;
+        }
+
+        mem = pci_iomap(pdev, 0, 0);
+        if (!mem) {
+                dev_err(&pdev->dev, "cannot remap PCI memory region\n") ;
+                ret = -EIO;
+                goto err_reg;
+        }
+
+        /*
+         * Allocate hw (mac80211 main struct)
+         * and hw->priv (driver private data)
+         */
+        hw = ieee80211_alloc_hw(sizeof(*sc), &ath5k_hw_ops);
+        if (hw == NULL) {
+                dev_err(&pdev->dev, "cannot allocate ieee80211_hw\n");
+                ret = -ENOMEM;
+                goto err_map;
+        }
+
+        dev_info(&pdev->dev, "registered as '%s'\n", wiphy_name(hw->wiphy));
+
+        /* Initialize driver private data */
+        SET_IEEE80211_DEV(hw, &pdev->dev);
+        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
+                    IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
+                    IEEE80211_HW_SIGNAL_DBM;
+
+        hw->wiphy->interface_modes =
+                BIT(NL80211_IFTYPE_AP) |
+                BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_ADHOC) |
+                BIT(NL80211_IFTYPE_MESH_POINT);
+
+        hw->extra_tx_headroom = 2;
+        hw->channel_change_time = 5000;
+        sc = hw->priv;
+        sc->hw = hw;
+        sc->pdev = pdev;
+
+        /*
+         * Mark the device as detached to avoid processing
+         * interrupts until setup is complete.
+         */
+        __set_bit(ATH_STAT_INVALID, sc->status);
+
+        sc->iobase = mem; /* So we can unmap it on detach */
+        sc->opmode = NL80211_IFTYPE_STATION;
+        sc->bintval = 1000;
+        mutex_init(&sc->lock);
+        spin_lock_init(&sc->rxbuflock);
+        spin_lock_init(&sc->txbuflock);
+        spin_lock_init(&sc->block);
+
+        /* Set private data */
+        pci_set_drvdata(pdev, sc);
+
+        /* Setup interrupt handler */
+        ret = request_irq(pdev->irq, ath5k_intr, IRQF_SHARED, "ath", sc);
+        if (ret) {
+                ATH5K_ERR(sc, "request_irq failed\n");
+                goto err_free;
+        }
+
+        /* If we passed the test, malloc an ath5k_hw struct */
+        sc->ah = kzalloc(sizeof(struct ath5k_hw), GFP_KERNEL);
+        if (!sc->ah) {
+                ret = -ENOMEM;
+                ATH5K_ERR(sc, "out of memory\n");
+                goto err_irq;
+        }
+
+        sc->ah->ah_sc = sc;
+        sc->ah->ah_iobase = sc->iobase;
+        common = ath5k_hw_common(sc->ah);
+        common->ops = &ath5k_common_ops;
+        common->ah = sc->ah;
+        common->hw = hw;
+        common->cachelsz = csz << 2; /* convert to bytes */
+
+        /* Initialize device */
+        ret = ath5k_hw_attach(sc);
+        if (ret) {
+                goto err_free_ah;
+        }
+
+        /* set up multi-rate retry capabilities */
+        if (sc->ah->ah_version == AR5K_AR5212) {
+                hw->max_rates = 4;
+                hw->max_rate_tries = 11;
+        }
+
+        hw->vif_data_size = sizeof(struct ath5k_vif);
+
+        /* Finish private driver data initialization */
+        ret = ath5k_attach(pdev, hw);
+        if (ret)
+                goto err_ah;
+
+        ATH5K_INFO(sc, "Atheros AR%s chip found (MAC: 0x%x, PHY: 0x%x)\n",
+                        ath5k_chip_name(AR5K_VERSION_MAC, sc->ah->ah_mac_srev),
+                                        sc->ah->ah_mac_srev,
+                                        sc->ah->ah_phy_revision);
+
+        if (!sc->ah->ah_single_chip) {
+                /* Single chip radio (!RF5111) */
+                if (sc->ah->ah_radio_5ghz_revision &&
+                        !sc->ah->ah_radio_2ghz_revision) {
+                        /* No 5GHz support -> report 2GHz radio */
+                        if (!test_bit(AR5K_MODE_11A,
+                                sc->ah->ah_capabilities.cap_mode)) {
+                                ATH5K_INFO(sc, "RF%s 2GHz radio found (0x%x)\n",
+                                        ath5k_chip_name(AR5K_VERSION_RAD,
+                                                sc->ah->ah_radio_5ghz_revision),
+                                                sc->ah->ah_radio_5ghz_revision);
+                        /* No 2GHz support (5110 and some
+                         * 5Ghz only cards) -> report 5Ghz radio */
+                        } else if (!test_bit(AR5K_MODE_11B,
+                                sc->ah->ah_capabilities.cap_mode)) {
+                                ATH5K_INFO(sc, "RF%s 5GHz radio found (0x%x)\n",
+                                        ath5k_chip_name(AR5K_VERSION_RAD,
+                                                sc->ah->ah_radio_5ghz_revision),
+                                                sc->ah->ah_radio_5ghz_revision);
+                        /* Multiband radio */
+                        } else {
+                                ATH5K_INFO(sc, "RF%s multiband radio found"
+                                        " (0x%x)\n",
+                                        ath5k_chip_name(AR5K_VERSION_RAD,
+                                                sc->ah->ah_radio_5ghz_revision),
+                                                sc->ah->ah_radio_5ghz_revision);
+                        }
+                }
+                /* Multi chip radio (RF5111 - RF2111) ->
+                 * report both 2GHz/5GHz radios */
+                else if (sc->ah->ah_radio_5ghz_revision &&
+                                sc->ah->ah_radio_2ghz_revision){
+                        ATH5K_INFO(sc, "RF%s 5GHz radio found (0x%x)\n",
+                                ath5k_chip_name(AR5K_VERSION_RAD,
+                                        sc->ah->ah_radio_5ghz_revision),
+                                        sc->ah->ah_radio_5ghz_revision);
+                        ATH5K_INFO(sc, "RF%s 2GHz radio found (0x%x)\n",
+                                ath5k_chip_name(AR5K_VERSION_RAD,
+                                        sc->ah->ah_radio_2ghz_revision),
+                                        sc->ah->ah_radio_2ghz_revision);
+                }
+        }
+
+        ath5k_debug_init_device(sc);
+
+        /* ready to process interrupts */
+        __clear_bit(ATH_STAT_INVALID, sc->status);
+
+        return 0;
+err_ah:
+        ath5k_hw_detach(sc->ah);
+err_free_ah:
+        kfree(sc->ah);
+err_irq:
+        free_irq(pdev->irq, sc);
+err_free:
+        ieee80211_free_hw(hw);
+err_map:
+        pci_iounmap(pdev, mem);
+err_reg:
+        pci_release_region(pdev, 0);
+err_dis:
+        pci_disable_device(pdev);
+err:
+        return ret;
+}
+
+static void __devexit
+ath5k_pci_remove(struct pci_dev *pdev)
+{
+        struct ath5k_softc *sc = pci_get_drvdata(pdev);
+
+        ath5k_debug_finish_device(sc);
+        ath5k_detach(pdev, sc->hw);
+        ath5k_hw_detach(sc->ah);
+        kfree(sc->ah);
+        free_irq(pdev->irq, sc);
+        pci_iounmap(pdev, sc->iobase);
+        pci_release_region(pdev, 0);
+        pci_disable_device(pdev);
+        ieee80211_free_hw(sc->hw);
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int ath5k_pci_suspend(struct device *dev)
+{
+        struct ath5k_softc *sc = pci_get_drvdata(to_pci_dev(dev));
+
+        ath5k_led_off(sc);
+        return 0;
+}
+
+static int ath5k_pci_resume(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct ath5k_softc *sc = pci_get_drvdata(pdev);
+
+        /*
+         * Suspend/Resume resets the PCI configuration space, so we have to
+         * re-disable the RETRY_TIMEOUT register (0x41) to keep
+         * PCI Tx retries from interfering with C3 CPU state
+         */
+        pci_write_config_byte(pdev, 0x41, 0);
+
+        ath5k_led_enable(sc);
+        return 0;
+}
+
+static SIMPLE_DEV_PM_OPS(ath5k_pm_ops, ath5k_pci_suspend, ath5k_pci_resume);
+#define ATH5K_PM_OPS    (&ath5k_pm_ops)
+#else
+#define ATH5K_PM_OPS    NULL
+#endif /* CONFIG_PM_SLEEP */
+
+static struct pci_driver ath5k_pci_driver = {
+        .name           = KBUILD_MODNAME,
+        .id_table       = ath5k_pci_id_table,
+        .probe          = ath5k_pci_probe,
+        .remove         = __devexit_p(ath5k_pci_remove),
+        .driver.pm      = ATH5K_PM_OPS,
+};
+
+/*
+ * Module init/exit functions
+ */
+static int __init
+init_ath5k_pci(void)
+{
+        int ret;
+
+        ret = pci_register_driver(&ath5k_pci_driver);
+        if (ret) {
+                printk(KERN_ERR "ath5k_pci: can't register pci driver\n");
+                return ret;
+        }
+
+        return 0;
+}
+
+static void __exit
+exit_ath5k_pci(void)
+{
+        pci_unregister_driver(&ath5k_pci_driver);
+}
+
+module_init(init_ath5k_pci);
+module_exit(exit_ath5k_pci);
diff --git a/drivers/net/wireless/ath/ath5k/base.h b/drivers/net/wireless/ath/ath5k/base.h
index dc1241f9c4e8..9a79773cdc2a 100644
--- a/drivers/net/wireless/ath/ath5k/base.h
+++ b/drivers/net/wireless/ath/ath5k/base.h
@@ -58,7 +58,9 @@
 
 #define ATH_RXBUF       40              /* number of RX buffers */
 #define ATH_TXBUF       200             /* number of TX buffers */
-#define ATH_BCBUF       1               /* number of beacon buffers */
+#define ATH_BCBUF       4               /* number of beacon buffers */
+#define ATH5K_TXQ_LEN_MAX       (ATH_TXBUF / 4)         /* bufs per queue */
+#define ATH5K_TXQ_LEN_LOW       (ATH5K_TXQ_LEN_MAX / 2) /* low mark */
 
 struct ath5k_buf {
         struct list_head        list;
@@ -83,6 +85,9 @@ struct ath5k_txq {
         struct list_head        q;      /* transmit queue */
         spinlock_t              lock;   /* lock on q and link */
         bool                    setup;
+        int                     txq_len; /* number of queued buffers */
+        bool                    txq_poll_mark;
+        unsigned int            txq_stuck;      /* informational counter */
 };
 
 #define ATH5K_LED_MAX_NAME_LEN 31
@@ -116,6 +121,13 @@ struct ath5k_statistics {
         /* frame errors */
         unsigned int rx_all_count;      /* all RX frames, including errors */
         unsigned int tx_all_count;      /* all TX frames, including errors */
+        unsigned int rx_bytes_count;    /* all RX bytes, including errored pks
+                                         * and the MAC headers for each packet
+                                         */
+        unsigned int tx_bytes_count;    /* all TX bytes, including errored pkts
+                                         * and the MAC headers and padding for
+                                         * each packet.
+                                         */
         unsigned int rxerr_crc;
         unsigned int rxerr_phy;
         unsigned int rxerr_phy_code[32];
@@ -146,6 +158,14 @@ struct ath5k_statistics {
 #define ATH_CHAN_MAX    (14+14+14+252+20)
 #endif
 
+struct ath5k_vif {
+        bool                    assoc; /* are we associated or not */
+        enum nl80211_iftype     opmode;
+        int                     bslot;
+        struct ath5k_buf        *bbuf; /* beacon buffer */
+        u8                      lladdr[ETH_ALEN];
+};
+
 /* Software Carrier, keeps track of the driver state
  * associated with an instance of a device */
 struct ath5k_softc {
@@ -182,10 +202,11 @@ struct ath5k_softc {
         unsigned int            curmode;        /* current phy mode */
         struct ieee80211_channel *curchan;      /* current h/w channel */
 
-        struct ieee80211_vif *vif;
+        u16                     nvifs;
 
         enum ath5k_int          imask;          /* interrupt mask copy */
 
+        u8                      lladdr[ETH_ALEN];
         u8                      bssidmask[ETH_ALEN];
 
         unsigned int            led_pin,        /* GPIO pin for driving LED */
@@ -204,7 +225,6 @@ struct ath5k_softc {
         spinlock_t              txbuflock;
         unsigned int            txbuf_len;      /* buf count in txbuf list */
         struct ath5k_txq        txqs[AR5K_NUM_TX_QUEUES];       /* tx queues */
-        struct ath5k_txq        *txq;           /* main tx queue */
         struct tasklet_struct   txtq;           /* tx intr tasklet */
         struct ath5k_led        tx_led;         /* tx led */
 
@@ -214,7 +234,10 @@ struct ath5k_softc {
 
         spinlock_t              block;          /* protects beacon */
         struct tasklet_struct   beacontq;       /* beacon intr tasklet */
-        struct ath5k_buf        *bbuf;          /* beacon buffer */
+        struct list_head        bcbuf;          /* beacon buffer */
+        struct ieee80211_vif    *bslot[ATH_BCBUF];
+        u16                     num_ap_vifs;
+        u16                     num_adhoc_vifs;
         unsigned int            bhalq,          /* SW q for outgoing beacons */
                                 bmisscount,     /* missed beacon transmits */
                                 bintval,        /* beacon interval in TU */
@@ -230,6 +253,8 @@ struct ath5k_softc {
 
         struct ath5k_ani_state  ani_state;
         struct tasklet_struct   ani_tasklet;    /* ANI calibration */
+
+        struct delayed_work     tx_complete_work;
 };
 
 #define ath5k_hw_hasbssidmask(_ah) \
diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
index 1b7c6d7fde93..42ea5b1bdb12 100644
--- a/drivers/net/wireless/ath/ath5k/debug.c
+++ b/drivers/net/wireless/ath/ath5k/debug.c
@@ -60,6 +60,7 @@
 
 #include "base.h"
 #include "debug.h"
+#include "../debug.h"
 
 static unsigned int ath5k_debug;
 module_param_named(debug, ath5k_debug, uint, 0);
@@ -71,8 +72,6 @@ module_param_named(debug, ath5k_debug, uint, 0);
 #include "reg.h"
 #include "ani.h"
 
-static struct dentry *ath5k_global_debugfs;
-
 static int ath5k_debugfs_open(struct inode *inode, struct file *file)
 {
         file->private_data = inode->i_private;
@@ -483,6 +482,60 @@ static const struct file_operations fops_antenna = {
         .owner = THIS_MODULE,
 };
 
+/* debugfs: misc */
+
+static ssize_t read_file_misc(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath5k_softc *sc = file->private_data;
+        char buf[700];
+        unsigned int len = 0;
+        u32 filt = ath5k_hw_get_rx_filter(sc->ah);
+
+        len += snprintf(buf+len, sizeof(buf)-len, "bssid-mask: %pM\n",
+                        sc->bssidmask);
+        len += snprintf(buf+len, sizeof(buf)-len, "filter-flags: 0x%x ",
+                        filt);
+        if (filt & AR5K_RX_FILTER_UCAST)
+                len += snprintf(buf+len, sizeof(buf)-len, " UCAST");
+        if (filt & AR5K_RX_FILTER_MCAST)
+                len += snprintf(buf+len, sizeof(buf)-len, " MCAST");
+        if (filt & AR5K_RX_FILTER_BCAST)
+                len += snprintf(buf+len, sizeof(buf)-len, " BCAST");
+        if (filt & AR5K_RX_FILTER_CONTROL)
+                len += snprintf(buf+len, sizeof(buf)-len, " CONTROL");
+        if (filt & AR5K_RX_FILTER_BEACON)
+                len += snprintf(buf+len, sizeof(buf)-len, " BEACON");
+        if (filt & AR5K_RX_FILTER_PROM)
+                len += snprintf(buf+len, sizeof(buf)-len, " PROM");
+        if (filt & AR5K_RX_FILTER_XRPOLL)
+                len += snprintf(buf+len, sizeof(buf)-len, " XRPOLL");
+        if (filt & AR5K_RX_FILTER_PROBEREQ)
+                len += snprintf(buf+len, sizeof(buf)-len, " PROBEREQ");
+        if (filt & AR5K_RX_FILTER_PHYERR_5212)
+                len += snprintf(buf+len, sizeof(buf)-len, " PHYERR-5212");
+        if (filt & AR5K_RX_FILTER_RADARERR_5212)
+                len += snprintf(buf+len, sizeof(buf)-len, " RADARERR-5212");
+        if (filt & AR5K_RX_FILTER_PHYERR_5211)
+                snprintf(buf+len, sizeof(buf)-len, " PHYERR-5211");
+        if (filt & AR5K_RX_FILTER_RADARERR_5211)
+                len += snprintf(buf+len, sizeof(buf)-len, " RADARERR-5211");
+
+        len += snprintf(buf+len, sizeof(buf)-len, "\nopmode: %s (%d)\n",
+                        ath_opmode_to_string(sc->opmode), sc->opmode);
+
+        if (len > sizeof(buf))
+                len = sizeof(buf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_misc = {
+        .read = read_file_misc,
+        .open = ath5k_debugfs_open,
+        .owner = THIS_MODULE,
+};
+
 
 /* debugfs: frameerrors */
 
@@ -534,6 +587,8 @@ static ssize_t read_file_frameerrors(struct file *file, char __user *user_buf,
                                 st->rxerr_jumbo*100/st->rx_all_count : 0);
         len += snprintf(buf+len, sizeof(buf)-len, "[RX all\t%d]\n",
                         st->rx_all_count);
+        len += snprintf(buf+len, sizeof(buf)-len, "RX-all-bytes\t%d\n",
+                        st->rx_bytes_count);
 
         len += snprintf(buf+len, sizeof(buf)-len,
                         "\nTX\n---------------------\n");
@@ -551,6 +606,8 @@ static ssize_t read_file_frameerrors(struct file *file, char __user *user_buf,
                                 st->txerr_filt*100/st->tx_all_count : 0);
         len += snprintf(buf+len, sizeof(buf)-len, "[TX all\t%d]\n",
                         st->tx_all_count);
+        len += snprintf(buf+len, sizeof(buf)-len, "TX-all-bytes\t%d\n",
+                        st->tx_bytes_count);
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -658,20 +715,21 @@ static ssize_t read_file_ani(struct file *file, char __user *user_buf,
         len += snprintf(buf+len, sizeof(buf)-len,
                         "beacon RSSI average:\t%d\n",
                         sc->ah->ah_beacon_rssi_avg.avg);
+
+#define CC_PRINT(_struct, _field) \
+        _struct._field, \
+        _struct.cycles > 0 ? \
+        _struct._field*100/_struct.cycles : 0
+
         len += snprintf(buf+len, sizeof(buf)-len, "profcnt tx\t\t%u\t(%d%%)\n",
-                        as->pfc_tx,
-                        as->pfc_cycles > 0 ?
-                        as->pfc_tx*100/as->pfc_cycles : 0);
+                        CC_PRINT(as->last_cc, tx_frame));
         len += snprintf(buf+len, sizeof(buf)-len, "profcnt rx\t\t%u\t(%d%%)\n",
-                        as->pfc_rx,
-                        as->pfc_cycles > 0 ?
-                        as->pfc_rx*100/as->pfc_cycles : 0);
+                        CC_PRINT(as->last_cc, rx_frame));
         len += snprintf(buf+len, sizeof(buf)-len, "profcnt busy\t\t%u\t(%d%%)\n",
-                        as->pfc_busy,
-                        as->pfc_cycles > 0 ?
-                        as->pfc_busy*100/as->pfc_cycles : 0);
+                        CC_PRINT(as->last_cc, rx_busy));
+#undef CC_PRINT
         len += snprintf(buf+len, sizeof(buf)-len, "profcnt cycles\t\t%u\n",
-                        as->pfc_cycles);
+                        as->last_cc.cycles);
         len += snprintf(buf+len, sizeof(buf)-len,
                         "listen time\t\t%d\tlast: %d\n",
                         as->listen_time, as->last_listen);
@@ -763,7 +821,7 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
 
         struct ath5k_txq *txq;
         struct ath5k_buf *bf, *bf0;
-        int i, n = 0;
+        int i, n;
 
         len += snprintf(buf+len, sizeof(buf)-len,
                         "available txbuffers: %d\n", sc->txbuf_len);
@@ -777,9 +835,16 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
                 if (!txq->setup)
                         continue;
 
+                n = 0;
+                spin_lock_bh(&txq->lock);
                 list_for_each_entry_safe(bf, bf0, &txq->q, list)
                         n++;
-                len += snprintf(buf+len, sizeof(buf)-len, "  len: %d\n", n);
+                spin_unlock_bh(&txq->lock);
+
+                len += snprintf(buf+len, sizeof(buf)-len,
+                                "  len: %d bufs: %d\n", txq->txq_len, n);
+                len += snprintf(buf+len, sizeof(buf)-len,
+                                "  stuck: %d\n", txq->txq_stuck);
         }
 
         if (len > sizeof(buf))
@@ -815,21 +880,13 @@ static const struct file_operations fops_queue = {
 };
 
 
-/* init */
-
-void
-ath5k_debug_init(void)
-{
-        ath5k_global_debugfs = debugfs_create_dir("ath5k", NULL);
-}
-
 void
 ath5k_debug_init_device(struct ath5k_softc *sc)
 {
         sc->debug.level = ath5k_debug;
 
-        sc->debug.debugfs_phydir = debugfs_create_dir(wiphy_name(sc->hw->wiphy),
-                                ath5k_global_debugfs);
+        sc->debug.debugfs_phydir = debugfs_create_dir("ath5k",
+                                sc->hw->wiphy->debugfsdir);
 
         sc->debug.debugfs_debug = debugfs_create_file("debug",
                                 S_IWUSR | S_IRUSR,
@@ -849,6 +906,10 @@ ath5k_debug_init_device(struct ath5k_softc *sc)
                                 S_IWUSR | S_IRUSR,
                                 sc->debug.debugfs_phydir, sc, &fops_antenna);
 
+        sc->debug.debugfs_misc = debugfs_create_file("misc",
+                                S_IRUSR,
+                                sc->debug.debugfs_phydir, sc, &fops_misc);
+
         sc->debug.debugfs_frameerrors = debugfs_create_file("frameerrors",
                                 S_IWUSR | S_IRUSR,
                                 sc->debug.debugfs_phydir, sc,
@@ -866,12 +927,6 @@ ath5k_debug_init_device(struct ath5k_softc *sc)
 }
 
 void
-ath5k_debug_finish(void)
-{
-        debugfs_remove(ath5k_global_debugfs);
-}
-
-void
 ath5k_debug_finish_device(struct ath5k_softc *sc)
 {
         debugfs_remove(sc->debug.debugfs_debug);
@@ -879,6 +934,7 @@ ath5k_debug_finish_device(struct ath5k_softc *sc)
         debugfs_remove(sc->debug.debugfs_beacon);
         debugfs_remove(sc->debug.debugfs_reset);
         debugfs_remove(sc->debug.debugfs_antenna);
+        debugfs_remove(sc->debug.debugfs_misc);
         debugfs_remove(sc->debug.debugfs_frameerrors);
         debugfs_remove(sc->debug.debugfs_ani);
         debugfs_remove(sc->debug.debugfs_queue);
diff --git a/drivers/net/wireless/ath/ath5k/debug.h b/drivers/net/wireless/ath/ath5k/debug.h
index 9b22722a95f0..236edbd2507d 100644
--- a/drivers/net/wireless/ath/ath5k/debug.h
+++ b/drivers/net/wireless/ath/ath5k/debug.h
@@ -75,6 +75,7 @@ struct ath5k_dbg_info {
         struct dentry           *debugfs_beacon;
         struct dentry           *debugfs_reset;
         struct dentry           *debugfs_antenna;
+        struct dentry           *debugfs_misc;
         struct dentry           *debugfs_frameerrors;
         struct dentry           *debugfs_ani;
         struct dentry           *debugfs_queue;
@@ -137,15 +138,9 @@ enum ath5k_debug_level {
         } while (0)
 
 void
-ath5k_debug_init(void);
-
-void
 ath5k_debug_init_device(struct ath5k_softc *sc);
 
 void
-ath5k_debug_finish(void);
-
-void
 ath5k_debug_finish_device(struct ath5k_softc *sc);
 
 void
@@ -173,15 +168,9 @@ ATH5K_DBG_UNLIMIT(struct ath5k_softc *sc, unsigned int m, const char *fmt, ...)
 {}
 
 static inline void
-ath5k_debug_init(void) {}
-
-static inline void
 ath5k_debug_init_device(struct ath5k_softc *sc) {}
 
 static inline void
-ath5k_debug_finish(void) {}
-
-static inline void
 ath5k_debug_finish_device(struct ath5k_softc *sc) {}
 
 static inline void
diff --git a/drivers/net/wireless/ath/ath5k/dma.c b/drivers/net/wireless/ath/ath5k/dma.c
index 58bb6c5dda7b..923c9ca5c4f0 100644
--- a/drivers/net/wireless/ath/ath5k/dma.c
+++ b/drivers/net/wireless/ath/ath5k/dma.c
@@ -244,7 +244,7 @@ int ath5k_hw_stop_tx_dma(struct ath5k_hw *ah, unsigned int queue)
 
                         /* Force channel idle high */
                         AR5K_REG_ENABLE_BITS(ah, AR5K_DIAG_SW_5211,
-                                        AR5K_DIAG_SW_CHANEL_IDLE_HIGH);
+                                        AR5K_DIAG_SW_CHANNEL_IDLE_HIGH);
 
                         /* Wait a while and disable mechanism */
                         udelay(200);
@@ -261,7 +261,7 @@ int ath5k_hw_stop_tx_dma(struct ath5k_hw *ah, unsigned int queue)
                         } while (--i && pending);
 
                         AR5K_REG_DISABLE_BITS(ah, AR5K_DIAG_SW_5211,
-                                        AR5K_DIAG_SW_CHANEL_IDLE_HIGH);
+                                        AR5K_DIAG_SW_CHANNEL_IDLE_HIGH);
                 }
 
                 /* Clear register */
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index bb2e21553d1b..074b4c644399 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -207,7 +207,8 @@ static int ath5k_hw_set_cts_timeout(struct ath5k_hw *ah, unsigned int timeout)
  */
 unsigned int ath5k_hw_htoclock(struct ath5k_hw *ah, unsigned int usec)
 {
-        return usec * ath5k_hw_get_clockrate(ah);
+        struct ath_common *common = ath5k_hw_common(ah);
+        return usec * common->clockrate;
 }
 
 /**
@@ -216,17 +217,19 @@ unsigned int ath5k_hw_htoclock(struct ath5k_hw *ah, unsigned int usec)
  */
 unsigned int ath5k_hw_clocktoh(struct ath5k_hw *ah, unsigned int clock)
 {
-        return clock / ath5k_hw_get_clockrate(ah);
+        struct ath_common *common = ath5k_hw_common(ah);
+        return clock / common->clockrate;
 }
 
 /**
- * ath5k_hw_get_clockrate - Get the clock rate for current mode
+ * ath5k_hw_set_clockrate - Set common->clockrate for the current channel
  *
  * @ah: The &struct ath5k_hw
  */
-unsigned int ath5k_hw_get_clockrate(struct ath5k_hw *ah)
+void ath5k_hw_set_clockrate(struct ath5k_hw *ah)
 {
         struct ieee80211_channel *channel = ah->ah_current_channel;
+        struct ath_common *common = ath5k_hw_common(ah);
         int clock;
 
         if (channel->hw_value & CHANNEL_5GHZ)
@@ -240,7 +243,7 @@ unsigned int ath5k_hw_get_clockrate(struct ath5k_hw *ah)
         if (channel->hw_value & CHANNEL_TURBO)
                 clock *= 2;
 
-        return clock;
+        common->clockrate = clock;
 }
 
 /**
@@ -495,6 +498,10 @@ u64 ath5k_hw_get_tsf64(struct ath5k_hw *ah)
 {
         u32 tsf_lower, tsf_upper1, tsf_upper2;
         int i;
+        unsigned long flags;
+
+        /* This code is time critical - we don't want to be interrupted here */
+        local_irq_save(flags);
 
         /*
          * While reading TSF upper and then lower part, the clock is still
@@ -517,6 +524,8 @@ u64 ath5k_hw_get_tsf64(struct ath5k_hw *ah)
                 tsf_upper1 = tsf_upper2;
         }
 
+        local_irq_restore(flags);
+
         WARN_ON( i == ATH5K_MAX_TSF_READ );
 
         return (((u64)tsf_upper1 << 32) | tsf_lower);
@@ -600,7 +609,7 @@ void ath5k_hw_init_beacon(struct ath5k_hw *ah, u32 next_beacon, u32 interval)
         /* Timer3 marks the end of our ATIM window
          * a zero length window is not allowed because
          * we 'll get no beacons */
-        timer3 = next_beacon + (ah->ah_atim_window ? ah->ah_atim_window : 1);
+        timer3 = next_beacon + 1;
 
         /*
          * Set the beacon register and enable all timers.
@@ -640,195 +649,95 @@ void ath5k_hw_init_beacon(struct ath5k_hw *ah, u32 next_beacon, u32 interval)
 
 }
 
-
-/*********************\
-* Key table functions *
-\*********************/
-
-/*
- * Reset a key entry on the table
+/**
+ * ath5k_check_timer_win - Check if timer B is timer A + window
+ *
+ * @a: timer a (before b)
+ * @b: timer b (after a)
+ * @window: difference between a and b
+ * @intval: timers are increased by this interval
+ *
+ * This helper function checks if timer B is timer A + window and covers
+ * cases where timer A or B might have already been updated or wrapped
+ * around (Timers are 16 bit).
+ *
+ * Returns true if O.K.
  */
-int ath5k_hw_reset_key(struct ath5k_hw *ah, u16 entry)
+static inline bool
+ath5k_check_timer_win(int a, int b, int window, int intval)
 {
-        unsigned int i, type;
-        u16 micentry = entry + AR5K_KEYTABLE_MIC_OFFSET;
-
-        AR5K_ASSERT_ENTRY(entry, AR5K_KEYTABLE_SIZE);
-
-        type = ath5k_hw_reg_read(ah, AR5K_KEYTABLE_TYPE(entry));
-
-        for (i = 0; i < AR5K_KEYCACHE_SIZE; i++)
-                ath5k_hw_reg_write(ah, 0, AR5K_KEYTABLE_OFF(entry, i));
-
-        /* Reset associated MIC entry if TKIP
-         * is enabled located at offset (entry + 64) */
-        if (type == AR5K_KEYTABLE_TYPE_TKIP) {
-                AR5K_ASSERT_ENTRY(micentry, AR5K_KEYTABLE_SIZE);
-                for (i = 0; i < AR5K_KEYCACHE_SIZE / 2 ; i++)
-                        ath5k_hw_reg_write(ah, 0,
-                                AR5K_KEYTABLE_OFF(micentry, i));
-        }
-
         /*
-         * Set NULL encryption on AR5212+
-         *
-         * Note: AR5K_KEYTABLE_TYPE -> AR5K_KEYTABLE_OFF(entry, 5)
-         *       AR5K_KEYTABLE_TYPE_NULL -> 0x00000007
-         *
-         * Note2: Windows driver (ndiswrapper) sets this to
-         *        0x00000714 instead of 0x00000007
+         * 1.) usually B should be A + window
+         * 2.) A already updated, B not updated yet
+         * 3.) A already updated and has wrapped around
+         * 4.) B has wrapped around
          */
-        if (ah->ah_version >= AR5K_AR5211) {
-                ath5k_hw_reg_write(ah, AR5K_KEYTABLE_TYPE_NULL,
-                                AR5K_KEYTABLE_TYPE(entry));
-
-                if (type == AR5K_KEYTABLE_TYPE_TKIP) {
-                        ath5k_hw_reg_write(ah, AR5K_KEYTABLE_TYPE_NULL,
-                                AR5K_KEYTABLE_TYPE(micentry));
-                }
-        }
-
-        return 0;
-}
-
-static
-int ath5k_keycache_type(const struct ieee80211_key_conf *key)
-{
-        switch (key->cipher) {
-        case WLAN_CIPHER_SUITE_TKIP:
-                return AR5K_KEYTABLE_TYPE_TKIP;
-        case WLAN_CIPHER_SUITE_CCMP:
-                return AR5K_KEYTABLE_TYPE_CCM;
-        case WLAN_CIPHER_SUITE_WEP40:
-                return AR5K_KEYTABLE_TYPE_40;
-        case WLAN_CIPHER_SUITE_WEP104:
-                return AR5K_KEYTABLE_TYPE_104;
-        default:
-                return -EINVAL;
-        }
+        if ((b - a == window) ||                                /* 1.) */
+            (a - b == intval - window) ||                       /* 2.) */
+            ((a | 0x10000) - b == intval - window) ||           /* 3.) */
+            ((b | 0x10000) - a == window))                      /* 4.) */
+                return true; /* O.K. */
+        return false;
 }
 
-/*
- * Set a key entry on the table
+/**
+ * ath5k_hw_check_beacon_timers - Check if the beacon timers are correct
+ *
+ * @ah: The &struct ath5k_hw
+ * @intval: beacon interval
+ *
+ * This is a workaround for IBSS mode:
+ *
+ * The need for this function arises from the fact that we have 4 separate
+ * HW timer registers (TIMER0 - TIMER3), which are closely related to the
+ * next beacon target time (NBTT), and that the HW updates these timers
+ * seperately based on the current TSF value. The hardware increments each
+ * timer by the beacon interval, when the local TSF coverted to TU is equal
+ * to the value stored in the timer.
+ *
+ * The reception of a beacon with the same BSSID can update the local HW TSF
+ * at any time - this is something we can't avoid. If the TSF jumps to a
+ * time which is later than the time stored in a timer, this timer will not
+ * be updated until the TSF in TU wraps around at 16 bit (the size of the
+ * timers) and reaches the time which is stored in the timer.
+ *
+ * The problem is that these timers are closely related to TIMER0 (NBTT) and
+ * that they define a time "window". When the TSF jumps between two timers
+ * (e.g. ATIM and NBTT), the one in the past will be left behind (not
+ * updated), while the one in the future will be updated every beacon
+ * interval. This causes the window to get larger, until the TSF wraps
+ * around as described above and the timer which was left behind gets
+ * updated again. But - because the beacon interval is usually not an exact
+ * divisor of the size of the timers (16 bit), an unwanted "window" between
+ * these timers has developed!
+ *
+ * This is especially important with the ATIM window, because during
+ * the ATIM window only ATIM frames and no data frames are allowed to be
+ * sent, which creates transmission pauses after each beacon. This symptom
+ * has been described as "ramping ping" because ping times increase linearly
+ * for some time and then drop down again. A wrong window on the DMA beacon
+ * timer has the same effect, so we check for these two conditions.
+ *
+ * Returns true if O.K.
  */
-int ath5k_hw_set_key(struct ath5k_hw *ah, u16 entry,
-                const struct ieee80211_key_conf *key, const u8 *mac)
-{
-        unsigned int i;
-        int keylen;
-        __le32 key_v[5] = {};
-        __le32 key0 = 0, key1 = 0;
-        __le32 *rxmic, *txmic;
-        int keytype;
-        u16 micentry = entry + AR5K_KEYTABLE_MIC_OFFSET;
-        bool is_tkip;
-        const u8 *key_ptr;
-
-        is_tkip = (key->cipher == WLAN_CIPHER_SUITE_TKIP);
-
-        /*
-         * key->keylen comes in from mac80211 in bytes.
-         * TKIP is 128 bit + 128 bit mic
-         */
-        keylen = (is_tkip) ? (128 / 8) : key->keylen;
-
-        if (entry > AR5K_KEYTABLE_SIZE ||
-                (is_tkip && micentry > AR5K_KEYTABLE_SIZE))
-                return -EOPNOTSUPP;
-
-        if (unlikely(keylen > 16))
-                return -EOPNOTSUPP;
-
-        keytype = ath5k_keycache_type(key);
-        if (keytype < 0)
-                return keytype;
-
-        /*
-         * each key block is 6 bytes wide, written as pairs of
-         * alternating 32 and 16 bit le values.
-         */
-        key_ptr = key->key;
-        for (i = 0; keylen >= 6; keylen -= 6) {
-                memcpy(&key_v[i], key_ptr, 6);
-                i += 2;
-                key_ptr += 6;
-        }
-        if (keylen)
-                memcpy(&key_v[i], key_ptr, keylen);
-
-        /* intentionally corrupt key until mic is installed */
-        if (is_tkip) {
-                key0 = key_v[0] = ~key_v[0];
-                key1 = key_v[1] = ~key_v[1];
-        }
-
-        for (i = 0; i < ARRAY_SIZE(key_v); i++)
-                ath5k_hw_reg_write(ah, le32_to_cpu(key_v[i]),
-                                AR5K_KEYTABLE_OFF(entry, i));
-
-        ath5k_hw_reg_write(ah, keytype, AR5K_KEYTABLE_TYPE(entry));
-
-        if (is_tkip) {
-                /* Install rx/tx MIC */
-                rxmic = (__le32 *) &key->key[16];
-                txmic = (__le32 *) &key->key[24];
-
-                if (ah->ah_combined_mic) {
-                        key_v[0] = rxmic[0];
-                        key_v[1] = cpu_to_le32(le32_to_cpu(txmic[0]) >> 16);
-                        key_v[2] = rxmic[1];
-                        key_v[3] = cpu_to_le32(le32_to_cpu(txmic[0]) & 0xffff);
-                        key_v[4] = txmic[1];
-                } else {
-                        key_v[0] = rxmic[0];
-                        key_v[1] = 0;
-                        key_v[2] = rxmic[1];
-                        key_v[3] = 0;
-                        key_v[4] = 0;
-                }
-                for (i = 0; i < ARRAY_SIZE(key_v); i++)
-                        ath5k_hw_reg_write(ah, le32_to_cpu(key_v[i]),
-                                AR5K_KEYTABLE_OFF(micentry, i));
-
-                ath5k_hw_reg_write(ah, AR5K_KEYTABLE_TYPE_NULL,
-                        AR5K_KEYTABLE_TYPE(micentry));
-                ath5k_hw_reg_write(ah, 0, AR5K_KEYTABLE_MAC0(micentry));
-                ath5k_hw_reg_write(ah, 0, AR5K_KEYTABLE_MAC1(micentry));
-
-                /* restore first 2 words of key */
-                ath5k_hw_reg_write(ah, le32_to_cpu(~key0),
-                        AR5K_KEYTABLE_OFF(entry, 0));
-                ath5k_hw_reg_write(ah, le32_to_cpu(~key1),
-                        AR5K_KEYTABLE_OFF(entry, 1));
-        }
-
-        return ath5k_hw_set_key_lladdr(ah, entry, mac);
-}
-
-int ath5k_hw_set_key_lladdr(struct ath5k_hw *ah, u16 entry, const u8 *mac)
+bool
+ath5k_hw_check_beacon_timers(struct ath5k_hw *ah, int intval)
 {
-        u32 low_id, high_id;
-
-         /* Invalid entry (key table overflow) */
-        AR5K_ASSERT_ENTRY(entry, AR5K_KEYTABLE_SIZE);
+        unsigned int nbtt, atim, dma;
 
-        /*
-         * MAC may be NULL if it's a broadcast key. In this case no need to
-         * to compute get_unaligned_le32 and get_unaligned_le16 as we
-         * already know it.
-         */
-        if (!mac) {
-                low_id = 0xffffffff;
-                high_id = 0xffff | AR5K_KEYTABLE_VALID;
-        } else {
-                low_id = get_unaligned_le32(mac);
-                high_id = get_unaligned_le16(mac + 4) | AR5K_KEYTABLE_VALID;
-        }
+        nbtt = ath5k_hw_reg_read(ah, AR5K_TIMER0);
+        atim = ath5k_hw_reg_read(ah, AR5K_TIMER3);
+        dma = ath5k_hw_reg_read(ah, AR5K_TIMER1) >> 3;
 
-        ath5k_hw_reg_write(ah, low_id, AR5K_KEYTABLE_MAC0(entry));
-        ath5k_hw_reg_write(ah, high_id, AR5K_KEYTABLE_MAC1(entry));
+        /* NOTE: SWBA is different. Having a wrong window there does not
+         * stop us from sending data and this condition is catched thru
+         * other means (SWBA interrupt) */
 
-        return 0;
+        if (ath5k_check_timer_win(nbtt, atim, 1, intval) &&
+            ath5k_check_timer_win(dma, nbtt, AR5K_TUNE_DMA_BEACON_RESP,
+                                  intval))
+                return true; /* O.K. */
+        return false;
 }
 
 /**
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 984ba92c7df3..219367884e64 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -1093,6 +1093,7 @@ int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *channel)
 
         ah->ah_current_channel = channel;
         ah->ah_turbo = channel->hw_value == CHANNEL_T ? true : false;
+        ath5k_hw_set_clockrate(ah);
 
         return 0;
 }
@@ -1257,7 +1258,7 @@ static int ath5k_hw_rf5110_calibrate(struct ath5k_hw *ah,
          * Disable beacons and RX/TX queues, wait
          */
         AR5K_REG_ENABLE_BITS(ah, AR5K_DIAG_SW_5210,
-                AR5K_DIAG_SW_DIS_TX | AR5K_DIAG_SW_DIS_RX_5210);
+                AR5K_DIAG_SW_DIS_TX_5210 | AR5K_DIAG_SW_DIS_RX_5210);
         beacon = ath5k_hw_reg_read(ah, AR5K_BEACON_5210);
         ath5k_hw_reg_write(ah, beacon & ~AR5K_BEACON_ENABLE, AR5K_BEACON_5210);
 
@@ -1336,7 +1337,7 @@ static int ath5k_hw_rf5110_calibrate(struct ath5k_hw *ah,
          * Re-enable RX/TX and beacons
          */
         AR5K_REG_DISABLE_BITS(ah, AR5K_DIAG_SW_5210,
-                AR5K_DIAG_SW_DIS_TX | AR5K_DIAG_SW_DIS_RX_5210);
+                AR5K_DIAG_SW_DIS_TX_5210 | AR5K_DIAG_SW_DIS_RX_5210);
         ath5k_hw_reg_write(ah, beacon, AR5K_BEACON_5210);
 
         return 0;
@@ -1377,7 +1378,7 @@ ath5k_hw_rf511x_iq_calibrate(struct ath5k_hw *ah)
 
         /* protect against divide by 0 and loss of sign bits */
         if (i_coffd == 0 || q_coffd < 2)
-                return -1;
+                return 0;
 
         i_coff = (-iq_corr) / i_coffd;
         i_coff = clamp(i_coff, -32, 31); /* signed 6 bit */
diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
index 4186ff4c6e9c..84c717ded1c5 100644
--- a/drivers/net/wireless/ath/ath5k/qcu.c
+++ b/drivers/net/wireless/ath/ath5k/qcu.c
@@ -36,24 +36,58 @@ int ath5k_hw_get_tx_queueprops(struct ath5k_hw *ah, int queue,
 }
 
 /*
+ * Make sure cw is a power of 2 minus 1 and smaller than 1024
+ */
+static u16 ath5k_cw_validate(u16 cw_req)
+{
+        u32 cw = 1;
+        cw_req = min(cw_req, (u16)1023);
+
+        while (cw < cw_req)
+                cw = (cw << 1) | 1;
+
+        return cw;
+}
+
+/*
  * Set properties for a transmit queue
  */
 int ath5k_hw_set_tx_queueprops(struct ath5k_hw *ah, int queue,
-                                const struct ath5k_txq_info *queue_info)
+                                const struct ath5k_txq_info *qinfo)
 {
+        struct ath5k_txq_info *qi;
+
         AR5K_ASSERT_ENTRY(queue, ah->ah_capabilities.cap_queues.q_tx_num);
 
-        if (ah->ah_txq[queue].tqi_type == AR5K_TX_QUEUE_INACTIVE)
+        qi = &ah->ah_txq[queue];
+
+        if (qi->tqi_type == AR5K_TX_QUEUE_INACTIVE)
                 return -EIO;
 
-        memcpy(&ah->ah_txq[queue], queue_info, sizeof(struct ath5k_txq_info));
+        /* copy and validate values */
+        qi->tqi_type = qinfo->tqi_type;
+        qi->tqi_subtype = qinfo->tqi_subtype;
+        qi->tqi_flags = qinfo->tqi_flags;
+        /*
+         * According to the docs: Although the AIFS field is 8 bit wide,
+         * the maximum supported value is 0xFC. Setting it higher than that
+         * will cause the DCU to hang.
+         */
+        qi->tqi_aifs = min(qinfo->tqi_aifs, (u8)0xFC);
+        qi->tqi_cw_min = ath5k_cw_validate(qinfo->tqi_cw_min);
+        qi->tqi_cw_max = ath5k_cw_validate(qinfo->tqi_cw_max);
+        qi->tqi_cbr_period = qinfo->tqi_cbr_period;
+        qi->tqi_cbr_overflow_limit = qinfo->tqi_cbr_overflow_limit;
+        qi->tqi_burst_time = qinfo->tqi_burst_time;
+        qi->tqi_ready_time = qinfo->tqi_ready_time;
 
         /*XXX: Is this supported on 5210 ?*/
-        if ((queue_info->tqi_type == AR5K_TX_QUEUE_DATA &&
-                        ((queue_info->tqi_subtype == AR5K_WME_AC_VI) ||
-                        (queue_info->tqi_subtype == AR5K_WME_AC_VO))) ||
-                        queue_info->tqi_type == AR5K_TX_QUEUE_UAPSD)
-                ah->ah_txq[queue].tqi_flags |= AR5K_TXQ_FLAG_POST_FR_BKOFF_DIS;
+        /*XXX: Is this correct for AR5K_WME_AC_VI,VO ???*/
+        if ((qinfo->tqi_type == AR5K_TX_QUEUE_DATA &&
+                ((qinfo->tqi_subtype == AR5K_WME_AC_VI) ||
+                 (qinfo->tqi_subtype == AR5K_WME_AC_VO))) ||
+             qinfo->tqi_type == AR5K_TX_QUEUE_UAPSD)
+                qi->tqi_flags |= AR5K_TXQ_FLAG_POST_FR_BKOFF_DIS;
 
         return 0;
 }
@@ -186,7 +220,7 @@ void ath5k_hw_release_tx_queue(struct ath5k_hw *ah, unsigned int queue)
  */
 int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
 {
-        u32 cw_min, cw_max, retry_lg, retry_sh;
+        u32 retry_lg, retry_sh;
         struct ath5k_txq_info *tq = &ah->ah_txq[queue];
 
         AR5K_ASSERT_ENTRY(queue, ah->ah_capabilities.cap_queues.q_tx_num);
@@ -217,14 +251,13 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
                 /* Set IFS0 */
                 if (ah->ah_turbo) {
                          ath5k_hw_reg_write(ah, ((AR5K_INIT_SIFS_TURBO +
-                                (ah->ah_aifs + tq->tqi_aifs) *
-                                AR5K_INIT_SLOT_TIME_TURBO) <<
+                                tq->tqi_aifs * AR5K_INIT_SLOT_TIME_TURBO) <<
                                 AR5K_IFS0_DIFS_S) | AR5K_INIT_SIFS_TURBO,
                                 AR5K_IFS0);
                 } else {
                         ath5k_hw_reg_write(ah, ((AR5K_INIT_SIFS +
-                                (ah->ah_aifs + tq->tqi_aifs) *
-                                AR5K_INIT_SLOT_TIME) << AR5K_IFS0_DIFS_S) |
+                                tq->tqi_aifs * AR5K_INIT_SLOT_TIME) <<
+                                AR5K_IFS0_DIFS_S) |
                                 AR5K_INIT_SIFS, AR5K_IFS0);
                 }
 
@@ -248,35 +281,6 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
         }
 
         /*
-         * Calculate cwmin/max by channel mode
-         */
-        cw_min = ah->ah_cw_min = AR5K_TUNE_CWMIN;
-        cw_max = ah->ah_cw_max = AR5K_TUNE_CWMAX;
-        ah->ah_aifs = AR5K_TUNE_AIFS;
-        /*XR is only supported on 5212*/
-        if (IS_CHAN_XR(ah->ah_current_channel) &&
-                        ah->ah_version == AR5K_AR5212) {
-                cw_min = ah->ah_cw_min = AR5K_TUNE_CWMIN_XR;
-                cw_max = ah->ah_cw_max = AR5K_TUNE_CWMAX_XR;
-                ah->ah_aifs = AR5K_TUNE_AIFS_XR;
-        /*B mode is not supported on 5210*/
-        } else if (IS_CHAN_B(ah->ah_current_channel) &&
-                        ah->ah_version != AR5K_AR5210) {
-                cw_min = ah->ah_cw_min = AR5K_TUNE_CWMIN_11B;
-                cw_max = ah->ah_cw_max = AR5K_TUNE_CWMAX_11B;
-                ah->ah_aifs = AR5K_TUNE_AIFS_11B;
-        }
-
-        cw_min = 1;
-        while (cw_min < ah->ah_cw_min)
-                cw_min = (cw_min << 1) | 1;
-
-        cw_min = tq->tqi_cw_min < 0 ? (cw_min >> (-tq->tqi_cw_min)) :
-                ((cw_min << tq->tqi_cw_min) + (1 << tq->tqi_cw_min) - 1);
-        cw_max = tq->tqi_cw_max < 0 ? (cw_max >> (-tq->tqi_cw_max)) :
-                ((cw_max << tq->tqi_cw_max) + (1 << tq->tqi_cw_max) - 1);
-
-        /*
          * Calculate and set retry limits
          */
         if (ah->ah_software_retry) {
@@ -292,7 +296,7 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
         /*No QCU/DCU [5210]*/
         if (ah->ah_version == AR5K_AR5210) {
                 ath5k_hw_reg_write(ah,
-                        (cw_min << AR5K_NODCU_RETRY_LMT_CW_MIN_S)
+                        (tq->tqi_cw_min << AR5K_NODCU_RETRY_LMT_CW_MIN_S)
                         | AR5K_REG_SM(AR5K_INIT_SLG_RETRY,
                                 AR5K_NODCU_RETRY_LMT_SLG_RETRY)
                         | AR5K_REG_SM(AR5K_INIT_SSH_RETRY,
@@ -314,14 +318,13 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
         /*===Rest is also for QCU/DCU only [5211+]===*/
 
                 /*
-                 * Set initial content window (cw_min/cw_max)
+                 * Set contention window (cw_min/cw_max)
                  * and arbitrated interframe space (aifs)...
                  */
                 ath5k_hw_reg_write(ah,
-                        AR5K_REG_SM(cw_min, AR5K_DCU_LCL_IFS_CW_MIN) |
-                        AR5K_REG_SM(cw_max, AR5K_DCU_LCL_IFS_CW_MAX) |
-                        AR5K_REG_SM(ah->ah_aifs + tq->tqi_aifs,
-                                AR5K_DCU_LCL_IFS_AIFS),
+                        AR5K_REG_SM(tq->tqi_cw_min, AR5K_DCU_LCL_IFS_CW_MIN) |
+                        AR5K_REG_SM(tq->tqi_cw_max, AR5K_DCU_LCL_IFS_CW_MAX) |
+                        AR5K_REG_SM(tq->tqi_aifs, AR5K_DCU_LCL_IFS_AIFS),
                         AR5K_QUEUE_DFS_LOCAL_IFS(queue));
 
                 /*
diff --git a/drivers/net/wireless/ath/ath5k/reg.h b/drivers/net/wireless/ath/ath5k/reg.h
index 05ef587ad2b4..a34929f06533 100644
--- a/drivers/net/wireless/ath/ath5k/reg.h
+++ b/drivers/net/wireless/ath/ath5k/reg.h
@@ -1387,10 +1387,9 @@
 
 
 /*
- * PCU control register
+ * PCU Diagnostic register
  *
- * Only DIS_RX is used in the code, the rest i guess are
- * for tweaking/diagnostics.
+ * Used for tweaking/diagnostics.
  */
 #define AR5K_DIAG_SW_5210               0x8068                  /* Register Address [5210] */
 #define AR5K_DIAG_SW_5211               0x8048                  /* Register Address [5211+] */
@@ -1399,22 +1398,22 @@
 #define AR5K_DIAG_SW_DIS_WEP_ACK        0x00000001      /* Disable ACKs if WEP key is invalid */
 #define AR5K_DIAG_SW_DIS_ACK            0x00000002      /* Disable ACKs */
 #define AR5K_DIAG_SW_DIS_CTS            0x00000004      /* Disable CTSs */
-#define AR5K_DIAG_SW_DIS_ENC            0x00000008      /* Disable encryption */
-#define AR5K_DIAG_SW_DIS_DEC            0x00000010      /* Disable decryption */
-#define AR5K_DIAG_SW_DIS_TX             0x00000020      /* Disable transmit [5210] */
-#define AR5K_DIAG_SW_DIS_RX_5210        0x00000040      /* Disable recieve */
+#define AR5K_DIAG_SW_DIS_ENC            0x00000008      /* Disable HW encryption */
+#define AR5K_DIAG_SW_DIS_DEC            0x00000010      /* Disable HW decryption */
+#define AR5K_DIAG_SW_DIS_TX_5210        0x00000020      /* Disable transmit [5210] */
+#define AR5K_DIAG_SW_DIS_RX_5210        0x00000040      /* Disable receive */
 #define AR5K_DIAG_SW_DIS_RX_5211        0x00000020
 #define AR5K_DIAG_SW_DIS_RX             (ah->ah_version == AR5K_AR5210 ? \
                                         AR5K_DIAG_SW_DIS_RX_5210 : AR5K_DIAG_SW_DIS_RX_5211)
-#define AR5K_DIAG_SW_LOOP_BACK_5210     0x00000080      /* Loopback (i guess it goes with DIS_TX) [5210] */
+#define AR5K_DIAG_SW_LOOP_BACK_5210     0x00000080      /* TX Data Loopback (i guess it goes with DIS_TX) [5210] */
 #define AR5K_DIAG_SW_LOOP_BACK_5211     0x00000040
 #define AR5K_DIAG_SW_LOOP_BACK          (ah->ah_version == AR5K_AR5210 ? \
                                         AR5K_DIAG_SW_LOOP_BACK_5210 : AR5K_DIAG_SW_LOOP_BACK_5211)
-#define AR5K_DIAG_SW_CORR_FCS_5210      0x00000100      /* Corrupted FCS */
+#define AR5K_DIAG_SW_CORR_FCS_5210      0x00000100      /* Generate invalid TX FCS */
 #define AR5K_DIAG_SW_CORR_FCS_5211      0x00000080
 #define AR5K_DIAG_SW_CORR_FCS           (ah->ah_version == AR5K_AR5210 ? \
                                         AR5K_DIAG_SW_CORR_FCS_5210 : AR5K_DIAG_SW_CORR_FCS_5211)
-#define AR5K_DIAG_SW_CHAN_INFO_5210     0x00000200      /* Dump channel info */
+#define AR5K_DIAG_SW_CHAN_INFO_5210     0x00000200      /* Add 56 bytes of channel info before the frame data in the RX buffer */
 #define AR5K_DIAG_SW_CHAN_INFO_5211     0x00000100
 #define AR5K_DIAG_SW_CHAN_INFO          (ah->ah_version == AR5K_AR5210 ? \
                                         AR5K_DIAG_SW_CHAN_INFO_5210 : AR5K_DIAG_SW_CHAN_INFO_5211)
@@ -1426,17 +1425,17 @@
 #define AR5K_DIAG_SW_SCVRAM_SEED        0x0003f800      /* [5210] */
 #define AR5K_DIAG_SW_SCRAM_SEED_M       0x0001fc00      /* Scrambler seed mask */
 #define AR5K_DIAG_SW_SCRAM_SEED_S       10
-#define AR5K_DIAG_SW_DIS_SEQ_INC        0x00040000      /* Disable seqnum increment (?)[5210] */
+#define AR5K_DIAG_SW_DIS_SEQ_INC_5210   0x00040000      /* Disable seqnum increment (?)[5210] */
 #define AR5K_DIAG_SW_FRAME_NV0_5210     0x00080000
 #define AR5K_DIAG_SW_FRAME_NV0_5211     0x00020000      /* Accept frames of non-zero protocol number */
 #define AR5K_DIAG_SW_FRAME_NV0          (ah->ah_version == AR5K_AR5210 ? \
                                         AR5K_DIAG_SW_FRAME_NV0_5210 : AR5K_DIAG_SW_FRAME_NV0_5211)
 #define AR5K_DIAG_SW_OBSPT_M            0x000c0000      /* Observation point select (?) */
 #define AR5K_DIAG_SW_OBSPT_S            18
-#define AR5K_DIAG_SW_RX_CLEAR_HIGH      0x0010000       /* Force RX Clear high */
-#define AR5K_DIAG_SW_IGNORE_CARR_SENSE  0x0020000       /* Ignore virtual carrier sense */
-#define AR5K_DIAG_SW_CHANEL_IDLE_HIGH   0x0040000       /* Force channel idle high */
-#define AR5K_DIAG_SW_PHEAR_ME           0x0080000       /* ??? */
+#define AR5K_DIAG_SW_RX_CLEAR_HIGH      0x00100000      /* Ignore carrier sense */
+#define AR5K_DIAG_SW_IGNORE_CARR_SENSE  0x00200000      /* Ignore virtual carrier sense */
+#define AR5K_DIAG_SW_CHANNEL_IDLE_HIGH  0x00400000      /* Force channel idle high */
+#define AR5K_DIAG_SW_PHEAR_ME           0x00800000      /* ??? */
 
 /*
  * TSF (clock) register (lower 32 bits)
@@ -1822,50 +1821,8 @@
 
 /*===5212 end===*/
 
-/*
- * Key table (WEP) register
- */
-#define AR5K_KEYTABLE_0_5210            0x9000
-#define AR5K_KEYTABLE_0_5211            0x8800
-#define AR5K_KEYTABLE_5210(_n)          (AR5K_KEYTABLE_0_5210 + ((_n) << 5))
-#define AR5K_KEYTABLE_5211(_n)          (AR5K_KEYTABLE_0_5211 + ((_n) << 5))
-#define AR5K_KEYTABLE(_n)               (ah->ah_version == AR5K_AR5210 ? \
-                                        AR5K_KEYTABLE_5210(_n) : AR5K_KEYTABLE_5211(_n))
-#define AR5K_KEYTABLE_OFF(_n, x)        (AR5K_KEYTABLE(_n) + (x << 2))
-#define AR5K_KEYTABLE_TYPE(_n)          AR5K_KEYTABLE_OFF(_n, 5)
-#define AR5K_KEYTABLE_TYPE_40           0x00000000
-#define AR5K_KEYTABLE_TYPE_104          0x00000001
-#define AR5K_KEYTABLE_TYPE_128          0x00000003
-#define AR5K_KEYTABLE_TYPE_TKIP         0x00000004      /* [5212+] */
-#define AR5K_KEYTABLE_TYPE_AES          0x00000005      /* [5211+] */
-#define AR5K_KEYTABLE_TYPE_CCM          0x00000006      /* [5212+] */
-#define AR5K_KEYTABLE_TYPE_NULL         0x00000007      /* [5211+] */
-#define AR5K_KEYTABLE_ANTENNA           0x00000008      /* [5212+] */
-#define AR5K_KEYTABLE_MAC0(_n)          AR5K_KEYTABLE_OFF(_n, 6)
-#define AR5K_KEYTABLE_MAC1(_n)          AR5K_KEYTABLE_OFF(_n, 7)
-#define AR5K_KEYTABLE_VALID             0x00008000
-
-/* If key type is TKIP and MIC is enabled
- * MIC key goes in offset entry + 64 */
-#define AR5K_KEYTABLE_MIC_OFFSET        64
-
-/* WEP 40-bit   = 40-bit  entered key + 24 bit IV = 64-bit
- * WEP 104-bit  = 104-bit entered key + 24-bit IV = 128-bit
- * WEP 128-bit  = 128-bit entered key + 24 bit IV = 152-bit
- *
- * Some vendors have introduced bigger WEP keys to address
- * security vulnerabilities in WEP. This includes:
- *
- * WEP 232-bit = 232-bit entered key + 24 bit IV = 256-bit
- *
- * We can expand this if we find ar5k Atheros cards with a larger
- * key table size.
- */
 #define AR5K_KEYTABLE_SIZE_5210         64
 #define AR5K_KEYTABLE_SIZE_5211         128
-#define AR5K_KEYTABLE_SIZE              (ah->ah_version == AR5K_AR5210 ? \
-                                        AR5K_KEYTABLE_SIZE_5210 : AR5K_KEYTABLE_SIZE_5211)
-
 
 /*===PHY REGISTERS===*/
 
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index 58912cd762d9..5b179d01f97d 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -167,7 +167,7 @@ static inline void ath5k_hw_write_rate_duration(struct ath5k_hw *ah,
                  * ieee80211_duration() for a brief description of
                  * what rate we should choose to TX ACKs. */
                 tx_time = le16_to_cpu(ieee80211_generic_frame_duration(sc->hw,
-                                                        sc->vif, 10, rate));
+                                                        NULL, 10, rate));
 
                 ath5k_hw_reg_write(ah, tx_time, reg);
 
@@ -1060,7 +1060,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                  * XXX: rethink this after new mode changes to
                  * mac80211 are integrated */
                 if (ah->ah_version == AR5K_AR5212 &&
-                        ah->ah_sc->vif != NULL)
+                        ah->ah_sc->nvifs)
                         ath5k_hw_write_rate_duration(ah, mode);
 
                 /*
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 35f23bdc442f..ad57a6d23110 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -32,6 +32,14 @@ config ATH9K_DEBUGFS
 
           Also required for changing debug message flags at run time.
 
+config ATH9K_RATE_CONTROL
+        bool "Atheros ath9k rate control"
+        depends on ATH9K
+        default y
+        ---help---
+          Say Y, if you want to use the ath9k specific rate control
+          module instead of minstrel_ht.
+
 config ATH9K_HTC
        tristate "Atheros HTC based wireless cards support"
        depends on USB && MAC80211
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 4555e9983903..aca01621c205 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -5,8 +5,8 @@ ath9k-y +=	beacon.o \
                 recv.o \
                 xmit.o \
                 virtual.o \
-                rc.o
 
+ath9k-$(CONFIG_ATH9K_RATE_CONTROL) += rc.o
 ath9k-$(CONFIG_PCI) += pci.o
 ath9k-$(CONFIG_ATHEROS_AR71XX) += ahb.o
 ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index cc648b6ae31c..63ccb39cdcd4 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -14,6 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include <linux/kernel.h>
 #include "hw.h"
 #include "hw-ops.h"
 
@@ -48,7 +49,7 @@ static const struct ani_ofdm_level_entry ofdm_level_table[] = {
         {  7,  8,  0  }  /* lvl 9 */
 };
 #define ATH9K_ANI_OFDM_NUM_LEVEL \
-        (sizeof(ofdm_level_table)/sizeof(ofdm_level_table[0]))
+        ARRAY_SIZE(ofdm_level_table)
 #define ATH9K_ANI_OFDM_MAX_LEVEL \
         (ATH9K_ANI_OFDM_NUM_LEVEL-1)
 #define ATH9K_ANI_OFDM_DEF_LEVEL \
@@ -94,7 +95,7 @@ static const struct ani_cck_level_entry cck_level_table[] = {
 };
 
 #define ATH9K_ANI_CCK_NUM_LEVEL \
-        (sizeof(cck_level_table)/sizeof(cck_level_table[0]))
+        ARRAY_SIZE(cck_level_table)
 #define ATH9K_ANI_CCK_MAX_LEVEL \
         (ATH9K_ANI_CCK_NUM_LEVEL-1)
 #define ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI \
@@ -102,31 +103,9 @@ static const struct ani_cck_level_entry cck_level_table[] = {
 #define ATH9K_ANI_CCK_DEF_LEVEL \
         2 /* default level - matches the INI settings */
 
-/* Private to ani.c */
-static void ath9k_hw_ani_lower_immunity(struct ath_hw *ah)
+static bool use_new_ani(struct ath_hw *ah)
 {
-        ath9k_hw_private_ops(ah)->ani_lower_immunity(ah);
-}
-
-int ath9k_hw_get_ani_channel_idx(struct ath_hw *ah,
-                                 struct ath9k_channel *chan)
-{
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(ah->ani); i++) {
-                if (ah->ani[i].c &&
-                    ah->ani[i].c->channel == chan->channel)
-                        return i;
-                if (ah->ani[i].c == NULL) {
-                        ah->ani[i].c = chan;
-                        return i;
-                }
-        }
-
-        ath_print(ath9k_hw_common(ah), ATH_DBG_ANI,
-                  "No more channel states left. Using channel 0\n");
-
-        return 0;
+        return AR_SREV_9300_20_OR_LATER(ah) || modparam_force_new_ani;
 }
 
 static void ath9k_hw_update_mibstats(struct ath_hw *ah,
@@ -139,82 +118,34 @@ static void ath9k_hw_update_mibstats(struct ath_hw *ah,
         stats->beacons += REG_READ(ah, AR_BEACON_CNT);
 }
 
-static void ath9k_ani_restart_old(struct ath_hw *ah)
+static void ath9k_ani_restart(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
         struct ath_common *common = ath9k_hw_common(ah);
+        u32 ofdm_base = 0, cck_base = 0;
 
         if (!DO_ANI(ah))
                 return;
 
-        aniState = ah->curani;
+        aniState = &ah->curchan->ani;
         aniState->listenTime = 0;
 
-        if (aniState->ofdmTrigHigh > AR_PHY_COUNTMAX) {
-                aniState->ofdmPhyErrBase = 0;
-                ath_print(common, ATH_DBG_ANI,
-                          "OFDM Trigger is too high for hw counters\n");
-        } else {
-                aniState->ofdmPhyErrBase =
-                        AR_PHY_COUNTMAX - aniState->ofdmTrigHigh;
-        }
-        if (aniState->cckTrigHigh > AR_PHY_COUNTMAX) {
-                aniState->cckPhyErrBase = 0;
-                ath_print(common, ATH_DBG_ANI,
-                          "CCK Trigger is too high for hw counters\n");
-        } else {
-                aniState->cckPhyErrBase =
-                        AR_PHY_COUNTMAX - aniState->cckTrigHigh;
+        if (!use_new_ani(ah)) {
+                ofdm_base = AR_PHY_COUNTMAX - ah->config.ofdm_trig_high;
+                cck_base = AR_PHY_COUNTMAX - ah->config.cck_trig_high;
         }
-        ath_print(common, ATH_DBG_ANI,
-                  "Writing ofdmbase=%u   cckbase=%u\n",
-                  aniState->ofdmPhyErrBase,
-                  aniState->cckPhyErrBase);
-
-        ENABLE_REGWRITE_BUFFER(ah);
-
-        REG_WRITE(ah, AR_PHY_ERR_1, aniState->ofdmPhyErrBase);
-        REG_WRITE(ah, AR_PHY_ERR_2, aniState->cckPhyErrBase);
-        REG_WRITE(ah, AR_PHY_ERR_MASK_1, AR_PHY_ERR_OFDM_TIMING);
-        REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
-
-        REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
-
-        ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
-
-        aniState->ofdmPhyErrCount = 0;
-        aniState->cckPhyErrCount = 0;
-}
-
-static void ath9k_ani_restart_new(struct ath_hw *ah)
-{
-        struct ar5416AniState *aniState;
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        if (!DO_ANI(ah))
-                return;
-
-        aniState = ah->curani;
-        aniState->listenTime = 0;
-
-        aniState->ofdmPhyErrBase = 0;
-        aniState->cckPhyErrBase = 0;
 
         ath_print(common, ATH_DBG_ANI,
-                  "Writing ofdmbase=%08x   cckbase=%08x\n",
-                  aniState->ofdmPhyErrBase,
-                  aniState->cckPhyErrBase);
+                  "Writing ofdmbase=%u   cckbase=%u\n", ofdm_base, cck_base);
 
         ENABLE_REGWRITE_BUFFER(ah);
 
-        REG_WRITE(ah, AR_PHY_ERR_1, aniState->ofdmPhyErrBase);
-        REG_WRITE(ah, AR_PHY_ERR_2, aniState->cckPhyErrBase);
+        REG_WRITE(ah, AR_PHY_ERR_1, ofdm_base);
+        REG_WRITE(ah, AR_PHY_ERR_2, cck_base);
         REG_WRITE(ah, AR_PHY_ERR_MASK_1, AR_PHY_ERR_OFDM_TIMING);
         REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
 
@@ -228,10 +159,7 @@ static void ath9k_hw_ani_ofdm_err_trigger_old(struct ath_hw *ah)
         struct ar5416AniState *aniState;
         int32_t rssi;
 
-        if (!DO_ANI(ah))
-                return;
-
-        aniState = ah->curani;
+        aniState = &ah->curchan->ani;
 
         if (aniState->noiseImmunityLevel < HAL_NOISE_IMMUNE_MAX) {
                 if (ath9k_hw_ani_control(ah, ATH9K_ANI_NOISE_IMMUNITY_LEVEL,
@@ -300,10 +228,7 @@ static void ath9k_hw_ani_cck_err_trigger_old(struct ath_hw *ah)
         struct ar5416AniState *aniState;
         int32_t rssi;
 
-        if (!DO_ANI(ah))
-                return;
-
-        aniState = ah->curani;
+        aniState = &ah->curchan->ani;
         if (aniState->noiseImmunityLevel < HAL_NOISE_IMMUNE_MAX) {
                 if (ath9k_hw_ani_control(ah, ATH9K_ANI_NOISE_IMMUNITY_LEVEL,
                                          aniState->noiseImmunityLevel + 1)) {
@@ -335,7 +260,7 @@ static void ath9k_hw_ani_cck_err_trigger_old(struct ath_hw *ah)
 /* Adjust the OFDM Noise Immunity Level */
 static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel)
 {
-        struct ar5416AniState *aniState = ah->curani;
+        struct ar5416AniState *aniState = &ah->curchan->ani;
         struct ath_common *common = ath9k_hw_common(ah);
         const struct ani_ofdm_level_entry *entry_ofdm;
         const struct ani_cck_level_entry *entry_cck;
@@ -380,14 +305,19 @@ static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel)
         }
 }
 
-static void ath9k_hw_ani_ofdm_err_trigger_new(struct ath_hw *ah)
+static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
 
         if (!DO_ANI(ah))
                 return;
 
-        aniState = ah->curani;
+        if (!use_new_ani(ah)) {
+                ath9k_hw_ani_ofdm_err_trigger_old(ah);
+                return;
+        }
+
+        aniState = &ah->curchan->ani;
 
         if (aniState->ofdmNoiseImmunityLevel < ATH9K_ANI_OFDM_MAX_LEVEL)
                 ath9k_hw_set_ofdm_nil(ah, aniState->ofdmNoiseImmunityLevel + 1);
@@ -398,7 +328,7 @@ static void ath9k_hw_ani_ofdm_err_trigger_new(struct ath_hw *ah)
  */
 static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel)
 {
-        struct ar5416AniState *aniState = ah->curani;
+        struct ar5416AniState *aniState = &ah->curchan->ani;
         struct ath_common *common = ath9k_hw_common(ah);
         const struct ani_ofdm_level_entry *entry_ofdm;
         const struct ani_cck_level_entry *entry_cck;
@@ -437,14 +367,19 @@ static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel)
                                      entry_cck->mrc_cck_on);
 }
 
-static void ath9k_hw_ani_cck_err_trigger_new(struct ath_hw *ah)
+static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
 
         if (!DO_ANI(ah))
                 return;
 
-        aniState = ah->curani;
+        if (!use_new_ani(ah)) {
+                ath9k_hw_ani_cck_err_trigger_old(ah);
+                return;
+        }
+
+        aniState = &ah->curchan->ani;
 
         if (aniState->cckNoiseImmunityLevel < ATH9K_ANI_CCK_MAX_LEVEL)
                 ath9k_hw_set_cck_nil(ah, aniState->cckNoiseImmunityLevel + 1);
@@ -455,7 +390,7 @@ static void ath9k_hw_ani_lower_immunity_old(struct ath_hw *ah)
         struct ar5416AniState *aniState;
         int32_t rssi;
 
-        aniState = ah->curani;
+        aniState = &ah->curchan->ani;
 
         if (ah->opmode == NL80211_IFTYPE_AP) {
                 if (aniState->firstepLevel > 0) {
@@ -507,11 +442,16 @@ static void ath9k_hw_ani_lower_immunity_old(struct ath_hw *ah)
  * only lower either OFDM or CCK errors per turn
  * we lower the other one next time
  */
-static void ath9k_hw_ani_lower_immunity_new(struct ath_hw *ah)
+static void ath9k_hw_ani_lower_immunity(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
 
-        aniState = ah->curani;
+        aniState = &ah->curchan->ani;
+
+        if (!use_new_ani(ah)) {
+                ath9k_hw_ani_lower_immunity_old(ah);
+                return;
+        }
 
         /* lower OFDM noise immunity */
         if (aniState->ofdmNoiseImmunityLevel > 0 &&
@@ -525,87 +465,18 @@ static void ath9k_hw_ani_lower_immunity_new(struct ath_hw *ah)
                 ath9k_hw_set_cck_nil(ah, aniState->cckNoiseImmunityLevel - 1);
 }
 
-static u8 ath9k_hw_chan_2_clockrate_mhz(struct ath_hw *ah)
-{
-        struct ath9k_channel *chan = ah->curchan;
-        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
-        u8 clockrate; /* in MHz */
-
-        if (!ah->curchan) /* should really check for CCK instead */
-                clockrate = ATH9K_CLOCK_RATE_CCK;
-        else if (conf->channel->band == IEEE80211_BAND_2GHZ)
-                clockrate = ATH9K_CLOCK_RATE_2GHZ_OFDM;
-        else if (IS_CHAN_A_FAST_CLOCK(ah, chan))
-                clockrate = ATH9K_CLOCK_FAST_RATE_5GHZ_OFDM;
-        else
-                clockrate = ATH9K_CLOCK_RATE_5GHZ_OFDM;
-
-        if (conf_is_ht40(conf))
-                return clockrate * 2;
-
-        return clockrate * 2;
-}
-
-static int32_t ath9k_hw_ani_get_listen_time(struct ath_hw *ah)
-{
-        struct ar5416AniState *aniState;
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 txFrameCount, rxFrameCount, cycleCount;
-        int32_t listenTime;
-
-        txFrameCount = REG_READ(ah, AR_TFCNT);
-        rxFrameCount = REG_READ(ah, AR_RFCNT);
-        cycleCount = REG_READ(ah, AR_CCCNT);
-
-        aniState = ah->curani;
-        if (aniState->cycleCount == 0 || aniState->cycleCount > cycleCount) {
-                listenTime = 0;
-                ah->stats.ast_ani_lzero++;
-                ath_print(common, ATH_DBG_ANI,
-                          "1st call: aniState->cycleCount=%d\n",
-                          aniState->cycleCount);
-        } else {
-                int32_t ccdelta = cycleCount - aniState->cycleCount;
-                int32_t rfdelta = rxFrameCount - aniState->rxFrameCount;
-                int32_t tfdelta = txFrameCount - aniState->txFrameCount;
-                int32_t clock_rate;
-
-                /*
-                 * convert HW counter values to ms using mode
-                 * specifix clock rate
-                 */
-                clock_rate = ath9k_hw_chan_2_clockrate_mhz(ah) * 1000;;
-
-                listenTime = (ccdelta - rfdelta - tfdelta) / clock_rate;
-
-                ath_print(common, ATH_DBG_ANI,
-                          "cyclecount=%d, rfcount=%d, "
-                          "tfcount=%d, listenTime=%d CLOCK_RATE=%d\n",
-                          ccdelta, rfdelta, tfdelta, listenTime, clock_rate);
-        }
-
-        aniState->cycleCount = cycleCount;
-        aniState->txFrameCount = txFrameCount;
-        aniState->rxFrameCount = rxFrameCount;
-
-        return listenTime;
-}
-
 static void ath9k_ani_reset_old(struct ath_hw *ah, bool is_scanning)
 {
         struct ar5416AniState *aniState;
         struct ath9k_channel *chan = ah->curchan;
         struct ath_common *common = ath9k_hw_common(ah);
-        int index;
 
         if (!DO_ANI(ah))
                 return;
 
-        index = ath9k_hw_get_ani_channel_idx(ah, chan);
-        aniState = &ah->ani[index];
-        ah->curani = aniState;
+        aniState = &ah->curchan->ani;
 
-        if (DO_ANI(ah) && ah->opmode != NL80211_IFTYPE_STATION
+        if (ah->opmode != NL80211_IFTYPE_STATION
             && ah->opmode != NL80211_IFTYPE_ADHOC) {
                 ath_print(common, ATH_DBG_ANI,
                           "Reset ANI state opmode %u\n", ah->opmode);
@@ -634,17 +505,7 @@ static void ath9k_ani_reset_old(struct ath_hw *ah, bool is_scanning)
                 ath9k_hw_setrxfilter(ah, ath9k_hw_getrxfilter(ah) |
                                      ATH9K_RX_FILTER_PHYERR);
 
-                if (ah->opmode == NL80211_IFTYPE_AP) {
-                        ah->curani->ofdmTrigHigh =
-                                ah->config.ofdm_trig_high;
-                        ah->curani->ofdmTrigLow =
-                                ah->config.ofdm_trig_low;
-                        ah->curani->cckTrigHigh =
-                                ah->config.cck_trig_high;
-                        ah->curani->cckTrigLow =
-                                ah->config.cck_trig_low;
-                }
-                ath9k_ani_restart_old(ah);
+                ath9k_ani_restart(ah);
                 return;
         }
 
@@ -666,7 +527,7 @@ static void ath9k_ani_reset_old(struct ath_hw *ah, bool is_scanning)
 
         ath9k_hw_setrxfilter(ah, ath9k_hw_getrxfilter(ah) &
                              ~ATH9K_RX_FILTER_PHYERR);
-        ath9k_ani_restart_old(ah);
+        ath9k_ani_restart(ah);
 
         ENABLE_REGWRITE_BUFFER(ah);
 
@@ -674,7 +535,6 @@ static void ath9k_ani_reset_old(struct ath_hw *ah, bool is_scanning)
         REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 /*
@@ -682,15 +542,18 @@ static void ath9k_ani_reset_old(struct ath_hw *ah, bool is_scanning)
  * This routine should be called for every hardware reset and for
  * every channel change.
  */
-static void ath9k_ani_reset_new(struct ath_hw *ah, bool is_scanning)
+void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
 {
-        struct ar5416AniState *aniState = ah->curani;
+        struct ar5416AniState *aniState = &ah->curchan->ani;
         struct ath9k_channel *chan = ah->curchan;
         struct ath_common *common = ath9k_hw_common(ah);
 
         if (!DO_ANI(ah))
                 return;
 
+        if (!use_new_ani(ah))
+                return ath9k_ani_reset_old(ah, is_scanning);
+
         BUG_ON(aniState == NULL);
         ah->stats.ast_ani_reset++;
 
@@ -760,7 +623,7 @@ static void ath9k_ani_reset_new(struct ath_hw *ah, bool is_scanning)
          * enable phy counters if hw supports or if not, enable phy
          * interrupts (so we can count each one)
          */
-        ath9k_ani_restart_new(ah);
+        ath9k_ani_restart(ah);
 
         ENABLE_REGWRITE_BUFFER(ah);
 
@@ -768,28 +631,30 @@ static void ath9k_ani_reset_new(struct ath_hw *ah, bool is_scanning)
         REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 }
 
-static void ath9k_hw_ani_monitor_old(struct ath_hw *ah,
-                                     struct ath9k_channel *chan)
+static bool ath9k_hw_ani_read_counters(struct ath_hw *ah)
 {
-        struct ar5416AniState *aniState;
         struct ath_common *common = ath9k_hw_common(ah);
-        int32_t listenTime;
-        u32 phyCnt1, phyCnt2;
+        struct ar5416AniState *aniState = &ah->curchan->ani;
+        u32 ofdm_base = 0;
+        u32 cck_base = 0;
         u32 ofdmPhyErrCnt, cckPhyErrCnt;
+        u32 phyCnt1, phyCnt2;
+        int32_t listenTime;
 
-        if (!DO_ANI(ah))
-                return;
-
-        aniState = ah->curani;
+        ath_hw_cycle_counters_update(common);
+        listenTime = ath_hw_get_listen_time(common);
 
-        listenTime = ath9k_hw_ani_get_listen_time(ah);
-        if (listenTime < 0) {
+        if (listenTime <= 0) {
                 ah->stats.ast_ani_lneg++;
-                ath9k_ani_restart_old(ah);
-                return;
+                ath9k_ani_restart(ah);
+                return false;
+        }
+
+        if (!use_new_ani(ah)) {
+                ofdm_base = AR_PHY_COUNTMAX - ah->config.ofdm_trig_high;
+                cck_base = AR_PHY_COUNTMAX - ah->config.cck_trig_high;
         }
 
         aniState->listenTime += listenTime;
@@ -799,145 +664,55 @@ static void ath9k_hw_ani_monitor_old(struct ath_hw *ah,
         phyCnt1 = REG_READ(ah, AR_PHY_ERR_1);
         phyCnt2 = REG_READ(ah, AR_PHY_ERR_2);
 
-        if (phyCnt1 < aniState->ofdmPhyErrBase ||
-            phyCnt2 < aniState->cckPhyErrBase) {
-                if (phyCnt1 < aniState->ofdmPhyErrBase) {
+        if (!use_new_ani(ah) && (phyCnt1 < ofdm_base || phyCnt2 < cck_base)) {
+                if (phyCnt1 < ofdm_base) {
                         ath_print(common, ATH_DBG_ANI,
                                   "phyCnt1 0x%x, resetting "
                                   "counter value to 0x%x\n",
-                                  phyCnt1,
-                                  aniState->ofdmPhyErrBase);
-                        REG_WRITE(ah, AR_PHY_ERR_1,
-                                  aniState->ofdmPhyErrBase);
+                                  phyCnt1, ofdm_base);
+                        REG_WRITE(ah, AR_PHY_ERR_1, ofdm_base);
                         REG_WRITE(ah, AR_PHY_ERR_MASK_1,
                                   AR_PHY_ERR_OFDM_TIMING);
                 }
-                if (phyCnt2 < aniState->cckPhyErrBase) {
+                if (phyCnt2 < cck_base) {
                         ath_print(common, ATH_DBG_ANI,
                                   "phyCnt2 0x%x, resetting "
                                   "counter value to 0x%x\n",
-                                  phyCnt2,
-                                  aniState->cckPhyErrBase);
-                        REG_WRITE(ah, AR_PHY_ERR_2,
-                                  aniState->cckPhyErrBase);
+                                  phyCnt2, cck_base);
+                        REG_WRITE(ah, AR_PHY_ERR_2, cck_base);
                         REG_WRITE(ah, AR_PHY_ERR_MASK_2,
                                   AR_PHY_ERR_CCK_TIMING);
                 }
-                return;
+                return false;
         }
 
-        ofdmPhyErrCnt = phyCnt1 - aniState->ofdmPhyErrBase;
+        ofdmPhyErrCnt = phyCnt1 - ofdm_base;
         ah->stats.ast_ani_ofdmerrs +=
                 ofdmPhyErrCnt - aniState->ofdmPhyErrCount;
         aniState->ofdmPhyErrCount = ofdmPhyErrCnt;
 
-        cckPhyErrCnt = phyCnt2 - aniState->cckPhyErrBase;
+        cckPhyErrCnt = phyCnt2 - cck_base;
         ah->stats.ast_ani_cckerrs +=
                 cckPhyErrCnt - aniState->cckPhyErrCount;
         aniState->cckPhyErrCount = cckPhyErrCnt;
-
-        if (aniState->listenTime > 5 * ah->aniperiod) {
-                if (aniState->ofdmPhyErrCount <= aniState->listenTime *
-                    aniState->ofdmTrigLow / 1000 &&
-                    aniState->cckPhyErrCount <= aniState->listenTime *
-                    aniState->cckTrigLow / 1000)
-                        ath9k_hw_ani_lower_immunity(ah);
-                ath9k_ani_restart_old(ah);
-        } else if (aniState->listenTime > ah->aniperiod) {
-                if (aniState->ofdmPhyErrCount > aniState->listenTime *
-                    aniState->ofdmTrigHigh / 1000) {
-                        ath9k_hw_ani_ofdm_err_trigger_old(ah);
-                        ath9k_ani_restart_old(ah);
-                } else if (aniState->cckPhyErrCount >
-                           aniState->listenTime * aniState->cckTrigHigh /
-                           1000) {
-                        ath9k_hw_ani_cck_err_trigger_old(ah);
-                        ath9k_ani_restart_old(ah);
-                }
-        }
+        return true;
 }
 
-static void ath9k_hw_ani_monitor_new(struct ath_hw *ah,
-                                     struct ath9k_channel *chan)
+void ath9k_hw_ani_monitor(struct ath_hw *ah, struct ath9k_channel *chan)
 {
         struct ar5416AniState *aniState;
         struct ath_common *common = ath9k_hw_common(ah);
-        int32_t listenTime;
-        u32 phyCnt1, phyCnt2;
-        u32 ofdmPhyErrCnt, cckPhyErrCnt;
         u32 ofdmPhyErrRate, cckPhyErrRate;
 
         if (!DO_ANI(ah))
                 return;
 
-        aniState = ah->curani;
+        aniState = &ah->curchan->ani;
         if (WARN_ON(!aniState))
                 return;
 
-        listenTime = ath9k_hw_ani_get_listen_time(ah);
-        if (listenTime <= 0) {
-                ah->stats.ast_ani_lneg++;
-                /* restart ANI period if listenTime is invalid */
-                ath_print(common, ATH_DBG_ANI,
-                          "listenTime=%d - on new ani monitor\n",
-                          listenTime);
-                ath9k_ani_restart_new(ah);
-                return;
-        }
-
-        aniState->listenTime += listenTime;
-
-        ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
-
-        phyCnt1 = REG_READ(ah, AR_PHY_ERR_1);
-        phyCnt2 = REG_READ(ah, AR_PHY_ERR_2);
-
-        if (phyCnt1 < aniState->ofdmPhyErrBase ||
-            phyCnt2 < aniState->cckPhyErrBase) {
-                if (phyCnt1 < aniState->ofdmPhyErrBase) {
-                        ath_print(common, ATH_DBG_ANI,
-                                  "phyCnt1 0x%x, resetting "
-                                  "counter value to 0x%x\n",
-                                  phyCnt1,
-                                  aniState->ofdmPhyErrBase);
-                        REG_WRITE(ah, AR_PHY_ERR_1,
-                                  aniState->ofdmPhyErrBase);
-                        REG_WRITE(ah, AR_PHY_ERR_MASK_1,
-                                  AR_PHY_ERR_OFDM_TIMING);
-                }
-                if (phyCnt2 < aniState->cckPhyErrBase) {
-                        ath_print(common, ATH_DBG_ANI,
-                                  "phyCnt2 0x%x, resetting "
-                                  "counter value to 0x%x\n",
-                                  phyCnt2,
-                                  aniState->cckPhyErrBase);
-                        REG_WRITE(ah, AR_PHY_ERR_2,
-                                  aniState->cckPhyErrBase);
-                        REG_WRITE(ah, AR_PHY_ERR_MASK_2,
-                                  AR_PHY_ERR_CCK_TIMING);
-                }
+        if (!ath9k_hw_ani_read_counters(ah))
                 return;
-        }
-
-        ofdmPhyErrCnt = phyCnt1 - aniState->ofdmPhyErrBase;
-        ah->stats.ast_ani_ofdmerrs +=
-                ofdmPhyErrCnt - aniState->ofdmPhyErrCount;
-        aniState->ofdmPhyErrCount = ofdmPhyErrCnt;
-
-        cckPhyErrCnt = phyCnt2 - aniState->cckPhyErrBase;
-        ah->stats.ast_ani_cckerrs +=
-                cckPhyErrCnt - aniState->cckPhyErrCount;
-        aniState->cckPhyErrCount = cckPhyErrCnt;
-
-        ath_print(common, ATH_DBG_ANI,
-                  "Errors: OFDM=0x%08x-0x%08x=%d   "
-                  "CCK=0x%08x-0x%08x=%d\n",
-                  phyCnt1,
-                  aniState->ofdmPhyErrBase,
-                  ofdmPhyErrCnt,
-                  phyCnt2,
-                  aniState->cckPhyErrBase,
-                  cckPhyErrCnt);
 
         ofdmPhyErrRate = aniState->ofdmPhyErrCount * 1000 /
                          aniState->listenTime;
@@ -947,61 +722,34 @@ static void ath9k_hw_ani_monitor_new(struct ath_hw *ah,
         ath_print(common, ATH_DBG_ANI,
                   "listenTime=%d OFDM:%d errs=%d/s CCK:%d "
                   "errs=%d/s ofdm_turn=%d\n",
-                  listenTime, aniState->ofdmNoiseImmunityLevel,
+                  aniState->listenTime,
+                  aniState->ofdmNoiseImmunityLevel,
                   ofdmPhyErrRate, aniState->cckNoiseImmunityLevel,
                   cckPhyErrRate, aniState->ofdmsTurn);
 
         if (aniState->listenTime > 5 * ah->aniperiod) {
-                if (ofdmPhyErrRate <= aniState->ofdmTrigLow &&
-                    cckPhyErrRate <= aniState->cckTrigLow) {
-                        ath_print(common, ATH_DBG_ANI,
-                                  "1. listenTime=%d OFDM:%d errs=%d/s(<%d)  "
-                                  "CCK:%d errs=%d/s(<%d) -> "
-                                  "ath9k_hw_ani_lower_immunity()\n",
-                                  aniState->listenTime,
-                                  aniState->ofdmNoiseImmunityLevel,
-                                  ofdmPhyErrRate,
-                                  aniState->ofdmTrigLow,
-                                  aniState->cckNoiseImmunityLevel,
-                                  cckPhyErrRate,
-                                  aniState->cckTrigLow);
+                if (ofdmPhyErrRate <= ah->config.ofdm_trig_low &&
+                    cckPhyErrRate <= ah->config.cck_trig_low) {
                         ath9k_hw_ani_lower_immunity(ah);
                         aniState->ofdmsTurn = !aniState->ofdmsTurn;
                 }
-                ath_print(common, ATH_DBG_ANI,
-                          "1 listenTime=%d ofdm=%d/s cck=%d/s - "
-                          "calling ath9k_ani_restart_new()\n",
-                          aniState->listenTime, ofdmPhyErrRate, cckPhyErrRate);
-                ath9k_ani_restart_new(ah);
+                ath9k_ani_restart(ah);
         } else if (aniState->listenTime > ah->aniperiod) {
                 /* check to see if need to raise immunity */
-                if (ofdmPhyErrRate > aniState->ofdmTrigHigh &&
-                    (cckPhyErrRate <= aniState->cckTrigHigh ||
+                if (ofdmPhyErrRate > ah->config.ofdm_trig_high &&
+                    (cckPhyErrRate <= ah->config.cck_trig_high ||
                      aniState->ofdmsTurn)) {
-                        ath_print(common, ATH_DBG_ANI,
-                                  "2 listenTime=%d OFDM:%d errs=%d/s(>%d) -> "
-                                  "ath9k_hw_ani_ofdm_err_trigger_new()\n",
-                                  aniState->listenTime,
-                                  aniState->ofdmNoiseImmunityLevel,
-                                  ofdmPhyErrRate,
-                                  aniState->ofdmTrigHigh);
-                        ath9k_hw_ani_ofdm_err_trigger_new(ah);
-                        ath9k_ani_restart_new(ah);
+                        ath9k_hw_ani_ofdm_err_trigger(ah);
+                        ath9k_ani_restart(ah);
                         aniState->ofdmsTurn = false;
-                } else if (cckPhyErrRate > aniState->cckTrigHigh) {
-                        ath_print(common, ATH_DBG_ANI,
-                                 "3 listenTime=%d CCK:%d errs=%d/s(>%d) -> "
-                                 "ath9k_hw_ani_cck_err_trigger_new()\n",
-                                 aniState->listenTime,
-                                 aniState->cckNoiseImmunityLevel,
-                                 cckPhyErrRate,
-                                 aniState->cckTrigHigh);
-                        ath9k_hw_ani_cck_err_trigger_new(ah);
-                        ath9k_ani_restart_new(ah);
+                } else if (cckPhyErrRate > ah->config.cck_trig_high) {
+                        ath9k_hw_ani_cck_err_trigger(ah);
+                        ath9k_ani_restart(ah);
                         aniState->ofdmsTurn = true;
                 }
         }
 }
+EXPORT_SYMBOL(ath9k_hw_ani_monitor);
 
 void ath9k_enable_mib_counters(struct ath_hw *ah)
 {
@@ -1022,7 +770,6 @@ void ath9k_enable_mib_counters(struct ath_hw *ah)
         REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 /* Freeze the MIB counters, get the stats and then clear them */
@@ -1040,53 +787,12 @@ void ath9k_hw_disable_mib_counters(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_disable_mib_counters);
 
-u32 ath9k_hw_GetMibCycleCountsPct(struct ath_hw *ah,
-                                  u32 *rxc_pcnt,
-                                  u32 *rxf_pcnt,
-                                  u32 *txf_pcnt)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-        static u32 cycles, rx_clear, rx_frame, tx_frame;
-        u32 good = 1;
-
-        u32 rc = REG_READ(ah, AR_RCCNT);
-        u32 rf = REG_READ(ah, AR_RFCNT);
-        u32 tf = REG_READ(ah, AR_TFCNT);
-        u32 cc = REG_READ(ah, AR_CCCNT);
-
-        if (cycles == 0 || cycles > cc) {
-                ath_print(common, ATH_DBG_ANI,
-                          "cycle counter wrap. ExtBusy = 0\n");
-                good = 0;
-        } else {
-                u32 cc_d = cc - cycles;
-                u32 rc_d = rc - rx_clear;
-                u32 rf_d = rf - rx_frame;
-                u32 tf_d = tf - tx_frame;
-
-                if (cc_d != 0) {
-                        *rxc_pcnt = rc_d * 100 / cc_d;
-                        *rxf_pcnt = rf_d * 100 / cc_d;
-                        *txf_pcnt = tf_d * 100 / cc_d;
-                } else {
-                        good = 0;
-                }
-        }
-
-        cycles = cc;
-        rx_frame = rf;
-        rx_clear = rc;
-        tx_frame = tf;
-
-        return good;
-}
-
 /*
  * Process a MIB interrupt.  We may potentially be invoked because
  * any of the MIB counters overflow/trigger so don't assume we're
  * here because a PHY error counter triggered.
  */
-static void ath9k_hw_proc_mib_event_old(struct ath_hw *ah)
+void ath9k_hw_proc_mib_event(struct ath_hw *ah)
 {
         u32 phyCnt1, phyCnt2;
 
@@ -1114,72 +820,15 @@ static void ath9k_hw_proc_mib_event_old(struct ath_hw *ah)
         phyCnt2 = REG_READ(ah, AR_PHY_ERR_2);
         if (((phyCnt1 & AR_MIBCNT_INTRMASK) == AR_MIBCNT_INTRMASK) ||
             ((phyCnt2 & AR_MIBCNT_INTRMASK) == AR_MIBCNT_INTRMASK)) {
-                struct ar5416AniState *aniState = ah->curani;
-                u32 ofdmPhyErrCnt, cckPhyErrCnt;
-
-                /* NB: only use ast_ani_*errs with AH_PRIVATE_DIAG */
-                ofdmPhyErrCnt = phyCnt1 - aniState->ofdmPhyErrBase;
-                ah->stats.ast_ani_ofdmerrs +=
-                        ofdmPhyErrCnt - aniState->ofdmPhyErrCount;
-                aniState->ofdmPhyErrCount = ofdmPhyErrCnt;
 
-                cckPhyErrCnt = phyCnt2 - aniState->cckPhyErrBase;
-                ah->stats.ast_ani_cckerrs +=
-                        cckPhyErrCnt - aniState->cckPhyErrCount;
-                aniState->cckPhyErrCount = cckPhyErrCnt;
+                if (!use_new_ani(ah))
+                        ath9k_hw_ani_read_counters(ah);
 
-                /*
-                 * NB: figure out which counter triggered.  If both
-                 * trigger we'll only deal with one as the processing
-                 * clobbers the error counter so the trigger threshold
-                 * check will never be true.
-                 */
-                if (aniState->ofdmPhyErrCount > aniState->ofdmTrigHigh)
-                        ath9k_hw_ani_ofdm_err_trigger_new(ah);
-                if (aniState->cckPhyErrCount > aniState->cckTrigHigh)
-                        ath9k_hw_ani_cck_err_trigger_old(ah);
                 /* NB: always restart to insure the h/w counters are reset */
-                ath9k_ani_restart_old(ah);
-        }
-}
-
-/*
- * Process a MIB interrupt.  We may potentially be invoked because
- * any of the MIB counters overflow/trigger so don't assume we're
- * here because a PHY error counter triggered.
- */
-static void ath9k_hw_proc_mib_event_new(struct ath_hw *ah)
-{
-        u32 phyCnt1, phyCnt2;
-
-        /* Reset these counters regardless */
-        REG_WRITE(ah, AR_FILT_OFDM, 0);
-        REG_WRITE(ah, AR_FILT_CCK, 0);
-        if (!(REG_READ(ah, AR_SLP_MIB_CTRL) & AR_SLP_MIB_PENDING))
-                REG_WRITE(ah, AR_SLP_MIB_CTRL, AR_SLP_MIB_CLEAR);
-
-        /* Clear the mib counters and save them in the stats */
-        ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
-
-        if (!DO_ANI(ah)) {
-                /*
-                 * We must always clear the interrupt cause by
-                 * resetting the phy error regs.
-                 */
-                REG_WRITE(ah, AR_PHY_ERR_1, 0);
-                REG_WRITE(ah, AR_PHY_ERR_2, 0);
-                return;
+                ath9k_ani_restart(ah);
         }
-
-        /* NB: these are not reset-on-read */
-        phyCnt1 = REG_READ(ah, AR_PHY_ERR_1);
-        phyCnt2 = REG_READ(ah, AR_PHY_ERR_2);
-
-        /* NB: always restart to insure the h/w counters are reset */
-        if (((phyCnt1 & AR_MIBCNT_INTRMASK) == AR_MIBCNT_INTRMASK) ||
-            ((phyCnt2 & AR_MIBCNT_INTRMASK) == AR_MIBCNT_INTRMASK))
-                ath9k_ani_restart_new(ah);
 }
+EXPORT_SYMBOL(ath9k_hw_proc_mib_event);
 
 void ath9k_hw_ani_setup(struct ath_hw *ah)
 {
@@ -1205,61 +854,58 @@ void ath9k_hw_ani_init(struct ath_hw *ah)
 
         ath_print(common, ATH_DBG_ANI, "Initialize ANI\n");
 
-        memset(ah->ani, 0, sizeof(ah->ani));
-        for (i = 0; i < ARRAY_SIZE(ah->ani); i++) {
-                if (AR_SREV_9300_20_OR_LATER(ah) || modparam_force_new_ani) {
-                        ah->ani[i].ofdmTrigHigh = ATH9K_ANI_OFDM_TRIG_HIGH_NEW;
-                        ah->ani[i].ofdmTrigLow = ATH9K_ANI_OFDM_TRIG_LOW_NEW;
+        if (use_new_ani(ah)) {
+                ah->config.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH_NEW;
+                ah->config.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW_NEW;
 
-                        ah->ani[i].cckTrigHigh = ATH9K_ANI_CCK_TRIG_HIGH_NEW;
-                        ah->ani[i].cckTrigLow = ATH9K_ANI_CCK_TRIG_LOW_NEW;
+                ah->config.cck_trig_high = ATH9K_ANI_CCK_TRIG_HIGH_NEW;
+                ah->config.cck_trig_low = ATH9K_ANI_CCK_TRIG_LOW_NEW;
+        } else {
+                ah->config.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH_OLD;
+                ah->config.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW_OLD;
 
-                        ah->ani[i].spurImmunityLevel =
-                                ATH9K_ANI_SPUR_IMMUNE_LVL_NEW;
+                ah->config.cck_trig_high = ATH9K_ANI_CCK_TRIG_HIGH_OLD;
+                ah->config.cck_trig_low = ATH9K_ANI_CCK_TRIG_LOW_OLD;
+        }
 
-                        ah->ani[i].firstepLevel = ATH9K_ANI_FIRSTEP_LVL_NEW;
+        for (i = 0; i < ARRAY_SIZE(ah->channels); i++) {
+                struct ath9k_channel *chan = &ah->channels[i];
+                struct ar5416AniState *ani = &chan->ani;
 
-                        ah->ani[i].ofdmPhyErrBase = 0;
-                        ah->ani[i].cckPhyErrBase = 0;
+                if (use_new_ani(ah)) {
+                        ani->spurImmunityLevel =
+                                ATH9K_ANI_SPUR_IMMUNE_LVL_NEW;
+
+                        ani->firstepLevel = ATH9K_ANI_FIRSTEP_LVL_NEW;
 
                         if (AR_SREV_9300_20_OR_LATER(ah))
-                                ah->ani[i].mrcCCKOff =
+                                ani->mrcCCKOff =
                                         !ATH9K_ANI_ENABLE_MRC_CCK;
                         else
-                                ah->ani[i].mrcCCKOff = true;
+                                ani->mrcCCKOff = true;
 
-                        ah->ani[i].ofdmsTurn = true;
+                        ani->ofdmsTurn = true;
                 } else {
-                        ah->ani[i].ofdmTrigHigh = ATH9K_ANI_OFDM_TRIG_HIGH_OLD;
-                        ah->ani[i].ofdmTrigLow = ATH9K_ANI_OFDM_TRIG_LOW_OLD;
-
-                        ah->ani[i].cckTrigHigh = ATH9K_ANI_CCK_TRIG_HIGH_OLD;
-                        ah->ani[i].cckTrigLow = ATH9K_ANI_CCK_TRIG_LOW_OLD;
-
-                        ah->ani[i].spurImmunityLevel =
+                        ani->spurImmunityLevel =
                                 ATH9K_ANI_SPUR_IMMUNE_LVL_OLD;
-                        ah->ani[i].firstepLevel = ATH9K_ANI_FIRSTEP_LVL_OLD;
+                        ani->firstepLevel = ATH9K_ANI_FIRSTEP_LVL_OLD;
 
-                        ah->ani[i].ofdmPhyErrBase =
-                                AR_PHY_COUNTMAX - ATH9K_ANI_OFDM_TRIG_HIGH_OLD;
-                        ah->ani[i].cckPhyErrBase =
-                                AR_PHY_COUNTMAX - ATH9K_ANI_CCK_TRIG_HIGH_OLD;
-                        ah->ani[i].cckWeakSigThreshold =
+                        ani->cckWeakSigThreshold =
                                 ATH9K_ANI_CCK_WEAK_SIG_THR;
                 }
 
-                ah->ani[i].rssiThrHigh = ATH9K_ANI_RSSI_THR_HIGH;
-                ah->ani[i].rssiThrLow = ATH9K_ANI_RSSI_THR_LOW;
-                ah->ani[i].ofdmWeakSigDetectOff =
+                ani->rssiThrHigh = ATH9K_ANI_RSSI_THR_HIGH;
+                ani->rssiThrLow = ATH9K_ANI_RSSI_THR_LOW;
+                ani->ofdmWeakSigDetectOff =
                         !ATH9K_ANI_USE_OFDM_WEAK_SIG;
-                ah->ani[i].cckNoiseImmunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;
+                ani->cckNoiseImmunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;
         }
 
         /*
          * since we expect some ongoing maintenance on the tables, let's sanity
          * check here default level should not modify INI setting.
          */
-        if (AR_SREV_9300_20_OR_LATER(ah) || modparam_force_new_ani) {
+        if (use_new_ani(ah)) {
                 const struct ani_ofdm_level_entry *entry_ofdm;
                 const struct ani_cck_level_entry *entry_cck;
 
@@ -1273,50 +919,9 @@ void ath9k_hw_ani_init(struct ath_hw *ah)
                 ah->config.ani_poll_interval = ATH9K_ANI_POLLINTERVAL_OLD;
         }
 
-        ath_print(common, ATH_DBG_ANI,
-                  "Setting OfdmErrBase = 0x%08x\n",
-                  ah->ani[0].ofdmPhyErrBase);
-        ath_print(common, ATH_DBG_ANI, "Setting cckErrBase = 0x%08x\n",
-                  ah->ani[0].cckPhyErrBase);
-
-        ENABLE_REGWRITE_BUFFER(ah);
-
-        REG_WRITE(ah, AR_PHY_ERR_1, ah->ani[0].ofdmPhyErrBase);
-        REG_WRITE(ah, AR_PHY_ERR_2, ah->ani[0].cckPhyErrBase);
-
-        REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
-
-        ath9k_enable_mib_counters(ah);
-
         if (ah->config.enable_ani)
                 ah->proc_phyerr |= HAL_PROCESS_ANI;
-}
-
-void ath9k_hw_attach_ani_ops_old(struct ath_hw *ah)
-{
-        struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
-        struct ath_hw_ops *ops = ath9k_hw_ops(ah);
-
-        priv_ops->ani_reset = ath9k_ani_reset_old;
-        priv_ops->ani_lower_immunity = ath9k_hw_ani_lower_immunity_old;
-
-        ops->ani_proc_mib_event = ath9k_hw_proc_mib_event_old;
-        ops->ani_monitor = ath9k_hw_ani_monitor_old;
 
-        ath_print(ath9k_hw_common(ah), ATH_DBG_ANY, "Using ANI v1\n");
-}
-
-void ath9k_hw_attach_ani_ops_new(struct ath_hw *ah)
-{
-        struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
-        struct ath_hw_ops *ops = ath9k_hw_ops(ah);
-
-        priv_ops->ani_reset = ath9k_ani_reset_new;
-        priv_ops->ani_lower_immunity = ath9k_hw_ani_lower_immunity_new;
-
-        ops->ani_proc_mib_event = ath9k_hw_proc_mib_event_new;
-        ops->ani_monitor = ath9k_hw_ani_monitor_new;
-
-        ath_print(ath9k_hw_common(ah), ATH_DBG_ANY, "Using ANI v2\n");
+        ath9k_ani_restart(ah);
+        ath9k_enable_mib_counters(ah);
 }
diff --git a/drivers/net/wireless/ath/ath9k/ani.h b/drivers/net/wireless/ath/ath9k/ani.h
index f4d0a4d48b37..0cd6783de883 100644
--- a/drivers/net/wireless/ath/ath9k/ani.h
+++ b/drivers/net/wireless/ath/ath9k/ani.h
@@ -19,7 +19,7 @@
 
 #define HAL_PROCESS_ANI           0x00000001
 
-#define DO_ANI(ah) (((ah)->proc_phyerr & HAL_PROCESS_ANI))
+#define DO_ANI(ah) (((ah)->proc_phyerr & HAL_PROCESS_ANI) && ah->curchan)
 
 #define BEACON_RSSI(ahp) (ahp->stats.avgbrssi)
 
@@ -123,20 +123,11 @@ struct ar5416AniState {
         u8 ofdmWeakSigDetectOff;
         u8 cckWeakSigThreshold;
         u32 listenTime;
-        u32 ofdmTrigHigh;
-        u32 ofdmTrigLow;
-        int32_t cckTrigHigh;
-        int32_t cckTrigLow;
         int32_t rssiThrLow;
         int32_t rssiThrHigh;
         u32 noiseFloor;
-        u32 txFrameCount;
-        u32 rxFrameCount;
-        u32 cycleCount;
         u32 ofdmPhyErrCount;
         u32 cckPhyErrCount;
-        u32 ofdmPhyErrBase;
-        u32 cckPhyErrBase;
         int16_t pktRssi[2];
         int16_t ofdmErrRssi[2];
         int16_t cckErrRssi[2];
@@ -166,8 +157,6 @@ struct ar5416Stats {
 
 void ath9k_enable_mib_counters(struct ath_hw *ah);
 void ath9k_hw_disable_mib_counters(struct ath_hw *ah);
-u32 ath9k_hw_GetMibCycleCountsPct(struct ath_hw *ah, u32 *rxc_pcnt,
-                                  u32 *rxf_pcnt, u32 *txf_pcnt);
 void ath9k_hw_ani_setup(struct ath_hw *ah);
 void ath9k_hw_ani_init(struct ath_hw *ah);
 int ath9k_hw_get_ani_channel_idx(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 3d2c8679bc85..ea9f4497f58c 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -118,7 +118,7 @@ static void ar5008_hw_force_bias(struct ath_hw *ah, u16 synth_freq)
         if (!AR_SREV_5416(ah) || synth_freq >= 3000)
                 return;
 
-        BUG_ON(AR_SREV_9280_10_OR_LATER(ah));
+        BUG_ON(AR_SREV_9280_20_OR_LATER(ah));
 
         if (synth_freq < 2412)
                 new_bias = 0;
@@ -454,7 +454,7 @@ static int ar5008_hw_rf_alloc_ext_banks(struct ath_hw *ah)
 
         struct ath_common *common = ath9k_hw_common(ah);
 
-        BUG_ON(AR_SREV_9280_10_OR_LATER(ah));
+        BUG_ON(AR_SREV_9280_20_OR_LATER(ah));
 
         ATH_ALLOC_BANK(ah->analogBank0Data, ah->iniBank0.ia_rows);
         ATH_ALLOC_BANK(ah->analogBank1Data, ah->iniBank1.ia_rows);
@@ -484,7 +484,7 @@ static void ar5008_hw_rf_free_ext_banks(struct ath_hw *ah)
                 bank = NULL; \
         } while (0);
 
-        BUG_ON(AR_SREV_9280_10_OR_LATER(ah));
+        BUG_ON(AR_SREV_9280_20_OR_LATER(ah));
 
         ATH_FREE_BANK(ah->analogBank0Data);
         ATH_FREE_BANK(ah->analogBank1Data);
@@ -525,7 +525,7 @@ static bool ar5008_hw_set_rf_regs(struct ath_hw *ah,
          * for single chip devices, that is AR9280 or anything
          * after that.
          */
-        if (AR_SREV_9280_10_OR_LATER(ah))
+        if (AR_SREV_9280_20_OR_LATER(ah))
                 return true;
 
         /* Setup rf parameters */
@@ -613,14 +613,11 @@ static void ar5008_hw_init_chain_masks(struct ath_hw *ah)
         rx_chainmask = ah->rxchainmask;
         tx_chainmask = ah->txchainmask;
 
-        ENABLE_REGWRITE_BUFFER(ah);
 
         switch (rx_chainmask) {
         case 0x5:
-                DISABLE_REGWRITE_BUFFER(ah);
                 REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
                             AR_PHY_SWAP_ALT_CHAIN);
-                ENABLE_REGWRITE_BUFFER(ah);
         case 0x3:
                 if (ah->hw_version.macVersion == AR_SREV_REVISION_5416_10) {
                         REG_WRITE(ah, AR_PHY_RX_CHAINMASK, 0x7);
@@ -630,17 +627,18 @@ static void ar5008_hw_init_chain_masks(struct ath_hw *ah)
         case 0x1:
         case 0x2:
         case 0x7:
+                ENABLE_REGWRITE_BUFFER(ah);
                 REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx_chainmask);
                 REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx_chainmask);
                 break;
         default:
+                ENABLE_REGWRITE_BUFFER(ah);
                 break;
         }
 
         REG_WRITE(ah, AR_SELFGEN_MASK, tx_chainmask);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         if (tx_chainmask == 0x5) {
                 REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
@@ -663,20 +661,20 @@ static void ar5008_hw_override_ini(struct ath_hw *ah,
          */
         REG_SET_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
 
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
                 val = REG_READ(ah, AR_PCU_MISC_MODE2);
 
                 if (!AR_SREV_9271(ah))
                         val &= ~AR_PCU_MISC_MODE2_HWWAR1;
 
-                if (AR_SREV_9287_10_OR_LATER(ah))
+                if (AR_SREV_9287_11_OR_LATER(ah))
                         val = val & (~AR_PCU_MISC_MODE2_HWWAR2);
 
                 REG_WRITE(ah, AR_PCU_MISC_MODE2, val);
         }
 
         if (!AR_SREV_5416_20_OR_LATER(ah) ||
-            AR_SREV_9280_10_OR_LATER(ah))
+            AR_SREV_9280_20_OR_LATER(ah))
                 return;
         /*
          * Disable BB clock gating
@@ -701,7 +699,7 @@ static void ar5008_hw_set_channel_regs(struct ath_hw *ah,
         u32 phymode;
         u32 enableDacFifo = 0;
 
-        if (AR_SREV_9285_10_OR_LATER(ah))
+        if (AR_SREV_9285_12_OR_LATER(ah))
                 enableDacFifo = (REG_READ(ah, AR_PHY_TURBO) &
                                          AR_PHY_FC_ENABLE_DAC_FIFO);
 
@@ -726,7 +724,6 @@ static void ar5008_hw_set_channel_regs(struct ath_hw *ah,
         REG_WRITE(ah, AR_CST, 0xF << AR_CST_TIMEOUT_LIMIT_S);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 
@@ -818,13 +815,12 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
         }
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
-        if (AR_SREV_9280(ah) || AR_SREV_9287_10_OR_LATER(ah))
+        if (AR_SREV_9280(ah) || AR_SREV_9287_11_OR_LATER(ah))
                 REG_WRITE_ARRAY(&ah->iniModesRxGain, modesIndex, regWrites);
 
         if (AR_SREV_9280(ah) || AR_SREV_9285_12_OR_LATER(ah) ||
-            AR_SREV_9287_10_OR_LATER(ah))
+            AR_SREV_9287_11_OR_LATER(ah))
                 REG_WRITE_ARRAY(&ah->iniModesTxGain, modesIndex, regWrites);
 
         if (AR_SREV_9271_10(ah))
@@ -849,7 +845,6 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
         }
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         if (AR_SREV_9271(ah)) {
                 if (ah->eep_ops->get_eeprom(ah, EEP_TXGAIN_TYPE) == 1)
@@ -900,7 +895,7 @@ static void ar5008_hw_set_rfmode(struct ath_hw *ah, struct ath9k_channel *chan)
         rfMode |= (IS_CHAN_B(chan) || IS_CHAN_G(chan))
                 ? AR_PHY_MODE_DYNAMIC : AR_PHY_MODE_OFDM;
 
-        if (!AR_SREV_9280_10_OR_LATER(ah))
+        if (!AR_SREV_9280_20_OR_LATER(ah))
                 rfMode |= (IS_CHAN_5GHZ(chan)) ?
                         AR_PHY_MODE_RF5GHZ : AR_PHY_MODE_RF2GHZ;
 
@@ -1053,7 +1048,7 @@ static bool ar5008_hw_ani_control_old(struct ath_hw *ah,
                                       enum ath9k_ani_cmd cmd,
                                       int param)
 {
-        struct ar5416AniState *aniState = ah->curani;
+        struct ar5416AniState *aniState = &ah->curchan->ani;
         struct ath_common *common = ath9k_hw_common(ah);
 
         switch (cmd & ah->ani_function) {
@@ -1225,8 +1220,7 @@ static bool ar5008_hw_ani_control_old(struct ath_hw *ah,
                   aniState->firstepLevel,
                   aniState->listenTime);
         ath_print(common, ATH_DBG_ANI,
-                "cycleCount=%d, ofdmPhyErrCount=%d, cckPhyErrCount=%d\n\n",
-                aniState->cycleCount,
+                "ofdmPhyErrCount=%d, cckPhyErrCount=%d\n\n",
                 aniState->ofdmPhyErrCount,
                 aniState->cckPhyErrCount);
 
@@ -1237,9 +1231,9 @@ static bool ar5008_hw_ani_control_new(struct ath_hw *ah,
                                       enum ath9k_ani_cmd cmd,
                                       int param)
 {
-        struct ar5416AniState *aniState = ah->curani;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_channel *chan = ah->curchan;
+        struct ar5416AniState *aniState = &chan->ani;
         s32 value, value2;
 
         switch (cmd & ah->ani_function) {
@@ -1478,15 +1472,13 @@ static bool ar5008_hw_ani_control_new(struct ath_hw *ah,
 
         ath_print(common, ATH_DBG_ANI,
                   "ANI parameters: SI=%d, ofdmWS=%s FS=%d "
-                  "MRCcck=%s listenTime=%d CC=%d listen=%d "
+                  "MRCcck=%s listenTime=%d "
                   "ofdmErrs=%d cckErrs=%d\n",
                   aniState->spurImmunityLevel,
                   !aniState->ofdmWeakSigDetectOff ? "on" : "off",
                   aniState->firstepLevel,
                   !aniState->mrcCCKOff ? "on" : "off",
                   aniState->listenTime,
-                  aniState->cycleCount,
-                  aniState->listenTime,
                   aniState->ofdmPhyErrCount,
                   aniState->cckPhyErrCount);
         return true;
@@ -1526,16 +1518,12 @@ static void ar5008_hw_do_getnf(struct ath_hw *ah,
  */
 static void ar5008_hw_ani_cache_ini_regs(struct ath_hw *ah)
 {
-        struct ar5416AniState *aniState;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_channel *chan = ah->curchan;
+        struct ar5416AniState *aniState = &chan->ani;
         struct ath9k_ani_default *iniDef;
-        int index;
         u32 val;
 
-        index = ath9k_hw_get_ani_channel_idx(ah, chan);
-        aniState = &ah->ani[index];
-        ah->curani = aniState;
         iniDef = &aniState->iniDef;
 
         ath_print(common, ATH_DBG_ANI,
@@ -1579,8 +1567,6 @@ static void ar5008_hw_ani_cache_ini_regs(struct ath_hw *ah)
         aniState->firstepLevel = ATH9K_ANI_FIRSTEP_LVL_NEW;
         aniState->ofdmWeakSigDetectOff = !ATH9K_ANI_USE_OFDM_WEAK_SIG;
         aniState->mrcCCKOff = true; /* not available on pre AR9003 */
-
-        aniState->cycleCount = 0;
 }
 
 static void ar5008_hw_set_nf_limits(struct ath_hw *ah)
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index fe7418aefc4a..15f62cd0cc38 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -20,6 +20,13 @@
 
 #define AR9285_CLCAL_REDO_THRESH    1
 
+enum ar9002_cal_types {
+        ADC_GAIN_CAL = BIT(0),
+        ADC_DC_CAL = BIT(1),
+        IQ_MISMATCH_CAL = BIT(2),
+};
+
+
 static void ar9002_hw_setup_calibration(struct ath_hw *ah,
                                         struct ath9k_cal_list *currCal)
 {
@@ -45,13 +52,6 @@ static void ar9002_hw_setup_calibration(struct ath_hw *ah,
                 ath_print(common, ATH_DBG_CALIBRATE,
                           "starting ADC DC Calibration\n");
                 break;
-        case ADC_DC_INIT_CAL:
-                REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_ADC_DC_INIT);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "starting Init ADC DC Calibration\n");
-                break;
-        case TEMP_COMP_CAL:
-                break; /* Not supported */
         }
 
         REG_SET_BIT(ah, AR_PHY_TIMING_CTRL4(0),
@@ -96,25 +96,6 @@ static bool ar9002_hw_per_calibration(struct ath_hw *ah,
         return iscaldone;
 }
 
-/* Assumes you are talking about the currently configured channel */
-static bool ar9002_hw_iscal_supported(struct ath_hw *ah,
-                                      enum ath9k_cal_types calType)
-{
-        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
-
-        switch (calType & ah->supp_cals) {
-        case IQ_MISMATCH_CAL: /* Both 2 GHz and 5 GHz support OFDM */
-                return true;
-        case ADC_GAIN_CAL:
-        case ADC_DC_CAL:
-                if (!(conf->channel->band == IEEE80211_BAND_2GHZ &&
-                      conf_is_ht20(conf)))
-                        return true;
-                break;
-        }
-        return false;
-}
-
 static void ar9002_hw_iqcal_collect(struct ath_hw *ah)
 {
         int i;
@@ -541,7 +522,6 @@ static void ar9271_hw_pa_cal(struct ath_hw *ah, bool is_reset)
                 REG_WRITE(ah, regList[i][0], regList[i][1]);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 static inline void ar9285_hw_pa_cal(struct ath_hw *ah, bool is_reset)
@@ -567,11 +547,6 @@ static inline void ar9285_hw_pa_cal(struct ath_hw *ah, bool is_reset)
             AR5416_EEP_TXGAIN_HIGH_POWER)
                 return;
 
-        if (AR_SREV_9285_11(ah)) {
-                REG_WRITE(ah, AR9285_AN_TOP4, (AR9285_AN_TOP4_DEFAULT | 0x14));
-                udelay(10);
-        }
-
         for (i = 0; i < ARRAY_SIZE(regList); i++)
                 regList[i][1] = REG_READ(ah, regList[i][0]);
 
@@ -651,10 +626,6 @@ static inline void ar9285_hw_pa_cal(struct ath_hw *ah, bool is_reset)
                 REG_WRITE(ah, regList[i][0], regList[i][1]);
 
         REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9285_AN_RF2G6_CCOMP, ccomp_org);
-
-        if (AR_SREV_9285_11(ah))
-                REG_WRITE(ah, AR9285_AN_TOP4, AR9285_AN_TOP4_DEFAULT);
-
 }
 
 static void ar9002_hw_pa_cal(struct ath_hw *ah, bool is_reset)
@@ -664,7 +635,7 @@ static void ar9002_hw_pa_cal(struct ath_hw *ah, bool is_reset)
                         ar9271_hw_pa_cal(ah, is_reset);
                 else
                         ah->pacal_info.skipcount--;
-        } else if (AR_SREV_9285_11_OR_LATER(ah)) {
+        } else if (AR_SREV_9285_12_OR_LATER(ah)) {
                 if (is_reset || !ah->pacal_info.skipcount)
                         ar9285_hw_pa_cal(ah, is_reset);
                 else
@@ -841,8 +812,8 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
                 if (!ar9285_hw_clc(ah, chan))
                         return false;
         } else {
-                if (AR_SREV_9280_10_OR_LATER(ah)) {
-                        if (!AR_SREV_9287_10_OR_LATER(ah))
+                if (AR_SREV_9280_20_OR_LATER(ah)) {
+                        if (!AR_SREV_9287_11_OR_LATER(ah))
                                 REG_CLR_BIT(ah, AR_PHY_ADC_CTL,
                                             AR_PHY_ADC_CTL_OFF_PWDADC);
                         REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
@@ -864,8 +835,8 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
                         return false;
                 }
 
-                if (AR_SREV_9280_10_OR_LATER(ah)) {
-                        if (!AR_SREV_9287_10_OR_LATER(ah))
+                if (AR_SREV_9280_20_OR_LATER(ah)) {
+                        if (!AR_SREV_9287_11_OR_LATER(ah))
                                 REG_SET_BIT(ah, AR_PHY_ADC_CTL,
                                             AR_PHY_ADC_CTL_OFF_PWDADC);
                         REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
@@ -886,24 +857,28 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
 
         /* Enable IQ, ADC Gain and ADC DC offset CALs */
         if (AR_SREV_9100(ah) || AR_SREV_9160_10_OR_LATER(ah)) {
-                if (ar9002_hw_iscal_supported(ah, ADC_GAIN_CAL)) {
+                ah->supp_cals = IQ_MISMATCH_CAL;
+
+                if (AR_SREV_9160_10_OR_LATER(ah) &&
+                    !(IS_CHAN_2GHZ(chan) && IS_CHAN_HT20(chan))) {
+                        ah->supp_cals |= ADC_GAIN_CAL | ADC_DC_CAL;
+
+
                         INIT_CAL(&ah->adcgain_caldata);
                         INSERT_CAL(ah, &ah->adcgain_caldata);
                         ath_print(common, ATH_DBG_CALIBRATE,
                                   "enabling ADC Gain Calibration.\n");
-                }
-                if (ar9002_hw_iscal_supported(ah, ADC_DC_CAL)) {
+
                         INIT_CAL(&ah->adcdc_caldata);
                         INSERT_CAL(ah, &ah->adcdc_caldata);
                         ath_print(common, ATH_DBG_CALIBRATE,
                                   "enabling ADC DC Calibration.\n");
                 }
-                if (ar9002_hw_iscal_supported(ah, IQ_MISMATCH_CAL)) {
-                        INIT_CAL(&ah->iq_caldata);
-                        INSERT_CAL(ah, &ah->iq_caldata);
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "enabling IQ Calibration.\n");
-                }
+
+                INIT_CAL(&ah->iq_caldata);
+                INSERT_CAL(ah, &ah->iq_caldata);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "enabling IQ Calibration.\n");
 
                 ah->cal_list_curr = ah->cal_list;
 
@@ -959,13 +934,6 @@ static const struct ath9k_percal_data adc_dc_cal_single_sample = {
         ar9002_hw_adc_dccal_collect,
         ar9002_hw_adc_dccal_calibrate
 };
-static const struct ath9k_percal_data adc_init_dc_cal = {
-        ADC_DC_INIT_CAL,
-        MIN_CAL_SAMPLES,
-        INIT_LOG_COUNT,
-        ar9002_hw_adc_dccal_collect,
-        ar9002_hw_adc_dccal_calibrate
-};
 
 static void ar9002_hw_init_cal_settings(struct ath_hw *ah)
 {
@@ -976,22 +944,18 @@ static void ar9002_hw_init_cal_settings(struct ath_hw *ah)
         }
 
         if (AR_SREV_9160_10_OR_LATER(ah)) {
-                if (AR_SREV_9280_10_OR_LATER(ah)) {
+                if (AR_SREV_9280_20_OR_LATER(ah)) {
                         ah->iq_caldata.calData = &iq_cal_single_sample;
                         ah->adcgain_caldata.calData =
                                 &adc_gain_cal_single_sample;
                         ah->adcdc_caldata.calData =
                                 &adc_dc_cal_single_sample;
-                        ah->adcdc_calinitdata.calData =
-                                &adc_init_dc_cal;
                 } else {
                         ah->iq_caldata.calData = &iq_cal_multi_sample;
                         ah->adcgain_caldata.calData =
                                 &adc_gain_cal_multi_sample;
                         ah->adcdc_caldata.calData =
                                 &adc_dc_cal_multi_sample;
-                        ah->adcdc_calinitdata.calData =
-                                &adc_init_dc_cal;
                 }
                 ah->supp_cals = ADC_GAIN_CAL | ADC_DC_CAL | IQ_MISMATCH_CAL;
         }
@@ -1005,7 +969,6 @@ void ar9002_hw_attach_calib_ops(struct ath_hw *ah)
         priv_ops->init_cal_settings = ar9002_hw_init_cal_settings;
         priv_ops->init_cal = ar9002_hw_init_cal;
         priv_ops->setup_calibration = ar9002_hw_setup_calibration;
-        priv_ops->iscal_supported = ar9002_hw_iscal_supported;
 
         ops->calibrate = ar9002_hw_calibrate;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 303c63da5ea3..a0471f2e1c7a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -371,7 +371,6 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
                         REG_WRITE(ah, AR_PCIE_SERDES2, 0x00000000);
 
                         REGWRITE_BUFFER_FLUSH(ah);
-                        DISABLE_REGWRITE_BUFFER(ah);
                 }
 
                 udelay(1000);
@@ -468,7 +467,6 @@ static int ar9002_hw_get_radiorev(struct ath_hw *ah)
                 REG_WRITE(ah, AR_PHY(0x20), 0x00010000);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         val = (REG_READ(ah, AR_PHY(256)) >> 24) & 0xff;
         val = ((val & 0xf0) >> 4) | ((val & 0x0f) << 4);
@@ -569,14 +567,57 @@ void ar9002_hw_attach_ops(struct ath_hw *ah)
         ops->config_pci_powersave = ar9002_hw_configpcipowersave;
 
         ar5008_hw_attach_phy_ops(ah);
-        if (AR_SREV_9280_10_OR_LATER(ah))
+        if (AR_SREV_9280_20_OR_LATER(ah))
                 ar9002_hw_attach_phy_ops(ah);
 
         ar9002_hw_attach_calib_ops(ah);
         ar9002_hw_attach_mac_ops(ah);
+}
+
+void ar9002_hw_load_ani_reg(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        u32 modesIndex;
+        int i;
+
+        switch (chan->chanmode) {
+        case CHANNEL_A:
+        case CHANNEL_A_HT20:
+                modesIndex = 1;
+                break;
+        case CHANNEL_A_HT40PLUS:
+        case CHANNEL_A_HT40MINUS:
+                modesIndex = 2;
+                break;
+        case CHANNEL_G:
+        case CHANNEL_G_HT20:
+        case CHANNEL_B:
+                modesIndex = 4;
+                break;
+        case CHANNEL_G_HT40PLUS:
+        case CHANNEL_G_HT40MINUS:
+                modesIndex = 3;
+                break;
+
+        default:
+                return;
+        }
+
+        ENABLE_REGWRITE_BUFFER(ah);
 
-        if (modparam_force_new_ani)
-                ath9k_hw_attach_ani_ops_new(ah);
-        else
-                ath9k_hw_attach_ani_ops_old(ah);
+        for (i = 0; i < ah->iniModes_9271_ANI_reg.ia_rows; i++) {
+                u32 reg = INI_RA(&ah->iniModes_9271_ANI_reg, i, 0);
+                u32 val = INI_RA(&ah->iniModes_9271_ANI_reg, i, modesIndex);
+                u32 val_orig;
+
+                if (reg == AR_PHY_CCK_DETECT) {
+                        val_orig = REG_READ(ah, reg);
+                        val &= AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK;
+                        val_orig &= ~AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK;
+
+                        REG_WRITE(ah, reg, val|val_orig);
+                } else
+                        REG_WRITE(ah, reg, val);
+        }
+
+        REGWRITE_BUFFER_FLUSH(ah);
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.c b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
index adbf031fbc5a..c00cdc67b55b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
@@ -415,7 +415,6 @@ static void ar9002_hw_spur_mitigate(struct ath_hw *ah,
         REG_WRITE(ah, AR_PHY_MASK2_P_61_45, tmp_mask);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 static void ar9002_olc_init(struct ath_hw *ah)
@@ -530,3 +529,38 @@ void ar9002_hw_attach_phy_ops(struct ath_hw *ah)
 
         ar9002_hw_set_nf_limits(ah);
 }
+
+void ath9k_hw_antdiv_comb_conf_get(struct ath_hw *ah,
+                                   struct ath_hw_antcomb_conf *antconf)
+{
+        u32 regval;
+
+        regval = REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
+        antconf->main_lna_conf = (regval & AR_PHY_9285_ANT_DIV_MAIN_LNACONF) >>
+                                  AR_PHY_9285_ANT_DIV_MAIN_LNACONF_S;
+        antconf->alt_lna_conf = (regval & AR_PHY_9285_ANT_DIV_ALT_LNACONF) >>
+                                 AR_PHY_9285_ANT_DIV_ALT_LNACONF_S;
+        antconf->fast_div_bias = (regval & AR_PHY_9285_FAST_DIV_BIAS) >>
+                                  AR_PHY_9285_FAST_DIV_BIAS_S;
+}
+EXPORT_SYMBOL(ath9k_hw_antdiv_comb_conf_get);
+
+void ath9k_hw_antdiv_comb_conf_set(struct ath_hw *ah,
+                                   struct ath_hw_antcomb_conf *antconf)
+{
+        u32 regval;
+
+        regval = REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
+        regval &= ~(AR_PHY_9285_ANT_DIV_MAIN_LNACONF |
+                    AR_PHY_9285_ANT_DIV_ALT_LNACONF |
+                    AR_PHY_9285_FAST_DIV_BIAS);
+        regval |= ((antconf->main_lna_conf << AR_PHY_9285_ANT_DIV_MAIN_LNACONF_S)
+                   & AR_PHY_9285_ANT_DIV_MAIN_LNACONF);
+        regval |= ((antconf->alt_lna_conf << AR_PHY_9285_ANT_DIV_ALT_LNACONF_S)
+                   & AR_PHY_9285_ANT_DIV_ALT_LNACONF);
+        regval |= ((antconf->fast_div_bias << AR_PHY_9285_FAST_DIV_BIAS_S)
+                   & AR_PHY_9285_FAST_DIV_BIAS);
+
+        REG_WRITE(ah, AR_PHY_MULTICHAIN_GAIN_CTL, regval);
+}
+EXPORT_SYMBOL(ath9k_hw_antdiv_comb_conf_set);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.h b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
index c5151a4dd10b..37663dbbcf57 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
@@ -302,6 +302,8 @@
 #define AR_PHY_NEW_ADC_DC_OFFSET_CORR_ENABLE 0x80000000
 
 #define AR_PHY_MULTICHAIN_GAIN_CTL          0x99ac
+#define AR_PHY_9285_FAST_DIV_BIAS           0x00007E00
+#define AR_PHY_9285_FAST_DIV_BIAS_S         9
 #define AR_PHY_9285_ANT_DIV_CTL_ALL         0x7f000000
 #define AR_PHY_9285_ANT_DIV_CTL             0x01000000
 #define AR_PHY_9285_ANT_DIV_CTL_S           24
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p0_initvals.h
deleted file mode 100644
index d3375fc4ce8b..000000000000
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p0_initvals.h
+++ /dev/null
@@ -1,1784 +0,0 @@
-/*
- * Copyright (c) 2010 Atheros Communications Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef INITVALS_9003_2P0_H
-#define INITVALS_9003_2P0_H
-
-/* AR9003 2.0 */
-
-static const u32 ar9300_2p0_radio_postamble[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0001609c, 0x0dd08f29, 0x0dd08f29, 0x0b283f31, 0x0b283f31},
-        {0x000160ac, 0xa4653c00, 0xa4653c00, 0x24652800, 0x24652800},
-        {0x000160b0, 0x03284f3e, 0x03284f3e, 0x05d08f20, 0x05d08f20},
-        {0x0001610c, 0x08000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x00016140, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
-        {0x0001650c, 0x08000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x00016540, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
-        {0x0001690c, 0x08000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x00016940, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
-};
-
-static const u32 ar9300Modes_lowest_ob_db_tx_gain_table_2p0[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
-        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
-        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
-        {0x0000a518, 0x21020220, 0x21020220, 0x16000402, 0x16000402},
-        {0x0000a51c, 0x27020223, 0x27020223, 0x19000404, 0x19000404},
-        {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
-        {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
-        {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
-        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
-        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
-        {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
-        {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
-        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
-        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
-        {0x0000a544, 0x5302266c, 0x5302266c, 0x3f001861, 0x3f001861},
-        {0x0000a548, 0x5702286c, 0x5702286c, 0x43001a81, 0x43001a81},
-        {0x0000a54c, 0x5c04286b, 0x5c04286b, 0x47001a83, 0x47001a83},
-        {0x0000a550, 0x61042a6c, 0x61042a6c, 0x4a001c84, 0x4a001c84},
-        {0x0000a554, 0x66062a6c, 0x66062a6c, 0x4e001ce3, 0x4e001ce3},
-        {0x0000a558, 0x6b062e6c, 0x6b062e6c, 0x52001ce5, 0x52001ce5},
-        {0x0000a55c, 0x7006308c, 0x7006308c, 0x56001ce9, 0x56001ce9},
-        {0x0000a560, 0x730a308a, 0x730a308a, 0x5a001ceb, 0x5a001ceb},
-        {0x0000a564, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a568, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a56c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a570, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a574, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a578, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a57c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
-        {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
-        {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
-        {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
-        {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202},
-        {0x0000a594, 0x1c800223, 0x1c800223, 0x12800400, 0x12800400},
-        {0x0000a598, 0x21820220, 0x21820220, 0x16800402, 0x16800402},
-        {0x0000a59c, 0x27820223, 0x27820223, 0x19800404, 0x19800404},
-        {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1c800603, 0x1c800603},
-        {0x0000a5a4, 0x2f822222, 0x2f822222, 0x21800a02, 0x21800a02},
-        {0x0000a5a8, 0x34822225, 0x34822225, 0x25800a04, 0x25800a04},
-        {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x28800a20, 0x28800a20},
-        {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2c800e20, 0x2c800e20},
-        {0x0000a5b4, 0x4282242a, 0x4282242a, 0x30800e22, 0x30800e22},
-        {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24},
-        {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640},
-        {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660},
-        {0x0000a5c4, 0x5382266c, 0x5382266c, 0x3f801861, 0x3f801861},
-        {0x0000a5c8, 0x5782286c, 0x5782286c, 0x43801a81, 0x43801a81},
-        {0x0000a5cc, 0x5c84286b, 0x5c84286b, 0x47801a83, 0x47801a83},
-        {0x0000a5d0, 0x61842a6c, 0x61842a6c, 0x4a801c84, 0x4a801c84},
-        {0x0000a5d4, 0x66862a6c, 0x66862a6c, 0x4e801ce3, 0x4e801ce3},
-        {0x0000a5d8, 0x6b862e6c, 0x6b862e6c, 0x52801ce5, 0x52801ce5},
-        {0x0000a5dc, 0x7086308c, 0x7086308c, 0x56801ce9, 0x56801ce9},
-        {0x0000a5e0, 0x738a308a, 0x738a308a, 0x5a801ceb, 0x5a801ceb},
-        {0x0000a5e4, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5e8, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5ec, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f0, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f4, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f8, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5fc, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016048, 0x62480001, 0x62480001, 0x62480001, 0x62480001},
-        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
-        {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016448, 0x62480001, 0x62480001, 0x62480001, 0x62480001},
-        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
-        {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016848, 0x62480001, 0x62480001, 0x62480001, 0x62480001},
-        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
-};
-
-static const u32 ar9300Modes_fast_clock_2p0[][3] = {
-        /* Addr      5G_HT20     5G_HT40   */
-        {0x00001030, 0x00000268, 0x000004d0},
-        {0x00001070, 0x0000018c, 0x00000318},
-        {0x000010b0, 0x00000fd0, 0x00001fa0},
-        {0x00008014, 0x044c044c, 0x08980898},
-        {0x0000801c, 0x148ec02b, 0x148ec057},
-        {0x00008318, 0x000044c0, 0x00008980},
-        {0x00009e00, 0x03721821, 0x03721821},
-        {0x0000a230, 0x0000000b, 0x00000016},
-        {0x0000a254, 0x00000898, 0x00001130},
-};
-
-static const u32 ar9300_2p0_radio_core[][2] = {
-        /* Addr      allmodes  */
-        {0x00016000, 0x36db6db6},
-        {0x00016004, 0x6db6db40},
-        {0x00016008, 0x73f00000},
-        {0x0001600c, 0x00000000},
-        {0x00016040, 0x7f80fff8},
-        {0x0001604c, 0x76d005b5},
-        {0x00016050, 0x556cf031},
-        {0x00016054, 0x13449440},
-        {0x00016058, 0x0c51c92c},
-        {0x0001605c, 0x3db7fffc},
-        {0x00016060, 0xfffffffc},
-        {0x00016064, 0x000f0278},
-        {0x0001606c, 0x6db60000},
-        {0x00016080, 0x00000000},
-        {0x00016084, 0x0e48048c},
-        {0x00016088, 0x54214514},
-        {0x0001608c, 0x119f481e},
-        {0x00016090, 0x24926490},
-        {0x00016098, 0xd2888888},
-        {0x000160a0, 0x0a108ffe},
-        {0x000160a4, 0x812fc370},
-        {0x000160a8, 0x423c8000},
-        {0x000160b4, 0x92480080},
-        {0x000160c0, 0x00adb6d0},
-        {0x000160c4, 0x6db6db60},
-        {0x000160c8, 0x6db6db6c},
-        {0x000160cc, 0x01e6c000},
-        {0x00016100, 0x3fffbe01},
-        {0x00016104, 0xfff80000},
-        {0x00016108, 0x00080010},
-        {0x00016144, 0x02084080},
-        {0x00016148, 0x00000000},
-        {0x00016280, 0x058a0001},
-        {0x00016284, 0x3d840208},
-        {0x00016288, 0x05a20408},
-        {0x0001628c, 0x00038c07},
-        {0x00016290, 0x40000004},
-        {0x00016294, 0x458aa14f},
-        {0x00016380, 0x00000000},
-        {0x00016384, 0x00000000},
-        {0x00016388, 0x00800700},
-        {0x0001638c, 0x00800700},
-        {0x00016390, 0x00800700},
-        {0x00016394, 0x00000000},
-        {0x00016398, 0x00000000},
-        {0x0001639c, 0x00000000},
-        {0x000163a0, 0x00000001},
-        {0x000163a4, 0x00000001},
-        {0x000163a8, 0x00000000},
-        {0x000163ac, 0x00000000},
-        {0x000163b0, 0x00000000},
-        {0x000163b4, 0x00000000},
-        {0x000163b8, 0x00000000},
-        {0x000163bc, 0x00000000},
-        {0x000163c0, 0x000000a0},
-        {0x000163c4, 0x000c0000},
-        {0x000163c8, 0x14021402},
-        {0x000163cc, 0x00001402},
-        {0x000163d0, 0x00000000},
-        {0x000163d4, 0x00000000},
-        {0x00016400, 0x36db6db6},
-        {0x00016404, 0x6db6db40},
-        {0x00016408, 0x73f00000},
-        {0x0001640c, 0x00000000},
-        {0x00016440, 0x7f80fff8},
-        {0x0001644c, 0x76d005b5},
-        {0x00016450, 0x556cf031},
-        {0x00016454, 0x13449440},
-        {0x00016458, 0x0c51c92c},
-        {0x0001645c, 0x3db7fffc},
-        {0x00016460, 0xfffffffc},
-        {0x00016464, 0x000f0278},
-        {0x0001646c, 0x6db60000},
-        {0x00016500, 0x3fffbe01},
-        {0x00016504, 0xfff80000},
-        {0x00016508, 0x00080010},
-        {0x00016544, 0x02084080},
-        {0x00016548, 0x00000000},
-        {0x00016780, 0x00000000},
-        {0x00016784, 0x00000000},
-        {0x00016788, 0x00800700},
-        {0x0001678c, 0x00800700},
-        {0x00016790, 0x00800700},
-        {0x00016794, 0x00000000},
-        {0x00016798, 0x00000000},
-        {0x0001679c, 0x00000000},
-        {0x000167a0, 0x00000001},
-        {0x000167a4, 0x00000001},
-        {0x000167a8, 0x00000000},
-        {0x000167ac, 0x00000000},
-        {0x000167b0, 0x00000000},
-        {0x000167b4, 0x00000000},
-        {0x000167b8, 0x00000000},
-        {0x000167bc, 0x00000000},
-        {0x000167c0, 0x000000a0},
-        {0x000167c4, 0x000c0000},
-        {0x000167c8, 0x14021402},
-        {0x000167cc, 0x00001402},
-        {0x000167d0, 0x00000000},
-        {0x000167d4, 0x00000000},
-        {0x00016800, 0x36db6db6},
-        {0x00016804, 0x6db6db40},
-        {0x00016808, 0x73f00000},
-        {0x0001680c, 0x00000000},
-        {0x00016840, 0x7f80fff8},
-        {0x0001684c, 0x76d005b5},
-        {0x00016850, 0x556cf031},
-        {0x00016854, 0x13449440},
-        {0x00016858, 0x0c51c92c},
-        {0x0001685c, 0x3db7fffc},
-        {0x00016860, 0xfffffffc},
-        {0x00016864, 0x000f0278},
-        {0x0001686c, 0x6db60000},
-        {0x00016900, 0x3fffbe01},
-        {0x00016904, 0xfff80000},
-        {0x00016908, 0x00080010},
-        {0x00016944, 0x02084080},
-        {0x00016948, 0x00000000},
-        {0x00016b80, 0x00000000},
-        {0x00016b84, 0x00000000},
-        {0x00016b88, 0x00800700},
-        {0x00016b8c, 0x00800700},
-        {0x00016b90, 0x00800700},
-        {0x00016b94, 0x00000000},
-        {0x00016b98, 0x00000000},
-        {0x00016b9c, 0x00000000},
-        {0x00016ba0, 0x00000001},
-        {0x00016ba4, 0x00000001},
-        {0x00016ba8, 0x00000000},
-        {0x00016bac, 0x00000000},
-        {0x00016bb0, 0x00000000},
-        {0x00016bb4, 0x00000000},
-        {0x00016bb8, 0x00000000},
-        {0x00016bbc, 0x00000000},
-        {0x00016bc0, 0x000000a0},
-        {0x00016bc4, 0x000c0000},
-        {0x00016bc8, 0x14021402},
-        {0x00016bcc, 0x00001402},
-        {0x00016bd0, 0x00000000},
-        {0x00016bd4, 0x00000000},
-};
-
-static const u32 ar9300Common_rx_gain_table_merlin_2p0[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a000, 0x02000101},
-        {0x0000a004, 0x02000102},
-        {0x0000a008, 0x02000103},
-        {0x0000a00c, 0x02000104},
-        {0x0000a010, 0x02000200},
-        {0x0000a014, 0x02000201},
-        {0x0000a018, 0x02000202},
-        {0x0000a01c, 0x02000203},
-        {0x0000a020, 0x02000204},
-        {0x0000a024, 0x02000205},
-        {0x0000a028, 0x02000208},
-        {0x0000a02c, 0x02000302},
-        {0x0000a030, 0x02000303},
-        {0x0000a034, 0x02000304},
-        {0x0000a038, 0x02000400},
-        {0x0000a03c, 0x02010300},
-        {0x0000a040, 0x02010301},
-        {0x0000a044, 0x02010302},
-        {0x0000a048, 0x02000500},
-        {0x0000a04c, 0x02010400},
-        {0x0000a050, 0x02020300},
-        {0x0000a054, 0x02020301},
-        {0x0000a058, 0x02020302},
-        {0x0000a05c, 0x02020303},
-        {0x0000a060, 0x02020400},
-        {0x0000a064, 0x02030300},
-        {0x0000a068, 0x02030301},
-        {0x0000a06c, 0x02030302},
-        {0x0000a070, 0x02030303},
-        {0x0000a074, 0x02030400},
-        {0x0000a078, 0x02040300},
-        {0x0000a07c, 0x02040301},
-        {0x0000a080, 0x02040302},
-        {0x0000a084, 0x02040303},
-        {0x0000a088, 0x02030500},
-        {0x0000a08c, 0x02040400},
-        {0x0000a090, 0x02050203},
-        {0x0000a094, 0x02050204},
-        {0x0000a098, 0x02050205},
-        {0x0000a09c, 0x02040500},
-        {0x0000a0a0, 0x02050301},
-        {0x0000a0a4, 0x02050302},
-        {0x0000a0a8, 0x02050303},
-        {0x0000a0ac, 0x02050400},
-        {0x0000a0b0, 0x02050401},
-        {0x0000a0b4, 0x02050402},
-        {0x0000a0b8, 0x02050403},
-        {0x0000a0bc, 0x02050500},
-        {0x0000a0c0, 0x02050501},
-        {0x0000a0c4, 0x02050502},
-        {0x0000a0c8, 0x02050503},
-        {0x0000a0cc, 0x02050504},
-        {0x0000a0d0, 0x02050600},
-        {0x0000a0d4, 0x02050601},
-        {0x0000a0d8, 0x02050602},
-        {0x0000a0dc, 0x02050603},
-        {0x0000a0e0, 0x02050604},
-        {0x0000a0e4, 0x02050700},
-        {0x0000a0e8, 0x02050701},
-        {0x0000a0ec, 0x02050702},
-        {0x0000a0f0, 0x02050703},
-        {0x0000a0f4, 0x02050704},
-        {0x0000a0f8, 0x02050705},
-        {0x0000a0fc, 0x02050708},
-        {0x0000a100, 0x02050709},
-        {0x0000a104, 0x0205070a},
-        {0x0000a108, 0x0205070b},
-        {0x0000a10c, 0x0205070c},
-        {0x0000a110, 0x0205070d},
-        {0x0000a114, 0x02050710},
-        {0x0000a118, 0x02050711},
-        {0x0000a11c, 0x02050712},
-        {0x0000a120, 0x02050713},
-        {0x0000a124, 0x02050714},
-        {0x0000a128, 0x02050715},
-        {0x0000a12c, 0x02050730},
-        {0x0000a130, 0x02050731},
-        {0x0000a134, 0x02050732},
-        {0x0000a138, 0x02050733},
-        {0x0000a13c, 0x02050734},
-        {0x0000a140, 0x02050735},
-        {0x0000a144, 0x02050750},
-        {0x0000a148, 0x02050751},
-        {0x0000a14c, 0x02050752},
-        {0x0000a150, 0x02050753},
-        {0x0000a154, 0x02050754},
-        {0x0000a158, 0x02050755},
-        {0x0000a15c, 0x02050770},
-        {0x0000a160, 0x02050771},
-        {0x0000a164, 0x02050772},
-        {0x0000a168, 0x02050773},
-        {0x0000a16c, 0x02050774},
-        {0x0000a170, 0x02050775},
-        {0x0000a174, 0x00000776},
-        {0x0000a178, 0x00000776},
-        {0x0000a17c, 0x00000776},
-        {0x0000a180, 0x00000776},
-        {0x0000a184, 0x00000776},
-        {0x0000a188, 0x00000776},
-        {0x0000a18c, 0x00000776},
-        {0x0000a190, 0x00000776},
-        {0x0000a194, 0x00000776},
-        {0x0000a198, 0x00000776},
-        {0x0000a19c, 0x00000776},
-        {0x0000a1a0, 0x00000776},
-        {0x0000a1a4, 0x00000776},
-        {0x0000a1a8, 0x00000776},
-        {0x0000a1ac, 0x00000776},
-        {0x0000a1b0, 0x00000776},
-        {0x0000a1b4, 0x00000776},
-        {0x0000a1b8, 0x00000776},
-        {0x0000a1bc, 0x00000776},
-        {0x0000a1c0, 0x00000776},
-        {0x0000a1c4, 0x00000776},
-        {0x0000a1c8, 0x00000776},
-        {0x0000a1cc, 0x00000776},
-        {0x0000a1d0, 0x00000776},
-        {0x0000a1d4, 0x00000776},
-        {0x0000a1d8, 0x00000776},
-        {0x0000a1dc, 0x00000776},
-        {0x0000a1e0, 0x00000776},
-        {0x0000a1e4, 0x00000776},
-        {0x0000a1e8, 0x00000776},
-        {0x0000a1ec, 0x00000776},
-        {0x0000a1f0, 0x00000776},
-        {0x0000a1f4, 0x00000776},
-        {0x0000a1f8, 0x00000776},
-        {0x0000a1fc, 0x00000776},
-        {0x0000b000, 0x02000101},
-        {0x0000b004, 0x02000102},
-        {0x0000b008, 0x02000103},
-        {0x0000b00c, 0x02000104},
-        {0x0000b010, 0x02000200},
-        {0x0000b014, 0x02000201},
-        {0x0000b018, 0x02000202},
-        {0x0000b01c, 0x02000203},
-        {0x0000b020, 0x02000204},
-        {0x0000b024, 0x02000205},
-        {0x0000b028, 0x02000208},
-        {0x0000b02c, 0x02000302},
-        {0x0000b030, 0x02000303},
-        {0x0000b034, 0x02000304},
-        {0x0000b038, 0x02000400},
-        {0x0000b03c, 0x02010300},
-        {0x0000b040, 0x02010301},
-        {0x0000b044, 0x02010302},
-        {0x0000b048, 0x02000500},
-        {0x0000b04c, 0x02010400},
-        {0x0000b050, 0x02020300},
-        {0x0000b054, 0x02020301},
-        {0x0000b058, 0x02020302},
-        {0x0000b05c, 0x02020303},
-        {0x0000b060, 0x02020400},
-        {0x0000b064, 0x02030300},
-        {0x0000b068, 0x02030301},
-        {0x0000b06c, 0x02030302},
-        {0x0000b070, 0x02030303},
-        {0x0000b074, 0x02030400},
-        {0x0000b078, 0x02040300},
-        {0x0000b07c, 0x02040301},
-        {0x0000b080, 0x02040302},
-        {0x0000b084, 0x02040303},
-        {0x0000b088, 0x02030500},
-        {0x0000b08c, 0x02040400},
-        {0x0000b090, 0x02050203},
-        {0x0000b094, 0x02050204},
-        {0x0000b098, 0x02050205},
-        {0x0000b09c, 0x02040500},
-        {0x0000b0a0, 0x02050301},
-        {0x0000b0a4, 0x02050302},
-        {0x0000b0a8, 0x02050303},
-        {0x0000b0ac, 0x02050400},
-        {0x0000b0b0, 0x02050401},
-        {0x0000b0b4, 0x02050402},
-        {0x0000b0b8, 0x02050403},
-        {0x0000b0bc, 0x02050500},
-        {0x0000b0c0, 0x02050501},
-        {0x0000b0c4, 0x02050502},
-        {0x0000b0c8, 0x02050503},
-        {0x0000b0cc, 0x02050504},
-        {0x0000b0d0, 0x02050600},
-        {0x0000b0d4, 0x02050601},
-        {0x0000b0d8, 0x02050602},
-        {0x0000b0dc, 0x02050603},
-        {0x0000b0e0, 0x02050604},
-        {0x0000b0e4, 0x02050700},
-        {0x0000b0e8, 0x02050701},
-        {0x0000b0ec, 0x02050702},
-        {0x0000b0f0, 0x02050703},
-        {0x0000b0f4, 0x02050704},
-        {0x0000b0f8, 0x02050705},
-        {0x0000b0fc, 0x02050708},
-        {0x0000b100, 0x02050709},
-        {0x0000b104, 0x0205070a},
-        {0x0000b108, 0x0205070b},
-        {0x0000b10c, 0x0205070c},
-        {0x0000b110, 0x0205070d},
-        {0x0000b114, 0x02050710},
-        {0x0000b118, 0x02050711},
-        {0x0000b11c, 0x02050712},
-        {0x0000b120, 0x02050713},
-        {0x0000b124, 0x02050714},
-        {0x0000b128, 0x02050715},
-        {0x0000b12c, 0x02050730},
-        {0x0000b130, 0x02050731},
-        {0x0000b134, 0x02050732},
-        {0x0000b138, 0x02050733},
-        {0x0000b13c, 0x02050734},
-        {0x0000b140, 0x02050735},
-        {0x0000b144, 0x02050750},
-        {0x0000b148, 0x02050751},
-        {0x0000b14c, 0x02050752},
-        {0x0000b150, 0x02050753},
-        {0x0000b154, 0x02050754},
-        {0x0000b158, 0x02050755},
-        {0x0000b15c, 0x02050770},
-        {0x0000b160, 0x02050771},
-        {0x0000b164, 0x02050772},
-        {0x0000b168, 0x02050773},
-        {0x0000b16c, 0x02050774},
-        {0x0000b170, 0x02050775},
-        {0x0000b174, 0x00000776},
-        {0x0000b178, 0x00000776},
-        {0x0000b17c, 0x00000776},
-        {0x0000b180, 0x00000776},
-        {0x0000b184, 0x00000776},
-        {0x0000b188, 0x00000776},
-        {0x0000b18c, 0x00000776},
-        {0x0000b190, 0x00000776},
-        {0x0000b194, 0x00000776},
-        {0x0000b198, 0x00000776},
-        {0x0000b19c, 0x00000776},
-        {0x0000b1a0, 0x00000776},
-        {0x0000b1a4, 0x00000776},
-        {0x0000b1a8, 0x00000776},
-        {0x0000b1ac, 0x00000776},
-        {0x0000b1b0, 0x00000776},
-        {0x0000b1b4, 0x00000776},
-        {0x0000b1b8, 0x00000776},
-        {0x0000b1bc, 0x00000776},
-        {0x0000b1c0, 0x00000776},
-        {0x0000b1c4, 0x00000776},
-        {0x0000b1c8, 0x00000776},
-        {0x0000b1cc, 0x00000776},
-        {0x0000b1d0, 0x00000776},
-        {0x0000b1d4, 0x00000776},
-        {0x0000b1d8, 0x00000776},
-        {0x0000b1dc, 0x00000776},
-        {0x0000b1e0, 0x00000776},
-        {0x0000b1e4, 0x00000776},
-        {0x0000b1e8, 0x00000776},
-        {0x0000b1ec, 0x00000776},
-        {0x0000b1f0, 0x00000776},
-        {0x0000b1f4, 0x00000776},
-        {0x0000b1f8, 0x00000776},
-        {0x0000b1fc, 0x00000776},
-};
-
-static const u32 ar9300_2p0_mac_postamble[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
-        {0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c},
-        {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
-        {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
-        {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
-        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
-        {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
-        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
-};
-
-static const u32 ar9300_2p0_soc_postamble[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00007010, 0x00000023, 0x00000023, 0x00000023, 0x00000023},
-};
-
-static const u32 ar9200_merlin_2p0_radio_core[][2] = {
-        /* Addr      allmodes  */
-        {0x00007800, 0x00040000},
-        {0x00007804, 0xdb005012},
-        {0x00007808, 0x04924914},
-        {0x0000780c, 0x21084210},
-        {0x00007810, 0x6d801300},
-        {0x00007814, 0x0019beff},
-        {0x00007818, 0x07e41000},
-        {0x0000781c, 0x00392000},
-        {0x00007820, 0x92592480},
-        {0x00007824, 0x00040000},
-        {0x00007828, 0xdb005012},
-        {0x0000782c, 0x04924914},
-        {0x00007830, 0x21084210},
-        {0x00007834, 0x6d801300},
-        {0x00007838, 0x0019beff},
-        {0x0000783c, 0x07e40000},
-        {0x00007840, 0x00392000},
-        {0x00007844, 0x92592480},
-        {0x00007848, 0x00100000},
-        {0x0000784c, 0x773f0567},
-        {0x00007850, 0x54214514},
-        {0x00007854, 0x12035828},
-        {0x00007858, 0x92592692},
-        {0x0000785c, 0x00000000},
-        {0x00007860, 0x56400000},
-        {0x00007864, 0x0a8e370e},
-        {0x00007868, 0xc0102850},
-        {0x0000786c, 0x812d4000},
-        {0x00007870, 0x807ec400},
-        {0x00007874, 0x001b6db0},
-        {0x00007878, 0x00376b63},
-        {0x0000787c, 0x06db6db6},
-        {0x00007880, 0x006d8000},
-        {0x00007884, 0xffeffffe},
-        {0x00007888, 0xffeffffe},
-        {0x0000788c, 0x00010000},
-        {0x00007890, 0x02060aeb},
-        {0x00007894, 0x5a108000},
-};
-
-static const u32 ar9300_2p0_baseband_postamble[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
-        {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a012e},
-        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0},
-        {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x06903881},
-        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
-        {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
-        {0x00009c00, 0x00000044, 0x000000c4, 0x000000c4, 0x00000044},
-        {0x00009e00, 0x0372161e, 0x0372161e, 0x037216a0, 0x037216a0},
-        {0x00009e04, 0x00802020, 0x00802020, 0x00802020, 0x00802020},
-        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
-        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec84d2e},
-        {0x00009e14, 0x31395d5e, 0x3139605e, 0x3139605e, 0x31395d5e},
-        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
-        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
-        {0x00009e44, 0x02321e27, 0x02321e27, 0x02291e27, 0x02291e27},
-        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
-        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
-        {0x0000a204, 0x000037c0, 0x000037c4, 0x000037c4, 0x000037c0},
-        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
-        {0x0000a230, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b},
-        {0x0000a238, 0xffb81018, 0xffb81018, 0xffb81018, 0xffb81018},
-        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
-        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
-        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
-        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01000e0e, 0x01000e0e},
-        {0x0000a260, 0x0a021501, 0x0a021501, 0x3a021501, 0x3a021501},
-        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e},
-        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
-        {0x0000a284, 0x00000000, 0x00000000, 0x00000150, 0x00000150},
-        {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
-        {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
-        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
-        {0x0000a2d0, 0x00071981, 0x00071981, 0x00071981, 0x00071982},
-        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0xf999a83a, 0xf999a83a},
-        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000ae04, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
-        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
-        {0x0000b284, 0x00000000, 0x00000000, 0x00000150, 0x00000150},
-        {0x0000b830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000be04, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
-        {0x0000be18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000be1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000be20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
-        {0x0000c284, 0x00000000, 0x00000000, 0x00000150, 0x00000150},
-};
-
-static const u32 ar9300_2p0_baseband_core[][2] = {
-        /* Addr      allmodes  */
-        {0x00009800, 0xafe68e30},
-        {0x00009804, 0xfd14e000},
-        {0x00009808, 0x9c0a9f6b},
-        {0x0000980c, 0x04900000},
-        {0x00009814, 0x9280c00a},
-        {0x00009818, 0x00000000},
-        {0x0000981c, 0x00020028},
-        {0x00009834, 0x5f3ca3de},
-        {0x00009838, 0x0108ecff},
-        {0x0000983c, 0x14750600},
-        {0x00009880, 0x201fff00},
-        {0x00009884, 0x00001042},
-        {0x000098a4, 0x00200400},
-        {0x000098b0, 0x52440bbe},
-        {0x000098d0, 0x004b6a8e},
-        {0x000098d4, 0x00000820},
-        {0x000098dc, 0x00000000},
-        {0x000098f0, 0x00000000},
-        {0x000098f4, 0x00000000},
-        {0x00009c04, 0xff55ff55},
-        {0x00009c08, 0x0320ff55},
-        {0x00009c0c, 0x00000000},
-        {0x00009c10, 0x00000000},
-        {0x00009c14, 0x00046384},
-        {0x00009c18, 0x05b6b440},
-        {0x00009c1c, 0x00b6b440},
-        {0x00009d00, 0xc080a333},
-        {0x00009d04, 0x40206c10},
-        {0x00009d08, 0x009c4060},
-        {0x00009d0c, 0x9883800a},
-        {0x00009d10, 0x01834061},
-        {0x00009d14, 0x00c0040b},
-        {0x00009d18, 0x00000000},
-        {0x00009e08, 0x0038230c},
-        {0x00009e24, 0x990bb515},
-        {0x00009e28, 0x0c6f0000},
-        {0x00009e30, 0x06336f77},
-        {0x00009e34, 0x6af6532f},
-        {0x00009e38, 0x0cc80c00},
-        {0x00009e3c, 0xcf946222},
-        {0x00009e40, 0x0d261820},
-        {0x00009e4c, 0x00001004},
-        {0x00009e50, 0x00ff03f1},
-        {0x00009e54, 0x00000000},
-        {0x00009fc0, 0x803e4788},
-        {0x00009fc4, 0x0001efb5},
-        {0x00009fcc, 0x40000014},
-        {0x00009fd0, 0x01193b93},
-        {0x0000a20c, 0x00000000},
-        {0x0000a220, 0x00000000},
-        {0x0000a224, 0x00000000},
-        {0x0000a228, 0x10002310},
-        {0x0000a22c, 0x01036a1e},
-        {0x0000a234, 0x10000fff},
-        {0x0000a23c, 0x00000000},
-        {0x0000a244, 0x0c000000},
-        {0x0000a2a0, 0x00000001},
-        {0x0000a2c0, 0x00000001},
-        {0x0000a2c8, 0x00000000},
-        {0x0000a2cc, 0x18c43433},
-        {0x0000a2d4, 0x00000000},
-        {0x0000a2dc, 0x00000000},
-        {0x0000a2e0, 0x00000000},
-        {0x0000a2e4, 0x00000000},
-        {0x0000a2e8, 0x00000000},
-        {0x0000a2ec, 0x00000000},
-        {0x0000a2f0, 0x00000000},
-        {0x0000a2f4, 0x00000000},
-        {0x0000a2f8, 0x00000000},
-        {0x0000a344, 0x00000000},
-        {0x0000a34c, 0x00000000},
-        {0x0000a350, 0x0000a000},
-        {0x0000a364, 0x00000000},
-        {0x0000a370, 0x00000000},
-        {0x0000a390, 0x00000001},
-        {0x0000a394, 0x00000444},
-        {0x0000a398, 0x001f0e0f},
-        {0x0000a39c, 0x0075393f},
-        {0x0000a3a0, 0xb79f6427},
-        {0x0000a3a4, 0x00000000},
-        {0x0000a3a8, 0xaaaaaaaa},
-        {0x0000a3ac, 0x3c466478},
-        {0x0000a3c0, 0x20202020},
-        {0x0000a3c4, 0x22222220},
-        {0x0000a3c8, 0x20200020},
-        {0x0000a3cc, 0x20202020},
-        {0x0000a3d0, 0x20202020},
-        {0x0000a3d4, 0x20202020},
-        {0x0000a3d8, 0x20202020},
-        {0x0000a3dc, 0x20202020},
-        {0x0000a3e0, 0x20202020},
-        {0x0000a3e4, 0x20202020},
-        {0x0000a3e8, 0x20202020},
-        {0x0000a3ec, 0x20202020},
-        {0x0000a3f0, 0x00000000},
-        {0x0000a3f4, 0x00000246},
-        {0x0000a3f8, 0x0cdbd380},
-        {0x0000a3fc, 0x000f0f01},
-        {0x0000a400, 0x8fa91f01},
-        {0x0000a404, 0x00000000},
-        {0x0000a408, 0x0e79e5c6},
-        {0x0000a40c, 0x00820820},
-        {0x0000a414, 0x1ce739ce},
-        {0x0000a418, 0x2d001dce},
-        {0x0000a41c, 0x1ce739ce},
-        {0x0000a420, 0x000001ce},
-        {0x0000a424, 0x1ce739ce},
-        {0x0000a428, 0x000001ce},
-        {0x0000a42c, 0x1ce739ce},
-        {0x0000a430, 0x1ce739ce},
-        {0x0000a434, 0x00000000},
-        {0x0000a438, 0x00001801},
-        {0x0000a43c, 0x00000000},
-        {0x0000a440, 0x00000000},
-        {0x0000a444, 0x00000000},
-        {0x0000a448, 0x04000080},
-        {0x0000a44c, 0x00000001},
-        {0x0000a450, 0x00010000},
-        {0x0000a458, 0x00000000},
-        {0x0000a600, 0x00000000},
-        {0x0000a604, 0x00000000},
-        {0x0000a608, 0x00000000},
-        {0x0000a60c, 0x00000000},
-        {0x0000a610, 0x00000000},
-        {0x0000a614, 0x00000000},
-        {0x0000a618, 0x00000000},
-        {0x0000a61c, 0x00000000},
-        {0x0000a620, 0x00000000},
-        {0x0000a624, 0x00000000},
-        {0x0000a628, 0x00000000},
-        {0x0000a62c, 0x00000000},
-        {0x0000a630, 0x00000000},
-        {0x0000a634, 0x00000000},
-        {0x0000a638, 0x00000000},
-        {0x0000a63c, 0x00000000},
-        {0x0000a640, 0x00000000},
-        {0x0000a644, 0x3fad9d74},
-        {0x0000a648, 0x0048060a},
-        {0x0000a64c, 0x00000637},
-        {0x0000a670, 0x03020100},
-        {0x0000a674, 0x09080504},
-        {0x0000a678, 0x0d0c0b0a},
-        {0x0000a67c, 0x13121110},
-        {0x0000a680, 0x31301514},
-        {0x0000a684, 0x35343332},
-        {0x0000a688, 0x00000036},
-        {0x0000a690, 0x00000838},
-        {0x0000a7c0, 0x00000000},
-        {0x0000a7c4, 0xfffffffc},
-        {0x0000a7c8, 0x00000000},
-        {0x0000a7cc, 0x00000000},
-        {0x0000a7d0, 0x00000000},
-        {0x0000a7d4, 0x00000004},
-        {0x0000a7dc, 0x00000001},
-        {0x0000a8d0, 0x004b6a8e},
-        {0x0000a8d4, 0x00000820},
-        {0x0000a8dc, 0x00000000},
-        {0x0000a8f0, 0x00000000},
-        {0x0000a8f4, 0x00000000},
-        {0x0000b2d0, 0x00000080},
-        {0x0000b2d4, 0x00000000},
-        {0x0000b2dc, 0x00000000},
-        {0x0000b2e0, 0x00000000},
-        {0x0000b2e4, 0x00000000},
-        {0x0000b2e8, 0x00000000},
-        {0x0000b2ec, 0x00000000},
-        {0x0000b2f0, 0x00000000},
-        {0x0000b2f4, 0x00000000},
-        {0x0000b2f8, 0x00000000},
-        {0x0000b408, 0x0e79e5c0},
-        {0x0000b40c, 0x00820820},
-        {0x0000b420, 0x00000000},
-        {0x0000b8d0, 0x004b6a8e},
-        {0x0000b8d4, 0x00000820},
-        {0x0000b8dc, 0x00000000},
-        {0x0000b8f0, 0x00000000},
-        {0x0000b8f4, 0x00000000},
-        {0x0000c2d0, 0x00000080},
-        {0x0000c2d4, 0x00000000},
-        {0x0000c2dc, 0x00000000},
-        {0x0000c2e0, 0x00000000},
-        {0x0000c2e4, 0x00000000},
-        {0x0000c2e8, 0x00000000},
-        {0x0000c2ec, 0x00000000},
-        {0x0000c2f0, 0x00000000},
-        {0x0000c2f4, 0x00000000},
-        {0x0000c2f8, 0x00000000},
-        {0x0000c408, 0x0e79e5c0},
-        {0x0000c40c, 0x00820820},
-        {0x0000c420, 0x00000000},
-};
-
-static const u32 ar9300Modes_high_power_tx_gain_table_2p0[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
-        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
-        {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
-        {0x0000a508, 0x09002421, 0x09002421, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x0d002621, 0x0d002621, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x13004620, 0x13004620, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x19004a20, 0x19004a20, 0x11000400, 0x11000400},
-        {0x0000a518, 0x1d004e20, 0x1d004e20, 0x15000402, 0x15000402},
-        {0x0000a51c, 0x21005420, 0x21005420, 0x19000404, 0x19000404},
-        {0x0000a520, 0x26005e20, 0x26005e20, 0x1b000603, 0x1b000603},
-        {0x0000a524, 0x2b005e40, 0x2b005e40, 0x1f000a02, 0x1f000a02},
-        {0x0000a528, 0x2f005e42, 0x2f005e42, 0x23000a04, 0x23000a04},
-        {0x0000a52c, 0x33005e44, 0x33005e44, 0x26000a20, 0x26000a20},
-        {0x0000a530, 0x38005e65, 0x38005e65, 0x2a000e20, 0x2a000e20},
-        {0x0000a534, 0x3c005e69, 0x3c005e69, 0x2e000e22, 0x2e000e22},
-        {0x0000a538, 0x40005e6b, 0x40005e6b, 0x31000e24, 0x31000e24},
-        {0x0000a53c, 0x44005e6d, 0x44005e6d, 0x34001640, 0x34001640},
-        {0x0000a540, 0x49005e72, 0x49005e72, 0x38001660, 0x38001660},
-        {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x3b001861, 0x3b001861},
-        {0x0000a548, 0x53005f12, 0x53005f12, 0x3e001a81, 0x3e001a81},
-        {0x0000a54c, 0x59025eb5, 0x59025eb5, 0x42001a83, 0x42001a83},
-        {0x0000a550, 0x5e025f12, 0x5e025f12, 0x44001c84, 0x44001c84},
-        {0x0000a554, 0x61027f12, 0x61027f12, 0x48001ce3, 0x48001ce3},
-        {0x0000a558, 0x6702bf12, 0x6702bf12, 0x4c001ce5, 0x4c001ce5},
-        {0x0000a55c, 0x6b02bf14, 0x6b02bf14, 0x50001ce9, 0x50001ce9},
-        {0x0000a560, 0x6f02bf16, 0x6f02bf16, 0x54001ceb, 0x54001ceb},
-        {0x0000a564, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a568, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a56c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a570, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a574, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a578, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a57c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a580, 0x00802220, 0x00802220, 0x00800000, 0x00800000},
-        {0x0000a584, 0x04802222, 0x04802222, 0x04800002, 0x04800002},
-        {0x0000a588, 0x09802421, 0x09802421, 0x08800004, 0x08800004},
-        {0x0000a58c, 0x0d802621, 0x0d802621, 0x0b800200, 0x0b800200},
-        {0x0000a590, 0x13804620, 0x13804620, 0x0f800202, 0x0f800202},
-        {0x0000a594, 0x19804a20, 0x19804a20, 0x11800400, 0x11800400},
-        {0x0000a598, 0x1d804e20, 0x1d804e20, 0x15800402, 0x15800402},
-        {0x0000a59c, 0x21805420, 0x21805420, 0x19800404, 0x19800404},
-        {0x0000a5a0, 0x26805e20, 0x26805e20, 0x1b800603, 0x1b800603},
-        {0x0000a5a4, 0x2b805e40, 0x2b805e40, 0x1f800a02, 0x1f800a02},
-        {0x0000a5a8, 0x2f805e42, 0x2f805e42, 0x23800a04, 0x23800a04},
-        {0x0000a5ac, 0x33805e44, 0x33805e44, 0x26800a20, 0x26800a20},
-        {0x0000a5b0, 0x38805e65, 0x38805e65, 0x2a800e20, 0x2a800e20},
-        {0x0000a5b4, 0x3c805e69, 0x3c805e69, 0x2e800e22, 0x2e800e22},
-        {0x0000a5b8, 0x40805e6b, 0x40805e6b, 0x31800e24, 0x31800e24},
-        {0x0000a5bc, 0x44805e6d, 0x44805e6d, 0x34801640, 0x34801640},
-        {0x0000a5c0, 0x49805e72, 0x49805e72, 0x38801660, 0x38801660},
-        {0x0000a5c4, 0x4e805eb2, 0x4e805eb2, 0x3b801861, 0x3b801861},
-        {0x0000a5c8, 0x53805f12, 0x53805f12, 0x3e801a81, 0x3e801a81},
-        {0x0000a5cc, 0x59825eb2, 0x59825eb2, 0x42801a83, 0x42801a83},
-        {0x0000a5d0, 0x5e825f12, 0x5e825f12, 0x44801c84, 0x44801c84},
-        {0x0000a5d4, 0x61827f12, 0x61827f12, 0x48801ce3, 0x48801ce3},
-        {0x0000a5d8, 0x6782bf12, 0x6782bf12, 0x4c801ce5, 0x4c801ce5},
-        {0x0000a5dc, 0x6b82bf14, 0x6b82bf14, 0x50801ce9, 0x50801ce9},
-        {0x0000a5e0, 0x6f82bf16, 0x6f82bf16, 0x54801ceb, 0x54801ceb},
-        {0x0000a5e4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5e8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5ec, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5f0, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5f4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5f8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5fc, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x00016044, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
-        {0x00016048, 0xae480001, 0xae480001, 0xae480001, 0xae480001},
-        {0x00016068, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
-        {0x00016444, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
-        {0x00016448, 0xae480001, 0xae480001, 0xae480001, 0xae480001},
-        {0x00016468, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
-        {0x00016844, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
-        {0x00016848, 0xae480001, 0xae480001, 0xae480001, 0xae480001},
-        {0x00016868, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
-};
-
-static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p0[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
-        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
-        {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
-        {0x0000a508, 0x09002421, 0x09002421, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x0d002621, 0x0d002621, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x13004620, 0x13004620, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x19004a20, 0x19004a20, 0x11000400, 0x11000400},
-        {0x0000a518, 0x1d004e20, 0x1d004e20, 0x15000402, 0x15000402},
-        {0x0000a51c, 0x21005420, 0x21005420, 0x19000404, 0x19000404},
-        {0x0000a520, 0x26005e20, 0x26005e20, 0x1b000603, 0x1b000603},
-        {0x0000a524, 0x2b005e40, 0x2b005e40, 0x1f000a02, 0x1f000a02},
-        {0x0000a528, 0x2f005e42, 0x2f005e42, 0x23000a04, 0x23000a04},
-        {0x0000a52c, 0x33005e44, 0x33005e44, 0x26000a20, 0x26000a20},
-        {0x0000a530, 0x38005e65, 0x38005e65, 0x2a000e20, 0x2a000e20},
-        {0x0000a534, 0x3c005e69, 0x3c005e69, 0x2e000e22, 0x2e000e22},
-        {0x0000a538, 0x40005e6b, 0x40005e6b, 0x31000e24, 0x31000e24},
-        {0x0000a53c, 0x44005e6d, 0x44005e6d, 0x34001640, 0x34001640},
-        {0x0000a540, 0x49005e72, 0x49005e72, 0x38001660, 0x38001660},
-        {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x3b001861, 0x3b001861},
-        {0x0000a548, 0x53005f12, 0x53005f12, 0x3e001a81, 0x3e001a81},
-        {0x0000a54c, 0x59025eb5, 0x59025eb5, 0x42001a83, 0x42001a83},
-        {0x0000a550, 0x5e025f12, 0x5e025f12, 0x44001c84, 0x44001c84},
-        {0x0000a554, 0x61027f12, 0x61027f12, 0x48001ce3, 0x48001ce3},
-        {0x0000a558, 0x6702bf12, 0x6702bf12, 0x4c001ce5, 0x4c001ce5},
-        {0x0000a55c, 0x6b02bf14, 0x6b02bf14, 0x50001ce9, 0x50001ce9},
-        {0x0000a560, 0x6f02bf16, 0x6f02bf16, 0x54001ceb, 0x54001ceb},
-        {0x0000a564, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a568, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a56c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a570, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a574, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a578, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a57c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a580, 0x00802220, 0x00802220, 0x00800000, 0x00800000},
-        {0x0000a584, 0x04802222, 0x04802222, 0x04800002, 0x04800002},
-        {0x0000a588, 0x09802421, 0x09802421, 0x08800004, 0x08800004},
-        {0x0000a58c, 0x0d802621, 0x0d802621, 0x0b800200, 0x0b800200},
-        {0x0000a590, 0x13804620, 0x13804620, 0x0f800202, 0x0f800202},
-        {0x0000a594, 0x19804a20, 0x19804a20, 0x11800400, 0x11800400},
-        {0x0000a598, 0x1d804e20, 0x1d804e20, 0x15800402, 0x15800402},
-        {0x0000a59c, 0x21805420, 0x21805420, 0x19800404, 0x19800404},
-        {0x0000a5a0, 0x26805e20, 0x26805e20, 0x1b800603, 0x1b800603},
-        {0x0000a5a4, 0x2b805e40, 0x2b805e40, 0x1f800a02, 0x1f800a02},
-        {0x0000a5a8, 0x2f805e42, 0x2f805e42, 0x23800a04, 0x23800a04},
-        {0x0000a5ac, 0x33805e44, 0x33805e44, 0x26800a20, 0x26800a20},
-        {0x0000a5b0, 0x38805e65, 0x38805e65, 0x2a800e20, 0x2a800e20},
-        {0x0000a5b4, 0x3c805e69, 0x3c805e69, 0x2e800e22, 0x2e800e22},
-        {0x0000a5b8, 0x40805e6b, 0x40805e6b, 0x31800e24, 0x31800e24},
-        {0x0000a5bc, 0x44805e6d, 0x44805e6d, 0x34801640, 0x34801640},
-        {0x0000a5c0, 0x49805e72, 0x49805e72, 0x38801660, 0x38801660},
-        {0x0000a5c4, 0x4e805eb2, 0x4e805eb2, 0x3b801861, 0x3b801861},
-        {0x0000a5c8, 0x53805f12, 0x53805f12, 0x3e801a81, 0x3e801a81},
-        {0x0000a5cc, 0x59825eb2, 0x59825eb2, 0x42801a83, 0x42801a83},
-        {0x0000a5d0, 0x5e825f12, 0x5e825f12, 0x44801c84, 0x44801c84},
-        {0x0000a5d4, 0x61827f12, 0x61827f12, 0x48801ce3, 0x48801ce3},
-        {0x0000a5d8, 0x6782bf12, 0x6782bf12, 0x4c801ce5, 0x4c801ce5},
-        {0x0000a5dc, 0x6b82bf14, 0x6b82bf14, 0x50801ce9, 0x50801ce9},
-        {0x0000a5e0, 0x6f82bf16, 0x6f82bf16, 0x54801ceb, 0x54801ceb},
-        {0x0000a5e4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5e8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5ec, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5f0, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5f4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5f8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5fc, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x00016044, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
-        {0x00016048, 0x8e480001, 0x8e480001, 0x8e480001, 0x8e480001},
-        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
-        {0x00016444, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
-        {0x00016448, 0x8e480001, 0x8e480001, 0x8e480001, 0x8e480001},
-        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
-        {0x00016844, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
-        {0x00016848, 0x8e480001, 0x8e480001, 0x8e480001, 0x8e480001},
-        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
-};
-
-static const u32 ar9300Common_rx_gain_table_2p0[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a000, 0x00010000},
-        {0x0000a004, 0x00030002},
-        {0x0000a008, 0x00050004},
-        {0x0000a00c, 0x00810080},
-        {0x0000a010, 0x00830082},
-        {0x0000a014, 0x01810180},
-        {0x0000a018, 0x01830182},
-        {0x0000a01c, 0x01850184},
-        {0x0000a020, 0x01890188},
-        {0x0000a024, 0x018b018a},
-        {0x0000a028, 0x018d018c},
-        {0x0000a02c, 0x01910190},
-        {0x0000a030, 0x01930192},
-        {0x0000a034, 0x01950194},
-        {0x0000a038, 0x038a0196},
-        {0x0000a03c, 0x038c038b},
-        {0x0000a040, 0x0390038d},
-        {0x0000a044, 0x03920391},
-        {0x0000a048, 0x03940393},
-        {0x0000a04c, 0x03960395},
-        {0x0000a050, 0x00000000},
-        {0x0000a054, 0x00000000},
-        {0x0000a058, 0x00000000},
-        {0x0000a05c, 0x00000000},
-        {0x0000a060, 0x00000000},
-        {0x0000a064, 0x00000000},
-        {0x0000a068, 0x00000000},
-        {0x0000a06c, 0x00000000},
-        {0x0000a070, 0x00000000},
-        {0x0000a074, 0x00000000},
-        {0x0000a078, 0x00000000},
-        {0x0000a07c, 0x00000000},
-        {0x0000a080, 0x22222229},
-        {0x0000a084, 0x1d1d1d1d},
-        {0x0000a088, 0x1d1d1d1d},
-        {0x0000a08c, 0x1d1d1d1d},
-        {0x0000a090, 0x171d1d1d},
-        {0x0000a094, 0x11111717},
-        {0x0000a098, 0x00030311},
-        {0x0000a09c, 0x00000000},
-        {0x0000a0a0, 0x00000000},
-        {0x0000a0a4, 0x00000000},
-        {0x0000a0a8, 0x00000000},
-        {0x0000a0ac, 0x00000000},
-        {0x0000a0b0, 0x00000000},
-        {0x0000a0b4, 0x00000000},
-        {0x0000a0b8, 0x00000000},
-        {0x0000a0bc, 0x00000000},
-        {0x0000a0c0, 0x001f0000},
-        {0x0000a0c4, 0x01000101},
-        {0x0000a0c8, 0x011e011f},
-        {0x0000a0cc, 0x011c011d},
-        {0x0000a0d0, 0x02030204},
-        {0x0000a0d4, 0x02010202},
-        {0x0000a0d8, 0x021f0200},
-        {0x0000a0dc, 0x0302021e},
-        {0x0000a0e0, 0x03000301},
-        {0x0000a0e4, 0x031e031f},
-        {0x0000a0e8, 0x0402031d},
-        {0x0000a0ec, 0x04000401},
-        {0x0000a0f0, 0x041e041f},
-        {0x0000a0f4, 0x0502041d},
-        {0x0000a0f8, 0x05000501},
-        {0x0000a0fc, 0x051e051f},
-        {0x0000a100, 0x06010602},
-        {0x0000a104, 0x061f0600},
-        {0x0000a108, 0x061d061e},
-        {0x0000a10c, 0x07020703},
-        {0x0000a110, 0x07000701},
-        {0x0000a114, 0x00000000},
-        {0x0000a118, 0x00000000},
-        {0x0000a11c, 0x00000000},
-        {0x0000a120, 0x00000000},
-        {0x0000a124, 0x00000000},
-        {0x0000a128, 0x00000000},
-        {0x0000a12c, 0x00000000},
-        {0x0000a130, 0x00000000},
-        {0x0000a134, 0x00000000},
-        {0x0000a138, 0x00000000},
-        {0x0000a13c, 0x00000000},
-        {0x0000a140, 0x001f0000},
-        {0x0000a144, 0x01000101},
-        {0x0000a148, 0x011e011f},
-        {0x0000a14c, 0x011c011d},
-        {0x0000a150, 0x02030204},
-        {0x0000a154, 0x02010202},
-        {0x0000a158, 0x021f0200},
-        {0x0000a15c, 0x0302021e},
-        {0x0000a160, 0x03000301},
-        {0x0000a164, 0x031e031f},
-        {0x0000a168, 0x0402031d},
-        {0x0000a16c, 0x04000401},
-        {0x0000a170, 0x041e041f},
-        {0x0000a174, 0x0502041d},
-        {0x0000a178, 0x05000501},
-        {0x0000a17c, 0x051e051f},
-        {0x0000a180, 0x06010602},
-        {0x0000a184, 0x061f0600},
-        {0x0000a188, 0x061d061e},
-        {0x0000a18c, 0x07020703},
-        {0x0000a190, 0x07000701},
-        {0x0000a194, 0x00000000},
-        {0x0000a198, 0x00000000},
-        {0x0000a19c, 0x00000000},
-        {0x0000a1a0, 0x00000000},
-        {0x0000a1a4, 0x00000000},
-        {0x0000a1a8, 0x00000000},
-        {0x0000a1ac, 0x00000000},
-        {0x0000a1b0, 0x00000000},
-        {0x0000a1b4, 0x00000000},
-        {0x0000a1b8, 0x00000000},
-        {0x0000a1bc, 0x00000000},
-        {0x0000a1c0, 0x00000000},
-        {0x0000a1c4, 0x00000000},
-        {0x0000a1c8, 0x00000000},
-        {0x0000a1cc, 0x00000000},
-        {0x0000a1d0, 0x00000000},
-        {0x0000a1d4, 0x00000000},
-        {0x0000a1d8, 0x00000000},
-        {0x0000a1dc, 0x00000000},
-        {0x0000a1e0, 0x00000000},
-        {0x0000a1e4, 0x00000000},
-        {0x0000a1e8, 0x00000000},
-        {0x0000a1ec, 0x00000000},
-        {0x0000a1f0, 0x00000396},
-        {0x0000a1f4, 0x00000396},
-        {0x0000a1f8, 0x00000396},
-        {0x0000a1fc, 0x00000196},
-        {0x0000b000, 0x00010000},
-        {0x0000b004, 0x00030002},
-        {0x0000b008, 0x00050004},
-        {0x0000b00c, 0x00810080},
-        {0x0000b010, 0x00830082},
-        {0x0000b014, 0x01810180},
-        {0x0000b018, 0x01830182},
-        {0x0000b01c, 0x01850184},
-        {0x0000b020, 0x02810280},
-        {0x0000b024, 0x02830282},
-        {0x0000b028, 0x02850284},
-        {0x0000b02c, 0x02890288},
-        {0x0000b030, 0x028b028a},
-        {0x0000b034, 0x0388028c},
-        {0x0000b038, 0x038a0389},
-        {0x0000b03c, 0x038c038b},
-        {0x0000b040, 0x0390038d},
-        {0x0000b044, 0x03920391},
-        {0x0000b048, 0x03940393},
-        {0x0000b04c, 0x03960395},
-        {0x0000b050, 0x00000000},
-        {0x0000b054, 0x00000000},
-        {0x0000b058, 0x00000000},
-        {0x0000b05c, 0x00000000},
-        {0x0000b060, 0x00000000},
-        {0x0000b064, 0x00000000},
-        {0x0000b068, 0x00000000},
-        {0x0000b06c, 0x00000000},
-        {0x0000b070, 0x00000000},
-        {0x0000b074, 0x00000000},
-        {0x0000b078, 0x00000000},
-        {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x32323232},
-        {0x0000b084, 0x2f2f3232},
-        {0x0000b088, 0x23282a2d},
-        {0x0000b08c, 0x1c1e2123},
-        {0x0000b090, 0x14171919},
-        {0x0000b094, 0x0e0e1214},
-        {0x0000b098, 0x03050707},
-        {0x0000b09c, 0x00030303},
-        {0x0000b0a0, 0x00000000},
-        {0x0000b0a4, 0x00000000},
-        {0x0000b0a8, 0x00000000},
-        {0x0000b0ac, 0x00000000},
-        {0x0000b0b0, 0x00000000},
-        {0x0000b0b4, 0x00000000},
-        {0x0000b0b8, 0x00000000},
-        {0x0000b0bc, 0x00000000},
-        {0x0000b0c0, 0x003f0020},
-        {0x0000b0c4, 0x00400041},
-        {0x0000b0c8, 0x0140005f},
-        {0x0000b0cc, 0x0160015f},
-        {0x0000b0d0, 0x017e017f},
-        {0x0000b0d4, 0x02410242},
-        {0x0000b0d8, 0x025f0240},
-        {0x0000b0dc, 0x027f0260},
-        {0x0000b0e0, 0x0341027e},
-        {0x0000b0e4, 0x035f0340},
-        {0x0000b0e8, 0x037f0360},
-        {0x0000b0ec, 0x04400441},
-        {0x0000b0f0, 0x0460045f},
-        {0x0000b0f4, 0x0541047f},
-        {0x0000b0f8, 0x055f0540},
-        {0x0000b0fc, 0x057f0560},
-        {0x0000b100, 0x06400641},
-        {0x0000b104, 0x0660065f},
-        {0x0000b108, 0x067e067f},
-        {0x0000b10c, 0x07410742},
-        {0x0000b110, 0x075f0740},
-        {0x0000b114, 0x077f0760},
-        {0x0000b118, 0x07800781},
-        {0x0000b11c, 0x07a0079f},
-        {0x0000b120, 0x07c107bf},
-        {0x0000b124, 0x000007c0},
-        {0x0000b128, 0x00000000},
-        {0x0000b12c, 0x00000000},
-        {0x0000b130, 0x00000000},
-        {0x0000b134, 0x00000000},
-        {0x0000b138, 0x00000000},
-        {0x0000b13c, 0x00000000},
-        {0x0000b140, 0x003f0020},
-        {0x0000b144, 0x00400041},
-        {0x0000b148, 0x0140005f},
-        {0x0000b14c, 0x0160015f},
-        {0x0000b150, 0x017e017f},
-        {0x0000b154, 0x02410242},
-        {0x0000b158, 0x025f0240},
-        {0x0000b15c, 0x027f0260},
-        {0x0000b160, 0x0341027e},
-        {0x0000b164, 0x035f0340},
-        {0x0000b168, 0x037f0360},
-        {0x0000b16c, 0x04400441},
-        {0x0000b170, 0x0460045f},
-        {0x0000b174, 0x0541047f},
-        {0x0000b178, 0x055f0540},
-        {0x0000b17c, 0x057f0560},
-        {0x0000b180, 0x06400641},
-        {0x0000b184, 0x0660065f},
-        {0x0000b188, 0x067e067f},
-        {0x0000b18c, 0x07410742},
-        {0x0000b190, 0x075f0740},
-        {0x0000b194, 0x077f0760},
-        {0x0000b198, 0x07800781},
-        {0x0000b19c, 0x07a0079f},
-        {0x0000b1a0, 0x07c107bf},
-        {0x0000b1a4, 0x000007c0},
-        {0x0000b1a8, 0x00000000},
-        {0x0000b1ac, 0x00000000},
-        {0x0000b1b0, 0x00000000},
-        {0x0000b1b4, 0x00000000},
-        {0x0000b1b8, 0x00000000},
-        {0x0000b1bc, 0x00000000},
-        {0x0000b1c0, 0x00000000},
-        {0x0000b1c4, 0x00000000},
-        {0x0000b1c8, 0x00000000},
-        {0x0000b1cc, 0x00000000},
-        {0x0000b1d0, 0x00000000},
-        {0x0000b1d4, 0x00000000},
-        {0x0000b1d8, 0x00000000},
-        {0x0000b1dc, 0x00000000},
-        {0x0000b1e0, 0x00000000},
-        {0x0000b1e4, 0x00000000},
-        {0x0000b1e8, 0x00000000},
-        {0x0000b1ec, 0x00000000},
-        {0x0000b1f0, 0x00000396},
-        {0x0000b1f4, 0x00000396},
-        {0x0000b1f8, 0x00000396},
-        {0x0000b1fc, 0x00000196},
-};
-
-static const u32 ar9300Modes_low_ob_db_tx_gain_table_2p0[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
-        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
-        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
-        {0x0000a518, 0x21020220, 0x21020220, 0x16000402, 0x16000402},
-        {0x0000a51c, 0x27020223, 0x27020223, 0x19000404, 0x19000404},
-        {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
-        {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
-        {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
-        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
-        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
-        {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
-        {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
-        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
-        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
-        {0x0000a544, 0x5302266c, 0x5302266c, 0x3f001861, 0x3f001861},
-        {0x0000a548, 0x5702286c, 0x5702286c, 0x43001a81, 0x43001a81},
-        {0x0000a54c, 0x5c04286b, 0x5c04286b, 0x47001a83, 0x47001a83},
-        {0x0000a550, 0x61042a6c, 0x61042a6c, 0x4a001c84, 0x4a001c84},
-        {0x0000a554, 0x66062a6c, 0x66062a6c, 0x4e001ce3, 0x4e001ce3},
-        {0x0000a558, 0x6b062e6c, 0x6b062e6c, 0x52001ce5, 0x52001ce5},
-        {0x0000a55c, 0x7006308c, 0x7006308c, 0x56001ce9, 0x56001ce9},
-        {0x0000a560, 0x730a308a, 0x730a308a, 0x5a001ceb, 0x5a001ceb},
-        {0x0000a564, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a568, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a56c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a570, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a574, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a578, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a57c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
-        {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
-        {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
-        {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
-        {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202},
-        {0x0000a594, 0x1c800223, 0x1c800223, 0x12800400, 0x12800400},
-        {0x0000a598, 0x21820220, 0x21820220, 0x16800402, 0x16800402},
-        {0x0000a59c, 0x27820223, 0x27820223, 0x19800404, 0x19800404},
-        {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1c800603, 0x1c800603},
-        {0x0000a5a4, 0x2f822222, 0x2f822222, 0x21800a02, 0x21800a02},
-        {0x0000a5a8, 0x34822225, 0x34822225, 0x25800a04, 0x25800a04},
-        {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x28800a20, 0x28800a20},
-        {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2c800e20, 0x2c800e20},
-        {0x0000a5b4, 0x4282242a, 0x4282242a, 0x30800e22, 0x30800e22},
-        {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24},
-        {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640},
-        {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660},
-        {0x0000a5c4, 0x5382266c, 0x5382266c, 0x3f801861, 0x3f801861},
-        {0x0000a5c8, 0x5782286c, 0x5782286c, 0x43801a81, 0x43801a81},
-        {0x0000a5cc, 0x5c84286b, 0x5c84286b, 0x47801a83, 0x47801a83},
-        {0x0000a5d0, 0x61842a6c, 0x61842a6c, 0x4a801c84, 0x4a801c84},
-        {0x0000a5d4, 0x66862a6c, 0x66862a6c, 0x4e801ce3, 0x4e801ce3},
-        {0x0000a5d8, 0x6b862e6c, 0x6b862e6c, 0x52801ce5, 0x52801ce5},
-        {0x0000a5dc, 0x7086308c, 0x7086308c, 0x56801ce9, 0x56801ce9},
-        {0x0000a5e0, 0x738a308a, 0x738a308a, 0x5a801ceb, 0x5a801ceb},
-        {0x0000a5e4, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5e8, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5ec, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f0, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f4, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f8, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5fc, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
-        {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016048, 0x64000001, 0x64000001, 0x64000001, 0x64000001},
-        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
-        {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016448, 0x64000001, 0x64000001, 0x64000001, 0x64000001},
-        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
-        {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016848, 0x64000001, 0x64000001, 0x64000001, 0x64000001},
-        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
-};
-
-static const u32 ar9300_2p0_mac_core[][2] = {
-        /* Addr      allmodes  */
-        {0x00000008, 0x00000000},
-        {0x00000030, 0x00020085},
-        {0x00000034, 0x00000005},
-        {0x00000040, 0x00000000},
-        {0x00000044, 0x00000000},
-        {0x00000048, 0x00000008},
-        {0x0000004c, 0x00000010},
-        {0x00000050, 0x00000000},
-        {0x00001040, 0x002ffc0f},
-        {0x00001044, 0x002ffc0f},
-        {0x00001048, 0x002ffc0f},
-        {0x0000104c, 0x002ffc0f},
-        {0x00001050, 0x002ffc0f},
-        {0x00001054, 0x002ffc0f},
-        {0x00001058, 0x002ffc0f},
-        {0x0000105c, 0x002ffc0f},
-        {0x00001060, 0x002ffc0f},
-        {0x00001064, 0x002ffc0f},
-        {0x000010f0, 0x00000100},
-        {0x00001270, 0x00000000},
-        {0x000012b0, 0x00000000},
-        {0x000012f0, 0x00000000},
-        {0x0000143c, 0x00000000},
-        {0x0000147c, 0x00000000},
-        {0x00008000, 0x00000000},
-        {0x00008004, 0x00000000},
-        {0x00008008, 0x00000000},
-        {0x0000800c, 0x00000000},
-        {0x00008018, 0x00000000},
-        {0x00008020, 0x00000000},
-        {0x00008038, 0x00000000},
-        {0x0000803c, 0x00000000},
-        {0x00008040, 0x00000000},
-        {0x00008044, 0x00000000},
-        {0x00008048, 0x00000000},
-        {0x0000804c, 0xffffffff},
-        {0x00008054, 0x00000000},
-        {0x00008058, 0x00000000},
-        {0x0000805c, 0x000fc78f},
-        {0x00008060, 0x0000000f},
-        {0x00008064, 0x00000000},
-        {0x00008070, 0x00000310},
-        {0x00008074, 0x00000020},
-        {0x00008078, 0x00000000},
-        {0x0000809c, 0x0000000f},
-        {0x000080a0, 0x00000000},
-        {0x000080a4, 0x02ff0000},
-        {0x000080a8, 0x0e070605},
-        {0x000080ac, 0x0000000d},
-        {0x000080b0, 0x00000000},
-        {0x000080b4, 0x00000000},
-        {0x000080b8, 0x00000000},
-        {0x000080bc, 0x00000000},
-        {0x000080c0, 0x2a800000},
-        {0x000080c4, 0x06900168},
-        {0x000080c8, 0x13881c20},
-        {0x000080cc, 0x01f40000},
-        {0x000080d0, 0x00252500},
-        {0x000080d4, 0x00a00000},
-        {0x000080d8, 0x00400000},
-        {0x000080dc, 0x00000000},
-        {0x000080e0, 0xffffffff},
-        {0x000080e4, 0x0000ffff},
-        {0x000080e8, 0x3f3f3f3f},
-        {0x000080ec, 0x00000000},
-        {0x000080f0, 0x00000000},
-        {0x000080f4, 0x00000000},
-        {0x000080fc, 0x00020000},
-        {0x00008100, 0x00000000},
-        {0x00008108, 0x00000052},
-        {0x0000810c, 0x00000000},
-        {0x00008110, 0x00000000},
-        {0x00008114, 0x000007ff},
-        {0x00008118, 0x000000aa},
-        {0x0000811c, 0x00003210},
-        {0x00008124, 0x00000000},
-        {0x00008128, 0x00000000},
-        {0x0000812c, 0x00000000},
-        {0x00008130, 0x00000000},
-        {0x00008134, 0x00000000},
-        {0x00008138, 0x00000000},
-        {0x0000813c, 0x0000ffff},
-        {0x00008144, 0xffffffff},
-        {0x00008168, 0x00000000},
-        {0x0000816c, 0x00000000},
-        {0x00008170, 0x18486200},
-        {0x00008174, 0x33332210},
-        {0x00008178, 0x00000000},
-        {0x0000817c, 0x00020000},
-        {0x000081c0, 0x00000000},
-        {0x000081c4, 0x33332210},
-        {0x000081c8, 0x00000000},
-        {0x000081cc, 0x00000000},
-        {0x000081d4, 0x00000000},
-        {0x000081ec, 0x00000000},
-        {0x000081f0, 0x00000000},
-        {0x000081f4, 0x00000000},
-        {0x000081f8, 0x00000000},
-        {0x000081fc, 0x00000000},
-        {0x00008240, 0x00100000},
-        {0x00008244, 0x0010f424},
-        {0x00008248, 0x00000800},
-        {0x0000824c, 0x0001e848},
-        {0x00008250, 0x00000000},
-        {0x00008254, 0x00000000},
-        {0x00008258, 0x00000000},
-        {0x0000825c, 0x40000000},
-        {0x00008260, 0x00080922},
-        {0x00008264, 0x98a00010},
-        {0x00008268, 0xffffffff},
-        {0x0000826c, 0x0000ffff},
-        {0x00008270, 0x00000000},
-        {0x00008274, 0x40000000},
-        {0x00008278, 0x003e4180},
-        {0x0000827c, 0x00000004},
-        {0x00008284, 0x0000002c},
-        {0x00008288, 0x0000002c},
-        {0x0000828c, 0x000000ff},
-        {0x00008294, 0x00000000},
-        {0x00008298, 0x00000000},
-        {0x0000829c, 0x00000000},
-        {0x00008300, 0x00000140},
-        {0x00008314, 0x00000000},
-        {0x0000831c, 0x0000010d},
-        {0x00008328, 0x00000000},
-        {0x0000832c, 0x00000007},
-        {0x00008330, 0x00000302},
-        {0x00008334, 0x00000700},
-        {0x00008338, 0x00ff0000},
-        {0x0000833c, 0x02400000},
-        {0x00008340, 0x000107ff},
-        {0x00008344, 0xaa48105b},
-        {0x00008348, 0x008f0000},
-        {0x0000835c, 0x00000000},
-        {0x00008360, 0xffffffff},
-        {0x00008364, 0xffffffff},
-        {0x00008368, 0x00000000},
-        {0x00008370, 0x00000000},
-        {0x00008374, 0x000000ff},
-        {0x00008378, 0x00000000},
-        {0x0000837c, 0x00000000},
-        {0x00008380, 0xffffffff},
-        {0x00008384, 0xffffffff},
-        {0x00008390, 0xffffffff},
-        {0x00008394, 0xffffffff},
-        {0x00008398, 0x00000000},
-        {0x0000839c, 0x00000000},
-        {0x000083a0, 0x00000000},
-        {0x000083a4, 0x0000fa14},
-        {0x000083a8, 0x000f0c00},
-        {0x000083ac, 0x33332210},
-        {0x000083b0, 0x33332210},
-        {0x000083b4, 0x33332210},
-        {0x000083b8, 0x33332210},
-        {0x000083bc, 0x00000000},
-        {0x000083c0, 0x00000000},
-        {0x000083c4, 0x00000000},
-        {0x000083c8, 0x00000000},
-        {0x000083cc, 0x00000200},
-        {0x000083d0, 0x000301ff},
-};
-
-static const u32 ar9300Common_wo_xlna_rx_gain_table_2p0[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a000, 0x00010000},
-        {0x0000a004, 0x00030002},
-        {0x0000a008, 0x00050004},
-        {0x0000a00c, 0x00810080},
-        {0x0000a010, 0x00830082},
-        {0x0000a014, 0x01810180},
-        {0x0000a018, 0x01830182},
-        {0x0000a01c, 0x01850184},
-        {0x0000a020, 0x01890188},
-        {0x0000a024, 0x018b018a},
-        {0x0000a028, 0x018d018c},
-        {0x0000a02c, 0x03820190},
-        {0x0000a030, 0x03840383},
-        {0x0000a034, 0x03880385},
-        {0x0000a038, 0x038a0389},
-        {0x0000a03c, 0x038c038b},
-        {0x0000a040, 0x0390038d},
-        {0x0000a044, 0x03920391},
-        {0x0000a048, 0x03940393},
-        {0x0000a04c, 0x03960395},
-        {0x0000a050, 0x00000000},
-        {0x0000a054, 0x00000000},
-        {0x0000a058, 0x00000000},
-        {0x0000a05c, 0x00000000},
-        {0x0000a060, 0x00000000},
-        {0x0000a064, 0x00000000},
-        {0x0000a068, 0x00000000},
-        {0x0000a06c, 0x00000000},
-        {0x0000a070, 0x00000000},
-        {0x0000a074, 0x00000000},
-        {0x0000a078, 0x00000000},
-        {0x0000a07c, 0x00000000},
-        {0x0000a080, 0x29292929},
-        {0x0000a084, 0x29292929},
-        {0x0000a088, 0x29292929},
-        {0x0000a08c, 0x29292929},
-        {0x0000a090, 0x22292929},
-        {0x0000a094, 0x1d1d2222},
-        {0x0000a098, 0x0c111117},
-        {0x0000a09c, 0x00030303},
-        {0x0000a0a0, 0x00000000},
-        {0x0000a0a4, 0x00000000},
-        {0x0000a0a8, 0x00000000},
-        {0x0000a0ac, 0x00000000},
-        {0x0000a0b0, 0x00000000},
-        {0x0000a0b4, 0x00000000},
-        {0x0000a0b8, 0x00000000},
-        {0x0000a0bc, 0x00000000},
-        {0x0000a0c0, 0x001f0000},
-        {0x0000a0c4, 0x01000101},
-        {0x0000a0c8, 0x011e011f},
-        {0x0000a0cc, 0x011c011d},
-        {0x0000a0d0, 0x02030204},
-        {0x0000a0d4, 0x02010202},
-        {0x0000a0d8, 0x021f0200},
-        {0x0000a0dc, 0x0302021e},
-        {0x0000a0e0, 0x03000301},
-        {0x0000a0e4, 0x031e031f},
-        {0x0000a0e8, 0x0402031d},
-        {0x0000a0ec, 0x04000401},
-        {0x0000a0f0, 0x041e041f},
-        {0x0000a0f4, 0x0502041d},
-        {0x0000a0f8, 0x05000501},
-        {0x0000a0fc, 0x051e051f},
-        {0x0000a100, 0x06010602},
-        {0x0000a104, 0x061f0600},
-        {0x0000a108, 0x061d061e},
-        {0x0000a10c, 0x07020703},
-        {0x0000a110, 0x07000701},
-        {0x0000a114, 0x00000000},
-        {0x0000a118, 0x00000000},
-        {0x0000a11c, 0x00000000},
-        {0x0000a120, 0x00000000},
-        {0x0000a124, 0x00000000},
-        {0x0000a128, 0x00000000},
-        {0x0000a12c, 0x00000000},
-        {0x0000a130, 0x00000000},
-        {0x0000a134, 0x00000000},
-        {0x0000a138, 0x00000000},
-        {0x0000a13c, 0x00000000},
-        {0x0000a140, 0x001f0000},
-        {0x0000a144, 0x01000101},
-        {0x0000a148, 0x011e011f},
-        {0x0000a14c, 0x011c011d},
-        {0x0000a150, 0x02030204},
-        {0x0000a154, 0x02010202},
-        {0x0000a158, 0x021f0200},
-        {0x0000a15c, 0x0302021e},
-        {0x0000a160, 0x03000301},
-        {0x0000a164, 0x031e031f},
-        {0x0000a168, 0x0402031d},
-        {0x0000a16c, 0x04000401},
-        {0x0000a170, 0x041e041f},
-        {0x0000a174, 0x0502041d},
-        {0x0000a178, 0x05000501},
-        {0x0000a17c, 0x051e051f},
-        {0x0000a180, 0x06010602},
-        {0x0000a184, 0x061f0600},
-        {0x0000a188, 0x061d061e},
-        {0x0000a18c, 0x07020703},
-        {0x0000a190, 0x07000701},
-        {0x0000a194, 0x00000000},
-        {0x0000a198, 0x00000000},
-        {0x0000a19c, 0x00000000},
-        {0x0000a1a0, 0x00000000},
-        {0x0000a1a4, 0x00000000},
-        {0x0000a1a8, 0x00000000},
-        {0x0000a1ac, 0x00000000},
-        {0x0000a1b0, 0x00000000},
-        {0x0000a1b4, 0x00000000},
-        {0x0000a1b8, 0x00000000},
-        {0x0000a1bc, 0x00000000},
-        {0x0000a1c0, 0x00000000},
-        {0x0000a1c4, 0x00000000},
-        {0x0000a1c8, 0x00000000},
-        {0x0000a1cc, 0x00000000},
-        {0x0000a1d0, 0x00000000},
-        {0x0000a1d4, 0x00000000},
-        {0x0000a1d8, 0x00000000},
-        {0x0000a1dc, 0x00000000},
-        {0x0000a1e0, 0x00000000},
-        {0x0000a1e4, 0x00000000},
-        {0x0000a1e8, 0x00000000},
-        {0x0000a1ec, 0x00000000},
-        {0x0000a1f0, 0x00000396},
-        {0x0000a1f4, 0x00000396},
-        {0x0000a1f8, 0x00000396},
-        {0x0000a1fc, 0x00000196},
-        {0x0000b000, 0x00010000},
-        {0x0000b004, 0x00030002},
-        {0x0000b008, 0x00050004},
-        {0x0000b00c, 0x00810080},
-        {0x0000b010, 0x00830082},
-        {0x0000b014, 0x01810180},
-        {0x0000b018, 0x01830182},
-        {0x0000b01c, 0x01850184},
-        {0x0000b020, 0x02810280},
-        {0x0000b024, 0x02830282},
-        {0x0000b028, 0x02850284},
-        {0x0000b02c, 0x02890288},
-        {0x0000b030, 0x028b028a},
-        {0x0000b034, 0x0388028c},
-        {0x0000b038, 0x038a0389},
-        {0x0000b03c, 0x038c038b},
-        {0x0000b040, 0x0390038d},
-        {0x0000b044, 0x03920391},
-        {0x0000b048, 0x03940393},
-        {0x0000b04c, 0x03960395},
-        {0x0000b050, 0x00000000},
-        {0x0000b054, 0x00000000},
-        {0x0000b058, 0x00000000},
-        {0x0000b05c, 0x00000000},
-        {0x0000b060, 0x00000000},
-        {0x0000b064, 0x00000000},
-        {0x0000b068, 0x00000000},
-        {0x0000b06c, 0x00000000},
-        {0x0000b070, 0x00000000},
-        {0x0000b074, 0x00000000},
-        {0x0000b078, 0x00000000},
-        {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x32323232},
-        {0x0000b084, 0x2f2f3232},
-        {0x0000b088, 0x23282a2d},
-        {0x0000b08c, 0x1c1e2123},
-        {0x0000b090, 0x14171919},
-        {0x0000b094, 0x0e0e1214},
-        {0x0000b098, 0x03050707},
-        {0x0000b09c, 0x00030303},
-        {0x0000b0a0, 0x00000000},
-        {0x0000b0a4, 0x00000000},
-        {0x0000b0a8, 0x00000000},
-        {0x0000b0ac, 0x00000000},
-        {0x0000b0b0, 0x00000000},
-        {0x0000b0b4, 0x00000000},
-        {0x0000b0b8, 0x00000000},
-        {0x0000b0bc, 0x00000000},
-        {0x0000b0c0, 0x003f0020},
-        {0x0000b0c4, 0x00400041},
-        {0x0000b0c8, 0x0140005f},
-        {0x0000b0cc, 0x0160015f},
-        {0x0000b0d0, 0x017e017f},
-        {0x0000b0d4, 0x02410242},
-        {0x0000b0d8, 0x025f0240},
-        {0x0000b0dc, 0x027f0260},
-        {0x0000b0e0, 0x0341027e},
-        {0x0000b0e4, 0x035f0340},
-        {0x0000b0e8, 0x037f0360},
-        {0x0000b0ec, 0x04400441},
-        {0x0000b0f0, 0x0460045f},
-        {0x0000b0f4, 0x0541047f},
-        {0x0000b0f8, 0x055f0540},
-        {0x0000b0fc, 0x057f0560},
-        {0x0000b100, 0x06400641},
-        {0x0000b104, 0x0660065f},
-        {0x0000b108, 0x067e067f},
-        {0x0000b10c, 0x07410742},
-        {0x0000b110, 0x075f0740},
-        {0x0000b114, 0x077f0760},
-        {0x0000b118, 0x07800781},
-        {0x0000b11c, 0x07a0079f},
-        {0x0000b120, 0x07c107bf},
-        {0x0000b124, 0x000007c0},
-        {0x0000b128, 0x00000000},
-        {0x0000b12c, 0x00000000},
-        {0x0000b130, 0x00000000},
-        {0x0000b134, 0x00000000},
-        {0x0000b138, 0x00000000},
-        {0x0000b13c, 0x00000000},
-        {0x0000b140, 0x003f0020},
-        {0x0000b144, 0x00400041},
-        {0x0000b148, 0x0140005f},
-        {0x0000b14c, 0x0160015f},
-        {0x0000b150, 0x017e017f},
-        {0x0000b154, 0x02410242},
-        {0x0000b158, 0x025f0240},
-        {0x0000b15c, 0x027f0260},
-        {0x0000b160, 0x0341027e},
-        {0x0000b164, 0x035f0340},
-        {0x0000b168, 0x037f0360},
-        {0x0000b16c, 0x04400441},
-        {0x0000b170, 0x0460045f},
-        {0x0000b174, 0x0541047f},
-        {0x0000b178, 0x055f0540},
-        {0x0000b17c, 0x057f0560},
-        {0x0000b180, 0x06400641},
-        {0x0000b184, 0x0660065f},
-        {0x0000b188, 0x067e067f},
-        {0x0000b18c, 0x07410742},
-        {0x0000b190, 0x075f0740},
-        {0x0000b194, 0x077f0760},
-        {0x0000b198, 0x07800781},
-        {0x0000b19c, 0x07a0079f},
-        {0x0000b1a0, 0x07c107bf},
-        {0x0000b1a4, 0x000007c0},
-        {0x0000b1a8, 0x00000000},
-        {0x0000b1ac, 0x00000000},
-        {0x0000b1b0, 0x00000000},
-        {0x0000b1b4, 0x00000000},
-        {0x0000b1b8, 0x00000000},
-        {0x0000b1bc, 0x00000000},
-        {0x0000b1c0, 0x00000000},
-        {0x0000b1c4, 0x00000000},
-        {0x0000b1c8, 0x00000000},
-        {0x0000b1cc, 0x00000000},
-        {0x0000b1d0, 0x00000000},
-        {0x0000b1d4, 0x00000000},
-        {0x0000b1d8, 0x00000000},
-        {0x0000b1dc, 0x00000000},
-        {0x0000b1e0, 0x00000000},
-        {0x0000b1e4, 0x00000000},
-        {0x0000b1e8, 0x00000000},
-        {0x0000b1ec, 0x00000000},
-        {0x0000b1f0, 0x00000396},
-        {0x0000b1f4, 0x00000396},
-        {0x0000b1f8, 0x00000396},
-        {0x0000b1fc, 0x00000196},
-};
-
-static const u32 ar9300_2p0_soc_preamble[][2] = {
-        /* Addr      allmodes  */
-        {0x000040a4, 0x00a0c1c9},
-        {0x00007008, 0x00000000},
-        {0x00007020, 0x00000000},
-        {0x00007034, 0x00000002},
-        {0x00007038, 0x000004c2},
-};
-
-static const u32 ar9300PciePhy_pll_on_clkreq_disable_L1_2p0[][2] = {
-        /* Addr      allmodes  */
-        {0x00004040, 0x08212e5e},
-        {0x00004040, 0x0008003b},
-        {0x00004044, 0x00000000},
-};
-
-static const u32 ar9300PciePhy_clkreq_enable_L1_2p0[][2] = {
-        /* Addr      allmodes  */
-        {0x00004040, 0x08253e5e},
-        {0x00004040, 0x0008003b},
-        {0x00004044, 0x00000000},
-};
-
-static const u32 ar9300PciePhy_clkreq_disable_L1_2p0[][2] = {
-        /* Addr      allmodes  */
-        {0x00004040, 0x08213e5e},
-        {0x00004040, 0x0008003b},
-        {0x00004044, 0x00000000},
-};
-
-#endif /* INITVALS_9003_2P0_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 4674ea8c9c99..9e6edffe0bd1 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -18,6 +18,11 @@
 #include "hw-ops.h"
 #include "ar9003_phy.h"
 
+enum ar9003_cal_types {
+        IQ_MISMATCH_CAL = BIT(0),
+        TEMP_COMP_CAL = BIT(1),
+};
+
 static void ar9003_hw_setup_calibration(struct ath_hw *ah,
                                         struct ath9k_cal_list *currCal)
 {
@@ -50,11 +55,6 @@ static void ar9003_hw_setup_calibration(struct ath_hw *ah,
                 ath_print(common, ATH_DBG_CALIBRATE,
                           "starting Temperature Compensation Calibration\n");
                 break;
-        case ADC_DC_INIT_CAL:
-        case ADC_GAIN_CAL:
-        case ADC_DC_CAL:
-                /* Not yet */
-                break;
         }
 }
 
@@ -314,27 +314,6 @@ static const struct ath9k_percal_data iq_cal_single_sample = {
 static void ar9003_hw_init_cal_settings(struct ath_hw *ah)
 {
         ah->iq_caldata.calData = &iq_cal_single_sample;
-        ah->supp_cals = IQ_MISMATCH_CAL;
-}
-
-static bool ar9003_hw_iscal_supported(struct ath_hw *ah,
-                                      enum ath9k_cal_types calType)
-{
-        switch (calType & ah->supp_cals) {
-        case IQ_MISMATCH_CAL:
-                /*
-                 * XXX: Run IQ Mismatch for non-CCK only
-                 * Note that CHANNEL_B is never set though.
-                 */
-                return true;
-        case ADC_GAIN_CAL:
-        case ADC_DC_CAL:
-                return false;
-        case TEMP_COMP_CAL:
-                return true;
-        }
-
-        return false;
 }
 
 /*
@@ -773,15 +752,16 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
 
         /* Initialize list pointers */
         ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
+        ah->supp_cals = IQ_MISMATCH_CAL;
 
-        if (ar9003_hw_iscal_supported(ah, IQ_MISMATCH_CAL)) {
+        if (ah->supp_cals & IQ_MISMATCH_CAL) {
                 INIT_CAL(&ah->iq_caldata);
                 INSERT_CAL(ah, &ah->iq_caldata);
                 ath_print(common, ATH_DBG_CALIBRATE,
                           "enabling IQ Calibration.\n");
         }
 
-        if (ar9003_hw_iscal_supported(ah, TEMP_COMP_CAL)) {
+        if (ah->supp_cals & TEMP_COMP_CAL) {
                 INIT_CAL(&ah->tempCompCalData);
                 INSERT_CAL(ah, &ah->tempCompCalData);
                 ath_print(common, ATH_DBG_CALIBRATE,
@@ -808,7 +788,6 @@ void ar9003_hw_attach_calib_ops(struct ath_hw *ah)
         priv_ops->init_cal_settings = ar9003_hw_init_cal_settings;
         priv_ops->init_cal = ar9003_hw_init_cal;
         priv_ops->setup_calibration = ar9003_hw_setup_calibration;
-        priv_ops->iscal_supported = ar9003_hw_iscal_supported;
 
         ops->calibrate = ar9003_hw_calibrate;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 057fb69ddf7f..c4182359bee4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -968,7 +968,7 @@ static int ath9k_hw_ar9300_get_eeprom_rev(struct ath_hw *ah)
 }
 
 static u8 ath9k_hw_ar9300_get_num_ant_config(struct ath_hw *ah,
-                                             enum ieee80211_band freq_band)
+                                             enum ath9k_hal_freq_band freq_band)
 {
         return 1;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 064168909108..c2a057156bfa 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -16,7 +16,6 @@
 
 #include "hw.h"
 #include "ar9003_mac.h"
-#include "ar9003_2p0_initvals.h"
 #include "ar9003_2p2_initvals.h"
 
 /* General hardware code for the AR9003 hadware family */
@@ -32,79 +31,12 @@ static bool ar9003_hw_macversion_supported(u32 macversion)
         return false;
 }
 
-/* AR9003 2.0 */
-static void ar9003_2p0_hw_init_mode_regs(struct ath_hw *ah)
-{
-        /* mac */
-        INIT_INI_ARRAY(&ah->iniMac[ATH_INI_PRE], NULL, 0, 0);
-        INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
-                       ar9300_2p0_mac_core,
-                       ARRAY_SIZE(ar9300_2p0_mac_core), 2);
-        INIT_INI_ARRAY(&ah->iniMac[ATH_INI_POST],
-                       ar9300_2p0_mac_postamble,
-                       ARRAY_SIZE(ar9300_2p0_mac_postamble), 5);
-
-        /* bb */
-        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_PRE], NULL, 0, 0);
-        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
-                       ar9300_2p0_baseband_core,
-                       ARRAY_SIZE(ar9300_2p0_baseband_core), 2);
-        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
-                       ar9300_2p0_baseband_postamble,
-                       ARRAY_SIZE(ar9300_2p0_baseband_postamble), 5);
-
-        /* radio */
-        INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_PRE], NULL, 0, 0);
-        INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_CORE],
-                       ar9300_2p0_radio_core,
-                       ARRAY_SIZE(ar9300_2p0_radio_core), 2);
-        INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_POST],
-                       ar9300_2p0_radio_postamble,
-                       ARRAY_SIZE(ar9300_2p0_radio_postamble), 5);
-
-        /* soc */
-        INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_PRE],
-                       ar9300_2p0_soc_preamble,
-                       ARRAY_SIZE(ar9300_2p0_soc_preamble), 2);
-        INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_CORE], NULL, 0, 0);
-        INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_POST],
-                       ar9300_2p0_soc_postamble,
-                       ARRAY_SIZE(ar9300_2p0_soc_postamble), 5);
-
-        /* rx/tx gain */
-        INIT_INI_ARRAY(&ah->iniModesRxGain,
-                       ar9300Common_rx_gain_table_2p0,
-                       ARRAY_SIZE(ar9300Common_rx_gain_table_2p0), 2);
-        INIT_INI_ARRAY(&ah->iniModesTxGain,
-                       ar9300Modes_lowest_ob_db_tx_gain_table_2p0,
-                       ARRAY_SIZE(ar9300Modes_lowest_ob_db_tx_gain_table_2p0),
-                       5);
-
-        /* Load PCIE SERDES settings from INI */
-
-        /* Awake Setting */
-
-        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                       ar9300PciePhy_pll_on_clkreq_disable_L1_2p0,
-                       ARRAY_SIZE(ar9300PciePhy_pll_on_clkreq_disable_L1_2p0),
-                       2);
-
-        /* Sleep Setting */
-
-        INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
-                       ar9300PciePhy_clkreq_enable_L1_2p0,
-                       ARRAY_SIZE(ar9300PciePhy_clkreq_enable_L1_2p0),
-                       2);
-
-        /* Fast clock modal settings */
-        INIT_INI_ARRAY(&ah->iniModesAdditional,
-                       ar9300Modes_fast_clock_2p0,
-                       ARRAY_SIZE(ar9300Modes_fast_clock_2p0),
-                       3);
-}
-
-/* AR9003 2.2 */
-static void ar9003_2p2_hw_init_mode_regs(struct ath_hw *ah)
+/*
+ * The AR9003 family uses a new INI format (pre, core, post
+ * arrays per subsystem). This provides support for the
+ * AR9003 2.2 chipsets.
+ */
+static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
 {
         /* mac */
         INIT_INI_ARRAY(&ah->iniMac[ATH_INI_PRE], NULL, 0, 0);
@@ -174,57 +106,27 @@ static void ar9003_2p2_hw_init_mode_regs(struct ath_hw *ah)
                        3);
 }
 
-/*
- * The AR9003 family uses a new INI format (pre, core, post
- * arrays per subsystem).
- */
-static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
-{
-        if (AR_SREV_9300_20(ah))
-                ar9003_2p0_hw_init_mode_regs(ah);
-        else
-                ar9003_2p2_hw_init_mode_regs(ah);
-}
-
 static void ar9003_tx_gain_table_apply(struct ath_hw *ah)
 {
         switch (ar9003_hw_get_tx_gain_idx(ah)) {
         case 0:
         default:
-                if (AR_SREV_9300_20(ah))
-                        INIT_INI_ARRAY(&ah->iniModesTxGain,
-                                       ar9300Modes_lowest_ob_db_tx_gain_table_2p0,
-                                       ARRAY_SIZE(ar9300Modes_lowest_ob_db_tx_gain_table_2p0),
-                                       5);
-                else
-                        INIT_INI_ARRAY(&ah->iniModesTxGain,
-                                       ar9300Modes_lowest_ob_db_tx_gain_table_2p2,
-                                       ARRAY_SIZE(ar9300Modes_lowest_ob_db_tx_gain_table_2p2),
-                                       5);
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               ar9300Modes_lowest_ob_db_tx_gain_table_2p2,
+                               ARRAY_SIZE(ar9300Modes_lowest_ob_db_tx_gain_table_2p2),
+                               5);
                 break;
         case 1:
-                if (AR_SREV_9300_20(ah))
-                        INIT_INI_ARRAY(&ah->iniModesTxGain,
-                                       ar9300Modes_high_ob_db_tx_gain_table_2p0,
-                                       ARRAY_SIZE(ar9300Modes_high_ob_db_tx_gain_table_2p0),
-                                       5);
-                else
-                        INIT_INI_ARRAY(&ah->iniModesTxGain,
-                                       ar9300Modes_high_ob_db_tx_gain_table_2p2,
-                                       ARRAY_SIZE(ar9300Modes_high_ob_db_tx_gain_table_2p2),
-                                       5);
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               ar9300Modes_high_ob_db_tx_gain_table_2p2,
+                               ARRAY_SIZE(ar9300Modes_high_ob_db_tx_gain_table_2p2),
+                               5);
                 break;
         case 2:
-                if (AR_SREV_9300_20(ah))
-                        INIT_INI_ARRAY(&ah->iniModesTxGain,
-                                       ar9300Modes_low_ob_db_tx_gain_table_2p0,
-                                       ARRAY_SIZE(ar9300Modes_low_ob_db_tx_gain_table_2p0),
-                                       5);
-                else
-                        INIT_INI_ARRAY(&ah->iniModesTxGain,
-                                       ar9300Modes_low_ob_db_tx_gain_table_2p2,
-                                       ARRAY_SIZE(ar9300Modes_low_ob_db_tx_gain_table_2p2),
-                                       5);
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               ar9300Modes_low_ob_db_tx_gain_table_2p2,
+                               ARRAY_SIZE(ar9300Modes_low_ob_db_tx_gain_table_2p2),
+                               5);
                 break;
         }
 }
@@ -234,28 +136,16 @@ static void ar9003_rx_gain_table_apply(struct ath_hw *ah)
         switch (ar9003_hw_get_rx_gain_idx(ah)) {
         case 0:
         default:
-                if (AR_SREV_9300_20(ah))
-                        INIT_INI_ARRAY(&ah->iniModesRxGain,
-                                       ar9300Common_rx_gain_table_2p0,
-                                       ARRAY_SIZE(ar9300Common_rx_gain_table_2p0),
-                                       2);
-                else
-                        INIT_INI_ARRAY(&ah->iniModesRxGain,
-                                       ar9300Common_rx_gain_table_2p2,
-                                       ARRAY_SIZE(ar9300Common_rx_gain_table_2p2),
-                                       2);
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               ar9300Common_rx_gain_table_2p2,
+                               ARRAY_SIZE(ar9300Common_rx_gain_table_2p2),
+                               2);
                 break;
         case 1:
-                if (AR_SREV_9300_20(ah))
-                        INIT_INI_ARRAY(&ah->iniModesRxGain,
-                                       ar9300Common_wo_xlna_rx_gain_table_2p0,
-                                       ARRAY_SIZE(ar9300Common_wo_xlna_rx_gain_table_2p0),
-                                       2);
-                else
-                        INIT_INI_ARRAY(&ah->iniModesRxGain,
-                                       ar9300Common_wo_xlna_rx_gain_table_2p2,
-                                       ARRAY_SIZE(ar9300Common_wo_xlna_rx_gain_table_2p2),
-                                       2);
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               ar9300Common_wo_xlna_rx_gain_table_2p2,
+                               ARRAY_SIZE(ar9300Common_wo_xlna_rx_gain_table_2p2),
+                               2);
                 break;
         }
 }
@@ -333,6 +223,4 @@ void ar9003_hw_attach_ops(struct ath_hw *ah)
         ar9003_hw_attach_phy_ops(ah);
         ar9003_hw_attach_calib_ops(ah);
         ar9003_hw_attach_mac_ops(ah);
-
-        ath9k_hw_attach_ani_ops_new(ah);
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index a462da23e87e..3b424ca1ba84 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -616,7 +616,8 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
                         rxs->rs_status |= ATH9K_RXERR_DECRYPT;
                 } else if (rxsp->status11 & AR_MichaelErr) {
                         rxs->rs_status |= ATH9K_RXERR_MIC;
-                }
+                } else if (rxsp->status11 & AR_KeyMiss)
+                        rxs->rs_status |= ATH9K_RXERR_DECRYPT;
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index a491854fa38a..669b777729b3 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -747,9 +747,9 @@ static void ar9003_hw_set_diversity(struct ath_hw *ah, bool value)
 static bool ar9003_hw_ani_control(struct ath_hw *ah,
                                   enum ath9k_ani_cmd cmd, int param)
 {
-        struct ar5416AniState *aniState = ah->curani;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_channel *chan = ah->curchan;
+        struct ar5416AniState *aniState = &chan->ani;
         s32 value, value2;
 
         switch (cmd & ah->ani_function) {
@@ -1005,15 +1005,13 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
 
         ath_print(common, ATH_DBG_ANI,
                   "ANI parameters: SI=%d, ofdmWS=%s FS=%d "
-                  "MRCcck=%s listenTime=%d CC=%d listen=%d "
+                  "MRCcck=%s listenTime=%d "
                   "ofdmErrs=%d cckErrs=%d\n",
                   aniState->spurImmunityLevel,
                   !aniState->ofdmWeakSigDetectOff ? "on" : "off",
                   aniState->firstepLevel,
                   !aniState->mrcCCKOff ? "on" : "off",
                   aniState->listenTime,
-                  aniState->cycleCount,
-                  aniState->listenTime,
                   aniState->ofdmPhyErrCount,
                   aniState->cckPhyErrCount);
         return true;
@@ -1067,12 +1065,9 @@ static void ar9003_hw_ani_cache_ini_regs(struct ath_hw *ah)
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_channel *chan = ah->curchan;
         struct ath9k_ani_default *iniDef;
-        int index;
         u32 val;
 
-        index = ath9k_hw_get_ani_channel_idx(ah, chan);
-        aniState = &ah->ani[index];
-        ah->curani = aniState;
+        aniState = &ah->curchan->ani;
         iniDef = &aniState->iniDef;
 
         ath_print(common, ATH_DBG_ANI,
@@ -1116,8 +1111,6 @@ static void ar9003_hw_ani_cache_ini_regs(struct ath_hw *ah)
         aniState->firstepLevel = ATH9K_ANI_FIRSTEP_LVL_NEW;
         aniState->ofdmWeakSigDetectOff = !ATH9K_ANI_USE_OFDM_WEAK_SIG;
         aniState->mrcCCKOff = !ATH9K_ANI_ENABLE_MRC_CCK;
-
-        aniState->cycleCount = 0;
 }
 
 void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
@@ -1232,7 +1225,7 @@ void ar9003_hw_bb_watchdog_read(struct ath_hw *ah)
 void ar9003_hw_bb_watchdog_dbg_info(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        u32 rxc_pcnt = 0, rxf_pcnt = 0, txf_pcnt = 0, status;
+        u32 status;
 
         if (likely(!(common->debug_mask & ATH_DBG_RESET)))
                 return;
@@ -1261,11 +1254,12 @@ void ar9003_hw_bb_watchdog_dbg_info(struct ath_hw *ah)
                   "** BB mode: BB_gen_controls=0x%08x **\n",
                   REG_READ(ah, AR_PHY_GEN_CTRL));
 
-        if (ath9k_hw_GetMibCycleCountsPct(ah, &rxc_pcnt, &rxf_pcnt, &txf_pcnt))
+#define PCT(_field) (common->cc_survey._field * 100 / common->cc_survey.cycles)
+        if (common->cc_survey.cycles)
                 ath_print(common, ATH_DBG_RESET,
                           "** BB busy times: rx_clear=%d%%, "
                           "rx_frame=%d%%, tx_frame=%d%% **\n",
-                          rxc_pcnt, rxf_pcnt, txf_pcnt);
+                          PCT(rx_busy), PCT(rx_frame), PCT(tx_frame));
 
         ath_print(common, ATH_DBG_RESET,
                   "==== BB update: done ====\n\n");
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index f0197a6046ab..973c919fdd27 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -239,13 +239,11 @@ struct ath_buf {
         struct sk_buff *bf_mpdu;        /* enclosing frame structure */
         void *bf_desc;                  /* virtual addr of desc */
         dma_addr_t bf_daddr;            /* physical addr of desc */
-        dma_addr_t bf_buf_addr;         /* physical addr of data buffer */
+        dma_addr_t bf_buf_addr; /* physical addr of data buffer, for DMA */
         bool bf_stale;
-        bool bf_isnullfunc;
         bool bf_tx_aborted;
         u16 bf_flags;
         struct ath_buf_state bf_state;
-        dma_addr_t bf_dmacontext;
         struct ath_wiphy *aphy;
 };
 
@@ -254,7 +252,7 @@ struct ath_atx_tid {
         struct list_head buf_q;
         struct ath_node *an;
         struct ath_atx_ac *ac;
-        struct ath_buf *tx_buf[ATH_TID_MAX_BUFS];
+        unsigned long tx_buf[BITS_TO_LONGS(ATH_TID_MAX_BUFS)];
         u16 seq_start;
         u16 seq_next;
         u16 baw_size;
@@ -345,12 +343,10 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
 void ath_tx_tasklet(struct ath_softc *sc);
 void ath_tx_edma_tasklet(struct ath_softc *sc);
 void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb);
-bool ath_tx_aggr_check(struct ath_softc *sc, struct ath_node *an, u8 tidno);
-void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
-                       u16 tid, u16 *ssn);
+int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
+                      u16 tid, u16 *ssn);
 void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
 void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
-void ath9k_enable_ps(struct ath_softc *sc);
 
 /********/
 /* VIFs */
@@ -481,6 +477,60 @@ struct ath_led {
 void ath_init_leds(struct ath_softc *sc);
 void ath_deinit_leds(struct ath_softc *sc);
 
+/* Antenna diversity/combining */
+#define ATH_ANT_RX_CURRENT_SHIFT 4
+#define ATH_ANT_RX_MAIN_SHIFT 2
+#define ATH_ANT_RX_MASK 0x3
+
+#define ATH_ANT_DIV_COMB_SHORT_SCAN_INTR 50
+#define ATH_ANT_DIV_COMB_SHORT_SCAN_PKTCOUNT 0x100
+#define ATH_ANT_DIV_COMB_MAX_PKTCOUNT 0x200
+#define ATH_ANT_DIV_COMB_INIT_COUNT 95
+#define ATH_ANT_DIV_COMB_MAX_COUNT 100
+#define ATH_ANT_DIV_COMB_ALT_ANT_RATIO 30
+#define ATH_ANT_DIV_COMB_ALT_ANT_RATIO2 20
+
+#define ATH_ANT_DIV_COMB_LNA1_LNA2_DELTA -3
+#define ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA -1
+#define ATH_ANT_DIV_COMB_LNA1_DELTA_HI -4
+#define ATH_ANT_DIV_COMB_LNA1_DELTA_MID -2
+#define ATH_ANT_DIV_COMB_LNA1_DELTA_LOW 2
+
+enum ath9k_ant_div_comb_lna_conf {
+        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2,
+        ATH_ANT_DIV_COMB_LNA2,
+        ATH_ANT_DIV_COMB_LNA1,
+        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2,
+};
+
+struct ath_ant_comb {
+        u16 count;
+        u16 total_pkt_count;
+        bool scan;
+        bool scan_not_start;
+        int main_total_rssi;
+        int alt_total_rssi;
+        int alt_recv_cnt;
+        int main_recv_cnt;
+        int rssi_lna1;
+        int rssi_lna2;
+        int rssi_add;
+        int rssi_sub;
+        int rssi_first;
+        int rssi_second;
+        int rssi_third;
+        bool alt_good;
+        int quick_scan_cnt;
+        int main_conf;
+        enum ath9k_ant_div_comb_lna_conf first_quick_scan_conf;
+        enum ath9k_ant_div_comb_lna_conf second_quick_scan_conf;
+        int first_bias;
+        int second_bias;
+        bool first_ratio;
+        bool second_ratio;
+        unsigned long scan_start_time;
+};
+
 /********************/
 /* Main driver core */
 /********************/
@@ -509,7 +559,6 @@ void ath_deinit_leds(struct ath_softc *sc);
 #define SC_OP_RXFLUSH                BIT(7)
 #define SC_OP_LED_ASSOCIATED         BIT(8)
 #define SC_OP_LED_ON                 BIT(9)
-#define SC_OP_SCANNING               BIT(10)
 #define SC_OP_TSF_RESET              BIT(11)
 #define SC_OP_BT_PRIORITY_DETECTED   BIT(12)
 #define SC_OP_BT_SCAN                BIT(13)
@@ -521,8 +570,6 @@ void ath_deinit_leds(struct ath_softc *sc);
 #define PS_WAIT_FOR_PSPOLL_DATA   BIT(2)
 #define PS_WAIT_FOR_TX_ACK        BIT(3)
 #define PS_BEACON_SYNC            BIT(4)
-#define PS_NULLFUNC_COMPLETED     BIT(5)
-#define PS_ENABLED                BIT(6)
 
 struct ath_wiphy;
 struct ath_rate_table;
@@ -545,6 +592,8 @@ struct ath_softc {
         struct delayed_work wiphy_work;
         unsigned long wiphy_scheduler_int;
         int wiphy_scheduler_index;
+        struct survey_info *cur_survey;
+        struct survey_info survey[ATH9K_NUM_CHANNELS];
 
         struct tasklet_struct intr_tq;
         struct tasklet_struct bcon_tasklet;
@@ -573,8 +622,6 @@ struct ath_softc {
         struct ath_rx rx;
         struct ath_tx tx;
         struct ath_beacon beacon;
-        const struct ath_rate_table *cur_rate_table;
-        enum wireless_mode cur_rate_mode;
         struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
 
         struct ath_led radio_led;
@@ -597,6 +644,8 @@ struct ath_softc {
         struct ath_btcoex btcoex;
 
         struct ath_descdma txsdma;
+
+        struct ath_ant_comb ant_comb;
 };
 
 struct ath_wiphy {
@@ -663,7 +712,7 @@ static inline void ath_ahb_exit(void) {};
 void ath9k_ps_wakeup(struct ath_softc *sc);
 void ath9k_ps_restore(struct ath_softc *sc);
 
-void ath9k_set_bssid_mask(struct ieee80211_hw *hw);
+void ath9k_set_bssid_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
 int ath9k_wiphy_add(struct ath_softc *sc);
 int ath9k_wiphy_del(struct ath_wiphy *aphy);
 void ath9k_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb);
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 081192e78a46..4ed010d4ef96 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -136,9 +136,10 @@ static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw,
         bf = avp->av_bcbuf;
         skb = bf->bf_mpdu;
         if (skb) {
-                dma_unmap_single(sc->dev, bf->bf_dmacontext,
+                dma_unmap_single(sc->dev, bf->bf_buf_addr,
                                  skb->len, DMA_TO_DEVICE);
                 dev_kfree_skb_any(skb);
+                bf->bf_buf_addr = 0;
         }
 
         /* Get a new beacon from mac80211 */
@@ -162,12 +163,12 @@ static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw,
                 hdr->seq_ctrl |= cpu_to_le16(sc->tx.seq_no);
         }
 
-        bf->bf_buf_addr = bf->bf_dmacontext =
-                dma_map_single(sc->dev, skb->data,
-                               skb->len, DMA_TO_DEVICE);
+        bf->bf_buf_addr = dma_map_single(sc->dev, skb->data,
+                                         skb->len, DMA_TO_DEVICE);
         if (unlikely(dma_mapping_error(sc->dev, bf->bf_buf_addr))) {
                 dev_kfree_skb_any(skb);
                 bf->bf_mpdu = NULL;
+                bf->bf_buf_addr = 0;
                 ath_print(common, ATH_DBG_FATAL,
                           "dma_mapping_error on beaconing\n");
                 return NULL;
@@ -252,10 +253,11 @@ int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
         bf = avp->av_bcbuf;
         if (bf->bf_mpdu != NULL) {
                 skb = bf->bf_mpdu;
-                dma_unmap_single(sc->dev, bf->bf_dmacontext,
+                dma_unmap_single(sc->dev, bf->bf_buf_addr,
                                  skb->len, DMA_TO_DEVICE);
                 dev_kfree_skb_any(skb);
                 bf->bf_mpdu = NULL;
+                bf->bf_buf_addr = 0;
         }
 
         /* NB: the beacon data buffer must be 32-bit aligned. */
@@ -296,12 +298,12 @@ int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
                 avp->tsf_adjust = cpu_to_le64(0);
 
         bf->bf_mpdu = skb;
-        bf->bf_buf_addr = bf->bf_dmacontext =
-                dma_map_single(sc->dev, skb->data,
-                               skb->len, DMA_TO_DEVICE);
+        bf->bf_buf_addr = dma_map_single(sc->dev, skb->data,
+                                         skb->len, DMA_TO_DEVICE);
         if (unlikely(dma_mapping_error(sc->dev, bf->bf_buf_addr))) {
                 dev_kfree_skb_any(skb);
                 bf->bf_mpdu = NULL;
+                bf->bf_buf_addr = 0;
                 ath_print(common, ATH_DBG_FATAL,
                           "dma_mapping_error on beacon alloc\n");
                 return -ENOMEM;
@@ -324,10 +326,11 @@ void ath_beacon_return(struct ath_softc *sc, struct ath_vif *avp)
                 bf = avp->av_bcbuf;
                 if (bf->bf_mpdu != NULL) {
                         struct sk_buff *skb = bf->bf_mpdu;
-                        dma_unmap_single(sc->dev, bf->bf_dmacontext,
+                        dma_unmap_single(sc->dev, bf->bf_buf_addr,
                                          skb->len, DMA_TO_DEVICE);
                         dev_kfree_skb_any(skb);
                         bf->bf_mpdu = NULL;
+                        bf->bf_buf_addr = 0;
                 }
                 list_add_tail(&bf->list, &sc->beacon.bbuf);
 
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 67ee5d735cc1..6d509484b5f6 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -186,7 +186,7 @@ bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
                 return true;
         }
 
-        if (!ath9k_hw_iscal_supported(ah, currCal->calData->calType))
+        if (!(ah->supp_cals & currCal->calData->calType))
                 return true;
 
         ath_print(common, ATH_DBG_CALIBRATE,
@@ -300,7 +300,6 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
                 }
         }
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 
@@ -346,34 +345,34 @@ bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
         struct ieee80211_channel *c = chan->chan;
         struct ath9k_hw_cal_data *caldata = ah->caldata;
 
-        if (!caldata)
-                return false;
-
         chan->channelFlags &= (~CHANNEL_CW_INT);
         if (REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF) {
                 ath_print(common, ATH_DBG_CALIBRATE,
                           "NF did not complete in calibration window\n");
-                nf = 0;
-                caldata->rawNoiseFloor = nf;
                 return false;
-        } else {
-                ath9k_hw_do_getnf(ah, nfarray);
-                ath9k_hw_nf_sanitize(ah, nfarray);
-                nf = nfarray[0];
-                if (ath9k_hw_get_nf_thresh(ah, c->band, &nfThresh)
-                    && nf > nfThresh) {
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "noise floor failed detected; "
-                                  "detected %d, threshold %d\n",
-                                  nf, nfThresh);
-                        chan->channelFlags |= CHANNEL_CW_INT;
-                }
+        }
+
+        ath9k_hw_do_getnf(ah, nfarray);
+        ath9k_hw_nf_sanitize(ah, nfarray);
+        nf = nfarray[0];
+        if (ath9k_hw_get_nf_thresh(ah, c->band, &nfThresh)
+            && nf > nfThresh) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "noise floor failed detected; "
+                          "detected %d, threshold %d\n",
+                          nf, nfThresh);
+                chan->channelFlags |= CHANNEL_CW_INT;
+        }
+
+        if (!caldata) {
+                chan->noisefloor = nf;
+                return false;
         }
 
         h = caldata->nfCalHist;
         caldata->nfcal_pending = false;
         ath9k_hw_update_nfcal_hist_buffer(ah, caldata, nfarray);
-        caldata->rawNoiseFloor = h[0].privNF;
+        chan->noisefloor = h[0].privNF;
         return true;
 }
 
@@ -401,10 +400,10 @@ void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
 
 s16 ath9k_hw_getchan_noise(struct ath_hw *ah, struct ath9k_channel *chan)
 {
-        if (!ah->caldata || !ah->caldata->rawNoiseFloor)
+        if (!ah->curchan || !ah->curchan->noisefloor)
                 return ath9k_hw_get_default_nf(ah, chan);
 
-        return ah->caldata->rawNoiseFloor;
+        return ah->curchan->noisefloor;
 }
 EXPORT_SYMBOL(ath9k_hw_getchan_noise);
 
diff --git a/drivers/net/wireless/ath/ath9k/calib.h b/drivers/net/wireless/ath/ath9k/calib.h
index 5b053a6260b2..b8973eb8d858 100644
--- a/drivers/net/wireless/ath/ath9k/calib.h
+++ b/drivers/net/wireless/ath/ath9k/calib.h
@@ -58,14 +58,6 @@ struct ar5416IniArray {
                 }                                                       \
         } while (0)
 
-enum ath9k_cal_types {
-        ADC_DC_INIT_CAL = 0x1,
-        ADC_GAIN_CAL = 0x2,
-        ADC_DC_CAL = 0x4,
-        IQ_MISMATCH_CAL = 0x8,
-        TEMP_COMP_CAL = 0x10,
-};
-
 enum ath9k_cal_state {
         CAL_INACTIVE,
         CAL_WAITING,
@@ -80,7 +72,7 @@ enum ath9k_cal_state {
 #define PER_MAX_LOG_COUNT  10
 
 struct ath9k_percal_data {
-        enum ath9k_cal_types calType;
+        u32 calType;
         u32 calNumSamples;
         u32 calCountMax;
         void (*calCollect) (struct ath_hw *);
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index 2dab64bb23a8..f43a2d98421c 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -148,276 +148,6 @@ struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ath9k_cmn_get_curchannel);
 
-static int ath_setkey_tkip(struct ath_common *common, u16 keyix, const u8 *key,
-                           struct ath9k_keyval *hk, const u8 *addr,
-                           bool authenticator)
-{
-        struct ath_hw *ah = common->ah;
-        const u8 *key_rxmic;
-        const u8 *key_txmic;
-
-        key_txmic = key + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
-        key_rxmic = key + NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
-
-        if (addr == NULL) {
-                /*
-                 * Group key installation - only two key cache entries are used
-                 * regardless of splitmic capability since group key is only
-                 * used either for TX or RX.
-                 */
-                if (authenticator) {
-                        memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
-                        memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_mic));
-                } else {
-                        memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
-                        memcpy(hk->kv_txmic, key_rxmic, sizeof(hk->kv_mic));
-                }
-                return ath9k_hw_set_keycache_entry(ah, keyix, hk, addr);
-        }
-        if (!common->splitmic) {
-                /* TX and RX keys share the same key cache entry. */
-                memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
-                memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_txmic));
-                return ath9k_hw_set_keycache_entry(ah, keyix, hk, addr);
-        }
-
-        /* Separate key cache entries for TX and RX */
-
-        /* TX key goes at first index, RX key at +32. */
-        memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
-        if (!ath9k_hw_set_keycache_entry(ah, keyix, hk, NULL)) {
-                /* TX MIC entry failed. No need to proceed further */
-                ath_print(common, ATH_DBG_FATAL,
-                          "Setting TX MIC Key Failed\n");
-                return 0;
-        }
-
-        memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
-        /* XXX delete tx key on failure? */
-        return ath9k_hw_set_keycache_entry(ah, keyix + 32, hk, addr);
-}
-
-static int ath_reserve_key_cache_slot_tkip(struct ath_common *common)
-{
-        int i;
-
-        for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
-                if (test_bit(i, common->keymap) ||
-                    test_bit(i + 64, common->keymap))
-                        continue; /* At least one part of TKIP key allocated */
-                if (common->splitmic &&
-                    (test_bit(i + 32, common->keymap) ||
-                     test_bit(i + 64 + 32, common->keymap)))
-                        continue; /* At least one part of TKIP key allocated */
-
-                /* Found a free slot for a TKIP key */
-                return i;
-        }
-        return -1;
-}
-
-static int ath_reserve_key_cache_slot(struct ath_common *common,
-                                      u32 cipher)
-{
-        int i;
-
-        if (cipher == WLAN_CIPHER_SUITE_TKIP)
-                return ath_reserve_key_cache_slot_tkip(common);
-
-        /* First, try to find slots that would not be available for TKIP. */
-        if (common->splitmic) {
-                for (i = IEEE80211_WEP_NKID; i < common->keymax / 4; i++) {
-                        if (!test_bit(i, common->keymap) &&
-                            (test_bit(i + 32, common->keymap) ||
-                             test_bit(i + 64, common->keymap) ||
-                             test_bit(i + 64 + 32, common->keymap)))
-                                return i;
-                        if (!test_bit(i + 32, common->keymap) &&
-                            (test_bit(i, common->keymap) ||
-                             test_bit(i + 64, common->keymap) ||
-                             test_bit(i + 64 + 32, common->keymap)))
-                                return i + 32;
-                        if (!test_bit(i + 64, common->keymap) &&
-                            (test_bit(i , common->keymap) ||
-                             test_bit(i + 32, common->keymap) ||
-                             test_bit(i + 64 + 32, common->keymap)))
-                                return i + 64;
-                        if (!test_bit(i + 64 + 32, common->keymap) &&
-                            (test_bit(i, common->keymap) ||
-                             test_bit(i + 32, common->keymap) ||
-                             test_bit(i + 64, common->keymap)))
-                                return i + 64 + 32;
-                }
-        } else {
-                for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
-                        if (!test_bit(i, common->keymap) &&
-                            test_bit(i + 64, common->keymap))
-                                return i;
-                        if (test_bit(i, common->keymap) &&
-                            !test_bit(i + 64, common->keymap))
-                                return i + 64;
-                }
-        }
-
-        /* No partially used TKIP slots, pick any available slot */
-        for (i = IEEE80211_WEP_NKID; i < common->keymax; i++) {
-                /* Do not allow slots that could be needed for TKIP group keys
-                 * to be used. This limitation could be removed if we know that
-                 * TKIP will not be used. */
-                if (i >= 64 && i < 64 + IEEE80211_WEP_NKID)
-                        continue;
-                if (common->splitmic) {
-                        if (i >= 32 && i < 32 + IEEE80211_WEP_NKID)
-                                continue;
-                        if (i >= 64 + 32 && i < 64 + 32 + IEEE80211_WEP_NKID)
-                                continue;
-                }
-
-                if (!test_bit(i, common->keymap))
-                        return i; /* Found a free slot for a key */
-        }
-
-        /* No free slot found */
-        return -1;
-}
-
-/*
- * Configure encryption in the HW.
- */
-int ath9k_cmn_key_config(struct ath_common *common,
-                         struct ieee80211_vif *vif,
-                         struct ieee80211_sta *sta,
-                         struct ieee80211_key_conf *key)
-{
-        struct ath_hw *ah = common->ah;
-        struct ath9k_keyval hk;
-        const u8 *mac = NULL;
-        u8 gmac[ETH_ALEN];
-        int ret = 0;
-        int idx;
-
-        memset(&hk, 0, sizeof(hk));
-
-        switch (key->cipher) {
-        case WLAN_CIPHER_SUITE_WEP40:
-        case WLAN_CIPHER_SUITE_WEP104:
-                hk.kv_type = ATH9K_CIPHER_WEP;
-                break;
-        case WLAN_CIPHER_SUITE_TKIP:
-                hk.kv_type = ATH9K_CIPHER_TKIP;
-                break;
-        case WLAN_CIPHER_SUITE_CCMP:
-                hk.kv_type = ATH9K_CIPHER_AES_CCM;
-                break;
-        default:
-                return -EOPNOTSUPP;
-        }
-
-        hk.kv_len = key->keylen;
-        memcpy(hk.kv_val, key->key, key->keylen);
-
-        if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
-                switch (vif->type) {
-                case NL80211_IFTYPE_AP:
-                        memcpy(gmac, vif->addr, ETH_ALEN);
-                        gmac[0] |= 0x01;
-                        mac = gmac;
-                        idx = ath_reserve_key_cache_slot(common, key->cipher);
-                        break;
-                case NL80211_IFTYPE_ADHOC:
-                        if (!sta) {
-                                idx = key->keyidx;
-                                break;
-                        }
-                        memcpy(gmac, sta->addr, ETH_ALEN);
-                        gmac[0] |= 0x01;
-                        mac = gmac;
-                        idx = ath_reserve_key_cache_slot(common, key->cipher);
-                        break;
-                default:
-                        idx = key->keyidx;
-                        break;
-                }
-        } else if (key->keyidx) {
-                if (WARN_ON(!sta))
-                        return -EOPNOTSUPP;
-                mac = sta->addr;
-
-                if (vif->type != NL80211_IFTYPE_AP) {
-                        /* Only keyidx 0 should be used with unicast key, but
-                         * allow this for client mode for now. */
-                        idx = key->keyidx;
-                } else
-                        return -EIO;
-        } else {
-                if (WARN_ON(!sta))
-                        return -EOPNOTSUPP;
-                mac = sta->addr;
-
-                idx = ath_reserve_key_cache_slot(common, key->cipher);
-        }
-
-        if (idx < 0)
-                return -ENOSPC; /* no free key cache entries */
-
-        if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
-                ret = ath_setkey_tkip(common, idx, key->key, &hk, mac,
-                                      vif->type == NL80211_IFTYPE_AP);
-        else
-                ret = ath9k_hw_set_keycache_entry(ah, idx, &hk, mac);
-
-        if (!ret)
-                return -EIO;
-
-        set_bit(idx, common->keymap);
-        if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
-                set_bit(idx + 64, common->keymap);
-                set_bit(idx, common->tkip_keymap);
-                set_bit(idx + 64, common->tkip_keymap);
-                if (common->splitmic) {
-                        set_bit(idx + 32, common->keymap);
-                        set_bit(idx + 64 + 32, common->keymap);
-                        set_bit(idx + 32, common->tkip_keymap);
-                        set_bit(idx + 64 + 32, common->tkip_keymap);
-                }
-        }
-
-        return idx;
-}
-EXPORT_SYMBOL(ath9k_cmn_key_config);
-
-/*
- * Delete Key.
- */
-void ath9k_cmn_key_delete(struct ath_common *common,
-                          struct ieee80211_key_conf *key)
-{
-        struct ath_hw *ah = common->ah;
-
-        ath9k_hw_keyreset(ah, key->hw_key_idx);
-        if (key->hw_key_idx < IEEE80211_WEP_NKID)
-                return;
-
-        clear_bit(key->hw_key_idx, common->keymap);
-        if (key->cipher != WLAN_CIPHER_SUITE_TKIP)
-                return;
-
-        clear_bit(key->hw_key_idx + 64, common->keymap);
-
-        clear_bit(key->hw_key_idx, common->tkip_keymap);
-        clear_bit(key->hw_key_idx + 64, common->tkip_keymap);
-
-        if (common->splitmic) {
-                ath9k_hw_keyreset(ah, key->hw_key_idx + 32);
-                clear_bit(key->hw_key_idx + 32, common->keymap);
-                clear_bit(key->hw_key_idx + 64 + 32, common->keymap);
-
-                clear_bit(key->hw_key_idx + 32, common->tkip_keymap);
-                clear_bit(key->hw_key_idx + 64 + 32, common->tkip_keymap);
-        }
-}
-EXPORT_SYMBOL(ath9k_cmn_key_delete);
-
 int ath9k_cmn_count_streams(unsigned int chainmask, int max)
 {
         int streams = 0;
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index 4aa4e7dbe4d2..fea3b3315391 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -66,12 +66,6 @@ void ath9k_cmn_update_ichannel(struct ieee80211_hw *hw,
                                struct ath9k_channel *ichan);
 struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
                                                struct ath_hw *ah);
-int ath9k_cmn_key_config(struct ath_common *common,
-                         struct ieee80211_vif *vif,
-                         struct ieee80211_sta *sta,
-                         struct ieee80211_key_conf *key);
-void ath9k_cmn_key_delete(struct ath_common *common,
-                          struct ieee80211_key_conf *key);
 int ath9k_cmn_count_streams(unsigned int chainmask, int max);
 void ath9k_cmn_btcoex_bt_stomp(struct ath_common *common,
                                   enum ath_stomp_type stomp_type);
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 54aae931424e..7f764e3d1c0a 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -378,95 +378,6 @@ static const struct file_operations fops_interrupt = {
         .owner = THIS_MODULE
 };
 
-void ath_debug_stat_rc(struct ath_softc *sc, int final_rate)
-{
-        struct ath_rc_stats *stats;
-
-        stats = &sc->debug.stats.rcstats[final_rate];
-        stats->success++;
-}
-
-void ath_debug_stat_retries(struct ath_softc *sc, int rix,
-                            int xretries, int retries, u8 per)
-{
-        struct ath_rc_stats *stats = &sc->debug.stats.rcstats[rix];
-
-        stats->xretries += xretries;
-        stats->retries += retries;
-        stats->per = per;
-}
-
-static ssize_t read_file_rcstat(struct file *file, char __user *user_buf,
-                                size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        char *buf;
-        unsigned int len = 0, max;
-        int i = 0;
-        ssize_t retval;
-
-        if (sc->cur_rate_table == NULL)
-                return 0;
-
-        max = 80 + sc->cur_rate_table->rate_cnt * 1024 + 1;
-        buf = kmalloc(max, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        len += sprintf(buf, "%6s %6s %6s "
-                       "%10s %10s %10s %10s\n",
-                       "HT", "MCS", "Rate",
-                       "Success", "Retries", "XRetries", "PER");
-
-        for (i = 0; i < sc->cur_rate_table->rate_cnt; i++) {
-                u32 ratekbps = sc->cur_rate_table->info[i].ratekbps;
-                struct ath_rc_stats *stats = &sc->debug.stats.rcstats[i];
-                char mcs[5];
-                char htmode[5];
-                int used_mcs = 0, used_htmode = 0;
-
-                if (WLAN_RC_PHY_HT(sc->cur_rate_table->info[i].phy)) {
-                        used_mcs = snprintf(mcs, 5, "%d",
-                                sc->cur_rate_table->info[i].ratecode);
-
-                        if (WLAN_RC_PHY_40(sc->cur_rate_table->info[i].phy))
-                                used_htmode = snprintf(htmode, 5, "HT40");
-                        else if (WLAN_RC_PHY_20(sc->cur_rate_table->info[i].phy))
-                                used_htmode = snprintf(htmode, 5, "HT20");
-                        else
-                                used_htmode = snprintf(htmode, 5, "????");
-                }
-
-                mcs[used_mcs] = '\0';
-                htmode[used_htmode] = '\0';
-
-                len += snprintf(buf + len, max - len,
-                        "%6s %6s %3u.%d: "
-                        "%10u %10u %10u %10u\n",
-                        htmode,
-                        mcs,
-                        ratekbps / 1000,
-                        (ratekbps % 1000) / 100,
-                        stats->success,
-                        stats->retries,
-                        stats->xretries,
-                        stats->per);
-        }
-
-        if (len > max)
-                len = max;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-        return retval;
-}
-
-static const struct file_operations fops_rcstat = {
-        .read = read_file_rcstat,
-        .open = ath9k_debugfs_open,
-        .owner = THIS_MODULE
-};
-
 static const char * ath_wiphy_state_str(enum ath_wiphy_state state)
 {
         switch (state) {
@@ -488,26 +399,20 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
                                size_t count, loff_t *ppos)
 {
         struct ath_softc *sc = file->private_data;
+        struct ath_wiphy *aphy = sc->pri_wiphy;
+        struct ieee80211_channel *chan = aphy->hw->conf.channel;
         char buf[512];
         unsigned int len = 0;
         int i;
         u8 addr[ETH_ALEN];
+        u32 tmp;
 
         len += snprintf(buf + len, sizeof(buf) - len,
                         "primary: %s (%s chan=%d ht=%d)\n",
                         wiphy_name(sc->pri_wiphy->hw->wiphy),
                         ath_wiphy_state_str(sc->pri_wiphy->state),
-                        sc->pri_wiphy->chan_idx, sc->pri_wiphy->chan_is_ht);
-        for (i = 0; i < sc->num_sec_wiphy; i++) {
-                struct ath_wiphy *aphy = sc->sec_wiphy[i];
-                if (aphy == NULL)
-                        continue;
-                len += snprintf(buf + len, sizeof(buf) - len,
-                                "secondary: %s (%s chan=%d ht=%d)\n",
-                                wiphy_name(aphy->hw->wiphy),
-                                ath_wiphy_state_str(aphy->state),
-                                aphy->chan_idx, aphy->chan_is_ht);
-        }
+                        ieee80211_frequency_to_channel(chan->center_freq),
+                        aphy->chan_is_ht);
 
         put_unaligned_le32(REG_READ_D(sc->sc_ah, AR_STA_ID0), addr);
         put_unaligned_le16(REG_READ_D(sc->sc_ah, AR_STA_ID1) & 0xffff, addr + 4);
@@ -517,7 +422,51 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
         put_unaligned_le16(REG_READ_D(sc->sc_ah, AR_BSSMSKU) & 0xffff, addr + 4);
         len += snprintf(buf + len, sizeof(buf) - len,
                         "addrmask: %pM\n", addr);
-
+        tmp = ath9k_hw_getrxfilter(sc->sc_ah);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "rfilt: 0x%x", tmp);
+        if (tmp & ATH9K_RX_FILTER_UCAST)
+                len += snprintf(buf + len, sizeof(buf) - len, " UCAST");
+        if (tmp & ATH9K_RX_FILTER_MCAST)
+                len += snprintf(buf + len, sizeof(buf) - len, " MCAST");
+        if (tmp & ATH9K_RX_FILTER_BCAST)
+                len += snprintf(buf + len, sizeof(buf) - len, " BCAST");
+        if (tmp & ATH9K_RX_FILTER_CONTROL)
+                len += snprintf(buf + len, sizeof(buf) - len, " CONTROL");
+        if (tmp & ATH9K_RX_FILTER_BEACON)
+                len += snprintf(buf + len, sizeof(buf) - len, " BEACON");
+        if (tmp & ATH9K_RX_FILTER_PROM)
+                len += snprintf(buf + len, sizeof(buf) - len, " PROM");
+        if (tmp & ATH9K_RX_FILTER_PROBEREQ)
+                len += snprintf(buf + len, sizeof(buf) - len, " PROBEREQ");
+        if (tmp & ATH9K_RX_FILTER_PHYERR)
+                len += snprintf(buf + len, sizeof(buf) - len, " PHYERR");
+        if (tmp & ATH9K_RX_FILTER_MYBEACON)
+                len += snprintf(buf + len, sizeof(buf) - len, " MYBEACON");
+        if (tmp & ATH9K_RX_FILTER_COMP_BAR)
+                len += snprintf(buf + len, sizeof(buf) - len, " COMP_BAR");
+        if (tmp & ATH9K_RX_FILTER_PSPOLL)
+                len += snprintf(buf + len, sizeof(buf) - len, " PSPOLL");
+        if (tmp & ATH9K_RX_FILTER_PHYRADAR)
+                len += snprintf(buf + len, sizeof(buf) - len, " PHYRADAR");
+        if (tmp & ATH9K_RX_FILTER_MCAST_BCAST_ALL)
+                len += snprintf(buf + len, sizeof(buf) - len, " MCAST_BCAST_ALL\n");
+        else
+                len += snprintf(buf + len, sizeof(buf) - len, "\n");
+
+        /* Put variable-length stuff down here, and check for overflows. */
+        for (i = 0; i < sc->num_sec_wiphy; i++) {
+                struct ath_wiphy *aphy = sc->sec_wiphy[i];
+                if (aphy == NULL)
+                        continue;
+                chan = aphy->hw->conf.channel;
+                len += snprintf(buf + len, sizeof(buf) - len,
+                        "secondary: %s (%s chan=%d ht=%d)\n",
+                        wiphy_name(aphy->hw->wiphy),
+                        ath_wiphy_state_str(aphy->state),
+                        ieee80211_frequency_to_channel(chan->center_freq),
+                        aphy->chan_is_ht);
+        }
         if (len > sizeof(buf))
                 len = sizeof(buf);
 
@@ -663,6 +612,8 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
         PR("DESC CFG Error:  ", desc_cfg_err);
         PR("DATA Underrun:   ", data_underrun);
         PR("DELIM Underrun:  ", delim_underrun);
+        PR("TX-Pkts-All:     ", tx_pkts_all);
+        PR("TX-Bytes-All:    ", tx_bytes_all);
 
         if (len > size)
                 len = size;
@@ -676,6 +627,9 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
 void ath_debug_stat_tx(struct ath_softc *sc, struct ath_txq *txq,
                        struct ath_buf *bf, struct ath_tx_status *ts)
 {
+        TX_STAT_INC(txq->axq_qnum, tx_pkts_all);
+        sc->debug.stats.txstats[txq->axq_qnum].tx_bytes_all += bf->bf_mpdu->len;
+
         if (bf_isampdu(bf)) {
                 if (bf_isxretried(bf))
                         TX_STAT_INC(txq->axq_qnum, a_xretries);
@@ -770,6 +724,13 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         PHY_ERR("HT-LENGTH", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
         PHY_ERR("HT-RATE", ATH9K_PHYERR_HT_RATE_ILLEGAL);
 
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10u\n", "RX-Pkts-All",
+                        sc->debug.stats.rxstats.rx_pkts_all);
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10u\n", "RX-Bytes-All",
+                        sc->debug.stats.rxstats.rx_bytes_all);
+
         if (len > size)
                 len = size;
 
@@ -788,6 +749,9 @@ void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
 
         u32 phyerr;
 
+        RX_STAT_INC(rx_pkts_all);
+        sc->debug.stats.rxstats.rx_bytes_all += rs->rs_datalen;
+
         if (rs->rs_status & ATH9K_RXERR_CRC)
                 RX_STAT_INC(crc_err);
         if (rs->rs_status & ATH9K_RXERR_DECRYPT)
@@ -924,10 +888,6 @@ int ath9k_init_debug(struct ath_hw *ah)
                         sc, &fops_interrupt))
                 goto err;
 
-        if (!debugfs_create_file("rcstat", S_IRUSR, sc->debug.debugfs_phy,
-                        sc, &fops_rcstat))
-                goto err;
-
         if (!debugfs_create_file("wiphy", S_IRUSR | S_IWUSR,
                         sc->debug.debugfs_phy, sc, &fops_wiphy))
                 goto err;
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 5d21704e87ff..bb0823242ba0 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -80,15 +80,12 @@ struct ath_interrupt_stats {
         u32 bb_watchdog;
 };
 
-struct ath_rc_stats {
-        u32 success;
-        u32 retries;
-        u32 xretries;
-        u8 per;
-};
-
 /**
  * struct ath_tx_stats - Statistics about TX
+ * @tx_pkts_all:  No. of total frames transmitted, including ones that
+        may have had errors.
+ * @tx_bytes_all:  No. of total bytes transmitted, including ones that
+        may have had errors.
  * @queued: Total MPDUs (non-aggr) queued
  * @completed: Total MPDUs (non-aggr) completed
  * @a_aggr: Total no. of aggregates queued
@@ -107,6 +104,8 @@ struct ath_rc_stats {
  * @delim_urn: TX delimiter underrun errors
  */
 struct ath_tx_stats {
+        u32 tx_pkts_all;
+        u32 tx_bytes_all;
         u32 queued;
         u32 completed;
         u32 a_aggr;
@@ -124,6 +123,10 @@ struct ath_tx_stats {
 
 /**
  * struct ath_rx_stats - RX Statistics
+ * @rx_pkts_all:  No. of total frames received, including ones that
+        may have had errors.
+ * @rx_bytes_all:  No. of total bytes received, including ones that
+        may have had errors.
  * @crc_err: No. of frames with incorrect CRC value
  * @decrypt_crc_err: No. of frames whose CRC check failed after
         decryption process completed
@@ -136,6 +139,8 @@ struct ath_tx_stats {
  * @phy_err_stats: Individual PHY error statistics
  */
 struct ath_rx_stats {
+        u32 rx_pkts_all;
+        u32 rx_bytes_all;
         u32 crc_err;
         u32 decrypt_crc_err;
         u32 phy_err;
@@ -148,7 +153,6 @@ struct ath_rx_stats {
 
 struct ath_stats {
         struct ath_interrupt_stats istats;
-        struct ath_rc_stats rcstats[RATE_TABLE_SIZE];
         struct ath_tx_stats txstats[ATH9K_NUM_TX_QUEUES];
         struct ath_rx_stats rxstats;
 };
@@ -165,12 +169,9 @@ void ath9k_exit_debug(struct ath_hw *ah);
 int ath9k_debug_create_root(void);
 void ath9k_debug_remove_root(void);
 void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status);
-void ath_debug_stat_rc(struct ath_softc *sc, int final_rate);
 void ath_debug_stat_tx(struct ath_softc *sc, struct ath_txq *txq,
                        struct ath_buf *bf, struct ath_tx_status *ts);
 void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs);
-void ath_debug_stat_retries(struct ath_softc *sc, int rix,
-                            int xretries, int retries, u8 per);
 
 #else
 
@@ -197,11 +198,6 @@ static inline void ath_debug_stat_interrupt(struct ath_softc *sc,
 {
 }
 
-static inline void ath_debug_stat_rc(struct ath_softc *sc,
-                                     int final_rate)
-{
-}
-
 static inline void ath_debug_stat_tx(struct ath_softc *sc,
                                      struct ath_txq *txq,
                                      struct ath_buf *bf,
@@ -214,11 +210,6 @@ static inline void ath_debug_stat_rx(struct ath_softc *sc,
 {
 }
 
-static inline void ath_debug_stat_retries(struct ath_softc *sc, int rix,
-                                          int xretries, int retries, u8 per)
-{
-}
-
 #endif /* CONFIG_ATH9K_DEBUGFS */
 
 #endif /* DEBUG_H */
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index 0b09db0f8e7d..dacb45e1b906 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -101,7 +101,7 @@
 #define AR5416_VER_MASK (eep->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK)
 #define OLC_FOR_AR9280_20_LATER (AR_SREV_9280_20_OR_LATER(ah) && \
                                  ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL))
-#define OLC_FOR_AR9287_10_LATER (AR_SREV_9287_10_OR_LATER(ah) && \
+#define OLC_FOR_AR9287_10_LATER (AR_SREV_9287_11_OR_LATER(ah) && \
                                  ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL))
 
 #define AR_EEPROM_RFSILENT_GPIO_SEL     0x001c
@@ -266,6 +266,8 @@ enum eeprom_param {
         EEP_INTERNAL_REGULATOR,
         EEP_SWREG,
         EEP_PAPRD,
+        EEP_MODAL_VER,
+        EEP_ANT_DIV_CTL1,
 };
 
 enum ar5416_rates {
@@ -670,7 +672,8 @@ struct eeprom_ops {
         bool (*fill_eeprom)(struct ath_hw *hw);
         int (*get_eeprom_ver)(struct ath_hw *hw);
         int (*get_eeprom_rev)(struct ath_hw *hw);
-        u8 (*get_num_ant_config)(struct ath_hw *hw, enum ieee80211_band band);
+        u8 (*get_num_ant_config)(struct ath_hw *hw,
+                                 enum ath9k_hal_freq_band band);
         u32 (*get_eeprom_antenna_cfg)(struct ath_hw *hw,
                                       struct ath9k_channel *chan);
         void (*set_board_values)(struct ath_hw *hw, struct ath9k_channel *chan);
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 9cccd12e8f21..4fa4d8e28c64 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -179,6 +179,9 @@ static u32 ath9k_hw_4k_get_eeprom(struct ath_hw *ah,
         struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
         struct modal_eep_4k_header *pModal = &eep->modalHeader;
         struct base_eep_header_4k *pBase = &eep->baseEepHeader;
+        u16 ver_minor;
+
+        ver_minor = pBase->version & AR5416_EEP_VER_MINOR_MASK;
 
         switch (param) {
         case EEP_NFTHRESH_2:
@@ -204,7 +207,7 @@ static u32 ath9k_hw_4k_get_eeprom(struct ath_hw *ah,
         case EEP_DB_2:
                 return pModal->db1_1;
         case EEP_MINOR_REV:
-                return pBase->version & AR5416_EEP_VER_MINOR_MASK;
+                return ver_minor;
         case EEP_TX_MASK:
                 return pBase->txMask;
         case EEP_RX_MASK:
@@ -213,6 +216,15 @@ static u32 ath9k_hw_4k_get_eeprom(struct ath_hw *ah,
                 return 0;
         case EEP_PWR_TABLE_OFFSET:
                 return AR5416_PWR_TABLE_OFFSET_DB;
+        case EEP_MODAL_VER:
+                return pModal->version;
+        case EEP_ANT_DIV_CTL1:
+                return pModal->antdiv_ctl1;
+        case EEP_TXGAIN_TYPE:
+                if (ver_minor >= AR5416_EEP_MINOR_VER_19)
+                        return pBase->txGainType;
+                else
+                        return AR5416_EEP_TXGAIN_ORIGINAL;
         default:
                 return 0;
         }
@@ -329,7 +341,7 @@ static void ath9k_hw_get_4k_gain_boundaries_pdadcs(struct ath_hw *ah,
                 }
 
                 if (i == 0) {
-                        if (AR_SREV_9280_10_OR_LATER(ah))
+                        if (AR_SREV_9280_20_OR_LATER(ah))
                                 ss = (int16_t)(0 - (minPwrT4[i] / 2));
                         else
                                 ss = 0;
@@ -496,7 +508,6 @@ static void ath9k_hw_set_4k_power_cal_table(struct ath_hw *ah,
                         }
 
                         REGWRITE_BUFFER_FLUSH(ah);
-                        DISABLE_REGWRITE_BUFFER(ah);
                 }
         }
 
@@ -757,7 +768,7 @@ static void ath9k_hw_4k_set_txpower(struct ath_hw *ah,
 
         regulatory->max_power_level = ratesArray[i];
 
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
                 for (i = 0; i < Ar5416RateSize; i++)
                         ratesArray[i] -= AR5416_PWR_TABLE_OFFSET_DB * 2;
         }
@@ -828,7 +839,6 @@ static void ath9k_hw_4k_set_txpower(struct ath_hw *ah,
         }
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 static void ath9k_hw_4k_set_addac(struct ath_hw *ah,
@@ -905,9 +915,6 @@ static void ath9k_hw_4k_set_gain(struct ath_hw *ah,
                       AR9280_PHY_RXGAIN_TXRX_ATTEN, txRxAttenLocal);
         REG_RMW_FIELD(ah, AR_PHY_RXGAIN + 0x1000,
                       AR9280_PHY_RXGAIN_TXRX_MARGIN, pModal->rxTxMarginCh[0]);
-
-        if (AR_SREV_9285_11(ah))
-                REG_WRITE(ah, AR9285_AN_TOP4, (AR9285_AN_TOP4_DEFAULT | 0x14));
 }
 
 /*
@@ -1105,9 +1112,6 @@ static void ath9k_hw_4k_set_board_values(struct ath_hw *ah,
         }
 
 
-        if (AR_SREV_9285_11(ah))
-                REG_WRITE(ah, AR9285_AN_TOP4, AR9285_AN_TOP4_DEFAULT);
-
         REG_RMW_FIELD(ah, AR_PHY_SETTLING, AR_PHY_SETTLING_SWITCH,
                       pModal->switchSettling);
         REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ, AR_PHY_DESIRED_SZ_ADC,
@@ -1157,7 +1161,7 @@ static u32 ath9k_hw_4k_get_eeprom_antenna_cfg(struct ath_hw *ah,
 }
 
 static u8 ath9k_hw_4k_get_num_ant_config(struct ath_hw *ah,
-                                         enum ieee80211_band freq_band)
+                                         enum ath9k_hal_freq_band freq_band)
 {
         return 1;
 }
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index dff2da777312..966b9496a9dd 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -324,7 +324,7 @@ static void ath9k_hw_get_ar9287_gain_boundaries_pdadcs(struct ath_hw *ah,
                 minDelta = 0;
 
                 if (i == 0) {
-                        if (AR_SREV_9280_10_OR_LATER(ah))
+                        if (AR_SREV_9280_20_OR_LATER(ah))
                                 ss = (int16_t)(0 - (minPwrT4[i] / 2));
                         else
                                 ss = 0;
@@ -883,7 +883,7 @@ static void ath9k_hw_ar9287_set_txpower(struct ath_hw *ah,
                         ratesArray[i] = AR9287_MAX_RATE_POWER;
         }
 
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
                 for (i = 0; i < Ar5416RateSize; i++)
                         ratesArray[i] -= AR9287_PWR_TABLE_OFFSET_DB * 2;
         }
@@ -977,7 +977,7 @@ static void ath9k_hw_ar9287_set_txpower(struct ath_hw *ah,
         else
                 i = rate6mb;
 
-        if (AR_SREV_9280_10_OR_LATER(ah))
+        if (AR_SREV_9280_20_OR_LATER(ah))
                 regulatory->max_power_level =
                         ratesArray[i] + AR9287_PWR_TABLE_OFFSET_DB * 2;
         else
@@ -1126,7 +1126,7 @@ static void ath9k_hw_ar9287_set_board_values(struct ath_hw *ah,
 }
 
 static u8 ath9k_hw_ar9287_get_num_ant_config(struct ath_hw *ah,
-                                             enum ieee80211_band freq_band)
+                                             enum ath9k_hal_freq_band freq_band)
 {
         return 1;
 }
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index afa2b73ddbdd..76b4d65472dd 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -223,7 +223,7 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
         }
 
         /* Enable fixup for AR_AN_TOP2 if necessary */
-        if (AR_SREV_9280_10_OR_LATER(ah) &&
+        if (AR_SREV_9280_20_OR_LATER(ah) &&
             (eep->baseEepHeader.version & 0xff) > 0x0a &&
             eep->baseEepHeader.pwdclkind == 0)
                 ah->need_an_top2_fixup = 1;
@@ -317,7 +317,7 @@ static void ath9k_hw_def_set_gain(struct ath_hw *ah,
         if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_3) {
                 txRxAttenLocal = pModal->txRxAttenCh[i];
 
-                if (AR_SREV_9280_10_OR_LATER(ah)) {
+                if (AR_SREV_9280_20_OR_LATER(ah)) {
                         REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
                               AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN,
                               pModal->bswMargin[i]);
@@ -344,7 +344,7 @@ static void ath9k_hw_def_set_gain(struct ath_hw *ah,
                 }
         }
 
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
                 REG_RMW_FIELD(ah,
                       AR_PHY_RXGAIN + regChainOffset,
                       AR9280_PHY_RXGAIN_TXRX_ATTEN, txRxAttenLocal);
@@ -408,7 +408,7 @@ static void ath9k_hw_def_set_board_values(struct ath_hw *ah,
                                               regChainOffset, i);
         }
 
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
                 if (IS_CHAN_2GHZ(chan)) {
                         ath9k_hw_analog_shift_rmw(ah, AR_AN_RF2G1_CH0,
                                                   AR_AN_RF2G1_CH0_OB,
@@ -461,7 +461,7 @@ static void ath9k_hw_def_set_board_values(struct ath_hw *ah,
         REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ, AR_PHY_DESIRED_SZ_ADC,
                       pModal->adcDesiredSize);
 
-        if (!AR_SREV_9280_10_OR_LATER(ah))
+        if (!AR_SREV_9280_20_OR_LATER(ah))
                 REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ,
                               AR_PHY_DESIRED_SZ_PGA,
                               pModal->pgaDesiredSize);
@@ -478,7 +478,7 @@ static void ath9k_hw_def_set_board_values(struct ath_hw *ah,
         REG_RMW_FIELD(ah, AR_PHY_RF_CTL3, AR_PHY_TX_END_TO_A2_RX_ON,
                       pModal->txEndToRxOn);
 
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_CCA, AR9280_PHY_CCA_THRESH62,
                               pModal->thresh62);
                 REG_RMW_FIELD(ah, AR_PHY_EXT_CCA0,
@@ -696,7 +696,7 @@ static void ath9k_hw_get_def_gain_boundaries_pdadcs(struct ath_hw *ah,
                 }
 
                 if (i == 0) {
-                        if (AR_SREV_9280_10_OR_LATER(ah))
+                        if (AR_SREV_9280_20_OR_LATER(ah))
                                 ss = (int16_t)(0 - (minPwrT4[i] / 2));
                         else
                                 ss = 0;
@@ -1291,7 +1291,7 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
                         ratesArray[i] = AR5416_MAX_RATE_POWER;
         }
 
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
                 for (i = 0; i < Ar5416RateSize; i++) {
                         int8_t pwr_table_offset;
 
@@ -1395,7 +1395,7 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
         else if (IS_CHAN_HT20(chan))
                 i = rateHt20_0;
 
-        if (AR_SREV_9280_10_OR_LATER(ah))
+        if (AR_SREV_9280_20_OR_LATER(ah))
                 regulatory->max_power_level =
                         ratesArray[i] + AR5416_PWR_TABLE_OFFSET_DB * 2;
         else
@@ -1418,11 +1418,11 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
 }
 
 static u8 ath9k_hw_def_get_num_ant_config(struct ath_hw *ah,
-                                          enum ieee80211_band freq_band)
+                                          enum ath9k_hal_freq_band freq_band)
 {
         struct ar5416_eeprom_def *eep = &ah->eeprom.def;
         struct modal_eep_header *pModal =
-                &(eep->modalHeader[ATH9K_HAL_FREQ_BAND_2GHZ == freq_band]);
+                &(eep->modalHeader[freq_band]);
         struct base_eep_header *pBase = &eep->baseEepHeader;
         u8 num_ant_config;
 
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 495f18950ac9..728d904c74d7 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -92,10 +92,10 @@ static int hif_usb_send_regout(struct hif_device_usb *hif_dev,
         cmd->skb = skb;
         cmd->hif_dev = hif_dev;
 
-        usb_fill_int_urb(urb, hif_dev->udev,
-                         usb_sndintpipe(hif_dev->udev, USB_REG_OUT_PIPE),
+        usb_fill_bulk_urb(urb, hif_dev->udev,
+                         usb_sndbulkpipe(hif_dev->udev, USB_REG_OUT_PIPE),
                          skb->data, skb->len,
-                         hif_usb_regout_cb, cmd, 1);
+                         hif_usb_regout_cb, cmd);
 
         usb_anchor_urb(urb, &hif_dev->regout_submitted);
         ret = usb_submit_urb(urb, GFP_KERNEL);
@@ -541,7 +541,8 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
                 }
 
                 usb_fill_int_urb(urb, hif_dev->udev,
-                                 usb_rcvintpipe(hif_dev->udev, USB_REG_IN_PIPE),
+                                 usb_rcvbulkpipe(hif_dev->udev,
+                                                 USB_REG_IN_PIPE),
                                  nskb->data, MAX_REG_IN_BUF_SIZE,
                                  ath9k_hif_usb_reg_in_cb, nskb, 1);
 
@@ -720,7 +721,8 @@ static int ath9k_hif_usb_alloc_reg_in_urb(struct hif_device_usb *hif_dev)
                 goto err;
 
         usb_fill_int_urb(hif_dev->reg_in_urb, hif_dev->udev,
-                         usb_rcvintpipe(hif_dev->udev, USB_REG_IN_PIPE),
+                         usb_rcvbulkpipe(hif_dev->udev,
+                                         USB_REG_IN_PIPE),
                          skb->data, MAX_REG_IN_BUF_SIZE,
                          ath9k_hif_usb_reg_in_cb, skb, 1);
 
@@ -822,7 +824,9 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
 
 static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
 {
-        int ret;
+        int ret, idx;
+        struct usb_host_interface *alt = &hif_dev->interface->altsetting[0];
+        struct usb_endpoint_descriptor *endp;
 
         /* Request firmware */
         ret = request_firmware(&hif_dev->firmware, hif_dev->fw_name,
@@ -850,6 +854,22 @@ static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
                 goto err_fw_download;
         }
 
+        /* On downloading the firmware to the target, the USB descriptor of EP4
+         * is 'patched' to change the type of the endpoint to Bulk. This will
+         * bring down CPU usage during the scan period.
+         */
+        for (idx = 0; idx < alt->desc.bNumEndpoints; idx++) {
+                endp = &alt->endpoint[idx].desc;
+                if (((endp->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK)
+                                == 0x04) &&
+                    ((endp->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+                                == USB_ENDPOINT_XFER_INT)) {
+                        endp->bmAttributes &= ~USB_ENDPOINT_XFERTYPE_MASK;
+                        endp->bmAttributes |= USB_ENDPOINT_XFER_BULK;
+                        endp->bInterval = 0;
+                }
+        }
+
         return 0;
 
 err_fw_download:
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
index bd1506e69105..1b72aa482ac7 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
@@ -235,7 +235,14 @@ void ath9k_htc_beaconq_config(struct ath9k_htc_priv *priv)
         ath9k_hw_get_txq_props(ah, qnum, &qi_be);
 
         qi.tqi_aifs = qi_be.tqi_aifs;
-        qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
+        /* For WIFI Beacon Distribution
+         * Long slot time  : 2x cwmin
+         * Short slot time : 4x cwmin
+         */
+        if (ah->slottime == ATH9K_SLOT_TIME_20)
+                qi.tqi_cwmin = 2*qi_be.tqi_cwmin;
+        else
+                qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
         qi.tqi_cwmax = qi_be.tqi_cwmax;
 
         if (!ath9k_hw_set_txq_props(ah, priv->beaconq, &qi)) {
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 695e2b088d10..3d7b97f1b3ae 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -380,15 +380,6 @@ static void ath9k_enable_regwrite_buffer(void *hw_priv)
         atomic_inc(&priv->wmi->mwrite_cnt);
 }
 
-static void ath9k_disable_regwrite_buffer(void *hw_priv)
-{
-        struct ath_hw *ah = (struct ath_hw *) hw_priv;
-        struct ath_common *common = ath9k_hw_common(ah);
-        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
-
-        atomic_dec(&priv->wmi->mwrite_cnt);
-}
-
 static void ath9k_regwrite_flush(void *hw_priv)
 {
         struct ath_hw *ah = (struct ath_hw *) hw_priv;
@@ -397,6 +388,8 @@ static void ath9k_regwrite_flush(void *hw_priv)
         u32 rsp_status;
         int r;
 
+        atomic_dec(&priv->wmi->mwrite_cnt);
+
         mutex_lock(&priv->wmi->multi_write_mutex);
 
         if (priv->wmi->multi_write_idx) {
@@ -420,7 +413,6 @@ static const struct ath_ops ath9k_common_ops = {
         .read = ath9k_regread,
         .write = ath9k_regwrite,
         .enable_write_buffer = ath9k_enable_regwrite_buffer,
-        .disable_write_buffer = ath9k_disable_regwrite_buffer,
         .write_flush = ath9k_regwrite_flush,
 };
 
@@ -561,17 +553,20 @@ static void ath9k_init_crypto(struct ath9k_htc_priv *priv)
                 common->keymax = ATH_KEYMAX;
         }
 
+        if (priv->ah->misc_mode & AR_PCU_MIC_NEW_LOC_ENA)
+                common->crypt_caps |= ATH_CRYPT_CAP_MIC_COMBINED;
+
         /*
          * Reset the key cache since some parts do not
          * reset the contents on initial power up.
          */
         for (i = 0; i < common->keymax; i++)
-                ath9k_hw_keyreset(priv->ah, (u16) i);
+                ath_hw_keyreset(common, (u16) i);
 }
 
 static void ath9k_init_channels_rates(struct ath9k_htc_priv *priv)
 {
-        if (test_bit(ATH9K_MODE_11G, priv->ah->caps.wireless_modes)) {
+        if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_2GHZ) {
                 priv->sbands[IEEE80211_BAND_2GHZ].channels =
                         ath9k_2ghz_channels;
                 priv->sbands[IEEE80211_BAND_2GHZ].band = IEEE80211_BAND_2GHZ;
@@ -582,7 +577,7 @@ static void ath9k_init_channels_rates(struct ath9k_htc_priv *priv)
                         ARRAY_SIZE(ath9k_legacy_rates);
         }
 
-        if (test_bit(ATH9K_MODE_11A, priv->ah->caps.wireless_modes)) {
+        if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ) {
                 priv->sbands[IEEE80211_BAND_5GHZ].channels = ath9k_5ghz_channels;
                 priv->sbands[IEEE80211_BAND_5GHZ].band = IEEE80211_BAND_5GHZ;
                 priv->sbands[IEEE80211_BAND_5GHZ].n_channels =
@@ -601,8 +596,7 @@ static void ath9k_init_misc(struct ath9k_htc_priv *priv)
         common->tx_chainmask = priv->ah->caps.tx_chainmask;
         common->rx_chainmask = priv->ah->caps.rx_chainmask;
 
-        if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
-                memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
+        memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
 
         priv->ah->opmode = NL80211_IFTYPE_STATION;
 }
@@ -746,18 +740,18 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
         hw->extra_tx_headroom = sizeof(struct tx_frame_hdr) +
                 sizeof(struct htc_frame_hdr) + 4;
 
-        if (test_bit(ATH9K_MODE_11G, priv->ah->caps.wireless_modes))
+        if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_2GHZ)
                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
                         &priv->sbands[IEEE80211_BAND_2GHZ];
-        if (test_bit(ATH9K_MODE_11A, priv->ah->caps.wireless_modes))
+        if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &priv->sbands[IEEE80211_BAND_5GHZ];
 
         if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
-                if (test_bit(ATH9K_MODE_11G, priv->ah->caps.wireless_modes))
+                if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_2GHZ)
                         setup_ht_cap(priv,
                                      &priv->sbands[IEEE80211_BAND_2GHZ].ht_cap);
-                if (test_bit(ATH9K_MODE_11A, priv->ah->caps.wireless_modes))
+                if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
                         setup_ht_cap(priv,
                                      &priv->sbands[IEEE80211_BAND_5GHZ].ht_cap);
         }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index f4672073ac0a..55c80866dfc6 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -137,8 +137,6 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
         if (priv->op_flags & OP_FULL_RESET)
                 fastcc = false;
 
-        /* Fiddle around with fastcc later on, for now just use full reset */
-        fastcc = false;
         ath9k_htc_ps_wakeup(priv);
         htc_stop(priv->htc);
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
@@ -146,9 +144,10 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
         WMI_CMD(WMI_STOP_RECV_CMDID);
 
         ath_print(common, ATH_DBG_CONFIG,
-                  "(%u MHz) -> (%u MHz), HT: %d, HT40: %d\n",
+                  "(%u MHz) -> (%u MHz), HT: %d, HT40: %d fastcc: %d\n",
                   priv->ah->curchan->channel,
-                  channel->center_freq, conf_is_ht(conf), conf_is_ht40(conf));
+                  channel->center_freq, conf_is_ht(conf), conf_is_ht40(conf),
+                  fastcc);
 
         caldata = &priv->caldata[channel->hw_value];
         ret = ath9k_hw_reset(ah, hchan, caldata, fastcc);
@@ -761,23 +760,12 @@ void ath9k_ani_work(struct work_struct *work)
                         ath9k_hw_ani_monitor(ah, ah->curchan);
 
                 /* Perform calibration if necessary */
-                if (longcal || shortcal) {
+                if (longcal || shortcal)
                         common->ani.caldone =
                                 ath9k_hw_calibrate(ah, ah->curchan,
                                                    common->rx_chainmask,
                                                    longcal);
 
-                        if (longcal)
-                                common->ani.noise_floor =
-                                        ath9k_hw_getchan_noise(ah, ah->curchan);
-
-                        ath_print(common, ATH_DBG_ANI,
-                                  " calibrate chan %u/%x nf: %d\n",
-                                  ah->curchan->channel,
-                                  ah->curchan->channelFlags,
-                                  common->ani.noise_floor);
-                }
-
                 ath9k_htc_ps_restore(priv);
         }
 
@@ -1466,6 +1454,7 @@ out:
         FIF_PSPOLL |                            \
         FIF_OTHER_BSS |                         \
         FIF_BCN_PRBRESP_PROMISC |               \
+        FIF_PROBE_REQ |                         \
         FIF_FCSFAIL)
 
 static void ath9k_htc_configure_filter(struct ieee80211_hw *hw,
@@ -1591,7 +1580,7 @@ static int ath9k_htc_set_key(struct ieee80211_hw *hw,
 
         switch (cmd) {
         case SET_KEY:
-                ret = ath9k_cmn_key_config(common, vif, sta, key);
+                ret = ath_key_config(common, vif, sta, key);
                 if (ret >= 0) {
                         key->hw_key_idx = ret;
                         /* push IV and Michael MIC generation to stack */
@@ -1605,7 +1594,7 @@ static int ath9k_htc_set_key(struct ieee80211_hw *hw,
                 }
                 break;
         case DISABLE_KEY:
-                ath9k_cmn_key_delete(common, key);
+                ath_key_delete(common, key);
                 break;
         default:
                 ret = -EINVAL;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 2a6e45a293a9..3d19b5bc937f 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -369,8 +369,7 @@ u32 ath9k_htc_calcrxfilter(struct ath9k_htc_priv *priv)
                 | ATH9K_RX_FILTER_UCAST | ATH9K_RX_FILTER_BCAST
                 | ATH9K_RX_FILTER_MCAST;
 
-        /* If not a STA, enable processing of Probe Requests */
-        if (ah->opmode != NL80211_IFTYPE_STATION)
+        if (priv->rxfilter & FIF_PROBE_REQ)
                 rfilt |= ATH9K_RX_FILTER_PROBEREQ;
 
         /*
@@ -415,8 +414,7 @@ static void ath9k_htc_opmode_init(struct ath9k_htc_priv *priv)
         ath9k_hw_setrxfilter(ah, rfilt);
 
         /* configure bssid mask */
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
-                ath_hw_setbssidmask(common);
+        ath_hw_setbssidmask(common);
 
         /* configure operational mode */
         ath9k_hw_setopmode(ah);
diff --git a/drivers/net/wireless/ath/ath9k/hw-ops.h b/drivers/net/wireless/ath/ath9k/hw-ops.h
index ffecbadaea4a..0a4ad348b699 100644
--- a/drivers/net/wireless/ath/ath9k/hw-ops.h
+++ b/drivers/net/wireless/ath/ath9k/hw-ops.h
@@ -128,17 +128,6 @@ static inline void ath9k_hw_set11n_virtualmorefrag(struct ath_hw *ah, void *ds,
         ath9k_hw_ops(ah)->set11n_virtualmorefrag(ah, ds, vmf);
 }
 
-static inline void ath9k_hw_procmibevent(struct ath_hw *ah)
-{
-        ath9k_hw_ops(ah)->ani_proc_mib_event(ah);
-}
-
-static inline void ath9k_hw_ani_monitor(struct ath_hw *ah,
-                                        struct ath9k_channel *chan)
-{
-        ath9k_hw_ops(ah)->ani_monitor(ah, chan);
-}
-
 /* Private hardware call ops */
 
 /* PHY ops */
@@ -276,15 +265,4 @@ static inline void ath9k_hw_setup_calibration(struct ath_hw *ah,
         ath9k_hw_private_ops(ah)->setup_calibration(ah, currCal);
 }
 
-static inline bool ath9k_hw_iscal_supported(struct ath_hw *ah,
-                                            enum ath9k_cal_types calType)
-{
-        return ath9k_hw_private_ops(ah)->iscal_supported(ah, calType);
-}
-
-static inline void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
-{
-        ath9k_hw_private_ops(ah)->ani_reset(ah, is_scanning);
-}
-
 #endif /* ATH9K_HW_OPS_H */
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 3384ca164562..cc13ee117823 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -88,29 +88,32 @@ static void ath9k_hw_ani_cache_ini_regs(struct ath_hw *ah)
 /* Helper Functions */
 /********************/
 
-static u32 ath9k_hw_mac_clks(struct ath_hw *ah, u32 usecs)
+static void ath9k_hw_set_clockrate(struct ath_hw *ah)
 {
         struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
+        struct ath_common *common = ath9k_hw_common(ah);
+        unsigned int clockrate;
 
         if (!ah->curchan) /* should really check for CCK instead */
-                return usecs *ATH9K_CLOCK_RATE_CCK;
-        if (conf->channel->band == IEEE80211_BAND_2GHZ)
-                return usecs *ATH9K_CLOCK_RATE_2GHZ_OFDM;
-
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_FASTCLOCK)
-                return usecs * ATH9K_CLOCK_FAST_RATE_5GHZ_OFDM;
+                clockrate = ATH9K_CLOCK_RATE_CCK;
+        else if (conf->channel->band == IEEE80211_BAND_2GHZ)
+                clockrate = ATH9K_CLOCK_RATE_2GHZ_OFDM;
+        else if (ah->caps.hw_caps & ATH9K_HW_CAP_FASTCLOCK)
+                clockrate = ATH9K_CLOCK_FAST_RATE_5GHZ_OFDM;
         else
-                return usecs * ATH9K_CLOCK_RATE_5GHZ_OFDM;
+                clockrate = ATH9K_CLOCK_RATE_5GHZ_OFDM;
+
+        if (conf_is_ht40(conf))
+                clockrate *= 2;
+
+        common->clockrate = clockrate;
 }
 
 static u32 ath9k_hw_mac_to_clks(struct ath_hw *ah, u32 usecs)
 {
-        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
+        struct ath_common *common = ath9k_hw_common(ah);
 
-        if (conf_is_ht40(conf))
-                return ath9k_hw_mac_clks(ah, usecs) * 2;
-        else
-                return ath9k_hw_mac_clks(ah, usecs);
+        return usecs * common->clockrate;
 }
 
 bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val, u32 timeout)
@@ -299,7 +302,6 @@ static void ath9k_hw_disablepcie(struct ath_hw *ah)
         REG_WRITE(ah, AR_PCIE_SERDES2, 0x00000000);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 /* This should work for all families including legacy */
@@ -371,10 +373,6 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         ah->config.pcie_clock_req = 0;
         ah->config.pcie_waen = 0;
         ah->config.analog_shiftreg = 1;
-        ah->config.ofdm_trig_low = 200;
-        ah->config.ofdm_trig_high = 500;
-        ah->config.cck_trig_high = 200;
-        ah->config.cck_trig_low = 100;
         ah->config.enable_ani = true;
 
         for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
@@ -565,7 +563,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         ath9k_hw_init_cal_settings(ah);
 
         ah->ani_function = ATH9K_ANI_ALL;
-        if (AR_SREV_9280_10_OR_LATER(ah) && !AR_SREV_9300_20_OR_LATER(ah))
+        if (AR_SREV_9280_20_OR_LATER(ah) && !AR_SREV_9300_20_OR_LATER(ah))
                 ah->ani_function &= ~ATH9K_ANI_NOISE_IMMUNITY_LEVEL;
         if (!AR_SREV_9300_20_OR_LATER(ah))
                 ah->ani_function &= ~ATH9K_ANI_MRC_CCK;
@@ -676,7 +674,6 @@ static void ath9k_hw_init_qos(struct ath_hw *ah)
         REG_WRITE(ah, AR_TXOP_12_15, 0xFFFFFFFF);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 static void ath9k_hw_init_pll(struct ath_hw *ah,
@@ -741,7 +738,6 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
         }
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         if (AR_SREV_9300_20_OR_LATER(ah)) {
                 REG_WRITE(ah, AR_INTR_PRIO_ASYNC_ENABLE, 0);
@@ -885,7 +881,6 @@ static inline void ath9k_hw_set_dma(struct ath_hw *ah)
         REG_WRITE(ah, AR_TXCFG, regval | AR_TXCFG_DMASZ_128B);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         /*
          * Restore TX Trigger Level to its pre-reset value.
@@ -933,7 +928,6 @@ static inline void ath9k_hw_set_dma(struct ath_hw *ah)
         }
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         if (AR_SREV_9300_20_OR_LATER(ah))
                 ath9k_hw_reset_txstatus_ring(ah);
@@ -1031,7 +1025,6 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
         REG_WRITE(ah, AR_RTC_RC, rst_flags);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         udelay(50);
 
@@ -1070,7 +1063,6 @@ static bool ath9k_hw_set_reset_power_on(struct ath_hw *ah)
         udelay(2);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         if (!AR_SREV_9300_20_OR_LATER(ah))
                 udelay(2);
@@ -1167,6 +1159,7 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
                           "Failed to set channel\n");
                 return false;
         }
+        ath9k_hw_set_clockrate(ah);
 
         ah->eep_ops->set_txpower(ah, chan,
                              ath9k_regd_get_ctl(regulatory, chan),
@@ -1190,7 +1183,7 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
         int count = 50;
         u32 reg;
 
-        if (AR_SREV_9285_10_OR_LATER(ah))
+        if (AR_SREV_9285_12_OR_LATER(ah))
                 return true;
 
         do {
@@ -1239,7 +1232,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
                 return -EIO;
 
-        if (curchan && !ah->chip_fullsleep && ah->caldata)
+        if (curchan && !ah->chip_fullsleep)
                 ath9k_hw_getnf(ah, curchan);
 
         ah->caldata = caldata;
@@ -1258,11 +1251,13 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
             (chan->channel != ah->curchan->channel) &&
             ((chan->channelFlags & CHANNEL_ALL) ==
              (ah->curchan->channelFlags & CHANNEL_ALL)) &&
-            !AR_SREV_9280(ah)) {
+            (!AR_SREV_9280(ah) || AR_DEVID_7010(ah))) {
 
                 if (ath9k_hw_channel_change(ah, chan)) {
                         ath9k_hw_loadnf(ah, ah->curchan);
                         ath9k_hw_start_nfcal(ah, true);
+                        if (AR_SREV_9271(ah))
+                                ar9002_hw_load_ani_reg(ah, chan);
                         return 0;
                 }
         }
@@ -1310,7 +1305,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (tsf)
                 ath9k_hw_settsf64(ah, tsf);
 
-        if (AR_SREV_9280_10_OR_LATER(ah))
+        if (AR_SREV_9280_20_OR_LATER(ah))
                 REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL, AR_GPIO_JTAG_DISABLE);
 
         if (!AR_SREV_9300_20_OR_LATER(ah))
@@ -1372,19 +1367,19 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         REG_WRITE(ah, AR_RSSI_THR, INIT_RSSI_THR);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         r = ath9k_hw_rf_set_freq(ah, chan);
         if (r)
                 return r;
 
+        ath9k_hw_set_clockrate(ah);
+
         ENABLE_REGWRITE_BUFFER(ah);
 
         for (i = 0; i < AR_NUM_DCU; i++)
                 REG_WRITE(ah, AR_DQCUMASK(i), 1 << i);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         ah->intr_txqs = 0;
         for (i = 0; i < ah->caps.total_queues; i++)
@@ -1432,7 +1427,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         REG_WRITE(ah, AR_CFG_LED, saveLedState | AR_CFG_SCLK_32KHZ);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         /*
          * For big endian systems turn on swapping for descriptors
@@ -1474,283 +1468,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 }
 EXPORT_SYMBOL(ath9k_hw_reset);
 
-/************************/
-/* Key Cache Management */
-/************************/
-
-bool ath9k_hw_keyreset(struct ath_hw *ah, u16 entry)
-{
-        u32 keyType;
-
-        if (entry >= ah->caps.keycache_size) {
-                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
-                          "keychache entry %u out of range\n", entry);
-                return false;
-        }
-
-        keyType = REG_READ(ah, AR_KEYTABLE_TYPE(entry));
-
-        REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), 0);
-        REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), 0);
-        REG_WRITE(ah, AR_KEYTABLE_KEY2(entry), 0);
-        REG_WRITE(ah, AR_KEYTABLE_KEY3(entry), 0);
-        REG_WRITE(ah, AR_KEYTABLE_KEY4(entry), 0);
-        REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), AR_KEYTABLE_TYPE_CLR);
-        REG_WRITE(ah, AR_KEYTABLE_MAC0(entry), 0);
-        REG_WRITE(ah, AR_KEYTABLE_MAC1(entry), 0);
-
-        if (keyType == AR_KEYTABLE_TYPE_TKIP && ATH9K_IS_MIC_ENABLED(ah)) {
-                u16 micentry = entry + 64;
-
-                REG_WRITE(ah, AR_KEYTABLE_KEY0(micentry), 0);
-                REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), 0);
-                REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), 0);
-                REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), 0);
-
-        }
-
-        return true;
-}
-EXPORT_SYMBOL(ath9k_hw_keyreset);
-
-static bool ath9k_hw_keysetmac(struct ath_hw *ah, u16 entry, const u8 *mac)
-{
-        u32 macHi, macLo;
-        u32 unicast_flag = AR_KEYTABLE_VALID;
-
-        if (entry >= ah->caps.keycache_size) {
-                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
-                          "keychache entry %u out of range\n", entry);
-                return false;
-        }
-
-        if (mac != NULL) {
-                /*
-                 * AR_KEYTABLE_VALID indicates that the address is a unicast
-                 * address, which must match the transmitter address for
-                 * decrypting frames.
-                 * Not setting this bit allows the hardware to use the key
-                 * for multicast frame decryption.
-                 */
-                if (mac[0] & 0x01)
-                        unicast_flag = 0;
-
-                macHi = (mac[5] << 8) | mac[4];
-                macLo = (mac[3] << 24) |
-                        (mac[2] << 16) |
-                        (mac[1] << 8) |
-                        mac[0];
-                macLo >>= 1;
-                macLo |= (macHi & 1) << 31;
-                macHi >>= 1;
-        } else {
-                macLo = macHi = 0;
-        }
-        REG_WRITE(ah, AR_KEYTABLE_MAC0(entry), macLo);
-        REG_WRITE(ah, AR_KEYTABLE_MAC1(entry), macHi | unicast_flag);
-
-        return true;
-}
-
-bool ath9k_hw_set_keycache_entry(struct ath_hw *ah, u16 entry,
-                                 const struct ath9k_keyval *k,
-                                 const u8 *mac)
-{
-        const struct ath9k_hw_capabilities *pCap = &ah->caps;
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 key0, key1, key2, key3, key4;
-        u32 keyType;
-
-        if (entry >= pCap->keycache_size) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "keycache entry %u out of range\n", entry);
-                return false;
-        }
-
-        switch (k->kv_type) {
-        case ATH9K_CIPHER_AES_OCB:
-                keyType = AR_KEYTABLE_TYPE_AES;
-                break;
-        case ATH9K_CIPHER_AES_CCM:
-                if (!(pCap->hw_caps & ATH9K_HW_CAP_CIPHER_AESCCM)) {
-                        ath_print(common, ATH_DBG_ANY,
-                                  "AES-CCM not supported by mac rev 0x%x\n",
-                                  ah->hw_version.macRev);
-                        return false;
-                }
-                keyType = AR_KEYTABLE_TYPE_CCM;
-                break;
-        case ATH9K_CIPHER_TKIP:
-                keyType = AR_KEYTABLE_TYPE_TKIP;
-                if (ATH9K_IS_MIC_ENABLED(ah)
-                    && entry + 64 >= pCap->keycache_size) {
-                        ath_print(common, ATH_DBG_ANY,
-                                  "entry %u inappropriate for TKIP\n", entry);
-                        return false;
-                }
-                break;
-        case ATH9K_CIPHER_WEP:
-                if (k->kv_len < WLAN_KEY_LEN_WEP40) {
-                        ath_print(common, ATH_DBG_ANY,
-                                  "WEP key length %u too small\n", k->kv_len);
-                        return false;
-                }
-                if (k->kv_len <= WLAN_KEY_LEN_WEP40)
-                        keyType = AR_KEYTABLE_TYPE_40;
-                else if (k->kv_len <= WLAN_KEY_LEN_WEP104)
-                        keyType = AR_KEYTABLE_TYPE_104;
-                else
-                        keyType = AR_KEYTABLE_TYPE_128;
-                break;
-        case ATH9K_CIPHER_CLR:
-                keyType = AR_KEYTABLE_TYPE_CLR;
-                break;
-        default:
-                ath_print(common, ATH_DBG_FATAL,
-                          "cipher %u not supported\n", k->kv_type);
-                return false;
-        }
-
-        key0 = get_unaligned_le32(k->kv_val + 0);
-        key1 = get_unaligned_le16(k->kv_val + 4);
-        key2 = get_unaligned_le32(k->kv_val + 6);
-        key3 = get_unaligned_le16(k->kv_val + 10);
-        key4 = get_unaligned_le32(k->kv_val + 12);
-        if (k->kv_len <= WLAN_KEY_LEN_WEP104)
-                key4 &= 0xff;
-
-        /*
-         * Note: Key cache registers access special memory area that requires
-         * two 32-bit writes to actually update the values in the internal
-         * memory. Consequently, the exact order and pairs used here must be
-         * maintained.
-         */
-
-        if (keyType == AR_KEYTABLE_TYPE_TKIP && ATH9K_IS_MIC_ENABLED(ah)) {
-                u16 micentry = entry + 64;
-
-                /*
-                 * Write inverted key[47:0] first to avoid Michael MIC errors
-                 * on frames that could be sent or received at the same time.
-                 * The correct key will be written in the end once everything
-                 * else is ready.
-                 */
-                REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), ~key0);
-                REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), ~key1);
-
-                /* Write key[95:48] */
-                REG_WRITE(ah, AR_KEYTABLE_KEY2(entry), key2);
-                REG_WRITE(ah, AR_KEYTABLE_KEY3(entry), key3);
-
-                /* Write key[127:96] and key type */
-                REG_WRITE(ah, AR_KEYTABLE_KEY4(entry), key4);
-                REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), keyType);
-
-                /* Write MAC address for the entry */
-                (void) ath9k_hw_keysetmac(ah, entry, mac);
-
-                if (ah->misc_mode & AR_PCU_MIC_NEW_LOC_ENA) {
-                        /*
-                         * TKIP uses two key cache entries:
-                         * Michael MIC TX/RX keys in the same key cache entry
-                         * (idx = main index + 64):
-                         * key0 [31:0] = RX key [31:0]
-                         * key1 [15:0] = TX key [31:16]
-                         * key1 [31:16] = reserved
-                         * key2 [31:0] = RX key [63:32]
-                         * key3 [15:0] = TX key [15:0]
-                         * key3 [31:16] = reserved
-                         * key4 [31:0] = TX key [63:32]
-                         */
-                        u32 mic0, mic1, mic2, mic3, mic4;
-
-                        mic0 = get_unaligned_le32(k->kv_mic + 0);
-                        mic2 = get_unaligned_le32(k->kv_mic + 4);
-                        mic1 = get_unaligned_le16(k->kv_txmic + 2) & 0xffff;
-                        mic3 = get_unaligned_le16(k->kv_txmic + 0) & 0xffff;
-                        mic4 = get_unaligned_le32(k->kv_txmic + 4);
-
-                        /* Write RX[31:0] and TX[31:16] */
-                        REG_WRITE(ah, AR_KEYTABLE_KEY0(micentry), mic0);
-                        REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), mic1);
-
-                        /* Write RX[63:32] and TX[15:0] */
-                        REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), mic2);
-                        REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), mic3);
-
-                        /* Write TX[63:32] and keyType(reserved) */
-                        REG_WRITE(ah, AR_KEYTABLE_KEY4(micentry), mic4);
-                        REG_WRITE(ah, AR_KEYTABLE_TYPE(micentry),
-                                  AR_KEYTABLE_TYPE_CLR);
-
-                } else {
-                        /*
-                         * TKIP uses four key cache entries (two for group
-                         * keys):
-                         * Michael MIC TX/RX keys are in different key cache
-                         * entries (idx = main index + 64 for TX and
-                         * main index + 32 + 96 for RX):
-                         * key0 [31:0] = TX/RX MIC key [31:0]
-                         * key1 [31:0] = reserved
-                         * key2 [31:0] = TX/RX MIC key [63:32]
-                         * key3 [31:0] = reserved
-                         * key4 [31:0] = reserved
-                         *
-                         * Upper layer code will call this function separately
-                         * for TX and RX keys when these registers offsets are
-                         * used.
-                         */
-                        u32 mic0, mic2;
-
-                        mic0 = get_unaligned_le32(k->kv_mic + 0);
-                        mic2 = get_unaligned_le32(k->kv_mic + 4);
-
-                        /* Write MIC key[31:0] */
-                        REG_WRITE(ah, AR_KEYTABLE_KEY0(micentry), mic0);
-                        REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), 0);
-
-                        /* Write MIC key[63:32] */
-                        REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), mic2);
-                        REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), 0);
-
-                        /* Write TX[63:32] and keyType(reserved) */
-                        REG_WRITE(ah, AR_KEYTABLE_KEY4(micentry), 0);
-                        REG_WRITE(ah, AR_KEYTABLE_TYPE(micentry),
-                                  AR_KEYTABLE_TYPE_CLR);
-                }
-
-                /* MAC address registers are reserved for the MIC entry */
-                REG_WRITE(ah, AR_KEYTABLE_MAC0(micentry), 0);
-                REG_WRITE(ah, AR_KEYTABLE_MAC1(micentry), 0);
-
-                /*
-                 * Write the correct (un-inverted) key[47:0] last to enable
-                 * TKIP now that all other registers are set with correct
-                 * values.
-                 */
-                REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), key0);
-                REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), key1);
-        } else {
-                /* Write key[47:0] */
-                REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), key0);
-                REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), key1);
-
-                /* Write key[95:48] */
-                REG_WRITE(ah, AR_KEYTABLE_KEY2(entry), key2);
-                REG_WRITE(ah, AR_KEYTABLE_KEY3(entry), key3);
-
-                /* Write key[127:96] and key type */
-                REG_WRITE(ah, AR_KEYTABLE_KEY4(entry), key4);
-                REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), keyType);
-
-                /* Write MAC address for the entry */
-                (void) ath9k_hw_keysetmac(ah, entry, mac);
-        }
-
-        return true;
-}
-EXPORT_SYMBOL(ath9k_hw_set_keycache_entry);
-
 /******************************/
 /* Power Management (Chipset) */
 /******************************/
@@ -1959,7 +1676,6 @@ void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period)
         REG_WRITE(ah, AR_NDP_PERIOD, TU_TO_USEC(beacon_period));
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         beacon_period &= ~ATH9K_BEACON_ENA;
         if (beacon_period & ATH9K_BEACON_RESET_TSF) {
@@ -1987,7 +1703,6 @@ void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
                   TU_TO_USEC(bs->bs_intval & ATH9K_BEACON_PERIOD));
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         REG_RMW_FIELD(ah, AR_RSSI_THR,
                       AR_RSSI_THR_BM_THR, bs->bs_bmissthreshold);
@@ -2033,7 +1748,6 @@ void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
         REG_WRITE(ah, AR_DTIM_PERIOD, TU_TO_USEC(dtimperiod));
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         REG_SET_BIT(ah, AR_TIMER_MODE,
                     AR_TBTT_TIMER_EN | AR_TIM_TIMER_EN |
@@ -2056,12 +1770,13 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         struct ath_btcoex_hw *btcoex_hw = &ah->btcoex_hw;
 
         u16 capField = 0, eeval;
+        u8 ant_div_ctl1;
 
         eeval = ah->eep_ops->get_eeprom(ah, EEP_REG_0);
         regulatory->current_rd = eeval;
 
         eeval = ah->eep_ops->get_eeprom(ah, EEP_REG_1);
-        if (AR_SREV_9285_10_OR_LATER(ah))
+        if (AR_SREV_9285_12_OR_LATER(ah))
                 eeval |= AR9285_RDEXT_DEFAULT;
         regulatory->current_rd_ext = eeval;
 
@@ -2085,37 +1800,11 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 return -EINVAL;
         }
 
-        bitmap_zero(pCap->wireless_modes, ATH9K_MODE_MAX);
+        if (eeval & AR5416_OPFLAGS_11A)
+                pCap->hw_caps |= ATH9K_HW_CAP_5GHZ;
 
-        if (eeval & AR5416_OPFLAGS_11A) {
-                set_bit(ATH9K_MODE_11A, pCap->wireless_modes);
-                if (ah->config.ht_enable) {
-                        if (!(eeval & AR5416_OPFLAGS_N_5G_HT20))
-                                set_bit(ATH9K_MODE_11NA_HT20,
-                                        pCap->wireless_modes);
-                        if (!(eeval & AR5416_OPFLAGS_N_5G_HT40)) {
-                                set_bit(ATH9K_MODE_11NA_HT40PLUS,
-                                        pCap->wireless_modes);
-                                set_bit(ATH9K_MODE_11NA_HT40MINUS,
-                                        pCap->wireless_modes);
-                        }
-                }
-        }
-
-        if (eeval & AR5416_OPFLAGS_11G) {
-                set_bit(ATH9K_MODE_11G, pCap->wireless_modes);
-                if (ah->config.ht_enable) {
-                        if (!(eeval & AR5416_OPFLAGS_N_2G_HT20))
-                                set_bit(ATH9K_MODE_11NG_HT20,
-                                        pCap->wireless_modes);
-                        if (!(eeval & AR5416_OPFLAGS_N_2G_HT40)) {
-                                set_bit(ATH9K_MODE_11NG_HT40PLUS,
-                                        pCap->wireless_modes);
-                                set_bit(ATH9K_MODE_11NG_HT40MINUS,
-                                        pCap->wireless_modes);
-                        }
-                }
-        }
+        if (eeval & AR5416_OPFLAGS_11G)
+                pCap->hw_caps |= ATH9K_HW_CAP_2GHZ;
 
         pCap->tx_chainmask = ah->eep_ops->get_eeprom(ah, EEP_TX_MASK);
         /*
@@ -2131,8 +1820,7 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 /* Use rx_chainmask from EEPROM. */
                 pCap->rx_chainmask = ah->eep_ops->get_eeprom(ah, EEP_RX_MASK);
 
-        if (!(AR_SREV_9280(ah) && (ah->hw_version.macRev == 0)))
-                ah->misc_mode |= AR_PCU_MIC_NEW_LOC_ENA;
+        ah->misc_mode |= AR_PCU_MIC_NEW_LOC_ENA;
 
         pCap->low_2ghz_chan = 2312;
         pCap->high_2ghz_chan = 2732;
@@ -2140,24 +1828,13 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         pCap->low_5ghz_chan = 4920;
         pCap->high_5ghz_chan = 6100;
 
-        pCap->hw_caps &= ~ATH9K_HW_CAP_CIPHER_CKIP;
-        pCap->hw_caps |= ATH9K_HW_CAP_CIPHER_TKIP;
-        pCap->hw_caps |= ATH9K_HW_CAP_CIPHER_AESCCM;
-
-        pCap->hw_caps &= ~ATH9K_HW_CAP_MIC_CKIP;
-        pCap->hw_caps |= ATH9K_HW_CAP_MIC_TKIP;
-        pCap->hw_caps |= ATH9K_HW_CAP_MIC_AESCCM;
+        common->crypt_caps |= ATH_CRYPT_CAP_CIPHER_AESCCM;
 
         if (ah->config.ht_enable)
                 pCap->hw_caps |= ATH9K_HW_CAP_HT;
         else
                 pCap->hw_caps &= ~ATH9K_HW_CAP_HT;
 
-        pCap->hw_caps |= ATH9K_HW_CAP_GTT;
-        pCap->hw_caps |= ATH9K_HW_CAP_VEOL;
-        pCap->hw_caps |= ATH9K_HW_CAP_BSSIDMASK;
-        pCap->hw_caps &= ~ATH9K_HW_CAP_MCAST_KEYSEARCH;
-
         if (capField & AR_EEPROM_EEPCAP_MAXQCU)
                 pCap->total_queues =
                         MS(capField, AR_EEPROM_EEPCAP_MAXQCU);
@@ -2170,8 +1847,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         else
                 pCap->keycache_size = AR_KEYTABLE_SIZE;
 
-        pCap->hw_caps |= ATH9K_HW_CAP_FASTCC;
-
         if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
                 pCap->tx_triglevel_max = MAX_TX_FIFO_THRESHOLD >> 1;
         else
@@ -2181,9 +1856,9 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->num_gpio_pins = AR9271_NUM_GPIO;
         else if (AR_DEVID_7010(ah))
                 pCap->num_gpio_pins = AR7010_NUM_GPIO;
-        else if (AR_SREV_9285_10_OR_LATER(ah))
+        else if (AR_SREV_9285_12_OR_LATER(ah))
                 pCap->num_gpio_pins = AR9285_NUM_GPIO;
-        else if (AR_SREV_9280_10_OR_LATER(ah))
+        else if (AR_SREV_9280_20_OR_LATER(ah))
                 pCap->num_gpio_pins = AR928X_NUM_GPIO;
         else
                 pCap->num_gpio_pins = AR_NUM_GPIO;
@@ -2240,7 +1915,7 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         pCap->num_antcfg_2ghz =
                 ah->eep_ops->get_num_ant_config(ah, ATH9K_HAL_FREQ_BAND_2GHZ);
 
-        if (AR_SREV_9280_10_OR_LATER(ah) &&
+        if (AR_SREV_9280_20_OR_LATER(ah) &&
             ath9k_hw_btcoex_supported(ah)) {
                 btcoex_hw->btactive_gpio = ATH_BTACTIVE_GPIO;
                 btcoex_hw->wlanactive_gpio = ATH_WLANACTIVE_GPIO;
@@ -2277,9 +1952,17 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         if (AR_SREV_9300_20_OR_LATER(ah))
                 pCap->hw_caps |= ATH9K_HW_CAP_RAC_SUPPORTED;
 
-        if (AR_SREV_9287_10_OR_LATER(ah) || AR_SREV_9271(ah))
+        if (AR_SREV_9287_11_OR_LATER(ah) || AR_SREV_9271(ah))
                 pCap->hw_caps |= ATH9K_HW_CAP_SGI_20;
 
+        if (AR_SREV_9285(ah))
+                if (ah->eep_ops->get_eeprom(ah, EEP_MODAL_VER) >= 3) {
+                        ant_div_ctl1 =
+                                ah->eep_ops->get_eeprom(ah, EEP_ANT_DIV_CTL1);
+                        if ((ant_div_ctl1 & 0x1) && ((ant_div_ctl1 >> 3) & 0x1))
+                                pCap->hw_caps |= ATH9K_HW_CAP_ANT_DIV_COMB;
+                }
+
         return 0;
 }
 
@@ -2353,11 +2036,11 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio)
                 return MS_REG_READ(AR9300, gpio) != 0;
         else if (AR_SREV_9271(ah))
                 return MS_REG_READ(AR9271, gpio) != 0;
-        else if (AR_SREV_9287_10_OR_LATER(ah))
+        else if (AR_SREV_9287_11_OR_LATER(ah))
                 return MS_REG_READ(AR9287, gpio) != 0;
-        else if (AR_SREV_9285_10_OR_LATER(ah))
+        else if (AR_SREV_9285_12_OR_LATER(ah))
                 return MS_REG_READ(AR9285, gpio) != 0;
-        else if (AR_SREV_9280_10_OR_LATER(ah))
+        else if (AR_SREV_9280_20_OR_LATER(ah))
                 return MS_REG_READ(AR928X, gpio) != 0;
         else
                 return MS_REG_READ(AR, gpio) != 0;
@@ -2456,7 +2139,6 @@ void ath9k_hw_setrxfilter(struct ath_hw *ah, u32 bits)
                           REG_READ(ah, AR_RXCFG) & ~AR_RXCFG_ZLFDMA);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 }
 EXPORT_SYMBOL(ath9k_hw_setrxfilter);
 
@@ -2854,7 +2536,7 @@ void ath9k_hw_name(struct ath_hw *ah, char *hw_name, size_t len)
         int used;
 
         /* chipsets >= AR9280 are single-chip */
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
                 used = snprintf(hw_name, len,
                                "Atheros AR%s Rev:%x",
                                ath9k_hw_mac_bb_name(ah->hw_version.macVersion),
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 1601dd439890..d032939768b0 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -61,6 +61,8 @@
 
 #define ATH9K_RSSI_BAD                  -128
 
+#define ATH9K_NUM_CHANNELS      38
+
 /* Register read/write primitives */
 #define REG_WRITE(_ah, _reg, _val) \
         ath9k_hw_common(_ah)->ops->write((_ah), (_val), (_reg))
@@ -70,19 +72,13 @@
 
 #define ENABLE_REGWRITE_BUFFER(_ah)                                     \
         do {                                                            \
-                if (AR_SREV_9271(_ah))                                  \
+                if (ath9k_hw_common(_ah)->ops->enable_write_buffer)     \
                         ath9k_hw_common(_ah)->ops->enable_write_buffer((_ah)); \
         } while (0)
 
-#define DISABLE_REGWRITE_BUFFER(_ah)                                    \
-        do {                                                            \
-                if (AR_SREV_9271(_ah))                                  \
-                        ath9k_hw_common(_ah)->ops->disable_write_buffer((_ah)); \
-        } while (0)
-
 #define REGWRITE_BUFFER_FLUSH(_ah)                                      \
         do {                                                            \
-                if (AR_SREV_9271(_ah))                                  \
+                if (ath9k_hw_common(_ah)->ops->write_flush)             \
                         ath9k_hw_common(_ah)->ops->write_flush((_ah));  \
         } while (0)
 
@@ -168,47 +164,26 @@ enum ath_ini_subsys {
         ATH_INI_NUM_SPLIT,
 };
 
-enum wireless_mode {
-        ATH9K_MODE_11A = 0,
-        ATH9K_MODE_11G,
-        ATH9K_MODE_11NA_HT20,
-        ATH9K_MODE_11NG_HT20,
-        ATH9K_MODE_11NA_HT40PLUS,
-        ATH9K_MODE_11NA_HT40MINUS,
-        ATH9K_MODE_11NG_HT40PLUS,
-        ATH9K_MODE_11NG_HT40MINUS,
-        ATH9K_MODE_MAX,
-};
-
 enum ath9k_hw_caps {
-        ATH9K_HW_CAP_MIC_AESCCM                 = BIT(0),
-        ATH9K_HW_CAP_MIC_CKIP                   = BIT(1),
-        ATH9K_HW_CAP_MIC_TKIP                   = BIT(2),
-        ATH9K_HW_CAP_CIPHER_AESCCM              = BIT(3),
-        ATH9K_HW_CAP_CIPHER_CKIP                = BIT(4),
-        ATH9K_HW_CAP_CIPHER_TKIP                = BIT(5),
-        ATH9K_HW_CAP_VEOL                       = BIT(6),
-        ATH9K_HW_CAP_BSSIDMASK                  = BIT(7),
-        ATH9K_HW_CAP_MCAST_KEYSEARCH            = BIT(8),
-        ATH9K_HW_CAP_HT                         = BIT(9),
-        ATH9K_HW_CAP_GTT                        = BIT(10),
-        ATH9K_HW_CAP_FASTCC                     = BIT(11),
-        ATH9K_HW_CAP_RFSILENT                   = BIT(12),
-        ATH9K_HW_CAP_CST                        = BIT(13),
-        ATH9K_HW_CAP_ENHANCEDPM                 = BIT(14),
-        ATH9K_HW_CAP_AUTOSLEEP                  = BIT(15),
-        ATH9K_HW_CAP_4KB_SPLITTRANS             = BIT(16),
-        ATH9K_HW_CAP_EDMA                       = BIT(17),
-        ATH9K_HW_CAP_RAC_SUPPORTED              = BIT(18),
-        ATH9K_HW_CAP_LDPC                       = BIT(19),
-        ATH9K_HW_CAP_FASTCLOCK                  = BIT(20),
-        ATH9K_HW_CAP_SGI_20                     = BIT(21),
-        ATH9K_HW_CAP_PAPRD                      = BIT(22),
+        ATH9K_HW_CAP_HT                         = BIT(0),
+        ATH9K_HW_CAP_RFSILENT                   = BIT(1),
+        ATH9K_HW_CAP_CST                        = BIT(2),
+        ATH9K_HW_CAP_ENHANCEDPM                 = BIT(3),
+        ATH9K_HW_CAP_AUTOSLEEP                  = BIT(4),
+        ATH9K_HW_CAP_4KB_SPLITTRANS             = BIT(5),
+        ATH9K_HW_CAP_EDMA                       = BIT(6),
+        ATH9K_HW_CAP_RAC_SUPPORTED              = BIT(7),
+        ATH9K_HW_CAP_LDPC                       = BIT(8),
+        ATH9K_HW_CAP_FASTCLOCK                  = BIT(9),
+        ATH9K_HW_CAP_SGI_20                     = BIT(10),
+        ATH9K_HW_CAP_PAPRD                      = BIT(11),
+        ATH9K_HW_CAP_ANT_DIV_COMB               = BIT(12),
+        ATH9K_HW_CAP_2GHZ                       = BIT(13),
+        ATH9K_HW_CAP_5GHZ                       = BIT(14),
 };
 
 struct ath9k_hw_capabilities {
         u32 hw_caps; /* ATH9K_HW_CAP_* from ath9k_hw_caps */
-        DECLARE_BITMAP(wireless_modes, ATH9K_MODE_MAX); /* ATH9K_MODE_* */
         u16 total_queues;
         u16 keycache_size;
         u16 low_5ghz_chan, high_5ghz_chan;
@@ -352,7 +327,6 @@ struct ath9k_hw_cal_data {
         int32_t CalValid;
         int8_t iCoff;
         int8_t qCoff;
-        int16_t rawNoiseFloor;
         bool paprd_done;
         bool nfcal_pending;
         bool nfcal_interference;
@@ -363,9 +337,11 @@ struct ath9k_hw_cal_data {
 
 struct ath9k_channel {
         struct ieee80211_channel *chan;
+        struct ar5416AniState ani;
         u16 channel;
         u32 channelFlags;
         u32 chanmode;
+        s16 noisefloor;
 };
 
 #define IS_CHAN_G(_c) ((((_c)->channelFlags & (CHANNEL_G)) == CHANNEL_G) || \
@@ -495,6 +471,12 @@ struct ath_gen_timer_table {
         } timer_mask;
 };
 
+struct ath_hw_antcomb_conf {
+        u8 main_lna_conf;
+        u8 alt_lna_conf;
+        u8 fast_div_bias;
+};
+
 /**
  * struct ath_hw_private_ops - callbacks used internally by hardware code
  *
@@ -518,14 +500,6 @@ struct ath_gen_timer_table {
  * @setup_calibration: set up calibration
  * @iscal_supported: used to query if a type of calibration is supported
  *
- * @ani_reset: reset ANI parameters to default values
- * @ani_lower_immunity: lower the noise immunity level. The level controls
- *      the power-based packet detection on hardware. If a power jump is
- *      detected the adapter takes it as an indication that a packet has
- *      arrived. The level ranges from 0-5. Each level corresponds to a
- *      few dB more of noise immunity. If you have a strong time-varying
- *      interference that is causing false detections (OFDM timing errors or
- *      CCK timing errors) the level can be increased.
  * @ani_cache_ini_regs: cache the values for ANI from the initial
  *      register settings through the register initialization.
  */
@@ -539,8 +513,6 @@ struct ath_hw_private_ops {
         bool (*macversion_supported)(u32 macversion);
         void (*setup_calibration)(struct ath_hw *ah,
                                   struct ath9k_cal_list *currCal);
-        bool (*iscal_supported)(struct ath_hw *ah,
-                                enum ath9k_cal_types calType);
 
         /* PHY ops */
         int (*rf_set_freq)(struct ath_hw *ah,
@@ -572,8 +544,6 @@ struct ath_hw_private_ops {
         void (*do_getnf)(struct ath_hw *ah, int16_t nfarray[NUM_NF_READINGS]);
 
         /* ANI */
-        void (*ani_reset)(struct ath_hw *ah, bool is_scanning);
-        void (*ani_lower_immunity)(struct ath_hw *ah);
         void (*ani_cache_ini_regs)(struct ath_hw *ah);
 };
 
@@ -585,11 +555,6 @@ struct ath_hw_private_ops {
  *
  * @config_pci_powersave:
  * @calibrate: periodic calibration for NF, ANI, IQ, ADC gain, ADC-DC
- *
- * @ani_proc_mib_event: process MIB events, this would happen upon specific ANI
- *      thresholds being reached or having overflowed.
- * @ani_monitor: called periodically by the core driver to collect
- *      MIB stats and adjust ANI if specific thresholds have been reached.
  */
 struct ath_hw_ops {
         void (*config_pci_powersave)(struct ath_hw *ah,
@@ -630,9 +595,6 @@ struct ath_hw_ops {
                                      u32 burstDuration);
         void (*set11n_virtualmorefrag)(struct ath_hw *ah, void *ds,
                                        u32 vmf);
-
-        void (*ani_proc_mib_event)(struct ath_hw *ah);
-        void (*ani_monitor)(struct ath_hw *ah, struct ath9k_channel *chan);
 };
 
 struct ath_nf_limits {
@@ -647,7 +609,7 @@ struct ath_hw {
         struct ath9k_hw_version hw_version;
         struct ath9k_ops_config config;
         struct ath9k_hw_capabilities caps;
-        struct ath9k_channel channels[38];
+        struct ath9k_channel channels[ATH9K_NUM_CHANNELS];
         struct ath9k_channel *curchan;
 
         union {
@@ -693,10 +655,9 @@ struct ath_hw {
         u32 atim_window;
 
         /* Calibration */
-        enum ath9k_cal_types supp_cals;
+        u32 supp_cals;
         struct ath9k_cal_list iq_caldata;
         struct ath9k_cal_list adcgain_caldata;
-        struct ath9k_cal_list adcdc_calinitdata;
         struct ath9k_cal_list adcdc_caldata;
         struct ath9k_cal_list tempCompCalData;
         struct ath9k_cal_list *cal_list;
@@ -765,8 +726,6 @@ struct ath_hw {
         /* ANI */
         u32 proc_phyerr;
         u32 aniperiod;
-        struct ar5416AniState *curani;
-        struct ar5416AniState ani[255];
         int totalSizeDesired[5];
         int coarse_high[5];
         int coarse_low[5];
@@ -874,12 +833,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 int ath9k_hw_fill_cap_info(struct ath_hw *ah);
 u32 ath9k_regd_get_ctl(struct ath_regulatory *reg, struct ath9k_channel *chan);
 
-/* Key Cache Management */
-bool ath9k_hw_keyreset(struct ath_hw *ah, u16 entry);
-bool ath9k_hw_set_keycache_entry(struct ath_hw *ah, u16 entry,
-                                 const struct ath9k_keyval *k,
-                                 const u8 *mac);
-
 /* GPIO / RFKILL / Antennae */
 void ath9k_hw_cfg_gpio_input(struct ath_hw *ah, u32 gpio);
 u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio);
@@ -888,6 +841,10 @@ void ath9k_hw_cfg_output(struct ath_hw *ah, u32 gpio,
 void ath9k_hw_set_gpio(struct ath_hw *ah, u32 gpio, u32 val);
 u32 ath9k_hw_getdefantenna(struct ath_hw *ah);
 void ath9k_hw_setantenna(struct ath_hw *ah, u32 antenna);
+void ath9k_hw_antdiv_comb_conf_get(struct ath_hw *ah,
+                                   struct ath_hw_antcomb_conf *antconf);
+void ath9k_hw_antdiv_comb_conf_set(struct ath_hw *ah,
+                                   struct ath_hw_antcomb_conf *antconf);
 
 /* General Operation */
 bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val, u32 timeout);
@@ -985,6 +942,7 @@ void ar9003_hw_attach_calib_ops(struct ath_hw *ah);
 void ar9002_hw_attach_ops(struct ath_hw *ah);
 void ar9003_hw_attach_ops(struct ath_hw *ah);
 
+void ar9002_hw_load_ani_reg(struct ath_hw *ah, struct ath9k_channel *chan);
 /*
  * ANI work can be shared between all families but a next
  * generation implementation of ANI will be used only for AR9003 only
@@ -993,8 +951,9 @@ void ar9003_hw_attach_ops(struct ath_hw *ah);
  * older families (AR5008, AR9001, AR9002) by using modparam_force_new_ani.
  */
 extern int modparam_force_new_ani;
-void ath9k_hw_attach_ani_ops_old(struct ath_hw *ah);
-void ath9k_hw_attach_ani_ops_new(struct ath_hw *ah);
+void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning);
+void ath9k_hw_proc_mib_event(struct ath_hw *ah);
+void ath9k_hw_ani_monitor(struct ath_hw *ah, struct ath9k_channel *chan);
 
 #define ATH_PCIE_CAP_LINK_CTRL  0x70
 #define ATH_PCIE_CAP_LINK_L0S   1
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 3dbff8d07766..bc6c4df9712c 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -56,7 +56,7 @@ MODULE_PARM_DESC(blink, "Enable LED blink on activity");
  * on 5 MHz steps, we support the channels which we know
  * we have calibration data for all cards though to make
  * this static */
-static struct ieee80211_channel ath9k_2ghz_chantable[] = {
+static const struct ieee80211_channel ath9k_2ghz_chantable[] = {
         CHAN2G(2412, 0), /* Channel 1 */
         CHAN2G(2417, 1), /* Channel 2 */
         CHAN2G(2422, 2), /* Channel 3 */
@@ -77,7 +77,7 @@ static struct ieee80211_channel ath9k_2ghz_chantable[] = {
  * on 5 MHz steps, we support the channels which we know
  * we have calibration data for all cards though to make
  * this static */
-static struct ieee80211_channel ath9k_5ghz_chantable[] = {
+static const struct ieee80211_channel ath9k_5ghz_chantable[] = {
         /* _We_ call this UNII 1 */
         CHAN5G(5180, 14), /* Channel 36 */
         CHAN5G(5200, 15), /* Channel 40 */
@@ -211,7 +211,7 @@ static void setup_ht_cap(struct ath_softc *sc,
         else
                 max_streams = 2;
 
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
                 if (max_streams >= 2)
                         ht_info->cap |= IEEE80211_HT_CAP_TX_STBC;
                 ht_info->cap |= (1 << IEEE80211_HT_CAP_RX_STBC_SHIFT);
@@ -381,7 +381,7 @@ static void ath9k_init_crypto(struct ath_softc *sc)
          * reset the contents on initial power up.
          */
         for (i = 0; i < common->keymax; i++)
-                ath9k_hw_keyreset(sc->sc_ah, (u16) i);
+                ath_hw_keyreset(common, (u16) i);
 
         /*
          * Check whether the separate key cache entries
@@ -389,8 +389,8 @@ static void ath9k_init_crypto(struct ath_softc *sc)
          * With split mic keys the number of stations is limited
          * to 27 otherwise 59.
          */
-        if (!(sc->sc_ah->misc_mode & AR_PCU_MIC_NEW_LOC_ENA))
-                common->splitmic = 1;
+        if (sc->sc_ah->misc_mode & AR_PCU_MIC_NEW_LOC_ENA)
+                common->crypt_caps |= ATH_CRYPT_CAP_MIC_COMBINED;
 }
 
 static int ath9k_init_btcoex(struct ath_softc *sc)
@@ -477,10 +477,21 @@ err:
         return -EIO;
 }
 
-static void ath9k_init_channels_rates(struct ath_softc *sc)
+static int ath9k_init_channels_rates(struct ath_softc *sc)
 {
-        if (test_bit(ATH9K_MODE_11G, sc->sc_ah->caps.wireless_modes)) {
-                sc->sbands[IEEE80211_BAND_2GHZ].channels = ath9k_2ghz_chantable;
+        void *channels;
+
+        BUILD_BUG_ON(ARRAY_SIZE(ath9k_2ghz_chantable) +
+                     ARRAY_SIZE(ath9k_5ghz_chantable) !=
+                     ATH9K_NUM_CHANNELS);
+
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_2GHZ) {
+                channels = kmemdup(ath9k_2ghz_chantable,
+                        sizeof(ath9k_2ghz_chantable), GFP_KERNEL);
+                if (!channels)
+                    return -ENOMEM;
+
+                sc->sbands[IEEE80211_BAND_2GHZ].channels = channels;
                 sc->sbands[IEEE80211_BAND_2GHZ].band = IEEE80211_BAND_2GHZ;
                 sc->sbands[IEEE80211_BAND_2GHZ].n_channels =
                         ARRAY_SIZE(ath9k_2ghz_chantable);
@@ -489,8 +500,16 @@ static void ath9k_init_channels_rates(struct ath_softc *sc)
                         ARRAY_SIZE(ath9k_legacy_rates);
         }
 
-        if (test_bit(ATH9K_MODE_11A, sc->sc_ah->caps.wireless_modes)) {
-                sc->sbands[IEEE80211_BAND_5GHZ].channels = ath9k_5ghz_chantable;
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ) {
+                channels = kmemdup(ath9k_5ghz_chantable,
+                        sizeof(ath9k_5ghz_chantable), GFP_KERNEL);
+                if (!channels) {
+                        if (sc->sbands[IEEE80211_BAND_2GHZ].channels)
+                                kfree(sc->sbands[IEEE80211_BAND_2GHZ].channels);
+                        return -ENOMEM;
+                }
+
+                sc->sbands[IEEE80211_BAND_5GHZ].channels = channels;
                 sc->sbands[IEEE80211_BAND_5GHZ].band = IEEE80211_BAND_5GHZ;
                 sc->sbands[IEEE80211_BAND_5GHZ].n_channels =
                         ARRAY_SIZE(ath9k_5ghz_chantable);
@@ -499,6 +518,7 @@ static void ath9k_init_channels_rates(struct ath_softc *sc)
                 sc->sbands[IEEE80211_BAND_5GHZ].n_bitrates =
                         ARRAY_SIZE(ath9k_legacy_rates) - 4;
         }
+        return 0;
 }
 
 static void ath9k_init_misc(struct ath_softc *sc)
@@ -506,7 +526,6 @@ static void ath9k_init_misc(struct ath_softc *sc)
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         int i = 0;
 
-        common->ani.noise_floor = ATH_DEFAULT_NOISE_FLOOR;
         setup_timer(&common->ani.timer, ath_ani_calibrate, (unsigned long)sc);
 
         sc->config.txpowlimit = ATH_TXPOWER_MAX;
@@ -522,8 +541,7 @@ static void ath9k_init_misc(struct ath_softc *sc)
         ath9k_hw_set_diversity(sc->sc_ah, true);
         sc->rx.defant = ath9k_hw_getdefantenna(sc->sc_ah);
 
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
-                memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
+        memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
 
         sc->beacon.slottime = ATH9K_SLOT_TIME_9;
 
@@ -531,6 +549,9 @@ static void ath9k_init_misc(struct ath_softc *sc)
                 sc->beacon.bslot[i] = NULL;
                 sc->beacon.bslot_aphy[i] = NULL;
         }
+
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB)
+                sc->ant_comb.count = ATH_ANT_DIV_COMB_INIT_COUNT;
 }
 
 static int ath9k_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
@@ -593,8 +614,11 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
         if (ret)
                 goto err_btcoex;
 
+        ret = ath9k_init_channels_rates(sc);
+        if (ret)
+                goto err_btcoex;
+
         ath9k_init_crypto(sc);
-        ath9k_init_channels_rates(sc);
         ath9k_init_misc(sc);
 
         return 0;
@@ -637,11 +661,13 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
 
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_AP) |
+                BIT(NL80211_IFTYPE_WDS) |
                 BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC) |
                 BIT(NL80211_IFTYPE_MESH_POINT);
 
-        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+        if (AR_SREV_5416(sc->sc_ah))
+                hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
         hw->queues = 4;
         hw->max_rates = 4;
@@ -651,19 +677,21 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->sta_data_size = sizeof(struct ath_node);
         hw->vif_data_size = sizeof(struct ath_vif);
 
+#ifdef CONFIG_ATH9K_RATE_CONTROL
         hw->rate_control_algorithm = "ath9k_rate_control";
+#endif
 
-        if (test_bit(ATH9K_MODE_11G, sc->sc_ah->caps.wireless_modes))
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_2GHZ)
                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
                         &sc->sbands[IEEE80211_BAND_2GHZ];
-        if (test_bit(ATH9K_MODE_11A, sc->sc_ah->caps.wireless_modes))
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &sc->sbands[IEEE80211_BAND_5GHZ];
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
-                if (test_bit(ATH9K_MODE_11G, sc->sc_ah->caps.wireless_modes))
+                if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_2GHZ)
                         setup_ht_cap(sc, &sc->sbands[IEEE80211_BAND_2GHZ].ht_cap);
-                if (test_bit(ATH9K_MODE_11A, sc->sc_ah->caps.wireless_modes))
+                if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
                         setup_ht_cap(sc, &sc->sbands[IEEE80211_BAND_5GHZ].ht_cap);
         }
 
@@ -751,6 +779,12 @@ static void ath9k_deinit_softc(struct ath_softc *sc)
 {
         int i = 0;
 
+        if (sc->sbands[IEEE80211_BAND_2GHZ].channels)
+                kfree(sc->sbands[IEEE80211_BAND_2GHZ].channels);
+
+        if (sc->sbands[IEEE80211_BAND_5GHZ].channels)
+                kfree(sc->sbands[IEEE80211_BAND_5GHZ].channels);
+
         if ((sc->btcoex.no_stomp_timer) &&
             sc->sc_ah->btcoex_hw.scheme == ATH_BTCOEX_CFG_3WIRE)
                 ath_gen_timer_free(sc->sc_ah, sc->btcoex.no_stomp_timer);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 0b7d1253f0c0..8c13479b17cd 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -40,7 +40,6 @@ static void ath9k_hw_set_txq_interrupts(struct ath_hw *ah,
         REG_WRITE(ah, AR_IMR_S2, ah->imrs2_reg);
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 u32 ath9k_hw_gettxbuf(struct ath_hw *ah, u32 q)
@@ -492,8 +491,6 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
         REG_WRITE(ah, AR_DMISC(q),
                   AR_D_MISC_CW_BKOFF_EN | AR_D_MISC_FRAG_WAIT_EN | 0x2);
 
-        REGWRITE_BUFFER_FLUSH(ah);
-
         if (qi->tqi_cbrPeriod) {
                 REG_WRITE(ah, AR_QCBRCFG(q),
                           SM(qi->tqi_cbrPeriod, AR_Q_CBRCFG_INTERVAL) |
@@ -509,8 +506,6 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
                           AR_Q_RDYTIMECFG_EN);
         }
 
-        REGWRITE_BUFFER_FLUSH(ah);
-
         REG_WRITE(ah, AR_DCHNTIME(q),
                   SM(qi->tqi_burstTime, AR_D_CHNTIME_DUR) |
                   (qi->tqi_burstTime ? AR_D_CHNTIME_EN : 0));
@@ -530,7 +525,6 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
         }
 
         REGWRITE_BUFFER_FLUSH(ah);
-        DISABLE_REGWRITE_BUFFER(ah);
 
         if (qi->tqi_qflags & TXQ_FLAG_FRAG_BURST_BACKOFF_ENABLE) {
                 REG_WRITE(ah, AR_DMISC(q),
@@ -553,7 +547,6 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
                           | AR_D_MISC_POST_FR_BKOFF_DIS);
 
                 REGWRITE_BUFFER_FLUSH(ah);
-                DISABLE_REGWRITE_BUFFER(ah);
 
                 /*
                  * cwmin and cwmax should be 0 for beacon queue
@@ -585,7 +578,6 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
                              AR_D_MISC_ARB_LOCKOUT_CNTRL_S));
 
                 REGWRITE_BUFFER_FLUSH(ah);
-                DISABLE_REGWRITE_BUFFER(ah);
 
                 break;
         case ATH9K_TX_QUEUE_PSPOLL:
@@ -714,6 +706,8 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
                 else if ((ads.ds_rxstatus8 & AR_MichaelErr) &&
                          rs->rs_keyix != ATH9K_RXKEYIX_INVALID)
                         rs->rs_status |= ATH9K_RXERR_MIC;
+                else if (ads.ds_rxstatus8 & AR_KeyMiss)
+                        rs->rs_status |= ATH9K_RXERR_DECRYPT;
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 2633896d3998..7c1a34d64f6d 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -660,17 +660,6 @@ struct ath9k_11n_rate_series {
         u32 RateFlags;
 };
 
-struct ath9k_keyval {
-        u8 kv_type;
-        u8 kv_pad;
-        u16 kv_len;
-        u8 kv_val[16]; /* TK */
-        u8 kv_mic[8]; /* Michael MIC key */
-        u8 kv_txmic[8]; /* Michael MIC TX key (used only if the hardware
-                         * supports both MIC keys in the same key cache entry;
-                         * in that case, kv_mic is the RX key) */
-};
-
 enum ath9k_key_type {
         ATH9K_KEY_TYPE_CLEAR,
         ATH9K_KEY_TYPE_WEP,
@@ -678,16 +667,6 @@ enum ath9k_key_type {
         ATH9K_KEY_TYPE_TKIP,
 };
 
-enum ath9k_cipher {
-        ATH9K_CIPHER_WEP = 0,
-        ATH9K_CIPHER_AES_OCB = 1,
-        ATH9K_CIPHER_AES_CCM = 2,
-        ATH9K_CIPHER_CKIP = 3,
-        ATH9K_CIPHER_TKIP = 4,
-        ATH9K_CIPHER_CLR = 5,
-        ATH9K_CIPHER_MIC = 127
-};
-
 struct ath_hw;
 struct ath9k_channel;
 
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 1165f909ef04..3ff0e476c2b3 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -18,36 +18,6 @@
 #include "ath9k.h"
 #include "btcoex.h"
 
-static void ath_cache_conf_rate(struct ath_softc *sc,
-                                struct ieee80211_conf *conf)
-{
-        switch (conf->channel->band) {
-        case IEEE80211_BAND_2GHZ:
-                if (conf_is_ht20(conf))
-                        sc->cur_rate_mode = ATH9K_MODE_11NG_HT20;
-                else if (conf_is_ht40_minus(conf))
-                        sc->cur_rate_mode = ATH9K_MODE_11NG_HT40MINUS;
-                else if (conf_is_ht40_plus(conf))
-                        sc->cur_rate_mode = ATH9K_MODE_11NG_HT40PLUS;
-                else
-                        sc->cur_rate_mode = ATH9K_MODE_11G;
-                break;
-        case IEEE80211_BAND_5GHZ:
-                if (conf_is_ht20(conf))
-                        sc->cur_rate_mode = ATH9K_MODE_11NA_HT20;
-                else if (conf_is_ht40_minus(conf))
-                        sc->cur_rate_mode = ATH9K_MODE_11NA_HT40MINUS;
-                else if (conf_is_ht40_plus(conf))
-                        sc->cur_rate_mode = ATH9K_MODE_11NA_HT40PLUS;
-                else
-                        sc->cur_rate_mode = ATH9K_MODE_11A;
-                break;
-        default:
-                BUG_ON(1);
-                break;
-        }
-}
-
 static void ath_update_txpow(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
@@ -121,6 +91,7 @@ bool ath9k_setpower(struct ath_softc *sc, enum ath9k_power_mode mode)
 
 void ath9k_ps_wakeup(struct ath_softc *sc)
 {
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         unsigned long flags;
 
         spin_lock_irqsave(&sc->sc_pm_lock, flags);
@@ -129,18 +100,33 @@ void ath9k_ps_wakeup(struct ath_softc *sc)
 
         ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
 
+        /*
+         * While the hardware is asleep, the cycle counters contain no
+         * useful data. Better clear them now so that they don't mess up
+         * survey data results.
+         */
+        spin_lock(&common->cc_lock);
+        ath_hw_cycle_counters_update(common);
+        memset(&common->cc_survey, 0, sizeof(common->cc_survey));
+        spin_unlock(&common->cc_lock);
+
  unlock:
         spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 }
 
 void ath9k_ps_restore(struct ath_softc *sc)
 {
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         unsigned long flags;
 
         spin_lock_irqsave(&sc->sc_pm_lock, flags);
         if (--sc->ps_usecount != 0)
                 goto unlock;
 
+        spin_lock(&common->cc_lock);
+        ath_hw_cycle_counters_update(common);
+        spin_unlock(&common->cc_lock);
+
         if (sc->ps_idle)
                 ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
         else if (sc->ps_enabled &&
@@ -175,6 +161,45 @@ static void ath_start_ani(struct ath_common *common)
                         msecs_to_jiffies((u32)ah->config.ani_poll_interval));
 }
 
+static void ath_update_survey_nf(struct ath_softc *sc, int channel)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath9k_channel *chan = &ah->channels[channel];
+        struct survey_info *survey = &sc->survey[channel];
+
+        if (chan->noisefloor) {
+                survey->filled |= SURVEY_INFO_NOISE_DBM;
+                survey->noise = chan->noisefloor;
+        }
+}
+
+static void ath_update_survey_stats(struct ath_softc *sc)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        int pos = ah->curchan - &ah->channels[0];
+        struct survey_info *survey = &sc->survey[pos];
+        struct ath_cycle_counters *cc = &common->cc_survey;
+        unsigned int div = common->clockrate * 1000;
+
+        if (ah->power_mode == ATH9K_PM_AWAKE)
+                ath_hw_cycle_counters_update(common);
+
+        if (cc->cycles > 0) {
+                survey->filled |= SURVEY_INFO_CHANNEL_TIME |
+                        SURVEY_INFO_CHANNEL_TIME_BUSY |
+                        SURVEY_INFO_CHANNEL_TIME_RX |
+                        SURVEY_INFO_CHANNEL_TIME_TX;
+                survey->channel_time += cc->cycles / div;
+                survey->channel_time_busy += cc->rx_busy / div;
+                survey->channel_time_rx += cc->rx_frame / div;
+                survey->channel_time_tx += cc->tx_frame / div;
+        }
+        memset(cc, 0, sizeof(*cc));
+
+        ath_update_survey_nf(sc, pos);
+}
+
 /*
  * Set/change channels.  If the channel is really being changed, it's done
  * by reseting the chip.  To accomplish this we must first cleanup any pending
@@ -251,14 +276,13 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
                 goto ps_restore;
         }
 
-        ath_cache_conf_rate(sc, &hw->conf);
         ath_update_txpow(sc);
         ath9k_hw_set_interrupts(ah, ah->imask);
 
-        if (!(sc->sc_flags & (SC_OP_OFFCHANNEL | SC_OP_SCANNING))) {
-                ath_start_ani(common);
-                ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
+        if (!(sc->sc_flags & (SC_OP_OFFCHANNEL))) {
                 ath_beacon_config(sc, NULL);
+                ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
+                ath_start_ani(common);
         }
 
  ps_restore:
@@ -270,6 +294,7 @@ static void ath_paprd_activate(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath9k_hw_cal_data *caldata = ah->caldata;
+        struct ath_common *common = ath9k_hw_common(ah);
         int chain;
 
         if (!caldata || !caldata->paprd_done)
@@ -278,7 +303,7 @@ static void ath_paprd_activate(struct ath_softc *sc)
         ath9k_ps_wakeup(sc);
         ar9003_paprd_enable(ah, false);
         for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
-                if (!(ah->caps.tx_chainmask & BIT(chain)))
+                if (!(common->tx_chainmask & BIT(chain)))
                         continue;
 
                 ar9003_paprd_populate_single_table(ah, caldata, chain);
@@ -300,6 +325,7 @@ void ath_paprd_calibrate(struct work_struct *work)
         struct ieee80211_supported_band *sband = &sc->sbands[band];
         struct ath_tx_control txctl;
         struct ath9k_hw_cal_data *caldata = ah->caldata;
+        struct ath_common *common = ath9k_hw_common(ah);
         int qnum, ftype;
         int chain_ok = 0;
         int chain;
@@ -333,7 +359,7 @@ void ath_paprd_calibrate(struct work_struct *work)
         ath9k_ps_wakeup(sc);
         ar9003_paprd_init_table(ah);
         for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
-                if (!(ah->caps.tx_chainmask & BIT(chain)))
+                if (!(common->tx_chainmask & BIT(chain)))
                         continue;
 
                 chain_ok = 0;
@@ -397,6 +423,7 @@ void ath_ani_calibrate(unsigned long data)
         bool aniflag = false;
         unsigned int timestamp = jiffies_to_msecs(jiffies);
         u32 cal_interval, short_cal_interval, long_cal_interval;
+        unsigned long flags;
 
         if (ah->caldata && ah->caldata->nfcal_interference)
                 long_cal_interval = ATH_LONG_CALINTERVAL_INT;
@@ -447,8 +474,12 @@ void ath_ani_calibrate(unsigned long data)
         /* Skip all processing if there's nothing to do. */
         if (longcal || shortcal || aniflag) {
                 /* Call ANI routine if necessary */
-                if (aniflag)
+                if (aniflag) {
+                        spin_lock_irqsave(&common->cc_lock, flags);
                         ath9k_hw_ani_monitor(ah, ah->curchan);
+                        ath_update_survey_stats(sc);
+                        spin_unlock_irqrestore(&common->cc_lock, flags);
+                }
 
                 /* Perform calibration if necessary */
                 if (longcal || shortcal) {
@@ -457,16 +488,6 @@ void ath_ani_calibrate(unsigned long data)
                                                    ah->curchan,
                                                    common->rx_chainmask,
                                                    longcal);
-
-                        if (longcal)
-                                common->ani.noise_floor = ath9k_hw_getchan_noise(ah,
-                                                                     ah->curchan);
-
-                        ath_print(common, ATH_DBG_ANI,
-                                  " calibrate chan %u/%x nf: %d\n",
-                                  ah->curchan->channel,
-                                  ah->curchan->channelFlags,
-                                  common->ani.noise_floor);
                 }
         }
 
@@ -643,6 +664,7 @@ irqreturn_t ath_isr(int irq, void *dev)
 
         struct ath_softc *sc = dev;
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         enum ath9k_int status;
         bool sched = false;
 
@@ -692,7 +714,12 @@ irqreturn_t ath_isr(int irq, void *dev)
 
         if ((ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
             (status & ATH9K_INT_BB_WATCHDOG)) {
+
+                spin_lock(&common->cc_lock);
+                ath_hw_cycle_counters_update(common);
                 ar9003_hw_bb_watchdog_dbg_info(ah);
+                spin_unlock(&common->cc_lock);
+
                 goto chip_reset;
         }
 
@@ -721,7 +748,9 @@ irqreturn_t ath_isr(int irq, void *dev)
                  * it will clear whatever condition caused
                  * the interrupt.
                  */
-                ath9k_hw_procmibevent(ah);
+                spin_lock(&common->cc_lock);
+                ath9k_hw_proc_mib_event(ah);
+                spin_unlock(&common->cc_lock);
                 ath9k_hw_set_interrupts(ah, ah->imask);
         }
 
@@ -953,11 +982,9 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
          * that changes the channel so update any state that
          * might change as a result.
          */
-        ath_cache_conf_rate(sc, &hw->conf);
-
         ath_update_txpow(sc);
 
-        if (sc->sc_flags & SC_OP_BEACONS)
+        if ((sc->sc_flags & SC_OP_BEACONS) || !(sc->sc_flags & (SC_OP_OFFCHANNEL)))
                 ath_beacon_config(sc, NULL);    /* restart beacons */
 
         ath9k_hw_set_interrupts(ah, ah->imask);
@@ -1156,14 +1183,11 @@ static int ath9k_start(struct ieee80211_hw *hw)
         else
                 ah->imask |= ATH9K_INT_RX;
 
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_GTT)
-                ah->imask |= ATH9K_INT_GTT;
+        ah->imask |= ATH9K_INT_GTT;
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_HT)
                 ah->imask |= ATH9K_INT_CST;
 
-        ath_cache_conf_rate(sc, &hw->conf);
-
         sc->sc_flags &= ~SC_OP_INVALID;
 
         /* Disable BMISS interrupt when we're not associated */
@@ -1379,16 +1403,13 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&sc->mutex);
 
-        if (!(ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK) &&
-            sc->nvifs > 0) {
-                ret = -ENOBUFS;
-                goto out;
-        }
-
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 ic_opmode = NL80211_IFTYPE_STATION;
                 break;
+        case NL80211_IFTYPE_WDS:
+                ic_opmode = NL80211_IFTYPE_WDS;
+                break;
         case NL80211_IFTYPE_ADHOC:
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_MESH_POINT:
@@ -1414,8 +1435,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
 
         sc->nvifs++;
 
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
-                ath9k_set_bssid_mask(hw);
+        ath9k_set_bssid_mask(hw, vif);
 
         if (sc->nvifs > 1)
                 goto out; /* skip global settings for secondary vif */
@@ -1497,7 +1517,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
         mutex_unlock(&sc->mutex);
 }
 
-void ath9k_enable_ps(struct ath_softc *sc)
+static void ath9k_enable_ps(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
 
@@ -1511,13 +1531,33 @@ void ath9k_enable_ps(struct ath_softc *sc)
         }
 }
 
+static void ath9k_disable_ps(struct ath_softc *sc)
+{
+        struct ath_hw *ah = sc->sc_ah;
+
+        sc->ps_enabled = false;
+        ath9k_hw_setpower(ah, ATH9K_PM_AWAKE);
+        if (!(ah->caps.hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
+                ath9k_hw_setrxabort(ah, 0);
+                sc->ps_flags &= ~(PS_WAIT_FOR_BEACON |
+                                  PS_WAIT_FOR_CAB |
+                                  PS_WAIT_FOR_PSPOLL_DATA |
+                                  PS_WAIT_FOR_TX_ACK);
+                if (ah->imask & ATH9K_INT_TIM_TIMER) {
+                        ah->imask &= ~ATH9K_INT_TIM_TIMER;
+                        ath9k_hw_set_interrupts(ah, ah->imask);
+                }
+        }
+
+}
+
 static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ieee80211_conf *conf = &hw->conf;
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ieee80211_conf *conf = &hw->conf;
         bool disable_radio;
 
         mutex_lock(&sc->mutex);
@@ -1562,35 +1602,13 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
          * IEEE80211_CONF_CHANGE_PS is only passed by mac80211 for STA mode.
          */
         if (changed & IEEE80211_CONF_CHANGE_PS) {
-                if (conf->flags & IEEE80211_CONF_PS) {
-                        sc->ps_flags |= PS_ENABLED;
-                        /*
-                         * At this point we know hardware has received an ACK
-                         * of a previously sent null data frame.
-                         */
-                        if ((sc->ps_flags & PS_NULLFUNC_COMPLETED)) {
-                                sc->ps_flags &= ~PS_NULLFUNC_COMPLETED;
-                                ath9k_enable_ps(sc);
-                        }
-                } else {
-                        sc->ps_enabled = false;
-                        sc->ps_flags &= ~(PS_ENABLED |
-                                          PS_NULLFUNC_COMPLETED);
-                        ath9k_setpower(sc, ATH9K_PM_AWAKE);
-                        if (!(ah->caps.hw_caps &
-                              ATH9K_HW_CAP_AUTOSLEEP)) {
-                                ath9k_hw_setrxabort(sc->sc_ah, 0);
-                                sc->ps_flags &= ~(PS_WAIT_FOR_BEACON |
-                                                  PS_WAIT_FOR_CAB |
-                                                  PS_WAIT_FOR_PSPOLL_DATA |
-                                                  PS_WAIT_FOR_TX_ACK);
-                                if (ah->imask & ATH9K_INT_TIM_TIMER) {
-                                        ah->imask &= ~ATH9K_INT_TIM_TIMER;
-                                        ath9k_hw_set_interrupts(sc->sc_ah,
-                                                        ah->imask);
-                                }
-                        }
-                }
+                unsigned long flags;
+                spin_lock_irqsave(&sc->sc_pm_lock, flags);
+                if (conf->flags & IEEE80211_CONF_PS)
+                        ath9k_enable_ps(sc);
+                else
+                        ath9k_disable_ps(sc);
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
         }
 
         if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
@@ -1604,6 +1622,11 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
                 struct ieee80211_channel *curchan = hw->conf.channel;
                 int pos = curchan->hw_value;
+                int old_pos = -1;
+                unsigned long flags;
+
+                if (ah->curchan)
+                        old_pos = ah->curchan - &ah->channels[0];
 
                 aphy->chan_idx = pos;
                 aphy->chan_is_ht = conf_is_ht(conf);
@@ -1631,12 +1654,45 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
 
                 ath_update_chainmask(sc, conf_is_ht(conf));
 
+                /* update survey stats for the old channel before switching */
+                spin_lock_irqsave(&common->cc_lock, flags);
+                ath_update_survey_stats(sc);
+                spin_unlock_irqrestore(&common->cc_lock, flags);
+
+                /*
+                 * If the operating channel changes, change the survey in-use flags
+                 * along with it.
+                 * Reset the survey data for the new channel, unless we're switching
+                 * back to the operating channel from an off-channel operation.
+                 */
+                if (!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL) &&
+                    sc->cur_survey != &sc->survey[pos]) {
+
+                        if (sc->cur_survey)
+                                sc->cur_survey->filled &= ~SURVEY_INFO_IN_USE;
+
+                        sc->cur_survey = &sc->survey[pos];
+
+                        memset(sc->cur_survey, 0, sizeof(struct survey_info));
+                        sc->cur_survey->filled |= SURVEY_INFO_IN_USE;
+                } else if (!(sc->survey[pos].filled & SURVEY_INFO_IN_USE)) {
+                        memset(&sc->survey[pos], 0, sizeof(struct survey_info));
+                }
+
                 if (ath_set_channel(sc, hw, &sc->sc_ah->channels[pos]) < 0) {
                         ath_print(common, ATH_DBG_FATAL,
                                   "Unable to set channel\n");
                         mutex_unlock(&sc->mutex);
                         return -EINVAL;
                 }
+
+                /*
+                 * The most recent snapshot of channel->noisefloor for the old
+                 * channel is only available after the hardware reset. Copy it to
+                 * the survey stats now.
+                 */
+                if (old_pos >= 0)
+                        ath_update_survey_nf(sc, old_pos);
         }
 
 skip_chan_change:
@@ -1667,6 +1723,7 @@ skip_chan_change:
         FIF_PSPOLL |                            \
         FIF_OTHER_BSS |                         \
         FIF_BCN_PRBRESP_PROMISC |               \
+        FIF_PROBE_REQ |                         \
         FIF_FCSFAIL)
 
 /* FIXME: sc->sc_full_reset ? */
@@ -1777,7 +1834,7 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
 
         switch (cmd) {
         case SET_KEY:
-                ret = ath9k_cmn_key_config(common, vif, sta, key);
+                ret = ath_key_config(common, vif, sta, key);
                 if (ret >= 0) {
                         key->hw_key_idx = ret;
                         /* push IV and Michael MIC generation to stack */
@@ -1791,7 +1848,7 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
                 }
                 break;
         case DISABLE_KEY:
-                ath9k_cmn_key_delete(common, key);
+                ath_key_delete(common, key);
                 break;
         default:
                 ret = -EINVAL;
@@ -1975,8 +2032,9 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
                 break;
         case IEEE80211_AMPDU_TX_START:
                 ath9k_ps_wakeup(sc);
-                ath_tx_aggr_start(sc, sta, tid, ssn);
-                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                ret = ath_tx_aggr_start(sc, sta, tid, ssn);
+                if (!ret)
+                        ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 ath9k_ps_restore(sc);
                 break;
         case IEEE80211_AMPDU_TX_STOP:
@@ -2005,16 +2063,35 @@ static int ath9k_get_survey(struct ieee80211_hw *hw, int idx,
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        struct ieee80211_conf *conf = &hw->conf;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *chan;
+        unsigned long flags;
+        int pos;
 
-         if (idx != 0)
+        spin_lock_irqsave(&common->cc_lock, flags);
+        if (idx == 0)
+                ath_update_survey_stats(sc);
+
+        sband = hw->wiphy->bands[IEEE80211_BAND_2GHZ];
+        if (sband && idx >= sband->n_channels) {
+                idx -= sband->n_channels;
+                sband = NULL;
+        }
+
+        if (!sband)
+                sband = hw->wiphy->bands[IEEE80211_BAND_5GHZ];
+
+        if (!sband || idx >= sband->n_channels) {
+                spin_unlock_irqrestore(&common->cc_lock, flags);
                 return -ENOENT;
+        }
 
-        survey->channel = conf->channel;
-        survey->filled = SURVEY_INFO_NOISE_DBM;
-        survey->noise = common->ani.noise_floor;
+        chan = &sband->channels[idx];
+        pos = chan->hw_value;
+        memcpy(survey, &sc->survey[pos], sizeof(*survey));
+        survey->channel = chan;
+        spin_unlock_irqrestore(&common->cc_lock, flags);
 
         return 0;
 }
@@ -2039,7 +2116,6 @@ static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
 
         aphy->state = ATH_WIPHY_SCAN;
         ath9k_wiphy_pause_all_forced(sc, aphy);
-        sc->sc_flags |= SC_OP_SCANNING;
         mutex_unlock(&sc->mutex);
 }
 
@@ -2054,7 +2130,6 @@ static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
 
         mutex_lock(&sc->mutex);
         aphy->state = ATH_WIPHY_ACTIVE;
-        sc->sc_flags &= ~SC_OP_SCANNING;
         mutex_unlock(&sc->mutex);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/phy.h b/drivers/net/wireless/ath/ath9k/phy.h
index e724c2c1ae2a..17969af842f6 100644
--- a/drivers/net/wireless/ath/ath9k/phy.h
+++ b/drivers/net/wireless/ath/ath9k/phy.h
@@ -45,9 +45,6 @@
                 }                                                       \
         } while (0)
 
-#define ATH9K_IS_MIC_ENABLED(ah)                                        \
-        ((ah)->sta_id1_defaults & AR_STA_ID1_CRPT_MIC_ENABLE)
-
 #define ANTSWAP_AB 0x0001
 #define REDUCE_CHAIN_0 0x00000050
 #define REDUCE_CHAIN_1 0x00000051
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index e49be733d546..0cee90cf8dc9 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -302,7 +302,7 @@ static const struct ath_rate_table ar5416_11ng_ratetable = {
                 [64] = {  RC_INVALID, WLAN_RC_PHY_HT_40_TS, 243000,
                         205100, 20, 20, 8, 64, 65, 65 }, /* 243 Mb */
                 [65] = {  RC_INVALID, WLAN_RC_PHY_HT_40_TS_HGI, 270000,
-                        224700, 20, 20, 8, 64, 65, 65 }, /* 170 Mb */
+                        224700, 20, 20, 8, 64, 65, 65 }, /* 270 Mb */
                 [66] = {  RC_HT_T_40, WLAN_RC_PHY_HT_40_TS, 324000,
                         263100, 21, 21, 8, 66, 67, 67 }, /* 324 Mb */
                 [67] = {  RC_HT_T_40, WLAN_RC_PHY_HT_40_TS_HGI, 360000,
@@ -378,17 +378,6 @@ static const struct ath_rate_table ar5416_11g_ratetable = {
         0,   /* Phy rates allowed initially */
 };
 
-static const struct ath_rate_table *hw_rate_table[ATH9K_MODE_MAX] = {
-        [ATH9K_MODE_11A] = &ar5416_11a_ratetable,
-        [ATH9K_MODE_11G] = &ar5416_11g_ratetable,
-        [ATH9K_MODE_11NA_HT20] = &ar5416_11na_ratetable,
-        [ATH9K_MODE_11NG_HT20] = &ar5416_11ng_ratetable,
-        [ATH9K_MODE_11NA_HT40PLUS] = &ar5416_11na_ratetable,
-        [ATH9K_MODE_11NA_HT40MINUS] = &ar5416_11na_ratetable,
-        [ATH9K_MODE_11NG_HT40PLUS] = &ar5416_11ng_ratetable,
-        [ATH9K_MODE_11NG_HT40MINUS] = &ar5416_11ng_ratetable,
-};
-
 static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table,
                                 struct ieee80211_tx_rate *rate);
 
@@ -791,7 +780,7 @@ static void ath_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
          */
         try_per_rate = 4;
 
-        rate_table = sc->cur_rate_table;
+        rate_table = ath_rc_priv->rate_table;
         rix = ath_rc_get_highest_rix(sc, ath_rc_priv, rate_table, &is_probe);
 
         /*
@@ -1026,6 +1015,16 @@ static bool ath_rc_update_per(struct ath_softc *sc,
         return state_change;
 }
 
+static void ath_debug_stat_retries(struct ath_rate_priv *rc, int rix,
+                                   int xretries, int retries, u8 per)
+{
+        struct ath_rc_stats *stats = &rc->rcstats[rix];
+
+        stats->xretries += xretries;
+        stats->retries += retries;
+        stats->per = per;
+}
+
 /* Update PER, RSSI and whatever else that the code thinks it is doing.
    If you can make sense of all this, you really need to go out more. */
 
@@ -1038,7 +1037,7 @@ static void ath_rc_update_ht(struct ath_softc *sc,
         int rate;
         u8 last_per;
         bool state_change = false;
-        const struct ath_rate_table *rate_table = sc->cur_rate_table;
+        const struct ath_rate_table *rate_table = ath_rc_priv->rate_table;
         int size = ath_rc_priv->rate_table_size;
 
         if ((tx_rate < 0) || (tx_rate > rate_table->rate_cnt))
@@ -1098,7 +1097,7 @@ static void ath_rc_update_ht(struct ath_softc *sc,
                 ath_rc_priv->per_down_time = now_msec;
         }
 
-        ath_debug_stat_retries(sc, tx_rate, xretries, retries,
+        ath_debug_stat_retries(ath_rc_priv, tx_rate, xretries, retries,
                                ath_rc_priv->per[tx_rate]);
 
 }
@@ -1140,7 +1139,7 @@ static void ath_rc_tx_status(struct ath_softc *sc,
         u8 flags;
         u32 i = 0, rix;
 
-        rate_table = sc->cur_rate_table;
+        rate_table = ath_rc_priv->rate_table;
 
         /*
          * If the first rate is not the final index, there
@@ -1190,39 +1189,23 @@ static void ath_rc_tx_status(struct ath_softc *sc,
 static const
 struct ath_rate_table *ath_choose_rate_table(struct ath_softc *sc,
                                              enum ieee80211_band band,
-                                             bool is_ht,
-                                             bool is_cw_40)
+                                             bool is_ht)
 {
-        int mode = 0;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
         switch(band) {
         case IEEE80211_BAND_2GHZ:
-                mode = ATH9K_MODE_11G;
                 if (is_ht)
-                        mode = ATH9K_MODE_11NG_HT20;
-                if (is_cw_40)
-                        mode = ATH9K_MODE_11NG_HT40PLUS;
-                break;
+                        return &ar5416_11ng_ratetable;
+                return &ar5416_11g_ratetable;
         case IEEE80211_BAND_5GHZ:
-                mode = ATH9K_MODE_11A;
                 if (is_ht)
-                        mode = ATH9K_MODE_11NA_HT20;
-                if (is_cw_40)
-                        mode = ATH9K_MODE_11NA_HT40PLUS;
-                break;
+                        return &ar5416_11na_ratetable;
+                return &ar5416_11a_ratetable;
         default:
                 ath_print(common, ATH_DBG_CONFIG, "Invalid band\n");
                 return NULL;
         }
-
-        BUG_ON(mode >= ATH9K_MODE_MAX);
-
-        ath_print(common, ATH_DBG_CONFIG,
-                  "Choosing rate table for mode: %d\n", mode);
-
-        sc->cur_rate_mode = mode;
-        return hw_rate_table[mode];
 }
 
 static void ath_rc_init(struct ath_softc *sc,
@@ -1293,7 +1276,7 @@ static void ath_rc_init(struct ath_softc *sc,
         ath_rc_priv->max_valid_rate = k;
         ath_rc_sort_validrates(rate_table, ath_rc_priv);
         ath_rc_priv->rate_max_phy = ath_rc_priv->valid_rate_index[k-4];
-        sc->cur_rate_table = rate_table;
+        ath_rc_priv->rate_table = rate_table;
 
         ath_print(common, ATH_DBG_CONFIG,
                   "RC Initialized with capabilities: 0x%x\n",
@@ -1320,10 +1303,35 @@ static u8 ath_rc_build_ht_caps(struct ath_softc *sc, struct ieee80211_sta *sta,
         return caps;
 }
 
+static bool ath_tx_aggr_check(struct ath_softc *sc, struct ath_node *an,
+                              u8 tidno)
+{
+        struct ath_atx_tid *txtid;
+
+        if (!(sc->sc_flags & SC_OP_TXAGGR))
+                return false;
+
+        txtid = ATH_AN_2_TID(an, tidno);
+
+        if (!(txtid->state & (AGGR_ADDBA_COMPLETE | AGGR_ADDBA_PROGRESS)))
+                        return true;
+        return false;
+}
+
+
 /***********************************/
 /* mac80211 Rate Control callbacks */
 /***********************************/
 
+static void ath_debug_stat_rc(struct ath_rate_priv *rc, int final_rate)
+{
+        struct ath_rc_stats *stats;
+
+        stats = &rc->rcstats[final_rate];
+        stats->success++;
+}
+
+
 static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
                           struct ieee80211_sta *sta, void *priv_sta,
                           struct sk_buff *skb)
@@ -1359,6 +1367,12 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
         if (tx_info->flags & IEEE80211_TX_STAT_TX_FILTERED)
                 return;
 
+        if (!(tx_info->flags & IEEE80211_TX_STAT_AMPDU)) {
+                tx_info->status.ampdu_ack_len =
+                        (tx_info->flags & IEEE80211_TX_STAT_ACK ? 1 : 0);
+                tx_info->status.ampdu_len = 1;
+        }
+
         /*
          * If an underrun error is seen assume it as an excessive retry only
          * if max frame trigger level has been reached (2 KB for singel stream,
@@ -1397,8 +1411,9 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
                 }
         }
 
-        ath_debug_stat_rc(sc, ath_rc_get_rateindex(sc->cur_rate_table,
-                &tx_info->status.rates[final_ts_idx]));
+        ath_debug_stat_rc(ath_rc_priv,
+                ath_rc_get_rateindex(ath_rc_priv->rate_table,
+                        &tx_info->status.rates[final_ts_idx]));
 }
 
 static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
@@ -1438,14 +1453,8 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
 
         /* Choose rate table first */
 
-        if ((sc->sc_ah->opmode == NL80211_IFTYPE_STATION) ||
-            (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT) ||
-            (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC)) {
-                rate_table = ath_choose_rate_table(sc, sband->band,
-                                      sta->ht_cap.ht_supported, is_cw40);
-        } else {
-                rate_table = hw_rate_table[sc->cur_rate_mode];
-        }
+        rate_table = ath_choose_rate_table(sc, sband->band,
+                              sta->ht_cap.ht_supported);
 
         ath_rc_priv->ht_cap = ath_rc_build_ht_caps(sc, sta, is_cw40, is_sgi);
         ath_rc_init(sc, priv_sta, sband, sta, rate_table);
@@ -1485,8 +1494,7 @@ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
 
                 if ((local_cw40 != oper_cw40) || (local_sgi != oper_sgi)) {
                         rate_table = ath_choose_rate_table(sc, sband->band,
-                                                   sta->ht_cap.ht_supported,
-                                                   oper_cw40);
+                                                   sta->ht_cap.ht_supported);
                         ath_rc_priv->ht_cap = ath_rc_build_ht_caps(sc, sta,
                                                    oper_cw40, oper_sgi);
                         ath_rc_init(sc, priv_sta, sband, sta, rate_table);
@@ -1494,11 +1502,98 @@ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
                         ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_CONFIG,
                                   "Operating HT Bandwidth changed to: %d\n",
                                   sc->hw->conf.channel_type);
-                        sc->cur_rate_table = hw_rate_table[sc->cur_rate_mode];
                 }
         }
 }
 
+#ifdef CONFIG_ATH9K_DEBUGFS
+
+static int ath9k_debugfs_open(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+        return 0;
+}
+
+static ssize_t read_file_rcstat(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos)
+{
+        struct ath_rate_priv *rc = file->private_data;
+        char *buf;
+        unsigned int len = 0, max;
+        int i = 0;
+        ssize_t retval;
+
+        if (rc->rate_table == NULL)
+                return 0;
+
+        max = 80 + rc->rate_table->rate_cnt * 1024 + 1;
+        buf = kmalloc(max, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        len += sprintf(buf, "%6s %6s %6s "
+                       "%10s %10s %10s %10s\n",
+                       "HT", "MCS", "Rate",
+                       "Success", "Retries", "XRetries", "PER");
+
+        for (i = 0; i < rc->rate_table->rate_cnt; i++) {
+                u32 ratekbps = rc->rate_table->info[i].ratekbps;
+                struct ath_rc_stats *stats = &rc->rcstats[i];
+                char mcs[5];
+                char htmode[5];
+                int used_mcs = 0, used_htmode = 0;
+
+                if (WLAN_RC_PHY_HT(rc->rate_table->info[i].phy)) {
+                        used_mcs = snprintf(mcs, 5, "%d",
+                                rc->rate_table->info[i].ratecode);
+
+                        if (WLAN_RC_PHY_40(rc->rate_table->info[i].phy))
+                                used_htmode = snprintf(htmode, 5, "HT40");
+                        else if (WLAN_RC_PHY_20(rc->rate_table->info[i].phy))
+                                used_htmode = snprintf(htmode, 5, "HT20");
+                        else
+                                used_htmode = snprintf(htmode, 5, "????");
+                }
+
+                mcs[used_mcs] = '\0';
+                htmode[used_htmode] = '\0';
+
+                len += snprintf(buf + len, max - len,
+                        "%6s %6s %3u.%d: "
+                        "%10u %10u %10u %10u\n",
+                        htmode,
+                        mcs,
+                        ratekbps / 1000,
+                        (ratekbps % 1000) / 100,
+                        stats->success,
+                        stats->retries,
+                        stats->xretries,
+                        stats->per);
+        }
+
+        if (len > max)
+                len = max;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+        return retval;
+}
+
+static const struct file_operations fops_rcstat = {
+        .read = read_file_rcstat,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE
+};
+
+static void ath_rate_add_sta_debugfs(void *priv, void *priv_sta,
+                                     struct dentry *dir)
+{
+        struct ath_rate_priv *rc = priv_sta;
+        debugfs_create_file("rc_stats", S_IRUGO, dir, rc, &fops_rcstat);
+}
+
+#endif /* CONFIG_ATH9K_DEBUGFS */
+
 static void *ath_rate_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
 {
         struct ath_wiphy *aphy = hw->priv;
@@ -1545,6 +1640,9 @@ static struct rate_control_ops ath_rate_ops = {
         .free = ath_rate_free,
         .alloc_sta = ath_rate_alloc_sta,
         .free_sta = ath_rate_free_sta,
+#ifdef CONFIG_ATH9K_DEBUGFS
+        .add_sta_debugfs = ath_rate_add_sta_debugfs,
+#endif
 };
 
 int ath_rate_control_register(void)
diff --git a/drivers/net/wireless/ath/ath9k/rc.h b/drivers/net/wireless/ath/ath9k/rc.h
index dc1082654501..2f46a2266ba1 100644
--- a/drivers/net/wireless/ath/ath9k/rc.h
+++ b/drivers/net/wireless/ath/ath9k/rc.h
@@ -135,20 +135,21 @@ enum {
 
 /**
  * struct ath_rate_table - Rate Control table
- * @valid: valid for use in rate control
- * @valid_single_stream: valid for use in rate control for
- *      single stream operation
- * @phy: CCK/OFDM
+ * @rate_cnt: total number of rates for the given wireless mode
+ * @mcs_start: MCS rate index offset
+ * @rate_flags: Rate Control flags
+ * @phy: CCK/OFDM/HT20/HT40
  * @ratekbps: rate in Kbits per second
  * @user_ratekbps: user rate in Kbits per second
  * @ratecode: rate that goes into HW descriptors
- * @short_preamble: Mask for enabling short preamble in ratecode for CCK
  * @dot11rate: value that goes into supported
  *      rates info element of MLME
  * @ctrl_rate: Index of next lower basic rate, used for duration computation
- * @max_4ms_framelen: maximum frame length(bytes) for tx duration
+ * @cw40index: Index of rates having 40MHz channel width
+ * @sgi_index: Index of rates having Short Guard Interval
+ * @ht_index: high throughput rates having 40MHz channel width and
+ *      Short Guard Interval
  * @probe_interval: interval for rate control to probe for other rates
- * @rssi_reduce_interval: interval for rate control to reduce rssi
  * @initial_ratemax: initial ratemax value
  */
 struct ath_rate_table {
@@ -175,6 +176,13 @@ struct ath_rateset {
         u8 rs_rates[ATH_RATE_MAX];
 };
 
+struct ath_rc_stats {
+        u32 success;
+        u32 retries;
+        u32 xretries;
+        u8 per;
+};
+
 /**
  * struct ath_rate_priv - Rate Control priv data
  * @state: RC state
@@ -211,6 +219,10 @@ struct ath_rate_priv {
         struct ath_rateset neg_rates;
         struct ath_rateset neg_ht_rates;
         struct ath_rate_softc *asc;
+        const struct ath_rate_table *rate_table;
+
+        struct dentry *debugfs_rcstats;
+        struct ath_rc_stats rcstats[RATE_TABLE_SIZE];
 };
 
 #define ATH_TX_INFO_FRAME_TYPE_INTERNAL (1 << 0)
@@ -224,7 +236,18 @@ enum ath9k_internal_frame_type {
         ATH9K_IFT_UNPAUSE
 };
 
+#ifdef CONFIG_ATH9K_RATE_CONTROL
 int ath_rate_control_register(void);
 void ath_rate_control_unregister(void);
+#else
+static inline int ath_rate_control_register(void)
+{
+        return 0;
+}
+
+static inline void ath_rate_control_unregister(void)
+{
+}
+#endif
 
 #endif /* RC_H */
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 534a91bcc1d9..fe73fc50082a 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -19,6 +19,15 @@
 
 #define SKB_CB_ATHBUF(__skb)    (*((struct ath_buf **)__skb->cb))
 
+static inline bool ath_is_alt_ant_ratio_better(int alt_ratio, int maxdelta,
+                                               int mindelta, int main_rssi_avg,
+                                               int alt_rssi_avg, int pkt_count)
+{
+        return (((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
+                (alt_rssi_avg > main_rssi_avg + maxdelta)) ||
+                (alt_rssi_avg > main_rssi_avg + mindelta)) && (pkt_count > 50);
+}
+
 static inline bool ath9k_check_auto_sleep(struct ath_softc *sc)
 {
         return sc->ps_enabled &&
@@ -110,8 +119,7 @@ static void ath_opmode_init(struct ath_softc *sc)
         ath9k_hw_setrxfilter(ah, rfilt);
 
         /* configure bssid mask */
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
-                ath_hw_setbssidmask(common);
+        ath_hw_setbssidmask(common);
 
         /* configure operational mode */
         ath9k_hw_setopmode(ah);
@@ -260,6 +268,7 @@ static int ath_rx_edma_init(struct ath_softc *sc, int nbufs)
                                                 bf->bf_buf_addr))) {
                                 dev_kfree_skb_any(skb);
                                 bf->bf_mpdu = NULL;
+                                bf->bf_buf_addr = 0;
                                 ath_print(common, ATH_DBG_FATAL,
                                         "dma_mapping_error() on RX init\n");
                                 error = -ENOMEM;
@@ -292,7 +301,7 @@ static void ath_edma_start_recv(struct ath_softc *sc)
 
         ath_opmode_init(sc);
 
-        ath9k_hw_startpcureceive(sc->sc_ah, (sc->sc_flags & SC_OP_SCANNING));
+        ath9k_hw_startpcureceive(sc->sc_ah, (sc->sc_flags & SC_OP_OFFCHANNEL));
 }
 
 static void ath_edma_stop_recv(struct ath_softc *sc)
@@ -350,12 +359,12 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
                                                         bf->bf_buf_addr))) {
                                 dev_kfree_skb_any(skb);
                                 bf->bf_mpdu = NULL;
+                                bf->bf_buf_addr = 0;
                                 ath_print(common, ATH_DBG_FATAL,
                                           "dma_mapping_error() on RX init\n");
                                 error = -ENOMEM;
                                 goto err;
                         }
-                        bf->bf_dmacontext = bf->bf_buf_addr;
                 }
                 sc->rx.rxlink = NULL;
         }
@@ -385,6 +394,8 @@ void ath_rx_cleanup(struct ath_softc *sc)
                                                 common->rx_bufsize,
                                                 DMA_FROM_DEVICE);
                                 dev_kfree_skb(skb);
+                                bf->bf_buf_addr = 0;
+                                bf->bf_mpdu = NULL;
                         }
                 }
 
@@ -422,8 +433,7 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
                 | ATH9K_RX_FILTER_UCAST | ATH9K_RX_FILTER_BCAST
                 | ATH9K_RX_FILTER_MCAST;
 
-        /* If not a STA, enable processing of Probe Requests */
-        if (sc->sc_ah->opmode != NL80211_IFTYPE_STATION)
+        if (sc->rx.rxfilter & FIF_PROBE_REQ)
                 rfilt |= ATH9K_RX_FILTER_PROBEREQ;
 
         /*
@@ -440,13 +450,14 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
                 rfilt |= ATH9K_RX_FILTER_CONTROL;
 
         if ((sc->sc_ah->opmode == NL80211_IFTYPE_STATION) &&
+            (sc->nvifs <= 1) &&
             !(sc->rx.rxfilter & FIF_BCN_PRBRESP_PROMISC))
                 rfilt |= ATH9K_RX_FILTER_MYBEACON;
         else
                 rfilt |= ATH9K_RX_FILTER_BEACON;
 
-        if ((AR_SREV_9280_10_OR_LATER(sc->sc_ah) ||
-            AR_SREV_9285_10_OR_LATER(sc->sc_ah)) &&
+        if ((AR_SREV_9280_20_OR_LATER(sc->sc_ah) ||
+            AR_SREV_9285_12_OR_LATER(sc->sc_ah)) &&
             (sc->sc_ah->opmode == NL80211_IFTYPE_AP) &&
             (sc->rx.rxfilter & FIF_PSPOLL))
                 rfilt |= ATH9K_RX_FILTER_PSPOLL;
@@ -454,9 +465,8 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
         if (conf_is_ht(&sc->hw->conf))
                 rfilt |= ATH9K_RX_FILTER_COMP_BAR;
 
-        if (sc->sec_wiphy || (sc->rx.rxfilter & FIF_OTHER_BSS)) {
-                /* TODO: only needed if more than one BSSID is in use in
-                 * station/adhoc mode */
+        if (sc->sec_wiphy || (sc->nvifs > 1) ||
+            (sc->rx.rxfilter & FIF_OTHER_BSS)) {
                 /* The following may also be needed for other older chips */
                 if (sc->sc_ah->hw_version.macVersion == AR_SREV_VERSION_9160)
                         rfilt |= ATH9K_RX_FILTER_PROM;
@@ -498,7 +508,7 @@ int ath_startrecv(struct ath_softc *sc)
 start_recv:
         spin_unlock_bh(&sc->rx.rxbuflock);
         ath_opmode_init(sc);
-        ath9k_hw_startpcureceive(ah, (sc->sc_flags & SC_OP_SCANNING));
+        ath9k_hw_startpcureceive(ah, (sc->sc_flags & SC_OP_OFFCHANNEL));
 
         return 0;
 }
@@ -631,7 +641,7 @@ static void ath_rx_ps(struct ath_softc *sc, struct sk_buff *skb)
                  * No more broadcast/multicast frames to be received at this
                  * point.
                  */
-                sc->ps_flags &= ~PS_WAIT_FOR_CAB;
+                sc->ps_flags &= ~(PS_WAIT_FOR_CAB | PS_WAIT_FOR_BEACON);
                 ath_print(common, ATH_DBG_PS,
                           "All PS CAB frames received, back to sleep\n");
         } else if ((sc->ps_flags & PS_WAIT_FOR_PSPOLL_DATA) &&
@@ -969,7 +979,11 @@ static void ath9k_process_rssi(struct ath_common *common,
          * at least one sdata of a wiphy on mac80211 but with ath9k virtual
          * wiphy you'd have to iterate over every wiphy and each sdata.
          */
-        sta = ieee80211_find_sta_by_hw(hw, hdr->addr2);
+        if (is_multicast_ether_addr(hdr->addr1))
+                sta = ieee80211_find_sta_by_ifaddr(hw, hdr->addr2, NULL);
+        else
+                sta = ieee80211_find_sta_by_ifaddr(hw, hdr->addr2, hdr->addr1);
+
         if (sta) {
                 an = (struct ath_node *) sta->drv_priv;
                 if (rx_stats->rs_rssi != ATH9K_RSSI_BAD &&
@@ -1076,6 +1090,539 @@ static void ath9k_rx_skb_postprocess(struct ath_common *common,
                 rxs->flag &= ~RX_FLAG_DECRYPTED;
 }
 
+static void ath_lnaconf_alt_good_scan(struct ath_ant_comb *antcomb,
+                                      struct ath_hw_antcomb_conf ant_conf,
+                                      int main_rssi_avg)
+{
+        antcomb->quick_scan_cnt = 0;
+
+        if (ant_conf.main_lna_conf == ATH_ANT_DIV_COMB_LNA2)
+                antcomb->rssi_lna2 = main_rssi_avg;
+        else if (ant_conf.main_lna_conf == ATH_ANT_DIV_COMB_LNA1)
+                antcomb->rssi_lna1 = main_rssi_avg;
+
+        switch ((ant_conf.main_lna_conf << 4) | ant_conf.alt_lna_conf) {
+        case (0x10): /* LNA2 A-B */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA1;
+                break;
+        case (0x20): /* LNA1 A-B */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA2;
+                break;
+        case (0x21): /* LNA1 LNA2 */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->second_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                break;
+        case (0x12): /* LNA2 LNA1 */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->second_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                break;
+        case (0x13): /* LNA2 A+B */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA1;
+                break;
+        case (0x23): /* LNA1 A+B */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA2;
+                break;
+        default:
+                break;
+        }
+}
+
+static void ath_select_ant_div_from_quick_scan(struct ath_ant_comb *antcomb,
+                                struct ath_hw_antcomb_conf *div_ant_conf,
+                                int main_rssi_avg, int alt_rssi_avg,
+                                int alt_ratio)
+{
+        /* alt_good */
+        switch (antcomb->quick_scan_cnt) {
+        case 0:
+                /* set alt to main, and alt to first conf */
+                div_ant_conf->main_lna_conf = antcomb->main_conf;
+                div_ant_conf->alt_lna_conf = antcomb->first_quick_scan_conf;
+                break;
+        case 1:
+                /* set alt to main, and alt to first conf */
+                div_ant_conf->main_lna_conf = antcomb->main_conf;
+                div_ant_conf->alt_lna_conf = antcomb->second_quick_scan_conf;
+                antcomb->rssi_first = main_rssi_avg;
+                antcomb->rssi_second = alt_rssi_avg;
+
+                if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) {
+                        /* main is LNA1 */
+                        if (ath_is_alt_ant_ratio_better(alt_ratio,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_HI,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
+                                                main_rssi_avg, alt_rssi_avg,
+                                                antcomb->total_pkt_count))
+                                antcomb->first_ratio = true;
+                        else
+                                antcomb->first_ratio = false;
+                } else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2) {
+                        if (ath_is_alt_ant_ratio_better(alt_ratio,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_MID,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
+                                                main_rssi_avg, alt_rssi_avg,
+                                                antcomb->total_pkt_count))
+                                antcomb->first_ratio = true;
+                        else
+                                antcomb->first_ratio = false;
+                } else {
+                        if ((((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
+                            (alt_rssi_avg > main_rssi_avg +
+                            ATH_ANT_DIV_COMB_LNA1_DELTA_HI)) ||
+                            (alt_rssi_avg > main_rssi_avg)) &&
+                            (antcomb->total_pkt_count > 50))
+                                antcomb->first_ratio = true;
+                        else
+                                antcomb->first_ratio = false;
+                }
+                break;
+        case 2:
+                antcomb->alt_good = false;
+                antcomb->scan_not_start = false;
+                antcomb->scan = false;
+                antcomb->rssi_first = main_rssi_avg;
+                antcomb->rssi_third = alt_rssi_avg;
+
+                if (antcomb->second_quick_scan_conf == ATH_ANT_DIV_COMB_LNA1)
+                        antcomb->rssi_lna1 = alt_rssi_avg;
+                else if (antcomb->second_quick_scan_conf ==
+                         ATH_ANT_DIV_COMB_LNA2)
+                        antcomb->rssi_lna2 = alt_rssi_avg;
+                else if (antcomb->second_quick_scan_conf ==
+                         ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2) {
+                        if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2)
+                                antcomb->rssi_lna2 = main_rssi_avg;
+                        else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1)
+                                antcomb->rssi_lna1 = main_rssi_avg;
+                }
+
+                if (antcomb->rssi_lna2 > antcomb->rssi_lna1 +
+                    ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)
+                        div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
+                else
+                        div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
+
+                if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) {
+                        if (ath_is_alt_ant_ratio_better(alt_ratio,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_HI,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
+                                                main_rssi_avg, alt_rssi_avg,
+                                                antcomb->total_pkt_count))
+                                antcomb->second_ratio = true;
+                        else
+                                antcomb->second_ratio = false;
+                } else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2) {
+                        if (ath_is_alt_ant_ratio_better(alt_ratio,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_MID,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
+                                                main_rssi_avg, alt_rssi_avg,
+                                                antcomb->total_pkt_count))
+                                antcomb->second_ratio = true;
+                        else
+                                antcomb->second_ratio = false;
+                } else {
+                        if ((((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
+                            (alt_rssi_avg > main_rssi_avg +
+                            ATH_ANT_DIV_COMB_LNA1_DELTA_HI)) ||
+                            (alt_rssi_avg > main_rssi_avg)) &&
+                            (antcomb->total_pkt_count > 50))
+                                antcomb->second_ratio = true;
+                        else
+                                antcomb->second_ratio = false;
+                }
+
+                /* set alt to the conf with maximun ratio */
+                if (antcomb->first_ratio && antcomb->second_ratio) {
+                        if (antcomb->rssi_second > antcomb->rssi_third) {
+                                /* first alt*/
+                                if ((antcomb->first_quick_scan_conf ==
+                                    ATH_ANT_DIV_COMB_LNA1) ||
+                                    (antcomb->first_quick_scan_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2))
+                                        /* Set alt LNA1 or LNA2*/
+                                        if (div_ant_conf->main_lna_conf ==
+                                            ATH_ANT_DIV_COMB_LNA2)
+                                                div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA1;
+                                        else
+                                                div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA2;
+                                else
+                                        /* Set alt to A+B or A-B */
+                                        div_ant_conf->alt_lna_conf =
+                                                antcomb->first_quick_scan_conf;
+                        } else if ((antcomb->second_quick_scan_conf ==
+                                   ATH_ANT_DIV_COMB_LNA1) ||
+                                   (antcomb->second_quick_scan_conf ==
+                                   ATH_ANT_DIV_COMB_LNA2)) {
+                                /* Set alt LNA1 or LNA2 */
+                                if (div_ant_conf->main_lna_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2)
+                                        div_ant_conf->alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                else
+                                        div_ant_conf->alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                        } else {
+                                /* Set alt to A+B or A-B */
+                                div_ant_conf->alt_lna_conf =
+                                        antcomb->second_quick_scan_conf;
+                        }
+                } else if (antcomb->first_ratio) {
+                        /* first alt */
+                        if ((antcomb->first_quick_scan_conf ==
+                            ATH_ANT_DIV_COMB_LNA1) ||
+                            (antcomb->first_quick_scan_conf ==
+                            ATH_ANT_DIV_COMB_LNA2))
+                                        /* Set alt LNA1 or LNA2 */
+                                if (div_ant_conf->main_lna_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2)
+                                        div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA1;
+                                else
+                                        div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA2;
+                        else
+                                /* Set alt to A+B or A-B */
+                                div_ant_conf->alt_lna_conf =
+                                                antcomb->first_quick_scan_conf;
+                } else if (antcomb->second_ratio) {
+                                /* second alt */
+                        if ((antcomb->second_quick_scan_conf ==
+                            ATH_ANT_DIV_COMB_LNA1) ||
+                            (antcomb->second_quick_scan_conf ==
+                            ATH_ANT_DIV_COMB_LNA2))
+                                /* Set alt LNA1 or LNA2 */
+                                if (div_ant_conf->main_lna_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2)
+                                        div_ant_conf->alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                else
+                                        div_ant_conf->alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                        else
+                                /* Set alt to A+B or A-B */
+                                div_ant_conf->alt_lna_conf =
+                                                antcomb->second_quick_scan_conf;
+                } else {
+                        /* main is largest */
+                        if ((antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) ||
+                            (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2))
+                                /* Set alt LNA1 or LNA2 */
+                                if (div_ant_conf->main_lna_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2)
+                                        div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA1;
+                                else
+                                        div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA2;
+                        else
+                                /* Set alt to A+B or A-B */
+                                div_ant_conf->alt_lna_conf = antcomb->main_conf;
+                }
+                break;
+        default:
+                break;
+        }
+}
+
+static void ath_ant_div_conf_fast_divbias(struct ath_hw_antcomb_conf *ant_conf)
+{
+        /* Adjust the fast_div_bias based on main and alt lna conf */
+        switch ((ant_conf->main_lna_conf << 4) | ant_conf->alt_lna_conf) {
+        case (0x01): /* A-B LNA2 */
+                ant_conf->fast_div_bias = 0x3b;
+                break;
+        case (0x02): /* A-B LNA1 */
+                ant_conf->fast_div_bias = 0x3d;
+                break;
+        case (0x03): /* A-B A+B */
+                ant_conf->fast_div_bias = 0x1;
+                break;
+        case (0x10): /* LNA2 A-B */
+                ant_conf->fast_div_bias = 0x7;
+                break;
+        case (0x12): /* LNA2 LNA1 */
+                ant_conf->fast_div_bias = 0x2;
+                break;
+        case (0x13): /* LNA2 A+B */
+                ant_conf->fast_div_bias = 0x7;
+                break;
+        case (0x20): /* LNA1 A-B */
+                ant_conf->fast_div_bias = 0x6;
+                break;
+        case (0x21): /* LNA1 LNA2 */
+                ant_conf->fast_div_bias = 0x0;
+                break;
+        case (0x23): /* LNA1 A+B */
+                ant_conf->fast_div_bias = 0x6;
+                break;
+        case (0x30): /* A+B A-B */
+                ant_conf->fast_div_bias = 0x1;
+                break;
+        case (0x31): /* A+B LNA2 */
+                ant_conf->fast_div_bias = 0x3b;
+                break;
+        case (0x32): /* A+B LNA1 */
+                ant_conf->fast_div_bias = 0x3d;
+                break;
+        default:
+                break;
+        }
+}
+
+/* Antenna diversity and combining */
+static void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs)
+{
+        struct ath_hw_antcomb_conf div_ant_conf;
+        struct ath_ant_comb *antcomb = &sc->ant_comb;
+        int alt_ratio = 0, alt_rssi_avg = 0, main_rssi_avg = 0, curr_alt_set;
+        int curr_main_set, curr_bias;
+        int main_rssi = rs->rs_rssi_ctl0;
+        int alt_rssi = rs->rs_rssi_ctl1;
+        int rx_ant_conf,  main_ant_conf;
+        bool short_scan = false;
+
+        rx_ant_conf = (rs->rs_rssi_ctl2 >> ATH_ANT_RX_CURRENT_SHIFT) &
+                       ATH_ANT_RX_MASK;
+        main_ant_conf = (rs->rs_rssi_ctl2 >> ATH_ANT_RX_MAIN_SHIFT) &
+                         ATH_ANT_RX_MASK;
+
+        /* Record packet only when alt_rssi is positive */
+        if (alt_rssi > 0) {
+                antcomb->total_pkt_count++;
+                antcomb->main_total_rssi += main_rssi;
+                antcomb->alt_total_rssi  += alt_rssi;
+                if (main_ant_conf == rx_ant_conf)
+                        antcomb->main_recv_cnt++;
+                else
+                        antcomb->alt_recv_cnt++;
+        }
+
+        /* Short scan check */
+        if (antcomb->scan && antcomb->alt_good) {
+                if (time_after(jiffies, antcomb->scan_start_time +
+                    msecs_to_jiffies(ATH_ANT_DIV_COMB_SHORT_SCAN_INTR)))
+                        short_scan = true;
+                else
+                        if (antcomb->total_pkt_count ==
+                            ATH_ANT_DIV_COMB_SHORT_SCAN_PKTCOUNT) {
+                                alt_ratio = ((antcomb->alt_recv_cnt * 100) /
+                                            antcomb->total_pkt_count);
+                                if (alt_ratio < ATH_ANT_DIV_COMB_ALT_ANT_RATIO)
+                                        short_scan = true;
+                        }
+        }
+
+        if (((antcomb->total_pkt_count < ATH_ANT_DIV_COMB_MAX_PKTCOUNT) ||
+            rs->rs_moreaggr) && !short_scan)
+                return;
+
+        if (antcomb->total_pkt_count) {
+                alt_ratio = ((antcomb->alt_recv_cnt * 100) /
+                             antcomb->total_pkt_count);
+                main_rssi_avg = (antcomb->main_total_rssi /
+                                 antcomb->total_pkt_count);
+                alt_rssi_avg = (antcomb->alt_total_rssi /
+                                 antcomb->total_pkt_count);
+        }
+
+
+        ath9k_hw_antdiv_comb_conf_get(sc->sc_ah, &div_ant_conf);
+        curr_alt_set = div_ant_conf.alt_lna_conf;
+        curr_main_set = div_ant_conf.main_lna_conf;
+        curr_bias = div_ant_conf.fast_div_bias;
+
+        antcomb->count++;
+
+        if (antcomb->count == ATH_ANT_DIV_COMB_MAX_COUNT) {
+                if (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO) {
+                        ath_lnaconf_alt_good_scan(antcomb, div_ant_conf,
+                                                  main_rssi_avg);
+                        antcomb->alt_good = true;
+                } else {
+                        antcomb->alt_good = false;
+                }
+
+                antcomb->count = 0;
+                antcomb->scan = true;
+                antcomb->scan_not_start = true;
+        }
+
+        if (!antcomb->scan) {
+                if (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO) {
+                        if (curr_alt_set == ATH_ANT_DIV_COMB_LNA2) {
+                                /* Switch main and alt LNA */
+                                div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                div_ant_conf.alt_lna_conf  =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                        } else if (curr_alt_set == ATH_ANT_DIV_COMB_LNA1) {
+                                div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                div_ant_conf.alt_lna_conf  =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                        }
+
+                        goto div_comb_done;
+                } else if ((curr_alt_set != ATH_ANT_DIV_COMB_LNA1) &&
+                           (curr_alt_set != ATH_ANT_DIV_COMB_LNA2)) {
+                        /* Set alt to another LNA */
+                        if (curr_main_set == ATH_ANT_DIV_COMB_LNA2)
+                                div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                        else if (curr_main_set == ATH_ANT_DIV_COMB_LNA1)
+                                div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+
+                        goto div_comb_done;
+                }
+
+                if ((alt_rssi_avg < (main_rssi_avg +
+                    ATH_ANT_DIV_COMB_LNA1_LNA2_DELTA)))
+                        goto div_comb_done;
+        }
+
+        if (!antcomb->scan_not_start) {
+                switch (curr_alt_set) {
+                case ATH_ANT_DIV_COMB_LNA2:
+                        antcomb->rssi_lna2 = alt_rssi_avg;
+                        antcomb->rssi_lna1 = main_rssi_avg;
+                        antcomb->scan = true;
+                        /* set to A+B */
+                        div_ant_conf.main_lna_conf =
+                                ATH_ANT_DIV_COMB_LNA1;
+                        div_ant_conf.alt_lna_conf  =
+                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                        break;
+                case ATH_ANT_DIV_COMB_LNA1:
+                        antcomb->rssi_lna1 = alt_rssi_avg;
+                        antcomb->rssi_lna2 = main_rssi_avg;
+                        antcomb->scan = true;
+                        /* set to A+B */
+                        div_ant_conf.main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
+                        div_ant_conf.alt_lna_conf  =
+                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                        break;
+                case ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2:
+                        antcomb->rssi_add = alt_rssi_avg;
+                        antcomb->scan = true;
+                        /* set to A-B */
+                        div_ant_conf.alt_lna_conf =
+                                ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                        break;
+                case ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2:
+                        antcomb->rssi_sub = alt_rssi_avg;
+                        antcomb->scan = false;
+                        if (antcomb->rssi_lna2 >
+                            (antcomb->rssi_lna1 +
+                            ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)) {
+                                /* use LNA2 as main LNA */
+                                if ((antcomb->rssi_add > antcomb->rssi_lna1) &&
+                                    (antcomb->rssi_add > antcomb->rssi_sub)) {
+                                        /* set to A+B */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                        div_ant_conf.alt_lna_conf  =
+                                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                                } else if (antcomb->rssi_sub >
+                                           antcomb->rssi_lna1) {
+                                        /* set to A-B */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                        div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                                } else {
+                                        /* set to LNA1 */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                        div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                }
+                        } else {
+                                /* use LNA1 as main LNA */
+                                if ((antcomb->rssi_add > antcomb->rssi_lna2) &&
+                                    (antcomb->rssi_add > antcomb->rssi_sub)) {
+                                        /* set to A+B */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                        div_ant_conf.alt_lna_conf  =
+                                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                                } else if (antcomb->rssi_sub >
+                                           antcomb->rssi_lna1) {
+                                        /* set to A-B */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                        div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                                } else {
+                                        /* set to LNA2 */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                        div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                }
+                        }
+                        break;
+                default:
+                        break;
+                }
+        } else {
+                if (!antcomb->alt_good) {
+                        antcomb->scan_not_start = false;
+                        /* Set alt to another LNA */
+                        if (curr_main_set == ATH_ANT_DIV_COMB_LNA2) {
+                                div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                        } else if (curr_main_set == ATH_ANT_DIV_COMB_LNA1) {
+                                div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                        }
+                        goto div_comb_done;
+                }
+        }
+
+        ath_select_ant_div_from_quick_scan(antcomb, &div_ant_conf,
+                                           main_rssi_avg, alt_rssi_avg,
+                                           alt_ratio);
+
+        antcomb->quick_scan_cnt++;
+
+div_comb_done:
+        ath_ant_div_conf_fast_divbias(&div_ant_conf);
+
+        ath9k_hw_antdiv_comb_conf_set(sc->sc_ah, &div_ant_conf);
+
+        antcomb->scan_start_time = jiffies;
+        antcomb->total_pkt_count = 0;
+        antcomb->main_total_rssi = 0;
+        antcomb->alt_total_rssi = 0;
+        antcomb->main_recv_cnt = 0;
+        antcomb->alt_recv_cnt = 0;
+}
+
 int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 {
         struct ath_buf *bf;
@@ -1099,6 +1646,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
         u8 rx_status_len = ah->caps.rx_status_len;
         u64 tsf = 0;
         u32 tsf_lower = 0;
+        unsigned long flags;
 
         if (edma)
                 dma_type = DMA_BIDIRECTIONAL;
@@ -1189,12 +1737,12 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                           bf->bf_buf_addr))) {
                         dev_kfree_skb_any(requeue_skb);
                         bf->bf_mpdu = NULL;
+                        bf->bf_buf_addr = 0;
                         ath_print(common, ATH_DBG_FATAL,
                                   "dma_mapping_error() on RX\n");
                         ath_rx_send_to_mac80211(hw, sc, skb, rxs);
                         break;
                 }
-                bf->bf_dmacontext = bf->bf_buf_addr;
 
                 /*
                  * change the default rx antenna if rx diversity chooses the
@@ -1207,11 +1755,16 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         sc->rx.rxotherant = 0;
                 }
 
+                spin_lock_irqsave(&sc->sc_pm_lock, flags);
                 if (unlikely(ath9k_check_auto_sleep(sc) ||
                              (sc->ps_flags & (PS_WAIT_FOR_BEACON |
                                               PS_WAIT_FOR_CAB |
                                               PS_WAIT_FOR_PSPOLL_DATA))))
                         ath_rx_ps(sc, skb);
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
+
+                if (ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB)
+                        ath_ant_comb_scan(sc, &rs);
 
                 ath_rx_send_to_mac80211(hw, sc, skb, rxs);
 
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index d01c4adab8d6..42976b0a01c1 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -107,12 +107,6 @@
 #define AR_RXCFG_DMASZ_256B  6
 #define AR_RXCFG_DMASZ_512B  7
 
-#define AR_MIBC              0x0040
-#define AR_MIBC_COW          0x00000001
-#define AR_MIBC_FMC          0x00000002
-#define AR_MIBC_CMC          0x00000004
-#define AR_MIBC_MCS          0x00000008
-
 #define AR_TOPS              0x0044
 #define AR_TOPS_MASK         0x0000FFFF
 
@@ -819,49 +813,23 @@
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9160_11))
 #define AR_SREV_9280(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9280))
-#define AR_SREV_9280_10_OR_LATER(_ah) \
+#define AR_SREV_9280_20_OR_LATER(_ah) \
         (((_ah)->hw_version.macVersion >= AR_SREV_VERSION_9280))
 #define AR_SREV_9280_20(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9280) && \
-                ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9280_20))
-#define AR_SREV_9280_20_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion > AR_SREV_VERSION_9280) || \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9280) && \
-        ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9280_20)))
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9280))
 
 #define AR_SREV_9285(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9285))
-#define AR_SREV_9285_10_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion >= AR_SREV_VERSION_9285))
-#define AR_SREV_9285_11(_ah) \
-        (AR_SREV_9285(ah) && \
-         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9285_11))
-#define AR_SREV_9285_11_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion > AR_SREV_VERSION_9285) || \
-         (AR_SREV_9285(ah) && ((_ah)->hw_version.macRev >= \
-                               AR_SREV_REVISION_9285_11)))
-#define AR_SREV_9285_12(_ah) \
-        (AR_SREV_9285(ah) && \
-         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9285_12))
 #define AR_SREV_9285_12_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion > AR_SREV_VERSION_9285) || \
-         (AR_SREV_9285(ah) && ((_ah)->hw_version.macRev >= \
-                               AR_SREV_REVISION_9285_12)))
+        (((_ah)->hw_version.macVersion >= AR_SREV_VERSION_9285))
 
 #define AR_SREV_9287(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9287))
-#define AR_SREV_9287_10_OR_LATER(_ah) \
+#define AR_SREV_9287_11_OR_LATER(_ah) \
         (((_ah)->hw_version.macVersion >= AR_SREV_VERSION_9287))
-#define AR_SREV_9287_10(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9287) && \
-         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9287_10))
 #define AR_SREV_9287_11(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9287) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9287_11))
-#define AR_SREV_9287_11_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion > AR_SREV_VERSION_9287) || \
-         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9287) && \
-          ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9287_11)))
 #define AR_SREV_9287_12(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9287) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9287_12))
@@ -885,9 +853,6 @@
 
 #define AR_SREV_9300(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9300))
-#define AR_SREV_9300_20(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9300) && \
-         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9300_20))
 #define AR_SREV_9300_20_OR_LATER(_ah) \
         (((_ah)->hw_version.macVersion > AR_SREV_VERSION_9300) || \
          (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9300) && \
@@ -1550,11 +1515,6 @@ enum {
 #define AR_TPC_CHIRP           0x003f0000
 #define AR_TPC_CHIRP_S         0x16
 
-#define AR_TFCNT           0x80ec
-#define AR_RFCNT           0x80f0
-#define AR_RCCNT           0x80f4
-#define AR_CCCNT           0x80f8
-
 #define AR_QUIET1          0x80fc
 #define AR_QUIET1_NEXT_QUIET_S         0
 #define AR_QUIET1_NEXT_QUIET_M         0x0000ffff
diff --git a/drivers/net/wireless/ath/ath9k/virtual.c b/drivers/net/wireless/ath/ath9k/virtual.c
index fd20241f57d8..ec7cf5ee56bc 100644
--- a/drivers/net/wireless/ath/ath9k/virtual.c
+++ b/drivers/net/wireless/ath/ath9k/virtual.c
@@ -19,45 +19,36 @@
 #include "ath9k.h"
 
 struct ath9k_vif_iter_data {
-        int count;
-        u8 *addr;
+        const u8 *hw_macaddr;
+        u8 mask[ETH_ALEN];
 };
 
 static void ath9k_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
 {
         struct ath9k_vif_iter_data *iter_data = data;
-        u8 *nbuf;
-
-        nbuf = krealloc(iter_data->addr, (iter_data->count + 1) * ETH_ALEN,
-                        GFP_ATOMIC);
-        if (nbuf == NULL)
-                return;
+        int i;
 
-        memcpy(nbuf + iter_data->count * ETH_ALEN, mac, ETH_ALEN);
-        iter_data->addr = nbuf;
-        iter_data->count++;
+        for (i = 0; i < ETH_ALEN; i++)
+                iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
 }
 
-void ath9k_set_bssid_mask(struct ieee80211_hw *hw)
+void ath9k_set_bssid_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath9k_vif_iter_data iter_data;
-        int i, j;
-        u8 mask[ETH_ALEN];
+        int i;
 
         /*
-         * Add primary MAC address even if it is not in active use since it
-         * will be configured to the hardware as the starting point and the
-         * BSSID mask will need to be changed if another address is active.
+         * Use the hardware MAC address as reference, the hardware uses it
+         * together with the BSSID mask when matching addresses.
          */
-        iter_data.addr = kmalloc(ETH_ALEN, GFP_ATOMIC);
-        if (iter_data.addr) {
-                memcpy(iter_data.addr, common->macaddr, ETH_ALEN);
-                iter_data.count = 1;
-        } else
-                iter_data.count = 0;
+        iter_data.hw_macaddr = common->macaddr;
+        memset(&iter_data.mask, 0xff, ETH_ALEN);
+
+        if (vif)
+                ath9k_vif_iter(&iter_data, vif->addr, vif);
 
         /* Get list of all active MAC addresses */
         spin_lock_bh(&sc->wiphy_lock);
@@ -71,31 +62,7 @@ void ath9k_set_bssid_mask(struct ieee80211_hw *hw)
         }
         spin_unlock_bh(&sc->wiphy_lock);
 
-        /* Generate an address mask to cover all active addresses */
-        memset(mask, 0, ETH_ALEN);
-        for (i = 0; i < iter_data.count; i++) {
-                u8 *a1 = iter_data.addr + i * ETH_ALEN;
-                for (j = i + 1; j < iter_data.count; j++) {
-                        u8 *a2 = iter_data.addr + j * ETH_ALEN;
-                        mask[0] |= a1[0] ^ a2[0];
-                        mask[1] |= a1[1] ^ a2[1];
-                        mask[2] |= a1[2] ^ a2[2];
-                        mask[3] |= a1[3] ^ a2[3];
-                        mask[4] |= a1[4] ^ a2[4];
-                        mask[5] |= a1[5] ^ a2[5];
-                }
-        }
-
-        kfree(iter_data.addr);
-
-        /* Invert the mask and configure hardware */
-        common->bssidmask[0] = ~mask[0];
-        common->bssidmask[1] = ~mask[1];
-        common->bssidmask[2] = ~mask[2];
-        common->bssidmask[3] = ~mask[3];
-        common->bssidmask[4] = ~mask[4];
-        common->bssidmask[5] = ~mask[5];
-
+        memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
         ath_hw_setbssidmask(common);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index 45fe9cac7971..93a8bda09c25 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -124,55 +124,11 @@ void ath9k_wmi_tasklet(unsigned long data)
 {
         struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *)data;
         struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct wmi_cmd_hdr *hdr;
-        struct wmi_swba *swba_hdr;
-        enum wmi_event_id event;
-        struct sk_buff *skb;
-        void *wmi_event;
-        unsigned long flags;
-#ifdef CONFIG_ATH9K_HTC_DEBUGFS
-        __be32 txrate;
-#endif
 
-        spin_lock_irqsave(&priv->wmi->wmi_lock, flags);
-        skb = priv->wmi->wmi_skb;
-        spin_unlock_irqrestore(&priv->wmi->wmi_lock, flags);
+        ath_print(common, ATH_DBG_WMI, "SWBA Event received\n");
 
-        hdr = (struct wmi_cmd_hdr *) skb->data;
-        event = be16_to_cpu(hdr->command_id);
-        wmi_event = skb_pull(skb, sizeof(struct wmi_cmd_hdr));
+        ath9k_htc_swba(priv, priv->wmi->beacon_pending);
 
-        ath_print(common, ATH_DBG_WMI,
-                  "WMI Event: 0x%x\n", event);
-
-        switch (event) {
-        case WMI_TGT_RDY_EVENTID:
-                break;
-        case WMI_SWBA_EVENTID:
-                swba_hdr = (struct wmi_swba *) wmi_event;
-                ath9k_htc_swba(priv, swba_hdr->beacon_pending);
-                break;
-        case WMI_FATAL_EVENTID:
-                break;
-        case WMI_TXTO_EVENTID:
-                break;
-        case WMI_BMISS_EVENTID:
-                break;
-        case WMI_WLAN_TXCOMP_EVENTID:
-                break;
-        case WMI_DELBA_EVENTID:
-                break;
-        case WMI_TXRATE_EVENTID:
-#ifdef CONFIG_ATH9K_HTC_DEBUGFS
-                txrate = ((struct wmi_event_txrate *)wmi_event)->txrate;
-                priv->debug.txrate = be32_to_cpu(txrate);
-#endif
-                break;
-        default:
-                break;
-        }
-
-        kfree_skb(skb);
 }
 
 static void ath9k_wmi_rsp_callback(struct wmi *wmi, struct sk_buff *skb)
@@ -191,6 +147,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
         struct wmi *wmi = (struct wmi *) priv;
         struct wmi_cmd_hdr *hdr;
         u16 cmd_id;
+        void *wmi_event;
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+        __be32 txrate;
+#endif
 
         if (unlikely(wmi->stopped))
                 goto free_skb;
@@ -199,10 +159,22 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
         cmd_id = be16_to_cpu(hdr->command_id);
 
         if (cmd_id & 0x1000) {
-                spin_lock(&wmi->wmi_lock);
-                wmi->wmi_skb = skb;
-                spin_unlock(&wmi->wmi_lock);
-                tasklet_schedule(&wmi->drv_priv->wmi_tasklet);
+                wmi_event = skb_pull(skb, sizeof(struct wmi_cmd_hdr));
+                switch (cmd_id) {
+                case WMI_SWBA_EVENTID:
+                        wmi->beacon_pending = *(u8 *)wmi_event;
+                        tasklet_schedule(&wmi->drv_priv->wmi_tasklet);
+                        break;
+                case WMI_TXRATE_EVENTID:
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+                        txrate = ((struct wmi_event_txrate *)wmi_event)->txrate;
+                        wmi->drv_priv->debug.txrate = be32_to_cpu(txrate);
+#endif
+                        break;
+                default:
+                        break;
+                }
+                kfree_skb(skb);
                 return;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h
index a0bf857625df..ac61074af8ac 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.h
+++ b/drivers/net/wireless/ath/ath9k/wmi.h
@@ -31,10 +31,6 @@ struct wmi_cmd_hdr {
         __be16 seq_no;
 } __packed;
 
-struct wmi_swba {
-        u8 beacon_pending;
-} __packed;
-
 enum wmi_cmd_id {
         WMI_ECHO_CMDID = 0x0001,
         WMI_ACCESS_MEMORY_CMDID,
@@ -104,7 +100,7 @@ struct wmi {
         u32 cmd_rsp_len;
         bool stopped;
 
-        struct sk_buff *wmi_skb;
+        u8 beacon_pending;
         spinlock_t wmi_lock;
 
         atomic_t mwrite_cnt;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 457f07692ac7..d077186da870 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -61,6 +61,8 @@ static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
                               struct ath_tx_status *ts, int txok);
 static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
                              int nbad, int txok, bool update_rc);
+static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
+                              int seqno);
 
 enum {
         MCS_HT20,
@@ -143,18 +145,23 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
         struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
         struct ath_buf *bf;
         struct list_head bf_head;
-        INIT_LIST_HEAD(&bf_head);
+        struct ath_tx_status ts;
 
-        WARN_ON(!tid->paused);
+        INIT_LIST_HEAD(&bf_head);
 
+        memset(&ts, 0, sizeof(ts));
         spin_lock_bh(&txq->axq_lock);
-        tid->paused = false;
 
         while (!list_empty(&tid->buf_q)) {
                 bf = list_first_entry(&tid->buf_q, struct ath_buf, list);
-                BUG_ON(bf_isretried(bf));
                 list_move_tail(&bf->list, &bf_head);
-                ath_tx_send_ht_normal(sc, txq, tid, &bf_head);
+
+                if (bf_isretried(bf)) {
+                        ath_tx_update_baw(sc, tid, bf->bf_seqno);
+                        ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
+                } else {
+                        ath_tx_send_ht_normal(sc, txq, tid, &bf_head);
+                }
         }
 
         spin_unlock_bh(&txq->axq_lock);
@@ -168,9 +175,9 @@ static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
         index  = ATH_BA_INDEX(tid->seq_start, seqno);
         cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
 
-        tid->tx_buf[cindex] = NULL;
+        __clear_bit(cindex, tid->tx_buf);
 
-        while (tid->baw_head != tid->baw_tail && !tid->tx_buf[tid->baw_head]) {
+        while (tid->baw_head != tid->baw_tail && !test_bit(tid->baw_head, tid->tx_buf)) {
                 INCR(tid->seq_start, IEEE80211_SEQ_MAX);
                 INCR(tid->baw_head, ATH_TID_MAX_BUFS);
         }
@@ -186,9 +193,7 @@ static void ath_tx_addto_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
 
         index  = ATH_BA_INDEX(tid->seq_start, bf->bf_seqno);
         cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
-
-        BUG_ON(tid->tx_buf[cindex] != NULL);
-        tid->tx_buf[cindex] = bf;
+        __set_bit(cindex, tid->tx_buf);
 
         if (index >= ((tid->baw_tail - tid->baw_head) &
                 (ATH_TID_MAX_BUFS - 1))) {
@@ -289,7 +294,6 @@ static struct ath_buf* ath_clone_txbuf(struct ath_softc *sc, struct ath_buf *bf)
         tbf->bf_buf_addr = bf->bf_buf_addr;
         memcpy(tbf->bf_desc, bf->bf_desc, sc->sc_ah->caps.tx_desc_len);
         tbf->bf_state = bf->bf_state;
-        tbf->bf_dmacontext = bf->bf_dmacontext;
 
         return tbf;
 }
@@ -312,6 +316,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
         bool rc_update = true;
         struct ieee80211_tx_rate rates[4];
+        int nframes;
 
         skb = bf->bf_mpdu;
         hdr = (struct ieee80211_hdr *)skb->data;
@@ -320,11 +325,11 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         hw = bf->aphy->hw;
 
         memcpy(rates, tx_info->control.rates, sizeof(rates));
+        nframes = bf->bf_nframes;
 
         rcu_read_lock();
 
-        /* XXX: use ieee80211_find_sta! */
-        sta = ieee80211_find_sta_by_hw(hw, hdr->addr1);
+        sta = ieee80211_find_sta_by_ifaddr(hw, hdr->addr1, hdr->addr2);
         if (!sta) {
                 rcu_read_unlock();
 
@@ -337,7 +342,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                             !bf->bf_stale || bf_next != NULL)
                                 list_move_tail(&bf->list, &bf_head);
 
-                        ath_tx_rc_status(bf, ts, 0, 0, false);
+                        ath_tx_rc_status(bf, ts, 1, 0, false);
                         ath_tx_complete_buf(sc, bf, txq, &bf_head, ts,
                                 0, 0);
 
@@ -431,7 +436,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                         list_move_tail(&bf->list, &bf_head);
                 }
 
-                if (!txpending) {
+                if (!txpending || (tid->state & AGGR_CLEANUP)) {
                         /*
                          * complete the acked-ones/xretried ones; update
                          * block-ack window
@@ -442,6 +447,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
 
                         if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) {
                                 memcpy(tx_info->control.rates, rates, sizeof(rates));
+                                bf->bf_nframes = nframes;
                                 ath_tx_rc_status(bf, ts, nbad, txok, true);
                                 rc_update = false;
                         } else {
@@ -510,15 +516,12 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         }
 
         if (tid->state & AGGR_CLEANUP) {
+                ath_tx_flush_tid(sc, tid);
+
                 if (tid->baw_head == tid->baw_tail) {
                         tid->state &= ~AGGR_ADDBA_COMPLETE;
                         tid->state &= ~AGGR_CLEANUP;
-
-                        /* send buffered frames as singles */
-                        ath_tx_flush_tid(sc, tid);
                 }
-                rcu_read_unlock();
-                return;
         }
 
         rcu_read_unlock();
@@ -785,17 +788,23 @@ static void ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
                  status != ATH_AGGR_BAW_CLOSED);
 }
 
-void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
-                       u16 tid, u16 *ssn)
+int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
+                      u16 tid, u16 *ssn)
 {
         struct ath_atx_tid *txtid;
         struct ath_node *an;
 
         an = (struct ath_node *)sta->drv_priv;
         txtid = ATH_AN_2_TID(an, tid);
+
+        if (txtid->state & (AGGR_CLEANUP | AGGR_ADDBA_COMPLETE))
+                return -EAGAIN;
+
         txtid->state |= AGGR_ADDBA_PROGRESS;
         txtid->paused = true;
         *ssn = txtid->seq_start;
+
+        return 0;
 }
 
 void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
@@ -803,12 +812,6 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
         struct ath_node *an = (struct ath_node *)sta->drv_priv;
         struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
         struct ath_txq *txq = &sc->tx.txq[txtid->ac->qnum];
-        struct ath_tx_status ts;
-        struct ath_buf *bf;
-        struct list_head bf_head;
-
-        memset(&ts, 0, sizeof(ts));
-        INIT_LIST_HEAD(&bf_head);
 
         if (txtid->state & AGGR_CLEANUP)
                 return;
@@ -818,31 +821,22 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
                 return;
         }
 
-        /* drop all software retried frames and mark this TID */
         spin_lock_bh(&txq->axq_lock);
         txtid->paused = true;
-        while (!list_empty(&txtid->buf_q)) {
-                bf = list_first_entry(&txtid->buf_q, struct ath_buf, list);
-                if (!bf_isretried(bf)) {
-                        /*
-                         * NB: it's based on the assumption that
-                         * software retried frame will always stay
-                         * at the head of software queue.
-                         */
-                        break;
-                }
-                list_move_tail(&bf->list, &bf_head);
-                ath_tx_update_baw(sc, txtid, bf->bf_seqno);
-                ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
-        }
-        spin_unlock_bh(&txq->axq_lock);
 
-        if (txtid->baw_head != txtid->baw_tail) {
+        /*
+         * If frames are still being transmitted for this TID, they will be
+         * cleaned up during tx completion. To prevent race conditions, this
+         * TID can only be reused after all in-progress subframes have been
+         * completed.
+         */
+        if (txtid->baw_head != txtid->baw_tail)
                 txtid->state |= AGGR_CLEANUP;
-        } else {
+        else
                 txtid->state &= ~AGGR_ADDBA_COMPLETE;
-                ath_tx_flush_tid(sc, txtid);
-        }
+        spin_unlock_bh(&txq->axq_lock);
+
+        ath_tx_flush_tid(sc, txtid);
 }
 
 void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
@@ -862,20 +856,6 @@ void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid
         }
 }
 
-bool ath_tx_aggr_check(struct ath_softc *sc, struct ath_node *an, u8 tidno)
-{
-        struct ath_atx_tid *txtid;
-
-        if (!(sc->sc_flags & SC_OP_TXAGGR))
-                return false;
-
-        txtid = ATH_AN_2_TID(an, tidno);
-
-        if (!(txtid->state & (AGGR_ADDBA_COMPLETE | AGGR_ADDBA_PROGRESS)))
-                        return true;
-        return false;
-}
-
 /********************/
 /* Queue Management */
 /********************/
@@ -1659,24 +1639,16 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
 
         bf->bf_mpdu = skb;
 
-        bf->bf_dmacontext = dma_map_single(sc->dev, skb->data,
-                                           skb->len, DMA_TO_DEVICE);
-        if (unlikely(dma_mapping_error(sc->dev, bf->bf_dmacontext))) {
+        bf->bf_buf_addr = dma_map_single(sc->dev, skb->data,
+                                         skb->len, DMA_TO_DEVICE);
+        if (unlikely(dma_mapping_error(sc->dev, bf->bf_buf_addr))) {
                 bf->bf_mpdu = NULL;
+                bf->bf_buf_addr = 0;
                 ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
                           "dma_mapping_error() on TX\n");
                 return -ENOMEM;
         }
 
-        bf->bf_buf_addr = bf->bf_dmacontext;
-
-        /* tag if this is a nullfunc frame to enable PS when AP acks it */
-        if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc)) {
-                bf->bf_isnullfunc = true;
-                sc->ps_flags &= ~PS_NULLFUNC_COMPLETED;
-        } else
-                bf->bf_isnullfunc = false;
-
         bf->bf_tx_aborted = false;
 
         return 0;
@@ -1940,7 +1912,8 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
                         tx_flags |= ATH_TX_XRETRY;
         }
 
-        dma_unmap_single(sc->dev, bf->bf_dmacontext, skb->len, DMA_TO_DEVICE);
+        dma_unmap_single(sc->dev, bf->bf_buf_addr, skb->len, DMA_TO_DEVICE);
+        bf->bf_buf_addr = 0;
 
         if (bf->bf_state.bfs_paprd) {
                 if (time_after(jiffies,
@@ -1950,9 +1923,13 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
                 else
                         complete(&sc->paprd_complete);
         } else {
-                ath_tx_complete(sc, skb, bf->aphy, tx_flags);
                 ath_debug_stat_tx(sc, txq, bf, ts);
+                ath_tx_complete(sc, skb, bf->aphy, tx_flags);
         }
+        /* At this point, skb (bf->bf_mpdu) is consumed...make sure we don't
+         * accidentally reference it later.
+         */
+        bf->bf_mpdu = NULL;
 
         /*
          * Return the list of ath_buf of this mpdu to free queue
@@ -2008,9 +1985,15 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
 
         if (ts->ts_status & ATH9K_TXERR_FILT)
                 tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
-        if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && update_rc)
+        if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && update_rc) {
                 tx_info->flags |= IEEE80211_TX_STAT_AMPDU;
 
+                BUG_ON(nbad > bf->bf_nframes);
+
+                tx_info->status.ampdu_len = bf->bf_nframes;
+                tx_info->status.ampdu_ack_len = bf->bf_nframes - nbad;
+        }
+
         if ((ts->ts_status & ATH9K_TXERR_FILT) == 0 &&
             (bf->bf_flags & ATH9K_TXDESC_NOACK) == 0 && update_rc) {
                 if (ieee80211_is_data(hdr->frame_control)) {
@@ -2020,8 +2003,6 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
                         if ((ts->ts_status & ATH9K_TXERR_XRETRY) ||
                             (ts->ts_status & ATH9K_TXERR_FIFO))
                                 tx_info->pad[0] |= ATH_TX_INFO_XRETRY;
-                        tx_info->status.ampdu_len = bf->bf_nframes;
-                        tx_info->status.ampdu_ack_len = bf->bf_nframes - nbad;
                 }
         }
 
@@ -2104,18 +2085,6 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                 }
 
                 /*
-                 * We now know the nullfunc frame has been ACKed so we
-                 * can disable RX.
-                 */
-                if (bf->bf_isnullfunc &&
-                    (ts.ts_status & ATH9K_TX_ACKED)) {
-                        if ((sc->ps_flags & PS_ENABLED))
-                                ath9k_enable_ps(sc);
-                        else
-                                sc->ps_flags |= PS_NULLFUNC_COMPLETED;
-                }
-
-                /*
                  * Remove ath_buf's of the same transmit unit from txq,
                  * however leave the last descriptor back as the holding
                  * descriptor for hw.
@@ -2143,7 +2112,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                          */
                         if (ts.ts_status & ATH9K_TXERR_XRETRY)
                                 bf->bf_state.bf_type |= BUF_XRETRY;
-                        ath_tx_rc_status(bf, &ts, 0, txok, true);
+                        ath_tx_rc_status(bf, &ts, txok ? 0 : 1, txok, true);
                 }
 
                 if (bf_isampdu(bf))
@@ -2258,21 +2227,10 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
 
                 txok = !(txs.ts_status & ATH9K_TXERR_MASK);
 
-                /*
-                 * Make sure null func frame is acked before configuring
-                 * hw into ps mode.
-                 */
-                if (bf->bf_isnullfunc && txok) {
-                        if ((sc->ps_flags & PS_ENABLED))
-                                ath9k_enable_ps(sc);
-                        else
-                                sc->ps_flags |= PS_NULLFUNC_COMPLETED;
-                }
-
                 if (!bf_isampdu(bf)) {
                         if (txs.ts_status & ATH9K_TXERR_XRETRY)
                                 bf->bf_state.bf_type |= BUF_XRETRY;
-                        ath_tx_rc_status(bf, &txs, 0, txok, true);
+                        ath_tx_rc_status(bf, &txs, txok ? 0 : 1, txok, true);
                 }
 
                 if (bf_isampdu(bf))
diff --git a/drivers/net/wireless/ath/carl9170/Kconfig b/drivers/net/wireless/ath/carl9170/Kconfig
new file mode 100644
index 000000000000..2d1b821b440d
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/Kconfig
@@ -0,0 +1,41 @@
+config CARL9170
+        tristate "Linux Community AR9170 802.11n USB support"
+        depends on USB && MAC80211 && EXPERIMENTAL
+        select FW_LOADER
+        select CRC32
+        help
+          This is another driver for the Atheros "otus" 802.11n USB devices.
+
+          This driver provides more features than the original,
+          but it needs a special firmware (carl9170-1.fw) to do that.
+
+          The firmware can be downloaded from our wiki here:
+          <http://wireless.kernel.org/en/users/Drivers/carl9170>
+
+          If you choose to build a module, it'll be called carl9170.
+
+config CARL9170_LEDS
+        bool "SoftLED Support"
+        depends on CARL9170
+        select MAC80211_LEDS
+        select LEDS_CLASS
+        select NEW_LEDS
+        default y
+        help
+          This option is necessary, if you want your device' LEDs to blink
+
+          Say Y, unless you need the LEDs for firmware debugging.
+
+config CARL9170_DEBUGFS
+        bool "DebugFS Support"
+        depends on CARL9170 && DEBUG_FS && MAC80211_DEBUGFS
+        default n
+        help
+          Export several driver and device internals to user space.
+
+          Say N.
+
+config CARL9170_WPC
+        bool
+        depends on CARL9170 && (INPUT = y || INPUT = CARL9170)
+        default y
diff --git a/drivers/net/wireless/ath/carl9170/Makefile b/drivers/net/wireless/ath/carl9170/Makefile
new file mode 100644
index 000000000000..f64ed76af8ad
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/Makefile
@@ -0,0 +1,4 @@
+carl9170-objs := main.o usb.o cmd.o mac.o phy.o led.o fw.o tx.o rx.o
+carl9170-$(CONFIG_CARL9170_DEBUGFS) += debug.o
+
+obj-$(CONFIG_CARL9170) += carl9170.o
diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
new file mode 100644
index 000000000000..6cf0c9ef47aa
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -0,0 +1,628 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * Driver specific definitions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __CARL9170_H
+#define __CARL9170_H
+
+#include <linux/kernel.h>
+#include <linux/firmware.h>
+#include <linux/completion.h>
+#include <linux/spinlock.h>
+#include <net/cfg80211.h>
+#include <net/mac80211.h>
+#include <linux/usb.h>
+#ifdef CONFIG_CARL9170_LEDS
+#include <linux/leds.h>
+#endif /* CONFIG_CARL170_LEDS */
+#ifdef CONFIG_CARL9170_WPC
+#include <linux/input.h>
+#endif /* CONFIG_CARL9170_WPC */
+#include "eeprom.h"
+#include "wlan.h"
+#include "hw.h"
+#include "fwdesc.h"
+#include "fwcmd.h"
+#include "../regd.h"
+
+#ifdef CONFIG_CARL9170_DEBUGFS
+#include "debug.h"
+#endif /* CONFIG_CARL9170_DEBUGFS */
+
+#define CARL9170FW_NAME "carl9170-1.fw"
+
+#define PAYLOAD_MAX     (CARL9170_MAX_CMD_LEN / 4 - 1)
+
+enum carl9170_rf_init_mode {
+        CARL9170_RFI_NONE,
+        CARL9170_RFI_WARM,
+        CARL9170_RFI_COLD,
+};
+
+#define CARL9170_MAX_RX_BUFFER_SIZE             8192
+
+enum carl9170_device_state {
+        CARL9170_UNKNOWN_STATE,
+        CARL9170_STOPPED,
+        CARL9170_IDLE,
+        CARL9170_STARTED,
+};
+
+#define CARL9170_NUM_TID                16
+#define WME_BA_BMP_SIZE                 64
+#define CARL9170_TX_USER_RATE_TRIES     3
+
+#define WME_AC_BE   2
+#define WME_AC_BK   3
+#define WME_AC_VI   1
+#define WME_AC_VO   0
+
+#define TID_TO_WME_AC(_tid)                             \
+        ((((_tid) == 0) || ((_tid) == 3)) ? WME_AC_BE : \
+         (((_tid) == 1) || ((_tid) == 2)) ? WME_AC_BK : \
+         (((_tid) == 4) || ((_tid) == 5)) ? WME_AC_VI : \
+         WME_AC_VO)
+
+#define SEQ_DIFF(_start, _seq) \
+        (((_start) - (_seq)) & 0x0fff)
+#define SEQ_PREV(_seq) \
+        (((_seq) - 1) & 0x0fff)
+#define SEQ_NEXT(_seq) \
+        (((_seq) + 1) & 0x0fff)
+#define BAW_WITHIN(_start, _bawsz, _seqno) \
+        ((((_seqno) - (_start)) & 0xfff) < (_bawsz))
+
+enum carl9170_tid_state {
+        CARL9170_TID_STATE_INVALID,
+        CARL9170_TID_STATE_KILLED,
+        CARL9170_TID_STATE_SHUTDOWN,
+        CARL9170_TID_STATE_SUSPEND,
+        CARL9170_TID_STATE_PROGRESS,
+        CARL9170_TID_STATE_IDLE,
+        CARL9170_TID_STATE_XMIT,
+};
+
+#define CARL9170_BAW_BITS (2 * WME_BA_BMP_SIZE)
+#define CARL9170_BAW_SIZE (BITS_TO_LONGS(CARL9170_BAW_BITS))
+#define CARL9170_BAW_LEN (DIV_ROUND_UP(CARL9170_BAW_BITS, BITS_PER_BYTE))
+
+struct carl9170_sta_tid {
+        /* must be the first entry! */
+        struct list_head list;
+
+        /* temporary list for RCU unlink procedure */
+        struct list_head tmp_list;
+
+        /* lock for the following data structures */
+        spinlock_t lock;
+
+        unsigned int counter;
+        enum carl9170_tid_state state;
+        u8 tid;         /* TID number ( 0 - 15 ) */
+        u16 max;        /* max. AMPDU size */
+
+        u16 snx;        /* awaiting _next_ frame */
+        u16 hsn;        /* highest _queued_ sequence */
+        u16 bsn;        /* base of the tx/agg bitmap */
+        unsigned long bitmap[CARL9170_BAW_SIZE];
+
+        /* Preaggregation reorder queue */
+        struct sk_buff_head queue;
+};
+
+#define CARL9170_QUEUE_TIMEOUT          256
+#define CARL9170_BUMP_QUEUE             1000
+#define CARL9170_TX_TIMEOUT             2500
+#define CARL9170_JANITOR_DELAY          128
+#define CARL9170_QUEUE_STUCK_TIMEOUT    5500
+
+#define CARL9170_NUM_TX_AGG_MAX         30
+
+/*
+ * Tradeoff between stability/latency and speed.
+ *
+ * AR9170_TXQ_DEPTH is devised by dividing the amount of available
+ * tx buffers with the size of a full ethernet frame + overhead.
+ *
+ * Naturally: The higher the limit, the faster the device CAN send.
+ * However, even a slight over-commitment at the wrong time and the
+ * hardware is doomed to send all already-queued frames at suboptimal
+ * rates. This in turn leads to an enourmous amount of unsuccessful
+ * retries => Latency goes up, whereas the throughput goes down. CRASH!
+ */
+#define CARL9170_NUM_TX_LIMIT_HARD      ((AR9170_TXQ_DEPTH * 3) / 2)
+#define CARL9170_NUM_TX_LIMIT_SOFT      (AR9170_TXQ_DEPTH)
+
+struct carl9170_tx_queue_stats {
+        unsigned int count;
+        unsigned int limit;
+        unsigned int len;
+};
+
+struct carl9170_vif {
+        unsigned int id;
+        struct ieee80211_vif *vif;
+};
+
+struct carl9170_vif_info {
+        struct list_head list;
+        bool active;
+        unsigned int id;
+        struct sk_buff *beacon;
+        bool enable_beacon;
+};
+
+#define AR9170_NUM_RX_URBS      16
+#define AR9170_NUM_RX_URBS_MUL  2
+#define AR9170_NUM_TX_URBS      8
+#define AR9170_NUM_RX_URBS_POOL (AR9170_NUM_RX_URBS_MUL * AR9170_NUM_RX_URBS)
+
+enum carl9170_device_features {
+        CARL9170_WPS_BUTTON             = BIT(0),
+        CARL9170_ONE_LED                = BIT(1),
+};
+
+#ifdef CONFIG_CARL9170_LEDS
+struct ar9170;
+
+struct carl9170_led {
+        struct ar9170 *ar;
+        struct led_classdev l;
+        char name[32];
+        unsigned int toggled;
+        bool last_state;
+        bool registered;
+};
+#endif /* CONFIG_CARL9170_LEDS */
+
+enum carl9170_restart_reasons {
+        CARL9170_RR_NO_REASON = 0,
+        CARL9170_RR_FATAL_FIRMWARE_ERROR,
+        CARL9170_RR_TOO_MANY_FIRMWARE_ERRORS,
+        CARL9170_RR_WATCHDOG,
+        CARL9170_RR_STUCK_TX,
+        CARL9170_RR_SLOW_SYSTEM,
+        CARL9170_RR_COMMAND_TIMEOUT,
+        CARL9170_RR_TOO_MANY_PHY_ERRORS,
+        CARL9170_RR_LOST_RSP,
+        CARL9170_RR_INVALID_RSP,
+        CARL9170_RR_USER_REQUEST,
+
+        __CARL9170_RR_LAST,
+};
+
+enum carl9170_erp_modes {
+        CARL9170_ERP_INVALID,
+        CARL9170_ERP_AUTO,
+        CARL9170_ERP_MAC80211,
+        CARL9170_ERP_OFF,
+        CARL9170_ERP_CTS,
+        CARL9170_ERP_RTS,
+        __CARL9170_ERP_NUM,
+};
+
+struct ar9170 {
+        struct ath_common common;
+        struct ieee80211_hw *hw;
+        struct mutex mutex;
+        enum carl9170_device_state state;
+        spinlock_t state_lock;
+        enum carl9170_restart_reasons last_reason;
+        bool registered;
+
+        /* USB */
+        struct usb_device *udev;
+        struct usb_interface *intf;
+        struct usb_anchor rx_anch;
+        struct usb_anchor rx_work;
+        struct usb_anchor rx_pool;
+        struct usb_anchor tx_wait;
+        struct usb_anchor tx_anch;
+        struct usb_anchor tx_cmd;
+        struct usb_anchor tx_err;
+        struct tasklet_struct usb_tasklet;
+        atomic_t tx_cmd_urbs;
+        atomic_t tx_anch_urbs;
+        atomic_t rx_anch_urbs;
+        atomic_t rx_work_urbs;
+        atomic_t rx_pool_urbs;
+        kernel_ulong_t features;
+
+        /* firmware settings */
+        struct completion fw_load_wait;
+        struct completion fw_boot_wait;
+        struct {
+                const struct carl9170fw_desc_head *desc;
+                const struct firmware *fw;
+                unsigned int offset;
+                unsigned int address;
+                unsigned int cmd_bufs;
+                unsigned int api_version;
+                unsigned int vif_num;
+                unsigned int err_counter;
+                unsigned int bug_counter;
+                u32 beacon_addr;
+                unsigned int beacon_max_len;
+                bool rx_stream;
+                bool tx_stream;
+                bool rx_filter;
+                unsigned int mem_blocks;
+                unsigned int mem_block_size;
+                unsigned int rx_size;
+        } fw;
+
+        /* reset / stuck frames/queue detection */
+        struct work_struct restart_work;
+        unsigned int restart_counter;
+        unsigned long queue_stop_timeout[__AR9170_NUM_TXQ];
+        unsigned long max_queue_stop_timeout[__AR9170_NUM_TXQ];
+        bool needs_full_reset;
+        atomic_t pending_restarts;
+
+        /* interface mode settings */
+        struct list_head vif_list;
+        unsigned long vif_bitmap;
+        unsigned int vifs;
+        struct carl9170_vif vif_priv[AR9170_MAX_VIRTUAL_MAC];
+
+        /* beaconing */
+        spinlock_t beacon_lock;
+        unsigned int global_pretbtt;
+        unsigned int global_beacon_int;
+        struct carl9170_vif_info *beacon_iter;
+        unsigned int beacon_enabled;
+
+        /* cryptographic engine */
+        u64 usedkeys;
+        bool rx_software_decryption;
+        bool disable_offload;
+
+        /* filter settings */
+        u64 cur_mc_hash;
+        u32 cur_filter;
+        unsigned int filter_state;
+        unsigned int rx_filter_caps;
+        bool sniffer_enabled;
+
+        /* MAC */
+        enum carl9170_erp_modes erp_mode;
+
+        /* PHY */
+        struct ieee80211_channel *channel;
+        int noise[4];
+        unsigned int chan_fail;
+        unsigned int total_chan_fail;
+        u8 heavy_clip;
+        u8 ht_settings;
+
+        /* power calibration data */
+        u8 power_5G_leg[4];
+        u8 power_2G_cck[4];
+        u8 power_2G_ofdm[4];
+        u8 power_5G_ht20[8];
+        u8 power_5G_ht40[8];
+        u8 power_2G_ht20[8];
+        u8 power_2G_ht40[8];
+
+#ifdef CONFIG_CARL9170_LEDS
+        /* LED */
+        struct delayed_work led_work;
+        struct carl9170_led leds[AR9170_NUM_LEDS];
+#endif /* CONFIG_CARL9170_LEDS */
+
+        /* qos queue settings */
+        spinlock_t tx_stats_lock;
+        struct carl9170_tx_queue_stats tx_stats[__AR9170_NUM_TXQ];
+        struct ieee80211_tx_queue_params edcf[5];
+        struct completion tx_flush;
+
+        /* CMD */
+        int cmd_seq;
+        int readlen;
+        u8 *readbuf;
+        spinlock_t cmd_lock;
+        struct completion cmd_wait;
+        union {
+                __le32 cmd_buf[PAYLOAD_MAX + 1];
+                struct carl9170_cmd cmd;
+                struct carl9170_rsp rsp;
+        };
+
+        /* statistics */
+        unsigned int tx_dropped;
+        unsigned int tx_ack_failures;
+        unsigned int tx_fcs_errors;
+        unsigned int rx_dropped;
+
+        /* EEPROM */
+        struct ar9170_eeprom eeprom;
+
+        /* tx queuing */
+        struct sk_buff_head tx_pending[__AR9170_NUM_TXQ];
+        struct sk_buff_head tx_status[__AR9170_NUM_TXQ];
+        struct delayed_work tx_janitor;
+        unsigned long tx_janitor_last_run;
+        bool tx_schedule;
+
+        /* tx ampdu */
+        struct work_struct ampdu_work;
+        spinlock_t tx_ampdu_list_lock;
+        struct carl9170_sta_tid *tx_ampdu_iter;
+        struct list_head tx_ampdu_list;
+        atomic_t tx_ampdu_upload;
+        atomic_t tx_ampdu_scheduler;
+        atomic_t tx_total_pending;
+        atomic_t tx_total_queued;
+        unsigned int tx_ampdu_list_len;
+        int current_density;
+        int current_factor;
+        bool tx_ampdu_schedule;
+
+        /* internal memory management */
+        spinlock_t mem_lock;
+        unsigned long *mem_bitmap;
+        atomic_t mem_free_blocks;
+        atomic_t mem_allocs;
+
+        /* rxstream mpdu merge */
+        struct ar9170_rx_head rx_plcp;
+        bool rx_has_plcp;
+        struct sk_buff *rx_failover;
+        int rx_failover_missing;
+
+#ifdef CONFIG_CARL9170_WPC
+        struct {
+                bool pbc_state;
+                struct input_dev *pbc;
+                char name[32];
+                char phys[32];
+        } wps;
+#endif /* CONFIG_CARL9170_WPC */
+
+#ifdef CONFIG_CARL9170_DEBUGFS
+        struct carl9170_debug debug;
+        struct dentry *debug_dir;
+#endif /* CONFIG_CARL9170_DEBUGFS */
+
+        /* PSM */
+        struct work_struct ps_work;
+        struct {
+                unsigned int dtim_counter;
+                unsigned long last_beacon;
+                unsigned long last_action;
+                unsigned long last_slept;
+                unsigned int sleep_ms;
+                unsigned int off_override;
+                bool state;
+        } ps;
+};
+
+enum carl9170_ps_off_override_reasons {
+        PS_OFF_VIF      = BIT(0),
+        PS_OFF_BCN      = BIT(1),
+        PS_OFF_5GHZ     = BIT(2),
+};
+
+struct carl9170_ba_stats {
+        u8 ampdu_len;
+        u8 ampdu_ack_len;
+        bool clear;
+};
+
+struct carl9170_sta_info {
+        bool ht_sta;
+        unsigned int ampdu_max_len;
+        struct carl9170_sta_tid *agg[CARL9170_NUM_TID];
+        struct carl9170_ba_stats stats[CARL9170_NUM_TID];
+};
+
+struct carl9170_tx_info {
+        unsigned long timeout;
+        struct ar9170 *ar;
+        struct kref ref;
+};
+
+#define CHK_DEV_STATE(a, s)     (((struct ar9170 *)a)->state >= (s))
+#define IS_INITIALIZED(a)       (CHK_DEV_STATE(a, CARL9170_STOPPED))
+#define IS_ACCEPTING_CMD(a)     (CHK_DEV_STATE(a, CARL9170_IDLE))
+#define IS_STARTED(a)           (CHK_DEV_STATE(a, CARL9170_STARTED))
+
+static inline void __carl9170_set_state(struct ar9170 *ar,
+        enum carl9170_device_state newstate)
+{
+        ar->state = newstate;
+}
+
+static inline void carl9170_set_state(struct ar9170 *ar,
+        enum carl9170_device_state newstate)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&ar->state_lock, flags);
+        __carl9170_set_state(ar, newstate);
+        spin_unlock_irqrestore(&ar->state_lock, flags);
+}
+
+static inline void carl9170_set_state_when(struct ar9170 *ar,
+        enum carl9170_device_state min, enum carl9170_device_state newstate)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&ar->state_lock, flags);
+        if (CHK_DEV_STATE(ar, min))
+                __carl9170_set_state(ar, newstate);
+        spin_unlock_irqrestore(&ar->state_lock, flags);
+}
+
+/* exported interface */
+void *carl9170_alloc(size_t priv_size);
+int carl9170_register(struct ar9170 *ar);
+void carl9170_unregister(struct ar9170 *ar);
+void carl9170_free(struct ar9170 *ar);
+void carl9170_restart(struct ar9170 *ar, const enum carl9170_restart_reasons r);
+void carl9170_ps_check(struct ar9170 *ar);
+
+/* USB back-end */
+int carl9170_usb_open(struct ar9170 *ar);
+void carl9170_usb_stop(struct ar9170 *ar);
+void carl9170_usb_tx(struct ar9170 *ar, struct sk_buff *skb);
+void carl9170_usb_handle_tx_err(struct ar9170 *ar);
+int carl9170_exec_cmd(struct ar9170 *ar, const enum carl9170_cmd_oids,
+                      u32 plen, void *payload, u32 rlen, void *resp);
+int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd,
+                        const bool free_buf);
+int carl9170_usb_restart(struct ar9170 *ar);
+void carl9170_usb_reset(struct ar9170 *ar);
+
+/* MAC */
+int carl9170_init_mac(struct ar9170 *ar);
+int carl9170_set_qos(struct ar9170 *ar);
+int carl9170_update_multicast(struct ar9170 *ar, const u64 mc_hast);
+int carl9170_mod_virtual_mac(struct ar9170 *ar, const unsigned int id,
+                             const u8 *mac);
+int carl9170_set_operating_mode(struct ar9170 *ar);
+int carl9170_set_beacon_timers(struct ar9170 *ar);
+int carl9170_set_dyn_sifs_ack(struct ar9170 *ar);
+int carl9170_set_rts_cts_rate(struct ar9170 *ar);
+int carl9170_set_ampdu_settings(struct ar9170 *ar);
+int carl9170_set_slot_time(struct ar9170 *ar);
+int carl9170_set_mac_rates(struct ar9170 *ar);
+int carl9170_set_hwretry_limit(struct ar9170 *ar, const u32 max_retry);
+int carl9170_update_beacon(struct ar9170 *ar, const bool submit);
+int carl9170_upload_key(struct ar9170 *ar, const u8 id, const u8 *mac,
+        const u8 ktype, const u8 keyidx, const u8 *keydata, const int keylen);
+int carl9170_disable_key(struct ar9170 *ar, const u8 id);
+
+/* RX */
+void carl9170_rx(struct ar9170 *ar, void *buf, unsigned int len);
+void carl9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len);
+
+/* TX */
+int carl9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
+void carl9170_tx_janitor(struct work_struct *work);
+void carl9170_tx_process_status(struct ar9170 *ar,
+                                const struct carl9170_rsp *cmd);
+void carl9170_tx_status(struct ar9170 *ar, struct sk_buff *skb,
+                        const bool success);
+void carl9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb);
+void carl9170_tx_drop(struct ar9170 *ar, struct sk_buff *skb);
+void carl9170_tx_scheduler(struct ar9170 *ar);
+void carl9170_tx_get_skb(struct sk_buff *skb);
+int carl9170_tx_put_skb(struct sk_buff *skb);
+
+/* LEDs */
+#ifdef CONFIG_CARL9170_LEDS
+int carl9170_led_register(struct ar9170 *ar);
+void carl9170_led_unregister(struct ar9170 *ar);
+#endif /* CONFIG_CARL9170_LEDS */
+int carl9170_led_init(struct ar9170 *ar);
+int carl9170_led_set_state(struct ar9170 *ar, const u32 led_state);
+
+/* PHY / RF */
+int carl9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
+        enum nl80211_channel_type bw, enum carl9170_rf_init_mode rfi);
+int carl9170_get_noisefloor(struct ar9170 *ar);
+
+/* FW */
+int carl9170_parse_firmware(struct ar9170 *ar);
+int carl9170_fw_fix_eeprom(struct ar9170 *ar);
+
+extern struct ieee80211_rate __carl9170_ratetable[];
+extern int modparam_noht;
+
+static inline struct ar9170 *carl9170_get_priv(struct carl9170_vif *carl_vif)
+{
+        return container_of(carl_vif, struct ar9170,
+                            vif_priv[carl_vif->id]);
+}
+
+static inline struct ieee80211_hdr *carl9170_get_hdr(struct sk_buff *skb)
+{
+        return (void *)((struct _carl9170_tx_superframe *)
+                skb->data)->frame_data;
+}
+
+static inline u16 get_seq_h(struct ieee80211_hdr *hdr)
+{
+        return le16_to_cpu(hdr->seq_ctrl) >> 4;
+}
+
+static inline u16 carl9170_get_seq(struct sk_buff *skb)
+{
+        return get_seq_h(carl9170_get_hdr(skb));
+}
+
+static inline u16 get_tid_h(struct ieee80211_hdr *hdr)
+{
+        return (ieee80211_get_qos_ctl(hdr))[0] & IEEE80211_QOS_CTL_TID_MASK;
+}
+
+static inline u16 carl9170_get_tid(struct sk_buff *skb)
+{
+        return get_tid_h(carl9170_get_hdr(skb));
+}
+
+static inline struct ieee80211_vif *
+carl9170_get_vif(struct carl9170_vif_info *priv)
+{
+        return container_of((void *)priv, struct ieee80211_vif, drv_priv);
+}
+
+/* Protected by ar->mutex or RCU */
+static inline struct ieee80211_vif *carl9170_get_main_vif(struct ar9170 *ar)
+{
+        struct carl9170_vif_info *cvif;
+
+        list_for_each_entry_rcu(cvif, &ar->vif_list, list) {
+                if (cvif->active)
+                        return carl9170_get_vif(cvif);
+        }
+
+        return NULL;
+}
+
+static inline bool is_main_vif(struct ar9170 *ar, struct ieee80211_vif *vif)
+{
+        bool ret;
+
+        rcu_read_lock();
+        ret = (carl9170_get_main_vif(ar) == vif);
+        rcu_read_unlock();
+        return ret;
+}
+
+#endif /* __CARL9170_H */
diff --git a/drivers/net/wireless/ath/carl9170/cmd.c b/drivers/net/wireless/ath/carl9170/cmd.c
new file mode 100644
index 000000000000..c21f3364bfec
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/cmd.c
@@ -0,0 +1,188 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * Basic HW register/memory/command access functions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "carl9170.h"
+#include "cmd.h"
+
+int carl9170_write_reg(struct ar9170 *ar, const u32 reg, const u32 val)
+{
+        __le32 buf[2] = {
+                cpu_to_le32(reg),
+                cpu_to_le32(val),
+        };
+        int err;
+
+        err = carl9170_exec_cmd(ar, CARL9170_CMD_WREG, sizeof(buf),
+                                (u8 *) buf, 0, NULL);
+        if (err) {
+                if (net_ratelimit()) {
+                        wiphy_err(ar->hw->wiphy, "writing reg %#x "
+                                "(val %#x) failed (%d)\n", reg, val, err);
+                }
+        }
+        return err;
+}
+
+int carl9170_read_mreg(struct ar9170 *ar, const int nregs,
+                       const u32 *regs, u32 *out)
+{
+        int i, err;
+        __le32 *offs, *res;
+
+        /* abuse "out" for the register offsets, must be same length */
+        offs = (__le32 *)out;
+        for (i = 0; i < nregs; i++)
+                offs[i] = cpu_to_le32(regs[i]);
+
+        /* also use the same buffer for the input */
+        res = (__le32 *)out;
+
+        err = carl9170_exec_cmd(ar, CARL9170_CMD_RREG,
+                                4 * nregs, (u8 *)offs,
+                                4 * nregs, (u8 *)res);
+        if (err) {
+                if (net_ratelimit()) {
+                        wiphy_err(ar->hw->wiphy, "reading regs failed (%d)\n",
+                                  err);
+                }
+                return err;
+        }
+
+        /* convert result to cpu endian */
+        for (i = 0; i < nregs; i++)
+                out[i] = le32_to_cpu(res[i]);
+
+        return 0;
+}
+
+int carl9170_read_reg(struct ar9170 *ar, u32 reg, u32 *val)
+{
+        return carl9170_read_mreg(ar, 1, &reg, val);
+}
+
+int carl9170_echo_test(struct ar9170 *ar, const u32 v)
+{
+        u32 echores;
+        int err;
+
+        err = carl9170_exec_cmd(ar, CARL9170_CMD_ECHO,
+                                4, (u8 *)&v,
+                                4, (u8 *)&echores);
+        if (err)
+                return err;
+
+        if (v != echores) {
+                wiphy_info(ar->hw->wiphy, "wrong echo %x != %x", v, echores);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+struct carl9170_cmd *carl9170_cmd_buf(struct ar9170 *ar,
+        const enum carl9170_cmd_oids cmd, const unsigned int len)
+{
+        struct carl9170_cmd *tmp;
+
+        tmp = kzalloc(sizeof(struct carl9170_cmd_head) + len, GFP_ATOMIC);
+        if (tmp) {
+                tmp->hdr.cmd = cmd;
+                tmp->hdr.len = len;
+        }
+
+        return tmp;
+}
+
+int carl9170_reboot(struct ar9170 *ar)
+{
+        struct carl9170_cmd *cmd;
+        int err;
+
+        cmd = carl9170_cmd_buf(ar, CARL9170_CMD_REBOOT_ASYNC, 0);
+        if (!cmd)
+                return -ENOMEM;
+
+        err = __carl9170_exec_cmd(ar, (struct carl9170_cmd *)cmd, true);
+        return err;
+}
+
+int carl9170_mac_reset(struct ar9170 *ar)
+{
+        return carl9170_exec_cmd(ar, CARL9170_CMD_SWRST,
+                                 0, NULL, 0, NULL);
+}
+
+int carl9170_bcn_ctrl(struct ar9170 *ar, const unsigned int vif_id,
+                       const u32 mode, const u32 addr, const u32 len)
+{
+        struct carl9170_cmd *cmd;
+
+        cmd = carl9170_cmd_buf(ar, CARL9170_CMD_BCN_CTRL_ASYNC,
+                               sizeof(struct carl9170_bcn_ctrl_cmd));
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->bcn_ctrl.vif_id = cpu_to_le32(vif_id);
+        cmd->bcn_ctrl.mode = cpu_to_le32(mode);
+        cmd->bcn_ctrl.bcn_addr = cpu_to_le32(addr);
+        cmd->bcn_ctrl.bcn_len = cpu_to_le32(len);
+
+        return __carl9170_exec_cmd(ar, cmd, true);
+}
+
+int carl9170_powersave(struct ar9170 *ar, const bool ps)
+{
+        struct carl9170_cmd *cmd;
+        u32 state;
+
+        cmd = carl9170_cmd_buf(ar, CARL9170_CMD_PSM_ASYNC,
+                               sizeof(struct carl9170_psm));
+        if (!cmd)
+                return -ENOMEM;
+
+        if (ps) {
+                /* Sleep until next TBTT */
+                state = CARL9170_PSM_SLEEP | 1;
+        } else {
+                /* wake up immediately */
+                state = 1;
+        }
+
+        cmd->psm.state = cpu_to_le32(state);
+        return __carl9170_exec_cmd(ar, cmd, true);
+}
diff --git a/drivers/net/wireless/ath/carl9170/cmd.h b/drivers/net/wireless/ath/carl9170/cmd.h
new file mode 100644
index 000000000000..f78728c38294
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/cmd.h
@@ -0,0 +1,168 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * Basic HW register/memory/command access functions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __CMD_H
+#define __CMD_H
+
+#include "carl9170.h"
+
+/* basic HW access */
+int carl9170_write_reg(struct ar9170 *ar, const u32 reg, const u32 val);
+int carl9170_read_reg(struct ar9170 *ar, const u32 reg, u32 *val);
+int carl9170_read_mreg(struct ar9170 *ar, const int nregs,
+                       const u32 *regs, u32 *out);
+int carl9170_echo_test(struct ar9170 *ar, u32 v);
+int carl9170_reboot(struct ar9170 *ar);
+int carl9170_mac_reset(struct ar9170 *ar);
+int carl9170_powersave(struct ar9170 *ar, const bool power_on);
+int carl9170_bcn_ctrl(struct ar9170 *ar, const unsigned int vif_id,
+                       const u32 mode, const u32 addr, const u32 len);
+
+static inline int carl9170_flush_cab(struct ar9170 *ar,
+                                     const unsigned int vif_id)
+{
+        return carl9170_bcn_ctrl(ar, vif_id, CARL9170_BCN_CTRL_DRAIN, 0, 0);
+}
+
+static inline int carl9170_rx_filter(struct ar9170 *ar,
+                                     const unsigned int _rx_filter)
+{
+        __le32 rx_filter = cpu_to_le32(_rx_filter);
+
+        return carl9170_exec_cmd(ar, CARL9170_CMD_RX_FILTER,
+                                sizeof(rx_filter), (u8 *)&rx_filter,
+                                0, NULL);
+}
+
+struct carl9170_cmd *carl9170_cmd_buf(struct ar9170 *ar,
+        const enum carl9170_cmd_oids cmd, const unsigned int len);
+
+/*
+ * Macros to facilitate writing multiple registers in a single
+ * write-combining USB command. Note that when the first group
+ * fails the whole thing will fail without any others attempted,
+ * but you won't know which write in the group failed.
+ */
+#define carl9170_regwrite_begin(ar)                                     \
+do {                                                                    \
+        int __nreg = 0, __err = 0;                                      \
+        struct ar9170 *__ar = ar;
+
+#define carl9170_regwrite(r, v) do {                                    \
+        __ar->cmd_buf[2 * __nreg + 1] = cpu_to_le32(r);                 \
+        __ar->cmd_buf[2 * __nreg + 2] = cpu_to_le32(v);                 \
+        __nreg++;                                                       \
+        if ((__nreg >= PAYLOAD_MAX/2)) {                                \
+                if (IS_ACCEPTING_CMD(__ar))                             \
+                        __err = carl9170_exec_cmd(__ar,                 \
+                                CARL9170_CMD_WREG, 8 * __nreg,          \
+                                (u8 *) &__ar->cmd_buf[1], 0, NULL);     \
+                else                                                    \
+                        goto __regwrite_out;                            \
+                                                                        \
+                __nreg = 0;                                             \
+                if (__err)                                              \
+                        goto __regwrite_out;                            \
+        }                                                               \
+} while (0)
+
+#define carl9170_regwrite_finish()                                      \
+__regwrite_out :                                                        \
+        if (__err == 0 && __nreg) {                                     \
+                if (IS_ACCEPTING_CMD(__ar))                             \
+                        __err = carl9170_exec_cmd(__ar,                 \
+                                CARL9170_CMD_WREG, 8 * __nreg,          \
+                                (u8 *) &__ar->cmd_buf[1], 0, NULL);     \
+                __nreg = 0;                                             \
+        }
+
+#define carl9170_regwrite_result()                                      \
+        __err;                                                          \
+} while (0);
+
+
+#define carl9170_async_get_buf()                                        \
+do {                                                                    \
+        __cmd = carl9170_cmd_buf(__carl, CARL9170_CMD_WREG_ASYNC,       \
+                                 CARL9170_MAX_CMD_PAYLOAD_LEN);         \
+        if (__cmd == NULL) {                                            \
+                __err = -ENOMEM;                                        \
+                goto __async_regwrite_out;                              \
+        }                                                               \
+} while (0);
+
+#define carl9170_async_regwrite_begin(carl)                             \
+do {                                                                    \
+        int __nreg = 0, __err = 0;                                      \
+        struct ar9170 *__carl = carl;                                   \
+        struct carl9170_cmd *__cmd;                                     \
+        carl9170_async_get_buf();                                       \
+
+#define carl9170_async_regwrite(r, v) do {                              \
+        __cmd->wreg.regs[__nreg].addr = cpu_to_le32(r);                 \
+        __cmd->wreg.regs[__nreg].val = cpu_to_le32(v);                  \
+        __nreg++;                                                       \
+        if ((__nreg >= PAYLOAD_MAX/2)) {                                \
+                if (IS_ACCEPTING_CMD(__carl)) {                         \
+                        __cmd->hdr.len = 8 * __nreg;                    \
+                        __err = __carl9170_exec_cmd(__carl, __cmd, true);\
+                        __cmd = NULL;                                   \
+                        carl9170_async_get_buf();                       \
+                } else {                                                \
+                        goto __async_regwrite_out;                      \
+                }                                                       \
+                __nreg = 0;                                             \
+                if (__err)                                              \
+                        goto __async_regwrite_out;                      \
+        }                                                               \
+} while (0)
+
+#define carl9170_async_regwrite_finish()                                \
+__async_regwrite_out :                                                  \
+        if (__err == 0 && __nreg) {                                     \
+                __cmd->hdr.len = 8 * __nreg;                            \
+                if (IS_ACCEPTING_CMD(__carl))                           \
+                        __err = __carl9170_exec_cmd(__carl, __cmd, true);\
+                __nreg = 0;                                             \
+        }
+
+#define carl9170_async_regwrite_result()                                \
+        __err;                                                          \
+} while (0);
+
+#endif /* __CMD_H */
diff --git a/drivers/net/wireless/ath/carl9170/debug.c b/drivers/net/wireless/ath/carl9170/debug.c
new file mode 100644
index 000000000000..0ac1124c2a0b
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/debug.c
@@ -0,0 +1,902 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * debug(fs) probing
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2008-2009 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/vmalloc.h>
+#include "carl9170.h"
+#include "cmd.h"
+
+#define ADD(buf, off, max, fmt, args...)                                \
+        off += snprintf(&buf[off], max - off, fmt, ##args);
+
+static int carl9170_debugfs_open(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+        return 0;
+}
+
+struct carl9170_debugfs_fops {
+        unsigned int read_bufsize;
+        mode_t attr;
+        char *(*read)(struct ar9170 *ar, char *buf, size_t bufsize,
+                      ssize_t *len);
+        ssize_t (*write)(struct ar9170 *aru, const char *buf, size_t size);
+        const struct file_operations fops;
+
+        enum carl9170_device_state req_dev_state;
+};
+
+static ssize_t carl9170_debugfs_read(struct file *file, char __user *userbuf,
+                                     size_t count, loff_t *ppos)
+{
+        struct carl9170_debugfs_fops *dfops;
+        struct ar9170 *ar;
+        char *buf = NULL, *res_buf = NULL;
+        ssize_t ret = 0;
+        int err = 0;
+
+        if (!count)
+                return 0;
+
+        ar = file->private_data;
+
+        if (!ar)
+                return -ENODEV;
+        dfops = container_of(file->f_op, struct carl9170_debugfs_fops, fops);
+
+        if (!dfops->read)
+                return -ENOSYS;
+
+        if (dfops->read_bufsize) {
+                buf = vmalloc(dfops->read_bufsize);
+                if (!buf)
+                        return -ENOMEM;
+        }
+
+        mutex_lock(&ar->mutex);
+        if (!CHK_DEV_STATE(ar, dfops->req_dev_state)) {
+                err = -ENODEV;
+                res_buf = buf;
+                goto out_free;
+        }
+
+        res_buf = dfops->read(ar, buf, dfops->read_bufsize, &ret);
+
+        if (ret > 0)
+                err = simple_read_from_buffer(userbuf, count, ppos,
+                                              res_buf, ret);
+        else
+                err = ret;
+
+        WARN_ON_ONCE(dfops->read_bufsize && (res_buf != buf));
+
+out_free:
+        vfree(res_buf);
+        mutex_unlock(&ar->mutex);
+        return err;
+}
+
+static ssize_t carl9170_debugfs_write(struct file *file,
+        const char __user *userbuf, size_t count, loff_t *ppos)
+{
+        struct carl9170_debugfs_fops *dfops;
+        struct ar9170 *ar;
+        char *buf = NULL;
+        int err = 0;
+
+        if (!count)
+                return 0;
+
+        if (count > PAGE_SIZE)
+                return -E2BIG;
+
+        ar = file->private_data;
+
+        if (!ar)
+                return -ENODEV;
+        dfops = container_of(file->f_op, struct carl9170_debugfs_fops, fops);
+
+        if (!dfops->write)
+                return -ENOSYS;
+
+        buf = vmalloc(count);
+        if (!buf)
+                return -ENOMEM;
+
+        if (copy_from_user(buf, userbuf, count)) {
+                err = -EFAULT;
+                goto out_free;
+        }
+
+        if (mutex_trylock(&ar->mutex) == 0) {
+                err = -EAGAIN;
+                goto out_free;
+        }
+
+        if (!CHK_DEV_STATE(ar, dfops->req_dev_state)) {
+                err = -ENODEV;
+                goto out_unlock;
+        }
+
+        err = dfops->write(ar, buf, count);
+        if (err)
+                goto out_unlock;
+
+out_unlock:
+        mutex_unlock(&ar->mutex);
+
+out_free:
+        vfree(buf);
+        return err;
+}
+
+#define __DEBUGFS_DECLARE_FILE(name, _read, _write, _read_bufsize,      \
+                               _attr, _dstate)                          \
+static const struct carl9170_debugfs_fops carl_debugfs_##name ##_ops = {\
+        .read_bufsize = _read_bufsize,                                  \
+        .read = _read,                                                  \
+        .write = _write,                                                \
+        .attr = _attr,                                                  \
+        .req_dev_state = _dstate,                                       \
+        .fops = {                                                       \
+                .open   = carl9170_debugfs_open,                        \
+                .read   = carl9170_debugfs_read,                        \
+                .write  = carl9170_debugfs_write,                       \
+                .owner  = THIS_MODULE                                   \
+        },                                                              \
+}
+
+#define DEBUGFS_DECLARE_FILE(name, _read, _write, _read_bufsize, _attr) \
+        __DEBUGFS_DECLARE_FILE(name, _read, _write, _read_bufsize,      \
+                               _attr, CARL9170_STARTED)                 \
+
+#define DEBUGFS_DECLARE_RO_FILE(name, _read_bufsize)                    \
+        DEBUGFS_DECLARE_FILE(name, carl9170_debugfs_##name ##_read,     \
+                             NULL, _read_bufsize, S_IRUSR)
+
+#define DEBUGFS_DECLARE_WO_FILE(name)                                   \
+        DEBUGFS_DECLARE_FILE(name, NULL, carl9170_debugfs_##name ##_write,\
+                             0, S_IWUSR)
+
+#define DEBUGFS_DECLARE_RW_FILE(name, _read_bufsize)                    \
+        DEBUGFS_DECLARE_FILE(name, carl9170_debugfs_##name ##_read,     \
+                             carl9170_debugfs_##name ##_write,          \
+                             _read_bufsize, S_IRUSR | S_IWUSR)
+
+#define __DEBUGFS_DECLARE_RW_FILE(name, _read_bufsize, _dstate)         \
+        __DEBUGFS_DECLARE_FILE(name, carl9170_debugfs_##name ##_read,   \
+                             carl9170_debugfs_##name ##_write,          \
+                             _read_bufsize, S_IRUSR | S_IWUSR, _dstate)
+
+#define DEBUGFS_READONLY_FILE(name, _read_bufsize, fmt, value...)       \
+static char *carl9170_debugfs_ ##name ## _read(struct ar9170 *ar,       \
+                                             char *buf, size_t buf_size,\
+                                             ssize_t *len)              \
+{                                                                       \
+        ADD(buf, *len, buf_size, fmt "\n", ##value);                    \
+        return buf;                                                     \
+}                                                                       \
+DEBUGFS_DECLARE_RO_FILE(name, _read_bufsize)
+
+static char *carl9170_debugfs_mem_usage_read(struct ar9170 *ar, char *buf,
+                                             size_t bufsize, ssize_t *len)
+{
+        ADD(buf, *len, bufsize, "jar: [");
+
+        spin_lock_bh(&ar->mem_lock);
+
+        *len += bitmap_scnprintf(&buf[*len], bufsize - *len,
+                                  ar->mem_bitmap, ar->fw.mem_blocks);
+
+        ADD(buf, *len, bufsize, "]\n");
+
+        ADD(buf, *len, bufsize, "cookies: used:%3d / total:%3d, allocs:%d\n",
+            bitmap_weight(ar->mem_bitmap, ar->fw.mem_blocks),
+            ar->fw.mem_blocks, atomic_read(&ar->mem_allocs));
+
+        ADD(buf, *len, bufsize, "memory: free:%3d (%3d KiB) / total:%3d KiB)\n",
+            atomic_read(&ar->mem_free_blocks),
+            (atomic_read(&ar->mem_free_blocks) * ar->fw.mem_block_size) / 1024,
+            (ar->fw.mem_blocks * ar->fw.mem_block_size) / 1024);
+
+        spin_unlock_bh(&ar->mem_lock);
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(mem_usage, 512);
+
+static char *carl9170_debugfs_qos_stat_read(struct ar9170 *ar, char *buf,
+                                            size_t bufsize, ssize_t *len)
+{
+        ADD(buf, *len, bufsize, "%s QoS AC\n", modparam_noht ? "Hardware" :
+            "Software");
+
+        ADD(buf, *len, bufsize, "[     VO            VI       "
+                                 "     BE            BK      ]\n");
+
+        spin_lock_bh(&ar->tx_stats_lock);
+        ADD(buf, *len, bufsize, "[length/limit  length/limit  "
+                                 "length/limit  length/limit ]\n"
+                                "[   %3d/%3d       %3d/%3d    "
+                                 "   %3d/%3d       %3d/%3d   ]\n\n",
+            ar->tx_stats[0].len, ar->tx_stats[0].limit,
+            ar->tx_stats[1].len, ar->tx_stats[1].limit,
+            ar->tx_stats[2].len, ar->tx_stats[2].limit,
+            ar->tx_stats[3].len, ar->tx_stats[3].limit);
+
+        ADD(buf, *len, bufsize, "[    total         total     "
+                                 "    total         total    ]\n"
+                                "[%10d    %10d    %10d    %10d   ]\n\n",
+            ar->tx_stats[0].count, ar->tx_stats[1].count,
+            ar->tx_stats[2].count, ar->tx_stats[3].count);
+
+        spin_unlock_bh(&ar->tx_stats_lock);
+
+        ADD(buf, *len, bufsize, "[  pend/waittx   pend/waittx "
+                                 "  pend/waittx   pend/waittx]\n"
+                                "[   %3d/%3d       %3d/%3d    "
+                                 "   %3d/%3d       %3d/%3d   ]\n\n",
+            skb_queue_len(&ar->tx_pending[0]),
+            skb_queue_len(&ar->tx_status[0]),
+            skb_queue_len(&ar->tx_pending[1]),
+            skb_queue_len(&ar->tx_status[1]),
+            skb_queue_len(&ar->tx_pending[2]),
+            skb_queue_len(&ar->tx_status[2]),
+            skb_queue_len(&ar->tx_pending[3]),
+            skb_queue_len(&ar->tx_status[3]));
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(qos_stat, 512);
+
+static void carl9170_debugfs_format_frame(struct ar9170 *ar,
+        struct sk_buff *skb, const char *prefix, char *buf,
+        ssize_t *off, ssize_t bufsize)
+{
+        struct _carl9170_tx_superframe *txc = (void *) skb->data;
+        struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
+        struct carl9170_tx_info *arinfo = (void *) txinfo->rate_driver_data;
+        struct ieee80211_hdr *hdr = (void *) txc->frame_data;
+
+        ADD(buf, *off, bufsize, "%s %p, c:%2x, DA:%pM, sq:%4d, mc:%.4x, "
+            "pc:%.8x, to:%d ms\n", prefix, skb, txc->s.cookie,
+            ieee80211_get_DA(hdr), get_seq_h(hdr),
+            le16_to_cpu(txc->f.mac_control), le32_to_cpu(txc->f.phy_control),
+            jiffies_to_msecs(jiffies - arinfo->timeout));
+}
+
+
+static char *carl9170_debugfs_ampdu_state_read(struct ar9170 *ar, char *buf,
+                                               size_t bufsize, ssize_t *len)
+{
+        struct carl9170_sta_tid *iter;
+        struct sk_buff *skb;
+        int cnt = 0, fc;
+        int offset;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(iter, &ar->tx_ampdu_list, list) {
+
+                spin_lock_bh(&iter->lock);
+                ADD(buf, *len, bufsize, "Entry: #%2d TID:%1d, BSN:%4d, "
+                    "SNX:%4d, HSN:%4d, BAW:%2d, state:%1d, toggles:%d\n",
+                    cnt, iter->tid, iter->bsn, iter->snx, iter->hsn,
+                    iter->max, iter->state, iter->counter);
+
+                ADD(buf, *len, bufsize, "\tWindow:  [");
+
+                *len += bitmap_scnprintf(&buf[*len], bufsize - *len,
+                        iter->bitmap, CARL9170_BAW_BITS);
+
+#define BM_STR_OFF(offset)                                      \
+        ((CARL9170_BAW_BITS - (offset) - 1) / 4 +               \
+         (CARL9170_BAW_BITS - (offset) - 1) / 32 + 1)
+
+                ADD(buf, *len, bufsize, ",W]\n");
+
+                offset = BM_STR_OFF(0);
+                ADD(buf, *len, bufsize, "\tBase Seq: %*s\n", offset, "T");
+
+                offset = BM_STR_OFF(SEQ_DIFF(iter->snx, iter->bsn));
+                ADD(buf, *len, bufsize, "\tNext Seq: %*s\n", offset, "W");
+
+                offset = BM_STR_OFF(((int)iter->hsn - (int)iter->bsn) %
+                                     CARL9170_BAW_BITS);
+                ADD(buf, *len, bufsize, "\tLast Seq: %*s\n", offset, "N");
+
+                ADD(buf, *len, bufsize, "\tPre-Aggregation reorder buffer: "
+                    " currently queued:%d\n", skb_queue_len(&iter->queue));
+
+                fc = 0;
+                skb_queue_walk(&iter->queue, skb) {
+                        char prefix[32];
+
+                        snprintf(prefix, sizeof(prefix), "\t\t%3d :", fc);
+                        carl9170_debugfs_format_frame(ar, skb, prefix, buf,
+                                                      len, bufsize);
+
+                        fc++;
+                }
+                spin_unlock_bh(&iter->lock);
+                cnt++;
+        }
+        rcu_read_unlock();
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(ampdu_state, 8000);
+
+static void carl9170_debugfs_queue_dump(struct ar9170 *ar, char *buf,
+        ssize_t *len, size_t bufsize, struct sk_buff_head *queue)
+{
+        struct sk_buff *skb;
+        char prefix[16];
+        int fc = 0;
+
+        spin_lock_bh(&queue->lock);
+        skb_queue_walk(queue, skb) {
+                snprintf(prefix, sizeof(prefix), "%3d :", fc);
+                carl9170_debugfs_format_frame(ar, skb, prefix, buf,
+                                              len, bufsize);
+                fc++;
+        }
+        spin_unlock_bh(&queue->lock);
+}
+
+#define DEBUGFS_QUEUE_DUMP(q, qi)                                       \
+static char *carl9170_debugfs_##q ##_##qi ##_read(struct ar9170 *ar,    \
+        char *buf, size_t bufsize, ssize_t *len)                        \
+{                                                                       \
+        carl9170_debugfs_queue_dump(ar, buf, len, bufsize, &ar->q[qi]); \
+        return buf;                                                     \
+}                                                                       \
+DEBUGFS_DECLARE_RO_FILE(q##_##qi, 8000);
+
+static char *carl9170_debugfs_sta_psm_read(struct ar9170 *ar, char *buf,
+                                           size_t bufsize, ssize_t *len)
+{
+        ADD(buf, *len, bufsize, "psm state: %s\n", (ar->ps.off_override ?
+            "FORCE CAM" : (ar->ps.state ? "PSM" : "CAM")));
+
+        ADD(buf, *len, bufsize, "sleep duration: %d ms.\n", ar->ps.sleep_ms);
+        ADD(buf, *len, bufsize, "last power-state transition: %d ms ago.\n",
+            jiffies_to_msecs(jiffies - ar->ps.last_action));
+        ADD(buf, *len, bufsize, "last CAM->PSM transition: %d ms ago.\n",
+            jiffies_to_msecs(jiffies - ar->ps.last_slept));
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(sta_psm, 160);
+
+static char *carl9170_debugfs_tx_stuck_read(struct ar9170 *ar, char *buf,
+                                            size_t bufsize, ssize_t *len)
+{
+        int i;
+
+        for (i = 0; i < ar->hw->queues; i++) {
+                ADD(buf, *len, bufsize, "TX queue [%d]: %10d max:%10d ms.\n",
+                    i, ieee80211_queue_stopped(ar->hw, i) ?
+                    jiffies_to_msecs(jiffies - ar->queue_stop_timeout[i]) : 0,
+                    jiffies_to_msecs(ar->max_queue_stop_timeout[i]));
+
+                ar->max_queue_stop_timeout[i] = 0;
+        }
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(tx_stuck, 180);
+
+static char *carl9170_debugfs_phy_noise_read(struct ar9170 *ar, char *buf,
+                                             size_t bufsize, ssize_t *len)
+{
+        int err;
+
+        err = carl9170_get_noisefloor(ar);
+        if (err) {
+                *len = err;
+                return buf;
+        }
+
+        ADD(buf, *len, bufsize, "Chain 0: %10d dBm, ext. chan.:%10d dBm\n",
+            ar->noise[0], ar->noise[2]);
+        ADD(buf, *len, bufsize, "Chain 2: %10d dBm, ext. chan.:%10d dBm\n",
+            ar->noise[1], ar->noise[3]);
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(phy_noise, 180);
+
+static char *carl9170_debugfs_vif_dump_read(struct ar9170 *ar, char *buf,
+                                            size_t bufsize, ssize_t *len)
+{
+        struct carl9170_vif_info *iter;
+        int i = 0;
+
+        ADD(buf, *len, bufsize, "registered VIFs:%d \\ %d\n",
+            ar->vifs, ar->fw.vif_num);
+
+        ADD(buf, *len, bufsize, "VIF bitmap: [");
+
+        *len += bitmap_scnprintf(&buf[*len], bufsize - *len,
+                                 &ar->vif_bitmap, ar->fw.vif_num);
+
+        ADD(buf, *len, bufsize, "]\n");
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(iter, &ar->vif_list, list) {
+                struct ieee80211_vif *vif = carl9170_get_vif(iter);
+                ADD(buf, *len, bufsize, "\t%d = [%s VIF, id:%d, type:%x "
+                    " mac:%pM %s]\n", i, (carl9170_get_main_vif(ar) == vif ?
+                    "Master" : " Slave"), iter->id, vif->type, vif->addr,
+                    iter->enable_beacon ? "beaconing " : "");
+                i++;
+        }
+        rcu_read_unlock();
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(vif_dump, 8000);
+
+#define UPDATE_COUNTER(ar, name)        ({                              \
+        u32 __tmp[ARRAY_SIZE(name##_regs)];                             \
+        unsigned int __i, __err = -ENODEV;                              \
+                                                                        \
+        for (__i = 0; __i < ARRAY_SIZE(name##_regs); __i++) {           \
+                __tmp[__i] = name##_regs[__i].reg;                      \
+                ar->debug.stats.name##_counter[__i] = 0;                \
+        }                                                               \
+                                                                        \
+        if (IS_STARTED(ar))                                             \
+                __err = carl9170_read_mreg(ar, ARRAY_SIZE(name##_regs), \
+                        __tmp, ar->debug.stats.name##_counter);         \
+        (__err); })
+
+#define TALLY_SUM_UP(ar, name)  do {                                    \
+        unsigned int __i;                                               \
+                                                                        \
+        for (__i = 0; __i < ARRAY_SIZE(name##_regs); __i++) {           \
+                ar->debug.stats.name##_sum[__i] +=                      \
+                        ar->debug.stats.name##_counter[__i];            \
+        }                                                               \
+} while (0)
+
+#define DEBUGFS_HW_TALLY_FILE(name, f)                                  \
+static char *carl9170_debugfs_##name ## _read(struct ar9170 *ar,        \
+         char *dum, size_t bufsize, ssize_t *ret)                       \
+{                                                                       \
+        char *buf;                                                      \
+        int i, max_len, err;                                            \
+                                                                        \
+        max_len = ARRAY_SIZE(name##_regs) * 80;                         \
+        buf = vmalloc(max_len);                                         \
+        if (!buf)                                                       \
+                return NULL;                                            \
+                                                                        \
+        err = UPDATE_COUNTER(ar, name);                                 \
+        if (err) {                                                      \
+                *ret = err;                                             \
+                return buf;                                             \
+        }                                                               \
+                                                                        \
+        TALLY_SUM_UP(ar, name);                                         \
+                                                                        \
+        for (i = 0; i < ARRAY_SIZE(name##_regs); i++) {                 \
+                ADD(buf, *ret, max_len, "%22s = %" f "[+%" f "]\n",     \
+                    name##_regs[i].nreg, ar->debug.stats.name ##_sum[i],\
+                    ar->debug.stats.name ##_counter[i]);                \
+        }                                                               \
+                                                                        \
+        return buf;                                                     \
+}                                                                       \
+DEBUGFS_DECLARE_RO_FILE(name, 0);
+
+#define DEBUGFS_HW_REG_FILE(name, f)                                    \
+static char *carl9170_debugfs_##name ## _read(struct ar9170 *ar,        \
+        char *dum, size_t bufsize, ssize_t *ret)                        \
+{                                                                       \
+        char *buf;                                                      \
+        int i, max_len, err;                                            \
+                                                                        \
+        max_len = ARRAY_SIZE(name##_regs) * 80;                         \
+        buf = vmalloc(max_len);                                         \
+        if (!buf)                                                       \
+                return NULL;                                            \
+                                                                        \
+        err = UPDATE_COUNTER(ar, name);                                 \
+        if (err) {                                                      \
+                *ret = err;                                             \
+                return buf;                                             \
+        }                                                               \
+                                                                        \
+        for (i = 0; i < ARRAY_SIZE(name##_regs); i++) {                 \
+                ADD(buf, *ret, max_len, "%22s = %" f "\n",              \
+                    name##_regs[i].nreg,                                \
+                    ar->debug.stats.name##_counter[i]);                 \
+        }                                                               \
+                                                                        \
+        return buf;                                                     \
+}                                                                       \
+DEBUGFS_DECLARE_RO_FILE(name, 0);
+
+static ssize_t carl9170_debugfs_hw_ioread32_write(struct ar9170 *ar,
+        const char *buf, size_t count)
+{
+        int err = 0, i, n = 0, max_len = 32, res;
+        unsigned int reg, tmp;
+
+        if (!count)
+                return 0;
+
+        if (count > max_len)
+                return -E2BIG;
+
+        res = sscanf(buf, "0x%X %d", &reg, &n);
+        if (res < 1) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        if (res == 1)
+                n = 1;
+
+        if (n > 15) {
+                err = -EMSGSIZE;
+                goto out;
+        }
+
+        if ((reg >= 0x280000) || ((reg + (n << 2)) >= 0x280000)) {
+                err = -EADDRNOTAVAIL;
+                goto out;
+        }
+
+        if (reg & 3) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        for (i = 0; i < n; i++) {
+                err = carl9170_read_reg(ar, reg + (i << 2), &tmp);
+                if (err)
+                        goto out;
+
+                ar->debug.ring[ar->debug.ring_tail].reg = reg + (i << 2);
+                ar->debug.ring[ar->debug.ring_tail].value = tmp;
+                ar->debug.ring_tail++;
+                ar->debug.ring_tail %= CARL9170_DEBUG_RING_SIZE;
+        }
+
+out:
+        return err ? err : count;
+}
+
+static char *carl9170_debugfs_hw_ioread32_read(struct ar9170 *ar, char *buf,
+                                               size_t bufsize, ssize_t *ret)
+{
+        int i = 0;
+
+        while (ar->debug.ring_head != ar->debug.ring_tail) {
+                ADD(buf, *ret, bufsize, "%.8x = %.8x\n",
+                    ar->debug.ring[ar->debug.ring_head].reg,
+                    ar->debug.ring[ar->debug.ring_head].value);
+
+                ar->debug.ring_head++;
+                ar->debug.ring_head %= CARL9170_DEBUG_RING_SIZE;
+
+                if (i++ == 64)
+                        break;
+        }
+        ar->debug.ring_head = ar->debug.ring_tail;
+        return buf;
+}
+DEBUGFS_DECLARE_RW_FILE(hw_ioread32, CARL9170_DEBUG_RING_SIZE * 40);
+
+static ssize_t carl9170_debugfs_bug_write(struct ar9170 *ar, const char *buf,
+                                          size_t count)
+{
+        int err;
+
+        if (count < 1)
+                return -EINVAL;
+
+        switch (buf[0]) {
+        case 'F':
+                ar->needs_full_reset = true;
+                break;
+
+        case 'R':
+                if (!IS_STARTED(ar)) {
+                        err = -EAGAIN;
+                        goto out;
+                }
+
+                ar->needs_full_reset = false;
+                break;
+
+        case 'M':
+                err = carl9170_mac_reset(ar);
+                if (err < 0)
+                        count = err;
+
+                goto out;
+
+        case 'P':
+                err = carl9170_set_channel(ar, ar->hw->conf.channel,
+                        ar->hw->conf.channel_type, CARL9170_RFI_COLD);
+                if (err < 0)
+                        count = err;
+
+                goto out;
+
+        default:
+                return -EINVAL;
+        }
+
+        carl9170_restart(ar, CARL9170_RR_USER_REQUEST);
+
+out:
+        return count;
+}
+
+static char *carl9170_debugfs_bug_read(struct ar9170 *ar, char *buf,
+                                       size_t bufsize, ssize_t *ret)
+{
+        ADD(buf, *ret, bufsize, "[P]hy reinit, [R]estart, [F]ull usb reset, "
+            "[M]ac reset\n");
+        ADD(buf, *ret, bufsize, "firmware restarts:%d, last reason:%d\n",
+                ar->restart_counter, ar->last_reason);
+        ADD(buf, *ret, bufsize, "phy reinit errors:%d (%d)\n",
+                ar->total_chan_fail, ar->chan_fail);
+        ADD(buf, *ret, bufsize, "reported firmware errors:%d\n",
+                ar->fw.err_counter);
+        ADD(buf, *ret, bufsize, "reported firmware BUGs:%d\n",
+                ar->fw.bug_counter);
+        ADD(buf, *ret, bufsize, "pending restart requests:%d\n",
+                atomic_read(&ar->pending_restarts));
+        return buf;
+}
+__DEBUGFS_DECLARE_RW_FILE(bug, 400, CARL9170_STOPPED);
+
+static const char *erp_modes[] = {
+        [CARL9170_ERP_INVALID] = "INVALID",
+        [CARL9170_ERP_AUTO] = "Automatic",
+        [CARL9170_ERP_MAC80211] = "Set by MAC80211",
+        [CARL9170_ERP_OFF] = "Force Off",
+        [CARL9170_ERP_RTS] = "Force RTS",
+        [CARL9170_ERP_CTS] = "Force CTS"
+};
+
+static char *carl9170_debugfs_erp_read(struct ar9170 *ar, char *buf,
+                                       size_t bufsize, ssize_t *ret)
+{
+        ADD(buf, *ret, bufsize, "ERP Setting: (%d) -> %s\n", ar->erp_mode,
+            erp_modes[ar->erp_mode]);
+        return buf;
+}
+
+static ssize_t carl9170_debugfs_erp_write(struct ar9170 *ar, const char *buf,
+                                          size_t count)
+{
+        int res, val;
+
+        if (count < 1)
+                return -EINVAL;
+
+        res = sscanf(buf, "%d", &val);
+        if (res != 1)
+                return -EINVAL;
+
+        if (!((val > CARL9170_ERP_INVALID) &&
+              (val < __CARL9170_ERP_NUM)))
+                return -EINVAL;
+
+        ar->erp_mode = val;
+        return count;
+}
+
+DEBUGFS_DECLARE_RW_FILE(erp, 80);
+
+static ssize_t carl9170_debugfs_hw_iowrite32_write(struct ar9170 *ar,
+        const char *buf, size_t count)
+{
+        int err = 0, max_len = 22, res;
+        u32 reg, val;
+
+        if (!count)
+                return 0;
+
+        if (count > max_len)
+                return -E2BIG;
+
+        res = sscanf(buf, "0x%X 0x%X", &reg, &val);
+        if (res != 2) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        if (reg <= 0x100000 || reg >= 0x280000) {
+                err = -EADDRNOTAVAIL;
+                goto out;
+        }
+
+        if (reg & 3) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        err = carl9170_write_reg(ar, reg, val);
+        if (err)
+                goto out;
+
+out:
+        return err ? err : count;
+}
+DEBUGFS_DECLARE_WO_FILE(hw_iowrite32);
+
+DEBUGFS_HW_TALLY_FILE(hw_tx_tally, "u");
+DEBUGFS_HW_TALLY_FILE(hw_rx_tally, "u");
+DEBUGFS_HW_TALLY_FILE(hw_phy_errors, "u");
+DEBUGFS_HW_REG_FILE(hw_wlan_queue, ".8x");
+DEBUGFS_HW_REG_FILE(hw_pta_queue, ".8x");
+DEBUGFS_HW_REG_FILE(hw_ampdu_info, ".8x");
+DEBUGFS_QUEUE_DUMP(tx_status, 0);
+DEBUGFS_QUEUE_DUMP(tx_status, 1);
+DEBUGFS_QUEUE_DUMP(tx_status, 2);
+DEBUGFS_QUEUE_DUMP(tx_status, 3);
+DEBUGFS_QUEUE_DUMP(tx_pending, 0);
+DEBUGFS_QUEUE_DUMP(tx_pending, 1);
+DEBUGFS_QUEUE_DUMP(tx_pending, 2);
+DEBUGFS_QUEUE_DUMP(tx_pending, 3);
+DEBUGFS_READONLY_FILE(usb_tx_anch_urbs, 20, "%d",
+                      atomic_read(&ar->tx_anch_urbs));
+DEBUGFS_READONLY_FILE(usb_rx_anch_urbs, 20, "%d",
+                      atomic_read(&ar->rx_anch_urbs));
+DEBUGFS_READONLY_FILE(usb_rx_work_urbs, 20, "%d",
+                      atomic_read(&ar->rx_work_urbs));
+DEBUGFS_READONLY_FILE(usb_rx_pool_urbs, 20, "%d",
+                      atomic_read(&ar->rx_pool_urbs));
+
+DEBUGFS_READONLY_FILE(tx_total_queued, 20, "%d",
+                      atomic_read(&ar->tx_total_queued));
+DEBUGFS_READONLY_FILE(tx_ampdu_scheduler, 20, "%d",
+                      atomic_read(&ar->tx_ampdu_scheduler));
+
+DEBUGFS_READONLY_FILE(tx_total_pending, 20, "%d",
+                      atomic_read(&ar->tx_total_pending));
+
+DEBUGFS_READONLY_FILE(tx_ampdu_list_len, 20, "%d",
+                      ar->tx_ampdu_list_len);
+
+DEBUGFS_READONLY_FILE(tx_ampdu_upload, 20, "%d",
+                      atomic_read(&ar->tx_ampdu_upload));
+
+DEBUGFS_READONLY_FILE(tx_janitor_last_run, 64, "last run:%d ms ago",
+        jiffies_to_msecs(jiffies - ar->tx_janitor_last_run));
+
+DEBUGFS_READONLY_FILE(tx_dropped, 20, "%d", ar->tx_dropped);
+
+DEBUGFS_READONLY_FILE(rx_dropped, 20, "%d", ar->rx_dropped);
+
+DEBUGFS_READONLY_FILE(sniffer_enabled, 20, "%d", ar->sniffer_enabled);
+DEBUGFS_READONLY_FILE(rx_software_decryption, 20, "%d",
+                      ar->rx_software_decryption);
+DEBUGFS_READONLY_FILE(ampdu_factor, 20, "%d",
+                      ar->current_factor);
+DEBUGFS_READONLY_FILE(ampdu_density, 20, "%d",
+                      ar->current_density);
+
+DEBUGFS_READONLY_FILE(beacon_int, 20, "%d TU", ar->global_beacon_int);
+DEBUGFS_READONLY_FILE(pretbtt, 20, "%d TU", ar->global_pretbtt);
+
+void carl9170_debugfs_register(struct ar9170 *ar)
+{
+        ar->debug_dir = debugfs_create_dir(KBUILD_MODNAME,
+                ar->hw->wiphy->debugfsdir);
+
+#define DEBUGFS_ADD(name)                                               \
+        debugfs_create_file(#name, carl_debugfs_##name ##_ops.attr,     \
+                            ar->debug_dir, ar,                          \
+                            &carl_debugfs_##name ## _ops.fops);
+
+        DEBUGFS_ADD(usb_tx_anch_urbs);
+        DEBUGFS_ADD(usb_rx_pool_urbs);
+        DEBUGFS_ADD(usb_rx_anch_urbs);
+        DEBUGFS_ADD(usb_rx_work_urbs);
+
+        DEBUGFS_ADD(tx_total_queued);
+        DEBUGFS_ADD(tx_total_pending);
+        DEBUGFS_ADD(tx_dropped);
+        DEBUGFS_ADD(tx_stuck);
+        DEBUGFS_ADD(tx_ampdu_upload);
+        DEBUGFS_ADD(tx_ampdu_scheduler);
+        DEBUGFS_ADD(tx_ampdu_list_len);
+
+        DEBUGFS_ADD(rx_dropped);
+        DEBUGFS_ADD(sniffer_enabled);
+        DEBUGFS_ADD(rx_software_decryption);
+
+        DEBUGFS_ADD(mem_usage);
+        DEBUGFS_ADD(qos_stat);
+        DEBUGFS_ADD(sta_psm);
+        DEBUGFS_ADD(ampdu_state);
+
+        DEBUGFS_ADD(hw_tx_tally);
+        DEBUGFS_ADD(hw_rx_tally);
+        DEBUGFS_ADD(hw_phy_errors);
+        DEBUGFS_ADD(phy_noise);
+
+        DEBUGFS_ADD(hw_wlan_queue);
+        DEBUGFS_ADD(hw_pta_queue);
+        DEBUGFS_ADD(hw_ampdu_info);
+
+        DEBUGFS_ADD(ampdu_density);
+        DEBUGFS_ADD(ampdu_factor);
+
+        DEBUGFS_ADD(tx_janitor_last_run);
+
+        DEBUGFS_ADD(tx_status_0);
+        DEBUGFS_ADD(tx_status_1);
+        DEBUGFS_ADD(tx_status_2);
+        DEBUGFS_ADD(tx_status_3);
+
+        DEBUGFS_ADD(tx_pending_0);
+        DEBUGFS_ADD(tx_pending_1);
+        DEBUGFS_ADD(tx_pending_2);
+        DEBUGFS_ADD(tx_pending_3);
+
+        DEBUGFS_ADD(hw_ioread32);
+        DEBUGFS_ADD(hw_iowrite32);
+        DEBUGFS_ADD(bug);
+
+        DEBUGFS_ADD(erp);
+
+        DEBUGFS_ADD(vif_dump);
+
+        DEBUGFS_ADD(beacon_int);
+        DEBUGFS_ADD(pretbtt);
+
+#undef DEBUGFS_ADD
+}
+
+void carl9170_debugfs_unregister(struct ar9170 *ar)
+{
+        debugfs_remove_recursive(ar->debug_dir);
+}
diff --git a/drivers/net/wireless/ath/carl9170/debug.h b/drivers/net/wireless/ath/carl9170/debug.h
new file mode 100644
index 000000000000..ea4b97524122
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/debug.h
@@ -0,0 +1,134 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * debug header
+ *
+ * Copyright 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __DEBUG_H
+#define __DEBUG_H
+
+#include "eeprom.h"
+#include "wlan.h"
+#include "hw.h"
+#include "fwdesc.h"
+#include "fwcmd.h"
+#include "../regd.h"
+
+struct hw_stat_reg_entry {
+        u32 reg;
+        char nreg[32];
+};
+
+#define STAT_MAC_REG(reg)       \
+        { (AR9170_MAC_REG_##reg), #reg }
+
+#define STAT_PTA_REG(reg)       \
+        { (AR9170_PTA_REG_##reg), #reg }
+
+#define STAT_USB_REG(reg)       \
+        { (AR9170_USB_REG_##reg), #reg }
+
+static const struct hw_stat_reg_entry hw_rx_tally_regs[] = {
+        STAT_MAC_REG(RX_CRC32),         STAT_MAC_REG(RX_CRC16),
+        STAT_MAC_REG(RX_TIMEOUT_COUNT), STAT_MAC_REG(RX_ERR_DECRYPTION_UNI),
+        STAT_MAC_REG(RX_ERR_DECRYPTION_MUL), STAT_MAC_REG(RX_MPDU),
+        STAT_MAC_REG(RX_DROPPED_MPDU),  STAT_MAC_REG(RX_DEL_MPDU),
+};
+
+static const struct hw_stat_reg_entry hw_phy_errors_regs[] = {
+        STAT_MAC_REG(RX_PHY_MISC_ERROR), STAT_MAC_REG(RX_PHY_XR_ERROR),
+        STAT_MAC_REG(RX_PHY_OFDM_ERROR), STAT_MAC_REG(RX_PHY_CCK_ERROR),
+        STAT_MAC_REG(RX_PHY_HT_ERROR), STAT_MAC_REG(RX_PHY_TOTAL),
+};
+
+static const struct hw_stat_reg_entry hw_tx_tally_regs[] = {
+        STAT_MAC_REG(TX_TOTAL),         STAT_MAC_REG(TX_UNDERRUN),
+        STAT_MAC_REG(TX_RETRY),
+};
+
+static const struct hw_stat_reg_entry hw_wlan_queue_regs[] = {
+        STAT_MAC_REG(DMA_STATUS),       STAT_MAC_REG(DMA_TRIGGER),
+        STAT_MAC_REG(DMA_TXQ0_ADDR),    STAT_MAC_REG(DMA_TXQ0_CURR_ADDR),
+        STAT_MAC_REG(DMA_TXQ1_ADDR),    STAT_MAC_REG(DMA_TXQ1_CURR_ADDR),
+        STAT_MAC_REG(DMA_TXQ2_ADDR),    STAT_MAC_REG(DMA_TXQ2_CURR_ADDR),
+        STAT_MAC_REG(DMA_TXQ3_ADDR),    STAT_MAC_REG(DMA_TXQ3_CURR_ADDR),
+        STAT_MAC_REG(DMA_RXQ_ADDR),     STAT_MAC_REG(DMA_RXQ_CURR_ADDR),
+};
+
+static const struct hw_stat_reg_entry hw_ampdu_info_regs[] = {
+        STAT_MAC_REG(AMPDU_DENSITY),    STAT_MAC_REG(AMPDU_FACTOR),
+};
+
+static const struct hw_stat_reg_entry hw_pta_queue_regs[] = {
+        STAT_PTA_REG(DN_CURR_ADDRH),    STAT_PTA_REG(DN_CURR_ADDRL),
+        STAT_PTA_REG(UP_CURR_ADDRH),    STAT_PTA_REG(UP_CURR_ADDRL),
+        STAT_PTA_REG(DMA_STATUS),       STAT_PTA_REG(DMA_MODE_CTRL),
+};
+
+#define DEFINE_TALLY(name)                                      \
+        u32 name##_sum[ARRAY_SIZE(name##_regs)],                \
+            name##_counter[ARRAY_SIZE(name##_regs)]             \
+
+#define DEFINE_STAT(name)                                       \
+        u32 name##_counter[ARRAY_SIZE(name##_regs)]             \
+
+struct ath_stats {
+        DEFINE_TALLY(hw_tx_tally);
+        DEFINE_TALLY(hw_rx_tally);
+        DEFINE_TALLY(hw_phy_errors);
+        DEFINE_STAT(hw_wlan_queue);
+        DEFINE_STAT(hw_pta_queue);
+        DEFINE_STAT(hw_ampdu_info);
+};
+
+struct carl9170_debug_mem_rbe {
+        u32 reg;
+        u32 value;
+};
+
+#define CARL9170_DEBUG_RING_SIZE                        64
+
+struct carl9170_debug {
+        struct ath_stats stats;
+        struct carl9170_debug_mem_rbe ring[CARL9170_DEBUG_RING_SIZE];
+        struct mutex ring_lock;
+        unsigned int ring_head, ring_tail;
+        struct delayed_work update_tally;
+};
+
+struct ar9170;
+
+void carl9170_debugfs_register(struct ar9170 *ar);
+void carl9170_debugfs_unregister(struct ar9170 *ar);
+#endif /* __DEBUG_H */
diff --git a/drivers/net/wireless/ath/carl9170/eeprom.h b/drivers/net/wireless/ath/carl9170/eeprom.h
new file mode 100644
index 000000000000..7cff40ac7759
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/eeprom.h
@@ -0,0 +1,216 @@
+/*
+ * Shared Atheros AR9170 Header
+ *
+ * EEPROM layout
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __CARL9170_SHARED_EEPROM_H
+#define __CARL9170_SHARED_EEPROM_H
+
+#define AR9170_EEPROM_START             0x1600
+
+#define AR5416_MAX_CHAINS               2
+#define AR5416_MODAL_SPURS              5
+
+struct ar9170_eeprom_modal {
+        __le32  antCtrlChain[AR5416_MAX_CHAINS];
+        __le32  antCtrlCommon;
+        s8      antennaGainCh[AR5416_MAX_CHAINS];
+        u8      switchSettling;
+        u8      txRxAttenCh[AR5416_MAX_CHAINS];
+        u8      rxTxMarginCh[AR5416_MAX_CHAINS];
+        s8      adcDesiredSize;
+        s8      pgaDesiredSize;
+        u8      xlnaGainCh[AR5416_MAX_CHAINS];
+        u8      txEndToXpaOff;
+        u8      txEndToRxOn;
+        u8      txFrameToXpaOn;
+        u8      thresh62;
+        s8      noiseFloorThreshCh[AR5416_MAX_CHAINS];
+        u8      xpdGain;
+        u8      xpd;
+        s8      iqCalICh[AR5416_MAX_CHAINS];
+        s8      iqCalQCh[AR5416_MAX_CHAINS];
+        u8      pdGainOverlap;
+        u8      ob;
+        u8      db;
+        u8      xpaBiasLvl;
+        u8      pwrDecreaseFor2Chain;
+        u8      pwrDecreaseFor3Chain;
+        u8      txFrameToDataStart;
+        u8      txFrameToPaOn;
+        u8      ht40PowerIncForPdadc;
+        u8      bswAtten[AR5416_MAX_CHAINS];
+        u8      bswMargin[AR5416_MAX_CHAINS];
+        u8      swSettleHt40;
+        u8      reserved[22];
+        struct spur_channel {
+                __le16 spurChan;
+                u8      spurRangeLow;
+                u8      spurRangeHigh;
+        } __packed spur_channels[AR5416_MODAL_SPURS];
+} __packed;
+
+#define AR5416_NUM_PD_GAINS             4
+#define AR5416_PD_GAIN_ICEPTS           5
+
+struct ar9170_calibration_data_per_freq {
+        u8      pwr_pdg[AR5416_NUM_PD_GAINS][AR5416_PD_GAIN_ICEPTS];
+        u8      vpd_pdg[AR5416_NUM_PD_GAINS][AR5416_PD_GAIN_ICEPTS];
+} __packed;
+
+#define AR5416_NUM_5G_CAL_PIERS         8
+#define AR5416_NUM_2G_CAL_PIERS         4
+
+#define AR5416_NUM_5G_TARGET_PWRS       8
+#define AR5416_NUM_2G_CCK_TARGET_PWRS   3
+#define AR5416_NUM_2G_OFDM_TARGET_PWRS  4
+#define AR5416_MAX_NUM_TGT_PWRS         8
+
+struct ar9170_calibration_target_power_legacy {
+        u8      freq;
+        u8      power[4];
+} __packed;
+
+struct ar9170_calibration_target_power_ht {
+        u8      freq;
+        u8      power[8];
+} __packed;
+
+#define AR5416_NUM_CTLS                 24
+
+struct ar9170_calctl_edges {
+        u8      channel;
+#define AR9170_CALCTL_EDGE_FLAGS        0xC0
+        u8      power_flags;
+} __packed;
+
+#define AR5416_NUM_BAND_EDGES           8
+
+struct ar9170_calctl_data {
+        struct ar9170_calctl_edges
+                control_edges[AR5416_MAX_CHAINS][AR5416_NUM_BAND_EDGES];
+} __packed;
+
+struct ar9170_eeprom {
+        __le16  length;
+        __le16  checksum;
+        __le16  version;
+        u8      operating_flags;
+#define AR9170_OPFLAG_5GHZ              1
+#define AR9170_OPFLAG_2GHZ              2
+        u8      misc;
+        __le16  reg_domain[2];
+        u8      mac_address[6];
+        u8      rx_mask;
+        u8      tx_mask;
+        __le16  rf_silent;
+        __le16  bluetooth_options;
+        __le16  device_capabilities;
+        __le32  build_number;
+        u8      deviceType;
+        u8      reserved[33];
+
+        u8      customer_data[64];
+
+        struct ar9170_eeprom_modal
+                modal_header[2];
+
+        u8      cal_freq_pier_5G[AR5416_NUM_5G_CAL_PIERS];
+        u8      cal_freq_pier_2G[AR5416_NUM_2G_CAL_PIERS];
+
+        struct ar9170_calibration_data_per_freq
+                cal_pier_data_5G[AR5416_MAX_CHAINS][AR5416_NUM_5G_CAL_PIERS],
+                cal_pier_data_2G[AR5416_MAX_CHAINS][AR5416_NUM_2G_CAL_PIERS];
+
+        /* power calibration data */
+        struct ar9170_calibration_target_power_legacy
+                cal_tgt_pwr_5G[AR5416_NUM_5G_TARGET_PWRS];
+        struct ar9170_calibration_target_power_ht
+                cal_tgt_pwr_5G_ht20[AR5416_NUM_5G_TARGET_PWRS],
+                cal_tgt_pwr_5G_ht40[AR5416_NUM_5G_TARGET_PWRS];
+
+        struct ar9170_calibration_target_power_legacy
+                cal_tgt_pwr_2G_cck[AR5416_NUM_2G_CCK_TARGET_PWRS],
+                cal_tgt_pwr_2G_ofdm[AR5416_NUM_2G_OFDM_TARGET_PWRS];
+        struct ar9170_calibration_target_power_ht
+                cal_tgt_pwr_2G_ht20[AR5416_NUM_2G_OFDM_TARGET_PWRS],
+                cal_tgt_pwr_2G_ht40[AR5416_NUM_2G_OFDM_TARGET_PWRS];
+
+        /* conformance testing limits */
+        u8      ctl_index[AR5416_NUM_CTLS];
+        struct ar9170_calctl_data
+                ctl_data[AR5416_NUM_CTLS];
+
+        u8      pad;
+        __le16  subsystem_id;
+} __packed;
+
+#define AR9170_LED_MODE_POWER_ON                0x0001
+#define AR9170_LED_MODE_RESERVED                0x0002
+#define AR9170_LED_MODE_DISABLE_STATE           0x0004
+#define AR9170_LED_MODE_OFF_IN_PSM              0x0008
+
+/* AR9170_LED_MODE BIT is set */
+#define AR9170_LED_MODE_FREQUENCY_S             4
+#define AR9170_LED_MODE_FREQUENCY               0x0030
+#define AR9170_LED_MODE_FREQUENCY_1HZ           0x0000
+#define AR9170_LED_MODE_FREQUENCY_0_5HZ         0x0010
+#define AR9170_LED_MODE_FREQUENCY_0_25HZ        0x0020
+#define AR9170_LED_MODE_FREQUENCY_0_125HZ       0x0030
+
+/* AR9170_LED_MODE BIT is not set */
+#define AR9170_LED_MODE_CONN_STATE_S            4
+#define AR9170_LED_MODE_CONN_STATE              0x0030
+#define AR9170_LED_MODE_CONN_STATE_FORCE_OFF    0x0000
+#define AR9170_LED_MODE_CONN_STATE_FORCE_ON     0x0010
+/* Idle off / Active on */
+#define AR9170_LED_MODE_CONN_STATE_IOFF_AON     0x0020
+/* Idle on / Active off */
+#define AR9170_LED_MODE_CONN_STATE_ION_AOFF     0x0010
+
+#define AR9170_LED_MODE_MODE                    0x0040
+#define AR9170_LED_MODE_RESERVED2               0x0080
+
+#define AR9170_LED_MODE_TON_SCAN_S              8
+#define AR9170_LED_MODE_TON_SCAN                0x0f00
+
+#define AR9170_LED_MODE_TOFF_SCAN_S             12
+#define AR9170_LED_MODE_TOFF_SCAN               0xf000
+
+struct ar9170_led_mode {
+        __le16 led;
+};
+
+#endif /* __CARL9170_SHARED_EEPROM_H */
diff --git a/drivers/net/wireless/ath/carl9170/fw.c b/drivers/net/wireless/ath/carl9170/fw.c
new file mode 100644
index 000000000000..ae6c006bbc56
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/fw.c
@@ -0,0 +1,402 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * firmware parser
+ *
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ */
+
+#include <linux/kernel.h>
+#include <linux/firmware.h>
+#include <linux/crc32.h>
+#include "carl9170.h"
+#include "fwcmd.h"
+#include "version.h"
+
+#define MAKE_STR(symbol) #symbol
+#define TO_STR(symbol) MAKE_STR(symbol)
+#define CARL9170FW_API_VER_STR TO_STR(CARL9170FW_API_MAX_VER)
+MODULE_VERSION(CARL9170FW_API_VER_STR ":" CARL9170FW_VERSION_GIT);
+
+static const u8 otus_magic[4] = { OTUS_MAGIC };
+
+static const void *carl9170_fw_find_desc(struct ar9170 *ar, const u8 descid[4],
+        const unsigned int len, const u8 compatible_revision)
+{
+        const struct carl9170fw_desc_head *iter;
+
+        carl9170fw_for_each_hdr(iter, ar->fw.desc) {
+                if (carl9170fw_desc_cmp(iter, descid, len,
+                                        compatible_revision))
+                        return (void *)iter;
+        }
+
+        /* needed to find the LAST desc */
+        if (carl9170fw_desc_cmp(iter, descid, len,
+                                compatible_revision))
+                return (void *)iter;
+
+        return NULL;
+}
+
+static int carl9170_fw_verify_descs(struct ar9170 *ar,
+        const struct carl9170fw_desc_head *head, unsigned int max_len)
+{
+        const struct carl9170fw_desc_head *pos;
+        unsigned long pos_addr, end_addr;
+        unsigned int pos_length;
+
+        if (max_len < sizeof(*pos))
+                return -ENODATA;
+
+        max_len = min_t(unsigned int, CARL9170FW_DESC_MAX_LENGTH, max_len);
+
+        pos = head;
+        pos_addr = (unsigned long) pos;
+        end_addr = pos_addr + max_len;
+
+        while (pos_addr < end_addr) {
+                if (pos_addr + sizeof(*head) > end_addr)
+                        return -E2BIG;
+
+                pos_length = le16_to_cpu(pos->length);
+
+                if (pos_length < sizeof(*head))
+                        return -EBADMSG;
+
+                if (pos_length > max_len)
+                        return -EOVERFLOW;
+
+                if (pos_addr + pos_length > end_addr)
+                        return -EMSGSIZE;
+
+                if (carl9170fw_desc_cmp(pos, LAST_MAGIC,
+                                        CARL9170FW_LAST_DESC_SIZE,
+                                        CARL9170FW_LAST_DESC_CUR_VER))
+                        return 0;
+
+                pos_addr += pos_length;
+                pos = (void *)pos_addr;
+                max_len -= pos_length;
+        }
+        return -EINVAL;
+}
+
+static void carl9170_fw_info(struct ar9170 *ar)
+{
+        const struct carl9170fw_motd_desc *motd_desc;
+        unsigned int str_ver_len;
+        u32 fw_date;
+
+        dev_info(&ar->udev->dev, "driver   API: %s 2%03d-%02d-%02d [%d-%d]\n",
+                CARL9170FW_VERSION_GIT, CARL9170FW_VERSION_YEAR,
+                CARL9170FW_VERSION_MONTH, CARL9170FW_VERSION_DAY,
+                CARL9170FW_API_MIN_VER, CARL9170FW_API_MAX_VER);
+
+        motd_desc = carl9170_fw_find_desc(ar, MOTD_MAGIC,
+                sizeof(*motd_desc), CARL9170FW_MOTD_DESC_CUR_VER);
+
+        if (motd_desc) {
+                str_ver_len = strnlen(motd_desc->release,
+                        CARL9170FW_MOTD_RELEASE_LEN);
+
+                fw_date = le32_to_cpu(motd_desc->fw_year_month_day);
+
+                dev_info(&ar->udev->dev, "firmware API: %.*s 2%03d-%02d-%02d\n",
+                         str_ver_len, motd_desc->release,
+                         CARL9170FW_GET_YEAR(fw_date),
+                         CARL9170FW_GET_MONTH(fw_date),
+                         CARL9170FW_GET_DAY(fw_date));
+
+                strlcpy(ar->hw->wiphy->fw_version, motd_desc->release,
+                        sizeof(ar->hw->wiphy->fw_version));
+        }
+}
+
+static bool valid_dma_addr(const u32 address)
+{
+        if (address >= AR9170_SRAM_OFFSET &&
+            address < (AR9170_SRAM_OFFSET + AR9170_SRAM_SIZE))
+                return true;
+
+        return false;
+}
+
+static bool valid_cpu_addr(const u32 address)
+{
+        if (valid_dma_addr(address) || (address >= AR9170_PRAM_OFFSET &&
+            address < (AR9170_PRAM_OFFSET + AR9170_PRAM_SIZE)))
+                return true;
+
+        return false;
+}
+
+static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len)
+{
+        const struct carl9170fw_otus_desc *otus_desc;
+        const struct carl9170fw_chk_desc *chk_desc;
+        const struct carl9170fw_last_desc *last_desc;
+
+        last_desc = carl9170_fw_find_desc(ar, LAST_MAGIC,
+                sizeof(*last_desc), CARL9170FW_LAST_DESC_CUR_VER);
+        if (!last_desc)
+                return -EINVAL;
+
+        otus_desc = carl9170_fw_find_desc(ar, OTUS_MAGIC,
+                sizeof(*otus_desc), CARL9170FW_OTUS_DESC_CUR_VER);
+        if (!otus_desc) {
+                dev_err(&ar->udev->dev, "failed to find compatible firmware "
+                        "descriptor.\n");
+                return -ENODATA;
+        }
+
+        chk_desc = carl9170_fw_find_desc(ar, CHK_MAGIC,
+                sizeof(*chk_desc), CARL9170FW_CHK_DESC_CUR_VER);
+
+        if (chk_desc) {
+                unsigned long fin, diff;
+                unsigned int dsc_len;
+                u32 crc32;
+
+                dsc_len = min_t(unsigned int, len,
+                        (unsigned long)chk_desc - (unsigned long)otus_desc);
+
+                fin = (unsigned long) last_desc + sizeof(*last_desc);
+                diff = fin - (unsigned long) otus_desc;
+
+                if (diff < len)
+                        len -= diff;
+
+                if (len < 256)
+                        return -EIO;
+
+                crc32 = crc32_le(~0, data, len);
+                if (cpu_to_le32(crc32) != chk_desc->fw_crc32) {
+                        dev_err(&ar->udev->dev, "fw checksum test failed.\n");
+                        return -ENOEXEC;
+                }
+
+                crc32 = crc32_le(crc32, (void *)otus_desc, dsc_len);
+                if (cpu_to_le32(crc32) != chk_desc->hdr_crc32) {
+                        dev_err(&ar->udev->dev, "descriptor check failed.\n");
+                        return -EINVAL;
+                }
+        } else {
+                dev_warn(&ar->udev->dev, "Unprotected firmware image.\n");
+        }
+
+#define SUPP(feat)                                              \
+        (carl9170fw_supports(otus_desc->feature_set, feat))
+
+        if (!SUPP(CARL9170FW_DUMMY_FEATURE)) {
+                dev_err(&ar->udev->dev, "invalid firmware descriptor "
+                        "format detected.\n");
+                return -EINVAL;
+        }
+
+        ar->fw.api_version = otus_desc->api_ver;
+
+        if (ar->fw.api_version < CARL9170FW_API_MIN_VER ||
+            ar->fw.api_version > CARL9170FW_API_MAX_VER) {
+                dev_err(&ar->udev->dev, "unsupported firmware api version.\n");
+                return -EINVAL;
+        }
+
+        if (!SUPP(CARL9170FW_COMMAND_PHY) || SUPP(CARL9170FW_UNUSABLE) ||
+            !SUPP(CARL9170FW_HANDLE_BACK_REQ)) {
+                dev_err(&ar->udev->dev, "firmware does support "
+                        "mandatory features.\n");
+                return -ECANCELED;
+        }
+
+        if (ilog2(le32_to_cpu(otus_desc->feature_set)) >=
+                __CARL9170FW_FEATURE_NUM) {
+                dev_warn(&ar->udev->dev, "driver does not support all "
+                         "firmware features.\n");
+        }
+
+        if (!SUPP(CARL9170FW_COMMAND_CAM)) {
+                dev_info(&ar->udev->dev, "crypto offloading is disabled "
+                         "by firmware.\n");
+                ar->disable_offload = true;
+        }
+
+        if (SUPP(CARL9170FW_PSM))
+                ar->hw->flags |= IEEE80211_HW_SUPPORTS_PS;
+
+        if (!SUPP(CARL9170FW_USB_INIT_FIRMWARE)) {
+                dev_err(&ar->udev->dev, "firmware does not provide "
+                        "mandatory interfaces.\n");
+                return -EINVAL;
+        }
+
+        if (SUPP(CARL9170FW_MINIBOOT))
+                ar->fw.offset = le16_to_cpu(otus_desc->miniboot_size);
+        else
+                ar->fw.offset = 0;
+
+        if (SUPP(CARL9170FW_USB_DOWN_STREAM)) {
+                ar->hw->extra_tx_headroom += sizeof(struct ar9170_stream);
+                ar->fw.tx_stream = true;
+        }
+
+        if (SUPP(CARL9170FW_USB_UP_STREAM))
+                ar->fw.rx_stream = true;
+
+        if (SUPP(CARL9170FW_RX_FILTER)) {
+                ar->fw.rx_filter = true;
+                ar->rx_filter_caps = FIF_FCSFAIL | FIF_PLCPFAIL |
+                        FIF_CONTROL | FIF_PSPOLL | FIF_OTHER_BSS |
+                        FIF_PROMISC_IN_BSS;
+        }
+
+        ar->fw.vif_num = otus_desc->vif_num;
+        ar->fw.cmd_bufs = otus_desc->cmd_bufs;
+        ar->fw.address = le32_to_cpu(otus_desc->fw_address);
+        ar->fw.rx_size = le16_to_cpu(otus_desc->rx_max_frame_len);
+        ar->fw.mem_blocks = min_t(unsigned int, otus_desc->tx_descs, 0xfe);
+        atomic_set(&ar->mem_free_blocks, ar->fw.mem_blocks);
+        ar->fw.mem_block_size = le16_to_cpu(otus_desc->tx_frag_len);
+
+        if (ar->fw.vif_num >= AR9170_MAX_VIRTUAL_MAC || !ar->fw.vif_num ||
+            ar->fw.mem_blocks < 16 || !ar->fw.cmd_bufs ||
+            ar->fw.mem_block_size < 64 || ar->fw.mem_block_size > 512 ||
+            ar->fw.rx_size > 32768 || ar->fw.rx_size < 4096 ||
+            !valid_cpu_addr(ar->fw.address)) {
+                dev_err(&ar->udev->dev, "firmware shows obvious signs of "
+                        "malicious tampering.\n");
+                return -EINVAL;
+        }
+
+        ar->fw.beacon_addr = le32_to_cpu(otus_desc->bcn_addr);
+        ar->fw.beacon_max_len = le16_to_cpu(otus_desc->bcn_len);
+
+        if (valid_dma_addr(ar->fw.beacon_addr) && ar->fw.beacon_max_len >=
+            AR9170_MAC_BCN_LENGTH_MAX) {
+                ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
+
+                if (SUPP(CARL9170FW_WLANTX_CAB)) {
+                        ar->hw->wiphy->interface_modes |=
+                                BIT(NL80211_IFTYPE_AP);
+                }
+        }
+
+#undef SUPPORTED
+        return 0;
+}
+
+static struct carl9170fw_desc_head *
+carl9170_find_fw_desc(struct ar9170 *ar, const __u8 *fw_data, const size_t len)
+
+{
+        int scan = 0, found = 0;
+
+        if (!carl9170fw_size_check(len)) {
+                dev_err(&ar->udev->dev, "firmware size is out of bound.\n");
+                return NULL;
+        }
+
+        while (scan < len - sizeof(struct carl9170fw_desc_head)) {
+                if (fw_data[scan++] == otus_magic[found])
+                        found++;
+                else
+                        found = 0;
+
+                if (scan >= len)
+                        break;
+
+                if (found == sizeof(otus_magic))
+                        break;
+        }
+
+        if (found != sizeof(otus_magic))
+                return NULL;
+
+        return (void *)&fw_data[scan - found];
+}
+
+int carl9170_fw_fix_eeprom(struct ar9170 *ar)
+{
+        const struct carl9170fw_fix_desc *fix_desc = NULL;
+        unsigned int i, n, off;
+        u32 *data = (void *)&ar->eeprom;
+
+        fix_desc = carl9170_fw_find_desc(ar, FIX_MAGIC,
+                sizeof(*fix_desc), CARL9170FW_FIX_DESC_CUR_VER);
+
+        if (!fix_desc)
+                return 0;
+
+        n = (le16_to_cpu(fix_desc->head.length) - sizeof(*fix_desc)) /
+            sizeof(struct carl9170fw_fix_entry);
+
+        for (i = 0; i < n; i++) {
+                off = le32_to_cpu(fix_desc->data[i].address) -
+                      AR9170_EEPROM_START;
+
+                if (off >= sizeof(struct ar9170_eeprom) || (off & 3)) {
+                        dev_err(&ar->udev->dev, "Skip invalid entry %d\n", i);
+                        continue;
+                }
+
+                data[off / sizeof(*data)] &=
+                        le32_to_cpu(fix_desc->data[i].mask);
+                data[off / sizeof(*data)] |=
+                        le32_to_cpu(fix_desc->data[i].value);
+        }
+
+        return 0;
+}
+
+int carl9170_parse_firmware(struct ar9170 *ar)
+{
+        const struct carl9170fw_desc_head *fw_desc = NULL;
+        const struct firmware *fw = ar->fw.fw;
+        unsigned long header_offset = 0;
+        int err;
+
+        if (WARN_ON(!fw))
+                return -EINVAL;
+
+        fw_desc = carl9170_find_fw_desc(ar, fw->data, fw->size);
+
+        if (!fw_desc) {
+                dev_err(&ar->udev->dev, "unsupported firmware.\n");
+                return -ENODATA;
+        }
+
+        header_offset = (unsigned long)fw_desc - (unsigned long)fw->data;
+
+        err = carl9170_fw_verify_descs(ar, fw_desc, fw->size - header_offset);
+        if (err) {
+                dev_err(&ar->udev->dev, "damaged firmware (%d).\n", err);
+                return err;
+        }
+
+        ar->fw.desc = fw_desc;
+
+        carl9170_fw_info(ar);
+
+        err = carl9170_fw(ar, fw->data, fw->size);
+        if (err) {
+                dev_err(&ar->udev->dev, "failed to parse firmware (%d).\n",
+                        err);
+                return err;
+        }
+
+        return 0;
+}
diff --git a/drivers/net/wireless/ath/carl9170/fwcmd.h b/drivers/net/wireless/ath/carl9170/fwcmd.h
new file mode 100644
index 000000000000..d552166db505
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/fwcmd.h
@@ -0,0 +1,284 @@
+/*
+ * Shared Atheros AR9170 Header
+ *
+ * Firmware command interface definitions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __CARL9170_SHARED_FWCMD_H
+#define __CARL9170_SHARED_FWCMD_H
+
+#define CARL9170_MAX_CMD_LEN            64
+#define CARL9170_MAX_CMD_PAYLOAD_LEN    60
+
+#define CARL9170FW_API_MIN_VER          1
+#define CARL9170FW_API_MAX_VER          1
+
+enum carl9170_cmd_oids {
+        CARL9170_CMD_RREG               = 0x00,
+        CARL9170_CMD_WREG               = 0x01,
+        CARL9170_CMD_ECHO               = 0x02,
+        CARL9170_CMD_SWRST              = 0x03,
+        CARL9170_CMD_REBOOT             = 0x04,
+        CARL9170_CMD_BCN_CTRL           = 0x05,
+        CARL9170_CMD_READ_TSF           = 0x06,
+        CARL9170_CMD_RX_FILTER          = 0x07,
+
+        /* CAM */
+        CARL9170_CMD_EKEY               = 0x10,
+        CARL9170_CMD_DKEY               = 0x11,
+
+        /* RF / PHY */
+        CARL9170_CMD_FREQUENCY          = 0x20,
+        CARL9170_CMD_RF_INIT            = 0x21,
+        CARL9170_CMD_SYNTH              = 0x22,
+        CARL9170_CMD_FREQ_START         = 0x23,
+        CARL9170_CMD_PSM                = 0x24,
+
+        /* Asychronous command flag */
+        CARL9170_CMD_ASYNC_FLAG         = 0x40,
+        CARL9170_CMD_WREG_ASYNC         = (CARL9170_CMD_WREG |
+                                           CARL9170_CMD_ASYNC_FLAG),
+        CARL9170_CMD_REBOOT_ASYNC       = (CARL9170_CMD_REBOOT |
+                                           CARL9170_CMD_ASYNC_FLAG),
+        CARL9170_CMD_BCN_CTRL_ASYNC     = (CARL9170_CMD_BCN_CTRL |
+                                           CARL9170_CMD_ASYNC_FLAG),
+        CARL9170_CMD_PSM_ASYNC          = (CARL9170_CMD_PSM |
+                                           CARL9170_CMD_ASYNC_FLAG),
+
+        /* responses and traps */
+        CARL9170_RSP_FLAG               = 0xc0,
+        CARL9170_RSP_PRETBTT            = 0xc0,
+        CARL9170_RSP_TXCOMP             = 0xc1,
+        CARL9170_RSP_BEACON_CONFIG      = 0xc2,
+        CARL9170_RSP_ATIM               = 0xc3,
+        CARL9170_RSP_WATCHDOG           = 0xc6,
+        CARL9170_RSP_TEXT               = 0xca,
+        CARL9170_RSP_HEXDUMP            = 0xcc,
+        CARL9170_RSP_RADAR              = 0xcd,
+        CARL9170_RSP_GPIO               = 0xce,
+        CARL9170_RSP_BOOT               = 0xcf,
+};
+
+struct carl9170_set_key_cmd {
+        __le16          user;
+        __le16          keyId;
+        __le16          type;
+        u8              macAddr[6];
+        u32             key[4];
+} __packed;
+#define CARL9170_SET_KEY_CMD_SIZE               28
+
+struct carl9170_disable_key_cmd {
+        __le16          user;
+        __le16          padding;
+} __packed;
+#define CARL9170_DISABLE_KEY_CMD_SIZE           4
+
+struct carl9170_u32_list {
+        u32     vals[0];
+} __packed;
+
+struct carl9170_reg_list {
+        __le32          regs[0];
+} __packed;
+
+struct carl9170_write_reg {
+        struct {
+                __le32          addr;
+                __le32          val;
+        } regs[0] __packed;
+} __packed;
+
+#define CARL9170FW_PHY_HT_ENABLE                0x4
+#define CARL9170FW_PHY_HT_DYN2040               0x8
+#define CARL9170FW_PHY_HT_EXT_CHAN_OFF          0x3
+#define CARL9170FW_PHY_HT_EXT_CHAN_OFF_S        2
+
+struct carl9170_rf_init {
+        __le32          freq;
+        u8              ht_settings;
+        u8              padding2[3];
+        __le32          delta_slope_coeff_exp;
+        __le32          delta_slope_coeff_man;
+        __le32          delta_slope_coeff_exp_shgi;
+        __le32          delta_slope_coeff_man_shgi;
+        __le32          finiteLoopCount;
+} __packed;
+#define CARL9170_RF_INIT_SIZE           28
+
+struct carl9170_rf_init_result {
+        __le32          ret;            /* AR9170_PHY_REG_AGC_CONTROL */
+} __packed;
+#define CARL9170_RF_INIT_RESULT_SIZE    4
+
+#define CARL9170_PSM_SLEEP              0x1000
+#define CARL9170_PSM_SOFTWARE           0
+#define CARL9170_PSM_WAKE               0 /* internally used. */
+#define CARL9170_PSM_COUNTER            0xfff
+#define CARL9170_PSM_COUNTER_S          0
+
+struct carl9170_psm {
+        __le32          state;
+} __packed;
+#define CARL9170_PSM_SIZE               4
+
+struct carl9170_rx_filter_cmd {
+        __le32          rx_filter;
+} __packed;
+#define CARL9170_RX_FILTER_CMD_SIZE     4
+
+#define CARL9170_RX_FILTER_BAD          0x01
+#define CARL9170_RX_FILTER_OTHER_RA     0x02
+#define CARL9170_RX_FILTER_DECRY_FAIL   0x04
+#define CARL9170_RX_FILTER_CTL_OTHER    0x08
+#define CARL9170_RX_FILTER_CTL_PSPOLL   0x10
+#define CARL9170_RX_FILTER_CTL_BACKR    0x20
+#define CARL9170_RX_FILTER_MGMT         0x40
+#define CARL9170_RX_FILTER_DATA         0x80
+
+struct carl9170_bcn_ctrl_cmd {
+        __le32          vif_id;
+        __le32          mode;
+        __le32          bcn_addr;
+        __le32          bcn_len;
+} __packed;
+#define CARL9170_BCN_CTRL_CMD_SIZE      16
+
+#define CARL9170_BCN_CTRL_DRAIN 0
+#define CARL9170_BCN_CTRL_CAB_TRIGGER   1
+
+struct carl9170_cmd_head {
+        union {
+                struct {
+                        u8      len;
+                        u8      cmd;
+                        u8      seq;
+                        u8      ext;
+                } __packed;
+
+                u32 hdr_data;
+        } __packed;
+} __packed;
+
+struct carl9170_cmd {
+        struct carl9170_cmd_head hdr;
+        union {
+                struct carl9170_set_key_cmd     setkey;
+                struct carl9170_disable_key_cmd disablekey;
+                struct carl9170_u32_list        echo;
+                struct carl9170_reg_list        rreg;
+                struct carl9170_write_reg       wreg;
+                struct carl9170_rf_init         rf_init;
+                struct carl9170_psm             psm;
+                struct carl9170_bcn_ctrl_cmd    bcn_ctrl;
+                struct carl9170_rx_filter_cmd   rx_filter;
+                u8 data[CARL9170_MAX_CMD_PAYLOAD_LEN];
+        } __packed;
+} __packed;
+
+#define CARL9170_TX_STATUS_QUEUE        3
+#define CARL9170_TX_STATUS_QUEUE_S      0
+#define CARL9170_TX_STATUS_RIX_S        2
+#define CARL9170_TX_STATUS_RIX          (3 << CARL9170_TX_STATUS_RIX_S)
+#define CARL9170_TX_STATUS_TRIES_S      4
+#define CARL9170_TX_STATUS_TRIES        (7 << CARL9170_TX_STATUS_TRIES_S)
+#define CARL9170_TX_STATUS_SUCCESS      0x80
+
+/*
+ * NOTE:
+ * Both structs [carl9170_tx_status and _carl9170_tx_status]
+ * need to be "bit for bit" in sync.
+ */
+struct carl9170_tx_status {
+        /*
+         * Beware of compiler bugs in all gcc pre 4.4!
+         */
+
+        u8 cookie;
+        u8 queue:2;
+        u8 rix:2;
+        u8 tries:3;
+        u8 success:1;
+} __packed;
+struct _carl9170_tx_status {
+        /*
+         * This version should be immune to all alignment bugs.
+         */
+
+        u8 cookie;
+        u8 info;
+} __packed;
+#define CARL9170_TX_STATUS_SIZE         2
+
+#define CARL9170_RSP_TX_STATUS_NUM      (CARL9170_MAX_CMD_PAYLOAD_LEN / \
+                                         sizeof(struct _carl9170_tx_status))
+
+#define CARL9170_TX_MAX_RATE_TRIES      7
+
+#define CARL9170_TX_MAX_RATES           4
+#define CARL9170_TX_MAX_RETRY_RATES     (CARL9170_TX_MAX_RATES - 1)
+#define CARL9170_ERR_MAGIC              "ERR:"
+#define CARL9170_BUG_MAGIC              "BUG:"
+
+struct carl9170_gpio {
+        __le32 gpio;
+} __packed;
+#define CARL9170_GPIO_SIZE              4
+
+struct carl9170_tsf_rsp {
+        union {
+                __le32 tsf[2];
+                __le64 tsf_64;
+        } __packed;
+} __packed;
+#define CARL9170_TSF_RSP_SIZE           8
+
+struct carl9170_rsp {
+        struct carl9170_cmd_head hdr;
+
+        union {
+                struct carl9170_rf_init_result  rf_init_res;
+                struct carl9170_u32_list        rreg_res;
+                struct carl9170_u32_list        echo;
+                struct carl9170_tx_status       tx_status[0];
+                struct _carl9170_tx_status      _tx_status[0];
+                struct carl9170_gpio            gpio;
+                struct carl9170_tsf_rsp         tsf;
+                struct carl9170_psm             psm;
+                u8 data[CARL9170_MAX_CMD_PAYLOAD_LEN];
+        } __packed;
+} __packed;
+
+#endif /* __CARL9170_SHARED_FWCMD_H */
diff --git a/drivers/net/wireless/ath/carl9170/fwdesc.h b/drivers/net/wireless/ath/carl9170/fwdesc.h
new file mode 100644
index 000000000000..71f3821f6058
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/fwdesc.h
@@ -0,0 +1,241 @@
+/*
+ * Shared CARL9170 Header
+ *
+ * Firmware descriptor format
+ *
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ */
+
+#ifndef __CARL9170_SHARED_FWDESC_H
+#define __CARL9170_SHARED_FWDESC_H
+
+/* NOTE: Don't mess with the order of the flags! */
+enum carl9170fw_feature_list {
+        /* Always set */
+        CARL9170FW_DUMMY_FEATURE,
+
+        /*
+         * Indicates that this image has special boot block which prevents
+         * legacy drivers to drive the firmware.
+         */
+        CARL9170FW_MINIBOOT,
+
+        /* usb registers are initialized by the firmware */
+        CARL9170FW_USB_INIT_FIRMWARE,
+
+        /* command traps & notifications are send through EP2 */
+        CARL9170FW_USB_RESP_EP2,
+
+        /* usb download (app -> fw) stream */
+        CARL9170FW_USB_DOWN_STREAM,
+
+        /* usb upload (fw -> app) stream */
+        CARL9170FW_USB_UP_STREAM,
+
+        /* unusable - reserved to flag non-functional debug firmwares */
+        CARL9170FW_UNUSABLE,
+
+        /* AR9170_CMD_RF_INIT, AR9170_CMD_FREQ_START, AR9170_CMD_FREQUENCY */
+        CARL9170FW_COMMAND_PHY,
+
+        /* AR9170_CMD_EKEY, AR9170_CMD_DKEY */
+        CARL9170FW_COMMAND_CAM,
+
+        /* Firmware has a software Content After Beacon Queueing mechanism */
+        CARL9170FW_WLANTX_CAB,
+
+        /* The firmware is capable of responding to incoming BAR frames */
+        CARL9170FW_HANDLE_BACK_REQ,
+
+        /* GPIO Interrupt | CARL9170_RSP_GPIO */
+        CARL9170FW_GPIO_INTERRUPT,
+
+        /* Firmware PSM support | CARL9170_CMD_PSM */
+        CARL9170FW_PSM,
+
+        /* Firmware RX filter | CARL9170_CMD_RX_FILTER */
+        CARL9170FW_RX_FILTER,
+
+        /* KEEP LAST */
+        __CARL9170FW_FEATURE_NUM
+};
+
+#define OTUS_MAGIC      "OTAR"
+#define MOTD_MAGIC      "MOTD"
+#define FIX_MAGIC       "FIX\0"
+#define DBG_MAGIC       "DBG\0"
+#define CHK_MAGIC       "CHK\0"
+#define LAST_MAGIC      "LAST"
+
+#define CARL9170FW_SET_DAY(d) (((d) - 1) % 31)
+#define CARL9170FW_SET_MONTH(m) ((((m) - 1) % 12) * 31)
+#define CARL9170FW_SET_YEAR(y) (((y) - 10) * 372)
+
+#define CARL9170FW_GET_DAY(d) (((d) % 31) + 1)
+#define CARL9170FW_GET_MONTH(m) ((((m) / 31) % 12) + 1)
+#define CARL9170FW_GET_YEAR(y) ((y) / 372 + 10)
+
+struct carl9170fw_desc_head {
+        u8      magic[4];
+        __le16 length;
+        u8 min_ver;
+        u8 cur_ver;
+} __packed;
+#define CARL9170FW_DESC_HEAD_SIZE                       \
+        (sizeof(struct carl9170fw_desc_head))
+
+#define CARL9170FW_OTUS_DESC_MIN_VER            6
+#define CARL9170FW_OTUS_DESC_CUR_VER            6
+struct carl9170fw_otus_desc {
+        struct carl9170fw_desc_head head;
+        __le32 feature_set;
+        __le32 fw_address;
+        __le32 bcn_addr;
+        __le16 bcn_len;
+        __le16 miniboot_size;
+        __le16 tx_frag_len;
+        __le16 rx_max_frame_len;
+        u8 tx_descs;
+        u8 cmd_bufs;
+        u8 api_ver;
+        u8 vif_num;
+} __packed;
+#define CARL9170FW_OTUS_DESC_SIZE                       \
+        (sizeof(struct carl9170fw_otus_desc))
+
+#define CARL9170FW_MOTD_STRING_LEN                      24
+#define CARL9170FW_MOTD_RELEASE_LEN                     20
+#define CARL9170FW_MOTD_DESC_MIN_VER                    1
+#define CARL9170FW_MOTD_DESC_CUR_VER                    2
+struct carl9170fw_motd_desc {
+        struct carl9170fw_desc_head head;
+        __le32 fw_year_month_day;
+        char desc[CARL9170FW_MOTD_STRING_LEN];
+        char release[CARL9170FW_MOTD_RELEASE_LEN];
+} __packed;
+#define CARL9170FW_MOTD_DESC_SIZE                       \
+        (sizeof(struct carl9170fw_motd_desc))
+
+#define CARL9170FW_FIX_DESC_MIN_VER                     1
+#define CARL9170FW_FIX_DESC_CUR_VER                     2
+struct carl9170fw_fix_entry {
+        __le32 address;
+        __le32 mask;
+        __le32 value;
+} __packed;
+
+struct carl9170fw_fix_desc {
+        struct carl9170fw_desc_head head;
+        struct carl9170fw_fix_entry data[0];
+} __packed;
+#define CARL9170FW_FIX_DESC_SIZE                        \
+        (sizeof(struct carl9170fw_fix_desc))
+
+#define CARL9170FW_DBG_DESC_MIN_VER                     1
+#define CARL9170FW_DBG_DESC_CUR_VER                     3
+struct carl9170fw_dbg_desc {
+        struct carl9170fw_desc_head head;
+
+        __le32 bogoclock_addr;
+        __le32 counter_addr;
+        __le32 rx_total_addr;
+        __le32 rx_overrun_addr;
+        __le32 rx_filter;
+
+        /* Put your debugging definitions here */
+} __packed;
+#define CARL9170FW_DBG_DESC_SIZE                        \
+        (sizeof(struct carl9170fw_dbg_desc))
+
+#define CARL9170FW_CHK_DESC_MIN_VER                     1
+#define CARL9170FW_CHK_DESC_CUR_VER                     2
+struct carl9170fw_chk_desc {
+        struct carl9170fw_desc_head head;
+        __le32 fw_crc32;
+        __le32 hdr_crc32;
+} __packed;
+#define CARL9170FW_CHK_DESC_SIZE                        \
+        (sizeof(struct carl9170fw_chk_desc))
+
+#define CARL9170FW_LAST_DESC_MIN_VER                    1
+#define CARL9170FW_LAST_DESC_CUR_VER                    2
+struct carl9170fw_last_desc {
+        struct carl9170fw_desc_head head;
+} __packed;
+#define CARL9170FW_LAST_DESC_SIZE                       \
+        (sizeof(struct carl9170fw_fix_desc))
+
+#define CARL9170FW_DESC_MAX_LENGTH                      8192
+
+#define CARL9170FW_FILL_DESC(_magic, _length, _min_ver, _cur_ver)       \
+        .head = {                                                       \
+                .magic = _magic,                                        \
+                .length = cpu_to_le16(_length),                         \
+                .min_ver = _min_ver,                                    \
+                .cur_ver = _cur_ver,                                    \
+        }
+
+static inline void carl9170fw_fill_desc(struct carl9170fw_desc_head *head,
+                                         u8 magic[4], __le16 length,
+                                         u8 min_ver, u8 cur_ver)
+{
+        head->magic[0] = magic[0];
+        head->magic[1] = magic[1];
+        head->magic[2] = magic[2];
+        head->magic[3] = magic[3];
+
+        head->length = length;
+        head->min_ver = min_ver;
+        head->cur_ver = cur_ver;
+}
+
+#define carl9170fw_for_each_hdr(desc, fw_desc)                          \
+        for (desc = fw_desc;                                            \
+             memcmp(desc->magic, LAST_MAGIC, 4) &&                      \
+             le16_to_cpu(desc->length) >= CARL9170FW_DESC_HEAD_SIZE &&  \
+             le16_to_cpu(desc->length) < CARL9170FW_DESC_MAX_LENGTH;    \
+             desc = (void *)((unsigned long)desc + le16_to_cpu(desc->length)))
+
+#define CHECK_HDR_VERSION(head, _min_ver)                               \
+        (((head)->cur_ver < _min_ver) || ((head)->min_ver > _min_ver))  \
+
+static inline bool carl9170fw_supports(__le32 list, u8 feature)
+{
+        return le32_to_cpu(list) & BIT(feature);
+}
+
+static inline bool carl9170fw_desc_cmp(const struct carl9170fw_desc_head *head,
+                                       const u8 descid[4], u16 min_len,
+                                       u8 compatible_revision)
+{
+        if (descid[0] == head->magic[0] && descid[1] == head->magic[1] &&
+            descid[2] == head->magic[2] && descid[3] == head->magic[3] &&
+            !CHECK_HDR_VERSION(head, compatible_revision) &&
+            (le16_to_cpu(head->length) >= min_len))
+                return true;
+
+        return false;
+}
+
+#define CARL9170FW_MIN_SIZE     32
+#define CARL9170FW_MAX_SIZE     16384
+
+static inline bool carl9170fw_size_check(unsigned int len)
+{
+        return (len <= CARL9170FW_MAX_SIZE && len >= CARL9170FW_MIN_SIZE);
+}
+
+#endif /* __CARL9170_SHARED_FWDESC_H */
diff --git a/drivers/net/wireless/ath/carl9170/hw.h b/drivers/net/wireless/ath/carl9170/hw.h
new file mode 100644
index 000000000000..2f471b3f05af
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/hw.h
@@ -0,0 +1,739 @@
+/*
+ * Shared Atheros AR9170 Header
+ *
+ * Register map, hardware-specific definitions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __CARL9170_SHARED_HW_H
+#define __CARL9170_SHARED_HW_H
+
+/* High Speed UART */
+#define AR9170_UART_REG_BASE                    0x1c0000
+
+/* Definitions of interrupt registers */
+#define AR9170_UART_REG_RX_BUFFER               (AR9170_UART_REG_BASE + 0x000)
+#define AR9170_UART_REG_TX_HOLDING              (AR9170_UART_REG_BASE + 0x004)
+#define AR9170_UART_REG_FIFO_CONTROL            (AR9170_UART_REG_BASE + 0x010)
+#define         AR9170_UART_FIFO_CTRL_RESET_RX_FIFO     0x02
+#define         AR9170_UART_FIFO_CTRL_RESET_TX_FIFO     0x04
+
+#define AR9170_UART_REG_LINE_CONTROL            (AR9170_UART_REG_BASE + 0x014)
+#define AR9170_UART_REG_MODEM_CONTROL           (AR9170_UART_REG_BASE + 0x018)
+#define         AR9170_UART_MODEM_CTRL_DTR_BIT          0x01
+#define         AR9170_UART_MODEM_CTRL_RTS_BIT          0x02
+#define         AR9170_UART_MODEM_CTRL_INTERNAL_LOOP_BACK       0x10
+#define         AR9170_UART_MODEM_CTRL_AUTO_RTS         0x20
+#define         AR9170_UART_MODEM_CTRL_AUTO_CTR         0x40
+
+#define AR9170_UART_REG_LINE_STATUS             (AR9170_UART_REG_BASE + 0x01c)
+#define         AR9170_UART_LINE_STS_RX_DATA_READY      0x01
+#define         AR9170_UART_LINE_STS_RX_BUFFER_OVERRUN  0x02
+#define         AR9170_UART_LINE_STS_RX_BREAK_IND       0x10
+#define         AR9170_UART_LINE_STS_TX_FIFO_NEAR_EMPTY 0x20
+#define         AR9170_UART_LINE_STS_TRANSMITTER_EMPTY  0x40
+
+#define AR9170_UART_REG_MODEM_STATUS            (AR9170_UART_REG_BASE + 0x020)
+#define         AR9170_UART_MODEM_STS_CTS_CHANGE        0x01
+#define         AR9170_UART_MODEM_STS_DSR_CHANGE        0x02
+#define         AR9170_UART_MODEM_STS_DCD_CHANGE        0x08
+#define         AR9170_UART_MODEM_STS_CTS_COMPL         0x10
+#define         AR9170_UART_MODEM_STS_DSR_COMPL         0x20
+#define         AR9170_UART_MODEM_STS_DCD_COMPL         0x80
+
+#define AR9170_UART_REG_SCRATCH                 (AR9170_UART_REG_BASE + 0x024)
+#define AR9170_UART_REG_DIVISOR_LSB             (AR9170_UART_REG_BASE + 0x028)
+#define AR9170_UART_REG_DIVISOR_MSB             (AR9170_UART_REG_BASE + 0x02c)
+#define AR9170_UART_REG_WORD_RX_BUFFER          (AR9170_UART_REG_BASE + 0x034)
+#define AR9170_UART_REG_WORD_TX_HOLDING         (AR9170_UART_REG_BASE + 0x038)
+#define AR9170_UART_REG_FIFO_COUNT              (AR9170_UART_REG_BASE + 0x03c)
+#define AR9170_UART_REG_REMAINDER               (AR9170_UART_REG_BASE + 0x04c)
+
+/* Timer */
+#define AR9170_TIMER_REG_BASE                   0x1c1000
+
+#define AR9170_TIMER_REG_WATCH_DOG              (AR9170_TIMER_REG_BASE + 0x000)
+#define AR9170_TIMER_REG_TIMER0                 (AR9170_TIMER_REG_BASE + 0x010)
+#define AR9170_TIMER_REG_TIMER1                 (AR9170_TIMER_REG_BASE + 0x014)
+#define AR9170_TIMER_REG_TIMER2                 (AR9170_TIMER_REG_BASE + 0x018)
+#define AR9170_TIMER_REG_TIMER3                 (AR9170_TIMER_REG_BASE + 0x01c)
+#define AR9170_TIMER_REG_TIMER4                 (AR9170_TIMER_REG_BASE + 0x020)
+#define AR9170_TIMER_REG_CONTROL                (AR9170_TIMER_REG_BASE + 0x024)
+#define         AR9170_TIMER_CTRL_DISABLE_CLOCK         0x100
+
+#define AR9170_TIMER_REG_INTERRUPT              (AR9170_TIMER_REG_BASE + 0x028)
+#define         AR9170_TIMER_INT_TIMER0                 0x001
+#define         AR9170_TIMER_INT_TIMER1                 0x002
+#define         AR9170_TIMER_INT_TIMER2                 0x004
+#define         AR9170_TIMER_INT_TIMER3                 0x008
+#define         AR9170_TIMER_INT_TIMER4                 0x010
+#define         AR9170_TIMER_INT_TICK_TIMER             0x100
+
+#define AR9170_TIMER_REG_TICK_TIMER             (AR9170_TIMER_REG_BASE + 0x030)
+#define AR9170_TIMER_REG_CLOCK_LOW              (AR9170_TIMER_REG_BASE + 0x040)
+#define AR9170_TIMER_REG_CLOCK_HIGH             (AR9170_TIMER_REG_BASE + 0x044)
+
+#define AR9170_MAC_REG_BASE                     0x1c3000
+
+#define AR9170_MAC_REG_POWER_STATE_CTRL         (AR9170_MAC_REG_BASE + 0x500)
+#define         AR9170_MAC_POWER_STATE_CTRL_RESET       0x20
+
+#define AR9170_MAC_REG_MAC_POWER_STATE_CTRL     (AR9170_MAC_REG_BASE + 0x50c)
+
+#define AR9170_MAC_REG_INT_CTRL                 (AR9170_MAC_REG_BASE + 0x510)
+#define         AR9170_MAC_INT_TXC                      BIT(0)
+#define         AR9170_MAC_INT_RXC                      BIT(1)
+#define         AR9170_MAC_INT_RETRY_FAIL               BIT(2)
+#define         AR9170_MAC_INT_WAKEUP                   BIT(3)
+#define         AR9170_MAC_INT_ATIM                     BIT(4)
+#define         AR9170_MAC_INT_DTIM                     BIT(5)
+#define         AR9170_MAC_INT_CFG_BCN                  BIT(6)
+#define         AR9170_MAC_INT_ABORT                    BIT(7)
+#define         AR9170_MAC_INT_QOS                      BIT(8)
+#define         AR9170_MAC_INT_MIMO_PS                  BIT(9)
+#define         AR9170_MAC_INT_KEY_GEN                  BIT(10)
+#define         AR9170_MAC_INT_DECRY_NOUSER             BIT(11)
+#define         AR9170_MAC_INT_RADAR                    BIT(12)
+#define         AR9170_MAC_INT_QUIET_FRAME              BIT(13)
+#define         AR9170_MAC_INT_PRETBTT                  BIT(14)
+
+#define AR9170_MAC_REG_TSF_L                    (AR9170_MAC_REG_BASE + 0x514)
+#define AR9170_MAC_REG_TSF_H                    (AR9170_MAC_REG_BASE + 0x518)
+
+#define AR9170_MAC_REG_ATIM_WINDOW              (AR9170_MAC_REG_BASE + 0x51c)
+#define         AR9170_MAC_ATIM_PERIOD_S                0
+#define         AR9170_MAC_ATIM_PERIOD                  0x0000ffff
+
+#define AR9170_MAC_REG_BCN_PERIOD               (AR9170_MAC_REG_BASE + 0x520)
+#define         AR9170_MAC_BCN_PERIOD_S                 0
+#define         AR9170_MAC_BCN_PERIOD                   0x0000ffff
+#define         AR9170_MAC_BCN_DTIM_S                   16
+#define         AR9170_MAC_BCN_DTIM                     0x00ff0000
+#define         AR9170_MAC_BCN_AP_MODE                  BIT(24)
+#define         AR9170_MAC_BCN_IBSS_MODE                BIT(25)
+#define         AR9170_MAC_BCN_PWR_MGT                  BIT(26)
+#define         AR9170_MAC_BCN_STA_PS                   BIT(27)
+
+#define AR9170_MAC_REG_PRETBTT                  (AR9170_MAC_REG_BASE + 0x524)
+#define         AR9170_MAC_PRETBTT_S                    0
+#define         AR9170_MAC_PRETBTT                      0x0000ffff
+#define         AR9170_MAC_PRETBTT2_S                   16
+#define         AR9170_MAC_PRETBTT2                     0xffff0000
+
+#define AR9170_MAC_REG_MAC_ADDR_L               (AR9170_MAC_REG_BASE + 0x610)
+#define AR9170_MAC_REG_MAC_ADDR_H               (AR9170_MAC_REG_BASE + 0x614)
+#define AR9170_MAC_REG_BSSID_L                  (AR9170_MAC_REG_BASE + 0x618)
+#define AR9170_MAC_REG_BSSID_H                  (AR9170_MAC_REG_BASE + 0x61c)
+
+#define AR9170_MAC_REG_GROUP_HASH_TBL_L         (AR9170_MAC_REG_BASE + 0x624)
+#define AR9170_MAC_REG_GROUP_HASH_TBL_H         (AR9170_MAC_REG_BASE + 0x628)
+
+#define AR9170_MAC_REG_RX_TIMEOUT               (AR9170_MAC_REG_BASE + 0x62c)
+
+#define AR9170_MAC_REG_BASIC_RATE               (AR9170_MAC_REG_BASE + 0x630)
+#define AR9170_MAC_REG_MANDATORY_RATE           (AR9170_MAC_REG_BASE + 0x634)
+#define AR9170_MAC_REG_RTS_CTS_RATE             (AR9170_MAC_REG_BASE + 0x638)
+#define AR9170_MAC_REG_BACKOFF_PROTECT          (AR9170_MAC_REG_BASE + 0x63c)
+#define AR9170_MAC_REG_RX_THRESHOLD             (AR9170_MAC_REG_BASE + 0x640)
+#define AR9170_MAC_REG_AFTER_PNP                (AR9170_MAC_REG_BASE + 0x648)
+#define AR9170_MAC_REG_RX_PE_DELAY              (AR9170_MAC_REG_BASE + 0x64c)
+
+#define AR9170_MAC_REG_DYNAMIC_SIFS_ACK         (AR9170_MAC_REG_BASE + 0x658)
+#define AR9170_MAC_REG_SNIFFER                  (AR9170_MAC_REG_BASE + 0x674)
+#define         AR9170_MAC_SNIFFER_ENABLE_PROMISC       BIT(0)
+#define         AR9170_MAC_SNIFFER_DEFAULTS             0x02000000
+#define AR9170_MAC_REG_ENCRYPTION               (AR9170_MAC_REG_BASE + 0x678)
+#define         AR9170_MAC_ENCRYPTION_RX_SOFTWARE       BIT(3)
+#define         AR9170_MAC_ENCRYPTION_DEFAULTS          0x70
+
+#define AR9170_MAC_REG_MISC_680                 (AR9170_MAC_REG_BASE + 0x680)
+#define AR9170_MAC_REG_MISC_684                 (AR9170_MAC_REG_BASE + 0x684)
+#define AR9170_MAC_REG_TX_UNDERRUN              (AR9170_MAC_REG_BASE + 0x688)
+
+#define AR9170_MAC_REG_FRAMETYPE_FILTER         (AR9170_MAC_REG_BASE + 0x68c)
+#define         AR9170_MAC_FTF_ASSOC_REQ                BIT(0)
+#define         AR9170_MAC_FTF_ASSOC_RESP               BIT(1)
+#define         AR9170_MAC_FTF_REASSOC_REQ              BIT(2)
+#define         AR9170_MAC_FTF_REASSOC_RESP             BIT(3)
+#define         AR9170_MAC_FTF_PRB_REQ                  BIT(4)
+#define         AR9170_MAC_FTF_PRB_RESP                 BIT(5)
+#define         AR9170_MAC_FTF_BIT6                     BIT(6)
+#define         AR9170_MAC_FTF_BIT7                     BIT(7)
+#define         AR9170_MAC_FTF_BEACON                   BIT(8)
+#define         AR9170_MAC_FTF_ATIM                     BIT(9)
+#define         AR9170_MAC_FTF_DEASSOC                  BIT(10)
+#define         AR9170_MAC_FTF_AUTH                     BIT(11)
+#define         AR9170_MAC_FTF_DEAUTH                   BIT(12)
+#define         AR9170_MAC_FTF_BIT13                    BIT(13)
+#define         AR9170_MAC_FTF_BIT14                    BIT(14)
+#define         AR9170_MAC_FTF_BIT15                    BIT(15)
+#define         AR9170_MAC_FTF_BAR                      BIT(24)
+#define         AR9170_MAC_FTF_BA                       BIT(25)
+#define         AR9170_MAC_FTF_PSPOLL                   BIT(26)
+#define         AR9170_MAC_FTF_RTS                      BIT(27)
+#define         AR9170_MAC_FTF_CTS                      BIT(28)
+#define         AR9170_MAC_FTF_ACK                      BIT(29)
+#define         AR9170_MAC_FTF_CFE                      BIT(30)
+#define         AR9170_MAC_FTF_CFE_ACK                  BIT(31)
+#define         AR9170_MAC_FTF_DEFAULTS                 0x0500ffff
+#define         AR9170_MAC_FTF_MONITOR                  0xff00ffff
+
+#define AR9170_MAC_REG_ACK_EXTENSION            (AR9170_MAC_REG_BASE + 0x690)
+#define AR9170_MAC_REG_ACK_TPC                  (AR9170_MAC_REG_BASE + 0x694)
+#define AR9170_MAC_REG_EIFS_AND_SIFS            (AR9170_MAC_REG_BASE + 0x698)
+#define AR9170_MAC_REG_RX_TIMEOUT_COUNT         (AR9170_MAC_REG_BASE + 0x69c)
+#define AR9170_MAC_REG_RX_TOTAL                 (AR9170_MAC_REG_BASE + 0x6a0)
+#define AR9170_MAC_REG_RX_CRC32                 (AR9170_MAC_REG_BASE + 0x6a4)
+#define AR9170_MAC_REG_RX_CRC16                 (AR9170_MAC_REG_BASE + 0x6a8)
+#define AR9170_MAC_REG_RX_ERR_DECRYPTION_UNI    (AR9170_MAC_REG_BASE + 0x6ac)
+#define AR9170_MAC_REG_RX_OVERRUN               (AR9170_MAC_REG_BASE + 0x6b0)
+#define AR9170_MAC_REG_RX_ERR_DECRYPTION_MUL    (AR9170_MAC_REG_BASE + 0x6bc)
+#define AR9170_MAC_REG_TX_BLOCKACKS             (AR9170_MAC_REG_BASE + 0x6c0)
+#define AR9170_MAC_REG_NAV_COUNT                (AR9170_MAC_REG_BASE + 0x6c4)
+#define AR9170_MAC_REG_BACKOFF_STATUS           (AR9170_MAC_REG_BASE + 0x6c8)
+#define AR9170_MAC_REG_TX_RETRY                 (AR9170_MAC_REG_BASE + 0x6cc)
+
+#define AR9170_MAC_REG_TX_COMPLETE              (AR9170_MAC_REG_BASE + 0x6d4)
+
+#define AR9170_MAC_REG_CHANNEL_BUSY             (AR9170_MAC_REG_BASE + 0x6e8)
+#define AR9170_MAC_REG_EXT_BUSY                 (AR9170_MAC_REG_BASE + 0x6ec)
+
+#define AR9170_MAC_REG_SLOT_TIME                (AR9170_MAC_REG_BASE + 0x6f0)
+#define AR9170_MAC_REG_TX_TOTAL                 (AR9170_MAC_REG_BASE + 0x6f4)
+#define AR9170_MAC_REG_ACK_FC                   (AR9170_MAC_REG_BASE + 0x6f8)
+
+#define AR9170_MAC_REG_CAM_MODE                 (AR9170_MAC_REG_BASE + 0x700)
+#define         AR9170_MAC_CAM_IBSS                     0xe0
+#define         AR9170_MAC_CAM_AP                       0xa1
+#define         AR9170_MAC_CAM_STA                      0x2
+#define         AR9170_MAC_CAM_AP_WDS                   0x3
+#define         AR9170_MAC_CAM_DEFAULTS                 (0xf << 24)
+#define         AR9170_MAC_CAM_HOST_PENDING             0x80000000
+
+#define AR9170_MAC_REG_CAM_ROLL_CALL_TBL_L      (AR9170_MAC_REG_BASE + 0x704)
+#define AR9170_MAC_REG_CAM_ROLL_CALL_TBL_H      (AR9170_MAC_REG_BASE + 0x708)
+
+#define AR9170_MAC_REG_CAM_ADDR                 (AR9170_MAC_REG_BASE + 0x70c)
+#define         AR9170_MAC_CAM_ADDR_WRITE               0x80000000
+#define AR9170_MAC_REG_CAM_DATA0                (AR9170_MAC_REG_BASE + 0x720)
+#define AR9170_MAC_REG_CAM_DATA1                (AR9170_MAC_REG_BASE + 0x724)
+#define AR9170_MAC_REG_CAM_DATA2                (AR9170_MAC_REG_BASE + 0x728)
+#define AR9170_MAC_REG_CAM_DATA3                (AR9170_MAC_REG_BASE + 0x72c)
+
+#define AR9170_MAC_REG_CAM_DBG0                 (AR9170_MAC_REG_BASE + 0x730)
+#define AR9170_MAC_REG_CAM_DBG1                 (AR9170_MAC_REG_BASE + 0x734)
+#define AR9170_MAC_REG_CAM_DBG2                 (AR9170_MAC_REG_BASE + 0x738)
+#define AR9170_MAC_REG_CAM_STATE                (AR9170_MAC_REG_BASE + 0x73c)
+#define         AR9170_MAC_CAM_STATE_READ_PENDING       0x40000000
+#define         AR9170_MAC_CAM_STATE_WRITE_PENDING      0x80000000
+
+#define AR9170_MAC_REG_CAM_TXKEY                (AR9170_MAC_REG_BASE + 0x740)
+#define AR9170_MAC_REG_CAM_RXKEY                (AR9170_MAC_REG_BASE + 0x750)
+
+#define AR9170_MAC_REG_CAM_TX_ENC_TYPE          (AR9170_MAC_REG_BASE + 0x760)
+#define AR9170_MAC_REG_CAM_RX_ENC_TYPE          (AR9170_MAC_REG_BASE + 0x770)
+#define AR9170_MAC_REG_CAM_TX_SERACH_HIT        (AR9170_MAC_REG_BASE + 0x780)
+#define AR9170_MAC_REG_CAM_RX_SERACH_HIT        (AR9170_MAC_REG_BASE + 0x790)
+
+#define AR9170_MAC_REG_AC0_CW                   (AR9170_MAC_REG_BASE + 0xb00)
+#define AR9170_MAC_REG_AC1_CW                   (AR9170_MAC_REG_BASE + 0xb04)
+#define AR9170_MAC_REG_AC2_CW                   (AR9170_MAC_REG_BASE + 0xb08)
+#define AR9170_MAC_REG_AC3_CW                   (AR9170_MAC_REG_BASE + 0xb0c)
+#define AR9170_MAC_REG_AC4_CW                   (AR9170_MAC_REG_BASE + 0xb10)
+#define AR9170_MAC_REG_AC2_AC1_AC0_AIFS         (AR9170_MAC_REG_BASE + 0xb14)
+#define AR9170_MAC_REG_AC4_AC3_AC2_AIFS         (AR9170_MAC_REG_BASE + 0xb18)
+#define AR9170_MAC_REG_TXOP_ACK_EXTENSION       (AR9170_MAC_REG_BASE + 0xb1c)
+#define AR9170_MAC_REG_TXOP_ACK_INTERVAL        (AR9170_MAC_REG_BASE + 0xb20)
+#define AR9170_MAC_REG_CONTENTION_POINT         (AR9170_MAC_REG_BASE + 0xb24)
+#define AR9170_MAC_REG_RETRY_MAX                (AR9170_MAC_REG_BASE + 0xb28)
+#define AR9170_MAC_REG_TID_CFACK_CFEND_RATE     (AR9170_MAC_REG_BASE + 0xb2c)
+#define AR9170_MAC_REG_TXOP_NOT_ENOUGH_IND      (AR9170_MAC_REG_BASE + 0xb30)
+#define AR9170_MAC_REG_TKIP_TSC                 (AR9170_MAC_REG_BASE + 0xb34)
+#define AR9170_MAC_REG_TXOP_DURATION            (AR9170_MAC_REG_BASE + 0xb38)
+#define AR9170_MAC_REG_TX_QOS_THRESHOLD         (AR9170_MAC_REG_BASE + 0xb3c)
+#define AR9170_MAC_REG_QOS_PRIORITY_VIRTUAL_CCA (AR9170_MAC_REG_BASE + 0xb40)
+#define         AR9170_MAC_VIRTUAL_CCA_Q0               BIT(15)
+#define         AR9170_MAC_VIRTUAL_CCA_Q1               BIT(16)
+#define         AR9170_MAC_VIRTUAL_CCA_Q2               BIT(17)
+#define         AR9170_MAC_VIRTUAL_CCA_Q3               BIT(18)
+#define         AR9170_MAC_VIRTUAL_CCA_Q4               BIT(19)
+#define         AR9170_MAC_VIRTUAL_CCA_ALL              (0xf8000)
+
+#define AR9170_MAC_REG_AC1_AC0_TXOP             (AR9170_MAC_REG_BASE + 0xb44)
+#define AR9170_MAC_REG_AC3_AC2_TXOP             (AR9170_MAC_REG_BASE + 0xb48)
+
+#define AR9170_MAC_REG_AMPDU_COUNT              (AR9170_MAC_REG_BASE + 0xb88)
+#define AR9170_MAC_REG_MPDU_COUNT               (AR9170_MAC_REG_BASE + 0xb8c)
+
+#define AR9170_MAC_REG_AMPDU_FACTOR             (AR9170_MAC_REG_BASE + 0xb9c)
+#define         AR9170_MAC_AMPDU_FACTOR                 0x7f0000
+#define         AR9170_MAC_AMPDU_FACTOR_S               16
+#define AR9170_MAC_REG_AMPDU_DENSITY            (AR9170_MAC_REG_BASE + 0xba0)
+#define         AR9170_MAC_AMPDU_DENSITY                0x7
+#define         AR9170_MAC_AMPDU_DENSITY_S              0
+
+#define AR9170_MAC_REG_FCS_SELECT               (AR9170_MAC_REG_BASE + 0xbb0)
+#define         AR9170_MAC_FCS_SWFCS                    0x1
+#define         AR9170_MAC_FCS_FIFO_PROT                0x4
+
+#define AR9170_MAC_REG_RTS_CTS_TPC              (AR9170_MAC_REG_BASE + 0xbb4)
+#define AR9170_MAC_REG_CFEND_QOSNULL_TPC        (AR9170_MAC_REG_BASE + 0xbb8)
+
+#define AR9170_MAC_REG_ACK_TABLE                (AR9170_MAC_REG_BASE + 0xc00)
+#define AR9170_MAC_REG_RX_CONTROL               (AR9170_MAC_REG_BASE + 0xc40)
+#define         AR9170_MAC_RX_CTRL_DEAGG                0x1
+#define         AR9170_MAC_RX_CTRL_SHORT_FILTER         0x2
+#define         AR9170_MAC_RX_CTRL_SA_DA_SEARCH         0x20
+#define         AR9170_MAC_RX_CTRL_PASS_TO_HOST         BIT(28)
+#define         AR9170_MAC_RX_CTRL_ACK_IN_SNIFFER       BIT(30)
+
+#define AR9170_MAC_REG_RX_CONTROL_1             (AR9170_MAC_REG_BASE + 0xc44)
+
+#define AR9170_MAC_REG_AMPDU_RX_THRESH          (AR9170_MAC_REG_BASE + 0xc50)
+
+#define AR9170_MAC_REG_RX_MPDU                  (AR9170_MAC_REG_BASE + 0xca0)
+#define AR9170_MAC_REG_RX_DROPPED_MPDU          (AR9170_MAC_REG_BASE + 0xca4)
+#define AR9170_MAC_REG_RX_DEL_MPDU              (AR9170_MAC_REG_BASE + 0xca8)
+#define AR9170_MAC_REG_RX_PHY_MISC_ERROR        (AR9170_MAC_REG_BASE + 0xcac)
+#define AR9170_MAC_REG_RX_PHY_XR_ERROR          (AR9170_MAC_REG_BASE + 0xcb0)
+#define AR9170_MAC_REG_RX_PHY_OFDM_ERROR        (AR9170_MAC_REG_BASE + 0xcb4)
+#define AR9170_MAC_REG_RX_PHY_CCK_ERROR         (AR9170_MAC_REG_BASE + 0xcb8)
+#define AR9170_MAC_REG_RX_PHY_HT_ERROR          (AR9170_MAC_REG_BASE + 0xcbc)
+#define AR9170_MAC_REG_RX_PHY_TOTAL             (AR9170_MAC_REG_BASE + 0xcc0)
+
+#define AR9170_MAC_REG_DMA_TXQ_ADDR             (AR9170_MAC_REG_BASE + 0xd00)
+#define AR9170_MAC_REG_DMA_TXQ_CURR_ADDR        (AR9170_MAC_REG_BASE + 0xd04)
+#define AR9170_MAC_REG_DMA_TXQ0_ADDR            (AR9170_MAC_REG_BASE + 0xd00)
+#define AR9170_MAC_REG_DMA_TXQ0_CURR_ADDR       (AR9170_MAC_REG_BASE + 0xd04)
+#define AR9170_MAC_REG_DMA_TXQ1_ADDR            (AR9170_MAC_REG_BASE + 0xd08)
+#define AR9170_MAC_REG_DMA_TXQ1_CURR_ADDR       (AR9170_MAC_REG_BASE + 0xd0c)
+#define AR9170_MAC_REG_DMA_TXQ2_ADDR            (AR9170_MAC_REG_BASE + 0xd10)
+#define AR9170_MAC_REG_DMA_TXQ2_CURR_ADDR       (AR9170_MAC_REG_BASE + 0xd14)
+#define AR9170_MAC_REG_DMA_TXQ3_ADDR            (AR9170_MAC_REG_BASE + 0xd18)
+#define AR9170_MAC_REG_DMA_TXQ3_CURR_ADDR       (AR9170_MAC_REG_BASE + 0xd1c)
+#define AR9170_MAC_REG_DMA_TXQ4_ADDR            (AR9170_MAC_REG_BASE + 0xd20)
+#define AR9170_MAC_REG_DMA_TXQ4_CURR_ADDR       (AR9170_MAC_REG_BASE + 0xd24)
+#define AR9170_MAC_REG_DMA_RXQ_ADDR             (AR9170_MAC_REG_BASE + 0xd28)
+#define AR9170_MAC_REG_DMA_RXQ_CURR_ADDR        (AR9170_MAC_REG_BASE + 0xd2c)
+
+#define AR9170_MAC_REG_DMA_TRIGGER              (AR9170_MAC_REG_BASE + 0xd30)
+#define         AR9170_DMA_TRIGGER_TXQ0                 BIT(0)
+#define         AR9170_DMA_TRIGGER_TXQ1                 BIT(1)
+#define         AR9170_DMA_TRIGGER_TXQ2                 BIT(2)
+#define         AR9170_DMA_TRIGGER_TXQ3                 BIT(3)
+#define         AR9170_DMA_TRIGGER_TXQ4                 BIT(4)
+#define         AR9170_DMA_TRIGGER_RXQ                  BIT(8)
+
+#define AR9170_MAC_REG_DMA_WLAN_STATUS          (AR9170_MAC_REG_BASE + 0xd38)
+#define AR9170_MAC_REG_DMA_STATUS               (AR9170_MAC_REG_BASE + 0xd3c)
+
+#define AR9170_MAC_REG_TXRX_MPI                 (AR9170_MAC_REG_BASE + 0xd7c)
+#define         AR9170_MAC_TXRX_MPI_TX_MPI_MASK         0x0000000f
+#define         AR9170_MAC_TXRX_MPI_TX_TO_MASK          0x0000fff0
+#define         AR9170_MAC_TXRX_MPI_RX_MPI_MASK         0x000f0000
+#define         AR9170_MAC_TXRX_MPI_RX_TO_MASK          0xfff00000
+
+#define AR9170_MAC_REG_BCN_ADDR                 (AR9170_MAC_REG_BASE + 0xd84)
+#define AR9170_MAC_REG_BCN_LENGTH               (AR9170_MAC_REG_BASE + 0xd88)
+#define         AR9170_MAC_BCN_LENGTH_MAX               256
+
+#define AR9170_MAC_REG_BCN_STATUS               (AR9170_MAC_REG_BASE + 0xd8c)
+
+#define AR9170_MAC_REG_BCN_PLCP                 (AR9170_MAC_REG_BASE + 0xd90)
+#define AR9170_MAC_REG_BCN_CTRL                 (AR9170_MAC_REG_BASE + 0xd94)
+#define         AR9170_BCN_CTRL_READY                   0x01
+#define         AR9170_BCN_CTRL_LOCK                    0x02
+
+#define AR9170_MAC_REG_BCN_CURR_ADDR            (AR9170_MAC_REG_BASE + 0xd98)
+#define AR9170_MAC_REG_BCN_COUNT                (AR9170_MAC_REG_BASE + 0xd9c)
+
+
+#define AR9170_MAC_REG_BCN_HT1                  (AR9170_MAC_REG_BASE + 0xda0)
+#define AR9170_MAC_REG_BCN_HT2                  (AR9170_MAC_REG_BASE + 0xda4)
+
+#define AR9170_MAC_REG_DMA_TXQX_ADDR_CURR       (AR9170_MAC_REG_BASE + 0xdc0)
+
+/* Random number generator */
+#define AR9170_RAND_REG_BASE                    0x1d0000
+
+#define AR9170_RAND_REG_NUM                     (AR9170_RAND_REG_BASE + 0x000)
+#define AR9170_RAND_REG_MODE                    (AR9170_RAND_REG_BASE + 0x004)
+#define         AR9170_RAND_MODE_MANUAL                 0x000
+#define         AR9170_RAND_MODE_FREE                   0x001
+
+/* GPIO */
+#define AR9170_GPIO_REG_BASE                    0x1d0100
+#define AR9170_GPIO_REG_PORT_TYPE               (AR9170_GPIO_REG_BASE + 0x000)
+#define AR9170_GPIO_REG_PORT_DATA               (AR9170_GPIO_REG_BASE + 0x004)
+#define         AR9170_GPIO_PORT_LED_0                  1
+#define         AR9170_GPIO_PORT_LED_1                  2
+/* WPS Button GPIO for TP-Link TL-WN821N */
+#define         AR9170_GPIO_PORT_WPS_BUTTON_PRESSED     4
+
+/* Memory Controller */
+#define AR9170_MC_REG_BASE                      0x1d1000
+
+#define AR9170_MC_REG_FLASH_WAIT_STATE          (AR9170_MC_REG_BASE + 0x000)
+#define AR9170_MC_REG_SEEPROM_WP0               (AR9170_MC_REG_BASE + 0x400)
+#define AR9170_MC_REG_SEEPROM_WP1               (AR9170_MC_REG_BASE + 0x404)
+#define AR9170_MC_REG_SEEPROM_WP2               (AR9170_MC_REG_BASE + 0x408)
+
+/* Interrupt Controller */
+#define AR9170_MAX_INT_SRC                      9
+#define AR9170_INT_REG_BASE                     0x1d2000
+
+#define AR9170_INT_REG_FLAG                     (AR9170_INT_REG_BASE + 0x000)
+#define AR9170_INT_REG_FIQ_MASK                 (AR9170_INT_REG_BASE + 0x004)
+#define AR9170_INT_REG_IRQ_MASK                 (AR9170_INT_REG_BASE + 0x008)
+/* INT_REG_FLAG, INT_REG_FIQ_MASK and INT_REG_IRQ_MASK */
+#define         AR9170_INT_FLAG_WLAN                    0x001
+#define         AR9170_INT_FLAG_PTAB_BIT                0x002
+#define         AR9170_INT_FLAG_SE_BIT                  0x004
+#define         AR9170_INT_FLAG_UART_BIT                0x008
+#define         AR9170_INT_FLAG_TIMER_BIT               0x010
+#define         AR9170_INT_FLAG_EXT_BIT                 0x020
+#define         AR9170_INT_FLAG_SW_BIT                  0x040
+#define         AR9170_INT_FLAG_USB_BIT                 0x080
+#define         AR9170_INT_FLAG_ETHERNET_BIT            0x100
+
+#define AR9170_INT_REG_PRIORITY1                (AR9170_INT_REG_BASE + 0x00c)
+#define AR9170_INT_REG_PRIORITY2                (AR9170_INT_REG_BASE + 0x010)
+#define AR9170_INT_REG_PRIORITY3                (AR9170_INT_REG_BASE + 0x014)
+#define AR9170_INT_REG_EXT_INT_CONTROL          (AR9170_INT_REG_BASE + 0x018)
+#define AR9170_INT_REG_SW_INT_CONTROL           (AR9170_INT_REG_BASE + 0x01c)
+#define         AR9170_INT_SW_INT_ENABLE                0x1
+
+#define AR9170_INT_REG_FIQ_ENCODE               (AR9170_INT_REG_BASE + 0x020)
+#define AR9170_INT_INT_IRQ_ENCODE               (AR9170_INT_REG_BASE + 0x024)
+
+/* Power Management */
+#define AR9170_PWR_REG_BASE                     0x1d4000
+
+#define AR9170_PWR_REG_POWER_STATE              (AR9170_PWR_REG_BASE + 0x000)
+
+#define AR9170_PWR_REG_RESET                    (AR9170_PWR_REG_BASE + 0x004)
+#define         AR9170_PWR_RESET_COMMIT_RESET_MASK      BIT(0)
+#define         AR9170_PWR_RESET_WLAN_MASK              BIT(1)
+#define         AR9170_PWR_RESET_DMA_MASK               BIT(2)
+#define         AR9170_PWR_RESET_BRIDGE_MASK            BIT(3)
+#define         AR9170_PWR_RESET_AHB_MASK               BIT(9)
+#define         AR9170_PWR_RESET_BB_WARM_RESET          BIT(10)
+#define         AR9170_PWR_RESET_BB_COLD_RESET          BIT(11)
+#define         AR9170_PWR_RESET_ADDA_CLK_COLD_RESET    BIT(12)
+#define         AR9170_PWR_RESET_PLL                    BIT(13)
+#define         AR9170_PWR_RESET_USB_PLL                BIT(14)
+
+#define AR9170_PWR_REG_CLOCK_SEL                (AR9170_PWR_REG_BASE + 0x008)
+#define         AR9170_PWR_CLK_AHB_40MHZ                0
+#define         AR9170_PWR_CLK_AHB_20_22MHZ             1
+#define         AR9170_PWR_CLK_AHB_40_44MHZ             2
+#define         AR9170_PWR_CLK_AHB_80_88MHZ             3
+#define         AR9170_PWR_CLK_DAC_160_INV_DLY          0x70
+
+#define AR9170_PWR_REG_CHIP_REVISION            (AR9170_PWR_REG_BASE + 0x010)
+#define AR9170_PWR_REG_PLL_ADDAC                (AR9170_PWR_REG_BASE + 0x014)
+#define AR9170_PWR_REG_WATCH_DOG_MAGIC          (AR9170_PWR_REG_BASE + 0x020)
+
+/* Faraday USB Controller */
+#define AR9170_USB_REG_BASE                     0x1e1000
+
+#define AR9170_USB_REG_MAIN_CTRL                (AR9170_USB_REG_BASE + 0x000)
+#define         AR9170_USB_MAIN_CTRL_REMOTE_WAKEUP      BIT(0)
+#define         AR9170_USB_MAIN_CTRL_ENABLE_GLOBAL_INT  BIT(2)
+#define         AR9170_USB_MAIN_CTRL_HIGHSPEED          BIT(6)
+
+#define AR9170_USB_REG_DEVICE_ADDRESS           (AR9170_USB_REG_BASE + 0x001)
+#define         AR9170_USB_DEVICE_ADDRESS_CONFIGURE     BIT(7)
+
+#define AR9170_USB_REG_TEST                     (AR9170_USB_REG_BASE + 0x002)
+#define AR9170_USB_REG_PHY_TEST_SELECT          (AR9170_USB_REG_BASE + 0x008)
+#define AR9170_USB_REG_CX_CONFIG_STATUS         (AR9170_USB_REG_BASE + 0x00b)
+#define AR9170_USB_REG_EP0_DATA                 (AR9170_USB_REG_BASE + 0x00c)
+#define AR9170_USB_REG_EP0_DATA1                (AR9170_USB_REG_BASE + 0x00c)
+#define AR9170_USB_REG_EP0_DATA2                (AR9170_USB_REG_BASE + 0x00d)
+
+#define AR9170_USB_REG_INTR_MASK_BYTE_0         (AR9170_USB_REG_BASE + 0x011)
+#define AR9170_USB_REG_INTR_MASK_BYTE_1         (AR9170_USB_REG_BASE + 0x012)
+#define AR9170_USB_REG_INTR_MASK_BYTE_2         (AR9170_USB_REG_BASE + 0x013)
+#define AR9170_USB_REG_INTR_MASK_BYTE_3         (AR9170_USB_REG_BASE + 0x014)
+#define AR9170_USB_REG_INTR_MASK_BYTE_4         (AR9170_USB_REG_BASE + 0x015)
+#define         AR9170_USB_INTR_DISABLE_OUT_INT         (BIT(7) | BIT(6))
+
+#define AR9170_USB_REG_INTR_MASK_BYTE_5         (AR9170_USB_REG_BASE + 0x016)
+#define AR9170_USB_REG_INTR_MASK_BYTE_6         (AR9170_USB_REG_BASE + 0x017)
+#define         AR9170_USB_INTR_DISABLE_IN_INT          BIT(6)
+
+#define AR9170_USB_REG_INTR_MASK_BYTE_7         (AR9170_USB_REG_BASE + 0x018)
+
+#define AR9170_USB_REG_INTR_GROUP               (AR9170_USB_REG_BASE + 0x020)
+
+#define AR9170_USB_REG_INTR_SOURCE_0            (AR9170_USB_REG_BASE + 0x021)
+#define AR9170_USB_REG_INTR_SOURCE_1            (AR9170_USB_REG_BASE + 0x022)
+#define AR9170_USB_REG_INTR_SOURCE_2            (AR9170_USB_REG_BASE + 0x023)
+#define AR9170_USB_REG_INTR_SOURCE_3            (AR9170_USB_REG_BASE + 0x024)
+#define AR9170_USB_REG_INTR_SOURCE_4            (AR9170_USB_REG_BASE + 0x025)
+#define AR9170_USB_REG_INTR_SOURCE_5            (AR9170_USB_REG_BASE + 0x026)
+#define AR9170_USB_REG_INTR_SOURCE_6            (AR9170_USB_REG_BASE + 0x027)
+#define AR9170_USB_REG_INTR_SOURCE_7            (AR9170_USB_REG_BASE + 0x028)
+
+#define AR9170_USB_REG_EP_MAP                   (AR9170_USB_REG_BASE + 0x030)
+#define AR9170_USB_REG_EP1_MAP                  (AR9170_USB_REG_BASE + 0x030)
+#define AR9170_USB_REG_EP2_MAP                  (AR9170_USB_REG_BASE + 0x031)
+#define AR9170_USB_REG_EP3_MAP                  (AR9170_USB_REG_BASE + 0x032)
+#define AR9170_USB_REG_EP4_MAP                  (AR9170_USB_REG_BASE + 0x033)
+#define AR9170_USB_REG_EP5_MAP                  (AR9170_USB_REG_BASE + 0x034)
+#define AR9170_USB_REG_EP6_MAP                  (AR9170_USB_REG_BASE + 0x035)
+#define AR9170_USB_REG_EP7_MAP                  (AR9170_USB_REG_BASE + 0x036)
+#define AR9170_USB_REG_EP8_MAP                  (AR9170_USB_REG_BASE + 0x037)
+#define AR9170_USB_REG_EP9_MAP                  (AR9170_USB_REG_BASE + 0x038)
+#define AR9170_USB_REG_EP10_MAP                 (AR9170_USB_REG_BASE + 0x039)
+
+#define AR9170_USB_REG_EP_IN_MAX_SIZE_HIGH      (AR9170_USB_REG_BASE + 0x03f)
+#define         AR9170_USB_EP_IN_TOGGLE                 0x10
+
+#define AR9170_USB_REG_EP_IN_MAX_SIZE_LOW       (AR9170_USB_REG_BASE + 0x03e)
+
+#define AR9170_USB_REG_EP_OUT_MAX_SIZE_HIGH     (AR9170_USB_REG_BASE + 0x05f)
+#define         AR9170_USB_EP_OUT_TOGGLE                0x10
+
+#define AR9170_USB_REG_EP_OUT_MAX_SIZE_LOW      (AR9170_USB_REG_BASE + 0x05e)
+
+#define AR9170_USB_REG_EP3_BYTE_COUNT_HIGH      (AR9170_USB_REG_BASE + 0x0ae)
+#define AR9170_USB_REG_EP3_BYTE_COUNT_LOW       (AR9170_USB_REG_BASE + 0x0be)
+#define AR9170_USB_REG_EP4_BYTE_COUNT_HIGH      (AR9170_USB_REG_BASE + 0x0af)
+#define AR9170_USB_REG_EP4_BYTE_COUNT_LOW       (AR9170_USB_REG_BASE + 0x0bf)
+
+#define AR9170_USB_REG_FIFO_MAP                 (AR9170_USB_REG_BASE + 0x080)
+#define AR9170_USB_REG_FIFO0_MAP                (AR9170_USB_REG_BASE + 0x080)
+#define AR9170_USB_REG_FIFO1_MAP                (AR9170_USB_REG_BASE + 0x081)
+#define AR9170_USB_REG_FIFO2_MAP                (AR9170_USB_REG_BASE + 0x082)
+#define AR9170_USB_REG_FIFO3_MAP                (AR9170_USB_REG_BASE + 0x083)
+#define AR9170_USB_REG_FIFO4_MAP                (AR9170_USB_REG_BASE + 0x084)
+#define AR9170_USB_REG_FIFO5_MAP                (AR9170_USB_REG_BASE + 0x085)
+#define AR9170_USB_REG_FIFO6_MAP                (AR9170_USB_REG_BASE + 0x086)
+#define AR9170_USB_REG_FIFO7_MAP                (AR9170_USB_REG_BASE + 0x087)
+#define AR9170_USB_REG_FIFO8_MAP                (AR9170_USB_REG_BASE + 0x088)
+#define AR9170_USB_REG_FIFO9_MAP                (AR9170_USB_REG_BASE + 0x089)
+
+#define AR9170_USB_REG_FIFO_CONFIG              (AR9170_USB_REG_BASE + 0x090)
+#define AR9170_USB_REG_FIFO0_CONFIG             (AR9170_USB_REG_BASE + 0x090)
+#define AR9170_USB_REG_FIFO1_CONFIG             (AR9170_USB_REG_BASE + 0x091)
+#define AR9170_USB_REG_FIFO2_CONFIG             (AR9170_USB_REG_BASE + 0x092)
+#define AR9170_USB_REG_FIFO3_CONFIG             (AR9170_USB_REG_BASE + 0x093)
+#define AR9170_USB_REG_FIFO4_CONFIG             (AR9170_USB_REG_BASE + 0x094)
+#define AR9170_USB_REG_FIFO5_CONFIG             (AR9170_USB_REG_BASE + 0x095)
+#define AR9170_USB_REG_FIFO6_CONFIG             (AR9170_USB_REG_BASE + 0x096)
+#define AR9170_USB_REG_FIFO7_CONFIG             (AR9170_USB_REG_BASE + 0x097)
+#define AR9170_USB_REG_FIFO8_CONFIG             (AR9170_USB_REG_BASE + 0x098)
+#define AR9170_USB_REG_FIFO9_CONFIG             (AR9170_USB_REG_BASE + 0x099)
+
+#define AR9170_USB_REG_EP3_DATA                 (AR9170_USB_REG_BASE + 0x0f8)
+#define AR9170_USB_REG_EP4_DATA                 (AR9170_USB_REG_BASE + 0x0fc)
+
+#define AR9170_USB_REG_FIFO_SIZE                (AR9170_USB_REG_BASE + 0x100)
+#define AR9170_USB_REG_DMA_CTL                  (AR9170_USB_REG_BASE + 0x108)
+#define         AR9170_USB_DMA_CTL_ENABLE_TO_DEVICE     BIT(0)
+#define         AR9170_USB_DMA_CTL_ENABLE_FROM_DEVICE   BIT(1)
+#define         AR9170_USB_DMA_CTL_HIGH_SPEED           BIT(2)
+#define         AR9170_USB_DMA_CTL_UP_PACKET_MODE       BIT(3)
+#define         AR9170_USB_DMA_CTL_UP_STREAM_S          4
+#define         AR9170_USB_DMA_CTL_UP_STREAM            (BIT(4) | BIT(5))
+#define         AR9170_USB_DMA_CTL_UP_STREAM_4K         (0)
+#define         AR9170_USB_DMA_CTL_UP_STREAM_8K         BIT(4)
+#define         AR9170_USB_DMA_CTL_UP_STREAM_16K        BIT(5)
+#define         AR9170_USB_DMA_CTL_UP_STREAM_32K        (BIT(4) | BIT(5))
+#define         AR9170_USB_DMA_CTL_DOWN_STREAM          BIT(6)
+
+#define AR9170_USB_REG_DMA_STATUS               (AR9170_USB_REG_BASE + 0x10c)
+#define         AR9170_USB_DMA_STATUS_UP_IDLE           BIT(8)
+#define         AR9170_USB_DMA_STATUS_DN_IDLE           BIT(16)
+
+#define AR9170_USB_REG_MAX_AGG_UPLOAD           (AR9170_USB_REG_BASE + 0x110)
+#define AR9170_USB_REG_UPLOAD_TIME_CTL          (AR9170_USB_REG_BASE + 0x114)
+#define AR9170_USB_REG_CBUS_CTRL                (AR9170_USB_REG_BASE + 0x1f0)
+#define         AR9170_USB_CBUS_CTRL_BUFFER_END         (BIT(1))
+
+/* PCI/USB to AHB Bridge */
+#define AR9170_PTA_REG_BASE                     0x1e2000
+
+#define AR9170_PTA_REG_CMD                      (AR9170_PTA_REG_BASE + 0x000)
+#define AR9170_PTA_REG_PARAM1                   (AR9170_PTA_REG_BASE + 0x004)
+#define AR9170_PTA_REG_PARAM2                   (AR9170_PTA_REG_BASE + 0x008)
+#define AR9170_PTA_REG_PARAM3                   (AR9170_PTA_REG_BASE + 0x00c)
+#define AR9170_PTA_REG_RSP                      (AR9170_PTA_REG_BASE + 0x010)
+#define AR9170_PTA_REG_STATUS1                  (AR9170_PTA_REG_BASE + 0x014)
+#define AR9170_PTA_REG_STATUS2                  (AR9170_PTA_REG_BASE + 0x018)
+#define AR9170_PTA_REG_STATUS3                  (AR9170_PTA_REG_BASE + 0x01c)
+#define AR9170_PTA_REG_AHB_INT_FLAG             (AR9170_PTA_REG_BASE + 0x020)
+#define AR9170_PTA_REG_AHB_INT_MASK             (AR9170_PTA_REG_BASE + 0x024)
+#define AR9170_PTA_REG_AHB_INT_ACK              (AR9170_PTA_REG_BASE + 0x028)
+#define AR9170_PTA_REG_AHB_SCRATCH1             (AR9170_PTA_REG_BASE + 0x030)
+#define AR9170_PTA_REG_AHB_SCRATCH2             (AR9170_PTA_REG_BASE + 0x034)
+#define AR9170_PTA_REG_AHB_SCRATCH3             (AR9170_PTA_REG_BASE + 0x038)
+#define AR9170_PTA_REG_AHB_SCRATCH4             (AR9170_PTA_REG_BASE + 0x03c)
+
+#define AR9170_PTA_REG_SHARE_MEM_CTRL           (AR9170_PTA_REG_BASE + 0x124)
+
+/*
+ * PCI to AHB Bridge
+ */
+
+#define AR9170_PTA_REG_INT_FLAG                 (AR9170_PTA_REG_BASE + 0x100)
+#define         AR9170_PTA_INT_FLAG_DN                  0x01
+#define         AR9170_PTA_INT_FLAG_UP                  0x02
+#define         AR9170_PTA_INT_FLAG_CMD                 0x04
+
+#define AR9170_PTA_REG_INT_MASK                 (AR9170_PTA_REG_BASE + 0x104)
+#define AR9170_PTA_REG_DN_DMA_ADDRL             (AR9170_PTA_REG_BASE + 0x108)
+#define AR9170_PTA_REG_DN_DMA_ADDRH             (AR9170_PTA_REG_BASE + 0x10c)
+#define AR9170_PTA_REG_UP_DMA_ADDRL             (AR9170_PTA_REG_BASE + 0x110)
+#define AR9170_PTA_REG_UP_DMA_ADDRH             (AR9170_PTA_REG_BASE + 0x114)
+#define AR9170_PTA_REG_DN_PEND_TIME             (AR9170_PTA_REG_BASE + 0x118)
+#define AR9170_PTA_REG_UP_PEND_TIME             (AR9170_PTA_REG_BASE + 0x11c)
+#define AR9170_PTA_REG_CONTROL                  (AR9170_PTA_REG_BASE + 0x120)
+#define         AR9170_PTA_CTRL_4_BEAT_BURST            0x00
+#define         AR9170_PTA_CTRL_8_BEAT_BURST            0x01
+#define         AR9170_PTA_CTRL_16_BEAT_BURST           0x02
+#define         AR9170_PTA_CTRL_LOOPBACK_MODE           0x10
+
+#define AR9170_PTA_REG_MEM_CTRL                 (AR9170_PTA_REG_BASE + 0x124)
+#define AR9170_PTA_REG_MEM_ADDR                 (AR9170_PTA_REG_BASE + 0x128)
+#define AR9170_PTA_REG_DN_DMA_TRIGGER           (AR9170_PTA_REG_BASE + 0x12c)
+#define AR9170_PTA_REG_UP_DMA_TRIGGER           (AR9170_PTA_REG_BASE + 0x130)
+#define AR9170_PTA_REG_DMA_STATUS               (AR9170_PTA_REG_BASE + 0x134)
+#define AR9170_PTA_REG_DN_CURR_ADDRL            (AR9170_PTA_REG_BASE + 0x138)
+#define AR9170_PTA_REG_DN_CURR_ADDRH            (AR9170_PTA_REG_BASE + 0x13c)
+#define AR9170_PTA_REG_UP_CURR_ADDRL            (AR9170_PTA_REG_BASE + 0x140)
+#define AR9170_PTA_REG_UP_CURR_ADDRH            (AR9170_PTA_REG_BASE + 0x144)
+#define AR9170_PTA_REG_DMA_MODE_CTRL            (AR9170_PTA_REG_BASE + 0x148)
+#define         AR9170_PTA_DMA_MODE_CTRL_RESET          BIT(0)
+#define         AR9170_PTA_DMA_MODE_CTRL_DISABLE_USB    BIT(1)
+
+/* Protocol Controller Module */
+#define AR9170_MAC_REG_PC_REG_BASE              (AR9170_MAC_REG_BASE + 0xe00)
+
+
+#define AR9170_NUM_LEDS                         2
+
+/* CAM */
+#define AR9170_CAM_MAX_USER                     64
+#define AR9170_CAM_MAX_KEY_LENGTH               16
+
+#define AR9170_SRAM_OFFSET              0x100000
+#define AR9170_SRAM_SIZE                0x18000
+
+#define AR9170_PRAM_OFFSET              0x200000
+#define AR9170_PRAM_SIZE                0x8000
+
+enum cpu_clock {
+        AHB_STATIC_40MHZ = 0,
+        AHB_GMODE_22MHZ = 1,
+        AHB_AMODE_20MHZ = 1,
+        AHB_GMODE_44MHZ = 2,
+        AHB_AMODE_40MHZ = 2,
+        AHB_GMODE_88MHZ = 3,
+        AHB_AMODE_80MHZ = 3
+};
+
+/* USB endpoints */
+enum ar9170_usb_ep {
+        /*
+         * Control EP is always EP 0 (USB SPEC)
+         *
+         * The weird thing is: the original firmware has a few
+         * comments that suggest that the actual EP numbers
+         * are in the 1 to 10 range?!
+         */
+        AR9170_USB_EP_CTRL              = 0,
+
+        AR9170_USB_EP_TX,
+        AR9170_USB_EP_RX,
+        AR9170_USB_EP_IRQ,
+        AR9170_USB_EP_CMD,
+        AR9170_USB_NUM_EXTRA_EP         = 4,
+
+        __AR9170_USB_NUM_EP,
+
+        __AR9170_USB_NUM_MAX_EP         = 10
+};
+
+enum ar9170_usb_fifo {
+        __AR9170_USB_NUM_MAX_FIFO       = 10
+};
+
+enum ar9170_tx_queues {
+        AR9170_TXQ0     = 0,
+        AR9170_TXQ1,
+        AR9170_TXQ2,
+        AR9170_TXQ3,
+        AR9170_TXQ_SPECIAL,
+
+        /* keep last */
+        __AR9170_NUM_TX_QUEUES = 5
+};
+
+#define AR9170_TX_STREAM_TAG            0x697e
+#define AR9170_RX_STREAM_TAG            0x4e00
+#define AR9170_RX_STREAM_MAX_SIZE       0xffff
+
+struct ar9170_stream {
+        __le16 length;
+        __le16 tag;
+
+        u8 payload[0];
+};
+
+#define AR9170_MAX_ACKTABLE_ENTRIES                     8
+#define AR9170_MAX_VIRTUAL_MAC                          7
+
+#define AR9170_USB_EP_CTRL_MAX                          64
+#define AR9170_USB_EP_TX_MAX                            512
+#define AR9170_USB_EP_RX_MAX                            512
+#define AR9170_USB_EP_IRQ_MAX                           64
+#define AR9170_USB_EP_CMD_MAX                           64
+
+/* Trigger PRETBTT interrupt 6 Kus earlier */
+#define CARL9170_PRETBTT_KUS                            6
+
+#define AR5416_MAX_RATE_POWER                           63
+
+#define SET_VAL(reg, value, newvalue)                                   \
+        (value = ((value) & ~reg) | (((newvalue) << reg##_S) & reg))
+
+#define SET_CONSTVAL(reg, newvalue)                                     \
+        (((newvalue) << reg##_S) & reg)
+
+#define MOD_VAL(reg, value, newvalue)                                   \
+        (((value) & ~reg) | (((newvalue) << reg##_S) & reg))
+#endif  /* __CARL9170_SHARED_HW_H */
diff --git a/drivers/net/wireless/ath/carl9170/led.c b/drivers/net/wireless/ath/carl9170/led.c
new file mode 100644
index 000000000000..4bb2cbd8bd9b
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/led.c
@@ -0,0 +1,190 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * LED handling
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparer <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "carl9170.h"
+#include "cmd.h"
+
+int carl9170_led_set_state(struct ar9170 *ar, const u32 led_state)
+{
+        return carl9170_write_reg(ar, AR9170_GPIO_REG_PORT_DATA, led_state);
+}
+
+int carl9170_led_init(struct ar9170 *ar)
+{
+        int err;
+
+        /* disable LEDs */
+        /* GPIO [0/1 mode: output, 2/3: input] */
+        err = carl9170_write_reg(ar, AR9170_GPIO_REG_PORT_TYPE, 3);
+        if (err)
+                goto out;
+
+        /* GPIO 0/1 value: off */
+        err = carl9170_led_set_state(ar, 0);
+
+out:
+        return err;
+}
+
+#ifdef CONFIG_CARL9170_LEDS
+static void carl9170_led_update(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170, led_work.work);
+        int i, tmp = 300, blink_delay = 1000;
+        u32 led_val = 0;
+        bool rerun = false;
+
+        if (!IS_ACCEPTING_CMD(ar))
+                return;
+
+        mutex_lock(&ar->mutex);
+        for (i = 0; i < AR9170_NUM_LEDS; i++) {
+                if (ar->leds[i].registered) {
+                        if (ar->leds[i].last_state ||
+                            ar->leds[i].toggled) {
+
+                                if (ar->leds[i].toggled)
+                                        tmp = 70 + 200 / (ar->leds[i].toggled);
+
+                                if (tmp < blink_delay)
+                                        blink_delay = tmp;
+
+                                led_val |= 1 << i;
+                                ar->leds[i].toggled = 0;
+                                rerun = true;
+                        }
+                }
+        }
+
+        carl9170_led_set_state(ar, led_val);
+        mutex_unlock(&ar->mutex);
+
+        if (!rerun)
+                return;
+
+        ieee80211_queue_delayed_work(ar->hw,
+                                     &ar->led_work,
+                                     msecs_to_jiffies(blink_delay));
+}
+
+static void carl9170_led_set_brightness(struct led_classdev *led,
+                                        enum led_brightness brightness)
+{
+        struct carl9170_led *arl = container_of(led, struct carl9170_led, l);
+        struct ar9170 *ar = arl->ar;
+
+        if (!arl->registered)
+                return;
+
+        if (arl->last_state != !!brightness) {
+                arl->toggled++;
+                arl->last_state = !!brightness;
+        }
+
+        if (likely(IS_ACCEPTING_CMD(ar) && arl->toggled))
+                ieee80211_queue_delayed_work(ar->hw, &ar->led_work, HZ/10);
+}
+
+static int carl9170_led_register_led(struct ar9170 *ar, int i, char *name,
+                                     char *trigger)
+{
+        int err;
+
+        snprintf(ar->leds[i].name, sizeof(ar->leds[i].name),
+                 "carl9170-%s::%s", wiphy_name(ar->hw->wiphy), name);
+
+        ar->leds[i].ar = ar;
+        ar->leds[i].l.name = ar->leds[i].name;
+        ar->leds[i].l.brightness_set = carl9170_led_set_brightness;
+        ar->leds[i].l.brightness = 0;
+        ar->leds[i].l.default_trigger = trigger;
+
+        err = led_classdev_register(wiphy_dev(ar->hw->wiphy),
+                                    &ar->leds[i].l);
+        if (err) {
+                wiphy_err(ar->hw->wiphy, "failed to register %s LED (%d).\n",
+                        ar->leds[i].name, err);
+        } else {
+                ar->leds[i].registered = true;
+        }
+
+        return err;
+}
+
+void carl9170_led_unregister(struct ar9170 *ar)
+{
+        int i;
+
+        for (i = 0; i < AR9170_NUM_LEDS; i++)
+                if (ar->leds[i].registered) {
+                        led_classdev_unregister(&ar->leds[i].l);
+                        ar->leds[i].registered = false;
+                        ar->leds[i].toggled = 0;
+                }
+
+        cancel_delayed_work_sync(&ar->led_work);
+}
+
+int carl9170_led_register(struct ar9170 *ar)
+{
+        int err;
+
+        INIT_DELAYED_WORK(&ar->led_work, carl9170_led_update);
+
+        err = carl9170_led_register_led(ar, 0, "tx",
+                                        ieee80211_get_tx_led_name(ar->hw));
+        if (err)
+                goto fail;
+
+        if (ar->features & CARL9170_ONE_LED)
+                return 0;
+
+        err = carl9170_led_register_led(ar, 1, "assoc",
+                                        ieee80211_get_assoc_led_name(ar->hw));
+        if (err)
+                goto fail;
+
+        return 0;
+
+fail:
+        carl9170_led_unregister(ar);
+        return err;
+}
+
+#endif /* CONFIG_CARL9170_LEDS */
diff --git a/drivers/net/wireless/ath/carl9170/mac.c b/drivers/net/wireless/ath/carl9170/mac.c
new file mode 100644
index 000000000000..2305bc27151c
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/mac.c
@@ -0,0 +1,604 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * MAC programming
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <asm/unaligned.h>
+
+#include "carl9170.h"
+#include "cmd.h"
+
+int carl9170_set_dyn_sifs_ack(struct ar9170 *ar)
+{
+        u32 val;
+
+        if (conf_is_ht40(&ar->hw->conf))
+                val = 0x010a;
+        else {
+                if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ)
+                        val = 0x105;
+                else
+                        val = 0x104;
+        }
+
+        return carl9170_write_reg(ar, AR9170_MAC_REG_DYNAMIC_SIFS_ACK, val);
+}
+
+int carl9170_set_rts_cts_rate(struct ar9170 *ar)
+{
+        u32 rts_rate, cts_rate;
+
+        if (conf_is_ht(&ar->hw->conf)) {
+                /* 12 mbit OFDM */
+                rts_rate = 0x1da;
+                cts_rate = 0x10a;
+        } else {
+                if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ) {
+                        /* 11 mbit CCK */
+                        rts_rate = 033;
+                        cts_rate = 003;
+                } else {
+                        /* 6 mbit OFDM */
+                        rts_rate = 0x1bb;
+                        cts_rate = 0x10b;
+                }
+        }
+
+        return carl9170_write_reg(ar, AR9170_MAC_REG_RTS_CTS_RATE,
+                                  rts_rate | (cts_rate) << 16);
+}
+
+int carl9170_set_slot_time(struct ar9170 *ar)
+{
+        struct ieee80211_vif *vif;
+        u32 slottime = 20;
+
+        rcu_read_lock();
+        vif = carl9170_get_main_vif(ar);
+        if (!vif) {
+                rcu_read_unlock();
+                return 0;
+        }
+
+        if ((ar->hw->conf.channel->band == IEEE80211_BAND_5GHZ) ||
+            vif->bss_conf.use_short_slot)
+                slottime = 9;
+
+        rcu_read_unlock();
+
+        return carl9170_write_reg(ar, AR9170_MAC_REG_SLOT_TIME,
+                                  slottime << 10);
+}
+
+int carl9170_set_mac_rates(struct ar9170 *ar)
+{
+        struct ieee80211_vif *vif;
+        u32 basic, mandatory;
+
+        rcu_read_lock();
+        vif = carl9170_get_main_vif(ar);
+
+        if (!vif) {
+                rcu_read_unlock();
+                return 0;
+        }
+
+        basic = (vif->bss_conf.basic_rates & 0xf);
+        basic |= (vif->bss_conf.basic_rates & 0xff0) << 4;
+        rcu_read_unlock();
+
+        if (ar->hw->conf.channel->band == IEEE80211_BAND_5GHZ)
+                mandatory = 0xff00; /* OFDM 6/9/12/18/24/36/48/54 */
+        else
+                mandatory = 0xff0f; /* OFDM (6/9../54) + CCK (1/2/5.5/11) */
+
+        carl9170_regwrite_begin(ar);
+        carl9170_regwrite(AR9170_MAC_REG_BASIC_RATE, basic);
+        carl9170_regwrite(AR9170_MAC_REG_MANDATORY_RATE, mandatory);
+        carl9170_regwrite_finish();
+
+        return carl9170_regwrite_result();
+}
+
+int carl9170_set_qos(struct ar9170 *ar)
+{
+        carl9170_regwrite_begin(ar);
+
+        carl9170_regwrite(AR9170_MAC_REG_AC0_CW, ar->edcf[0].cw_min |
+                          (ar->edcf[0].cw_max << 16));
+        carl9170_regwrite(AR9170_MAC_REG_AC1_CW, ar->edcf[1].cw_min |
+                          (ar->edcf[1].cw_max << 16));
+        carl9170_regwrite(AR9170_MAC_REG_AC2_CW, ar->edcf[2].cw_min |
+                          (ar->edcf[2].cw_max << 16));
+        carl9170_regwrite(AR9170_MAC_REG_AC3_CW, ar->edcf[3].cw_min |
+                          (ar->edcf[3].cw_max << 16));
+        carl9170_regwrite(AR9170_MAC_REG_AC4_CW, ar->edcf[4].cw_min |
+                          (ar->edcf[4].cw_max << 16));
+
+        carl9170_regwrite(AR9170_MAC_REG_AC2_AC1_AC0_AIFS,
+                          ((ar->edcf[0].aifs * 9 + 10)) |
+                          ((ar->edcf[1].aifs * 9 + 10) << 12) |
+                          ((ar->edcf[2].aifs * 9 + 10) << 24));
+        carl9170_regwrite(AR9170_MAC_REG_AC4_AC3_AC2_AIFS,
+                          ((ar->edcf[2].aifs * 9 + 10) >> 8) |
+                          ((ar->edcf[3].aifs * 9 + 10) << 4) |
+                          ((ar->edcf[4].aifs * 9 + 10) << 16));
+
+        carl9170_regwrite(AR9170_MAC_REG_AC1_AC0_TXOP,
+                          ar->edcf[0].txop | ar->edcf[1].txop << 16);
+        carl9170_regwrite(AR9170_MAC_REG_AC3_AC2_TXOP,
+                          ar->edcf[2].txop | ar->edcf[3].txop << 16 |
+                          ar->edcf[4].txop << 24);
+
+        carl9170_regwrite_finish();
+
+        return carl9170_regwrite_result();
+}
+
+int carl9170_init_mac(struct ar9170 *ar)
+{
+        carl9170_regwrite_begin(ar);
+
+        /* switch MAC to OTUS interface */
+        carl9170_regwrite(0x1c3600, 0x3);
+
+        carl9170_regwrite(AR9170_MAC_REG_ACK_EXTENSION, 0x40);
+
+        carl9170_regwrite(AR9170_MAC_REG_RETRY_MAX, 0x0);
+
+        carl9170_regwrite(AR9170_MAC_REG_FRAMETYPE_FILTER,
+                          AR9170_MAC_FTF_MONITOR);
+
+        /* enable MMIC */
+        carl9170_regwrite(AR9170_MAC_REG_SNIFFER,
+                        AR9170_MAC_SNIFFER_DEFAULTS);
+
+        carl9170_regwrite(AR9170_MAC_REG_RX_THRESHOLD, 0xc1f80);
+
+        carl9170_regwrite(AR9170_MAC_REG_RX_PE_DELAY, 0x70);
+        carl9170_regwrite(AR9170_MAC_REG_EIFS_AND_SIFS, 0xa144000);
+        carl9170_regwrite(AR9170_MAC_REG_SLOT_TIME, 9 << 10);
+
+        /* CF-END & CF-ACK rate => 24M OFDM */
+        carl9170_regwrite(AR9170_MAC_REG_TID_CFACK_CFEND_RATE, 0x59900000);
+
+        /* NAV protects ACK only (in TXOP) */
+        carl9170_regwrite(AR9170_MAC_REG_TXOP_DURATION, 0x201);
+
+        /* Set Beacon PHY CTRL's TPC to 0x7, TA1=1 */
+        /* OTUS set AM to 0x1 */
+        carl9170_regwrite(AR9170_MAC_REG_BCN_HT1, 0x8000170);
+
+        carl9170_regwrite(AR9170_MAC_REG_BACKOFF_PROTECT, 0x105);
+
+        /* Aggregation MAX number and timeout */
+        carl9170_regwrite(AR9170_MAC_REG_AMPDU_FACTOR, 0xa);
+        carl9170_regwrite(AR9170_MAC_REG_AMPDU_DENSITY, 0x140a00);
+
+        carl9170_regwrite(AR9170_MAC_REG_FRAMETYPE_FILTER,
+                          AR9170_MAC_FTF_DEFAULTS);
+
+        carl9170_regwrite(AR9170_MAC_REG_RX_CONTROL,
+                          AR9170_MAC_RX_CTRL_DEAGG |
+                          AR9170_MAC_RX_CTRL_SHORT_FILTER);
+
+        /* rate sets */
+        carl9170_regwrite(AR9170_MAC_REG_BASIC_RATE, 0x150f);
+        carl9170_regwrite(AR9170_MAC_REG_MANDATORY_RATE, 0x150f);
+        carl9170_regwrite(AR9170_MAC_REG_RTS_CTS_RATE, 0x0030033);
+
+        /* MIMO response control */
+        carl9170_regwrite(AR9170_MAC_REG_ACK_TPC, 0x4003c1e);
+
+        carl9170_regwrite(AR9170_MAC_REG_AMPDU_RX_THRESH, 0xffff);
+
+        /* set PHY register read timeout (??) */
+        carl9170_regwrite(AR9170_MAC_REG_MISC_680, 0xf00008);
+
+        /* Disable Rx TimeOut, workaround for BB. */
+        carl9170_regwrite(AR9170_MAC_REG_RX_TIMEOUT, 0x0);
+
+        /* Set WLAN DMA interrupt mode: generate int per packet */
+        carl9170_regwrite(AR9170_MAC_REG_TXRX_MPI, 0x110011);
+
+        carl9170_regwrite(AR9170_MAC_REG_FCS_SELECT,
+                        AR9170_MAC_FCS_FIFO_PROT);
+
+        /* Disables the CF_END frame, undocumented register */
+        carl9170_regwrite(AR9170_MAC_REG_TXOP_NOT_ENOUGH_IND,
+                        0x141e0f48);
+
+        /* reset group hash table */
+        carl9170_regwrite(AR9170_MAC_REG_GROUP_HASH_TBL_L, 0xffffffff);
+        carl9170_regwrite(AR9170_MAC_REG_GROUP_HASH_TBL_H, 0xffffffff);
+
+        /* disable PRETBTT interrupt */
+        carl9170_regwrite(AR9170_MAC_REG_PRETBTT, 0x0);
+        carl9170_regwrite(AR9170_MAC_REG_BCN_PERIOD, 0x0);
+
+        carl9170_regwrite_finish();
+
+        return carl9170_regwrite_result();
+}
+
+static int carl9170_set_mac_reg(struct ar9170 *ar,
+                                const u32 reg, const u8 *mac)
+{
+        static const u8 zero[ETH_ALEN] = { 0 };
+
+        if (!mac)
+                mac = zero;
+
+        carl9170_regwrite_begin(ar);
+
+        carl9170_regwrite(reg, get_unaligned_le32(mac));
+        carl9170_regwrite(reg + 4, get_unaligned_le16(mac + 4));
+
+        carl9170_regwrite_finish();
+
+        return carl9170_regwrite_result();
+}
+
+int carl9170_mod_virtual_mac(struct ar9170 *ar, const unsigned int id,
+                             const u8 *mac)
+{
+        if (WARN_ON(id >= ar->fw.vif_num))
+                return -EINVAL;
+
+        return carl9170_set_mac_reg(ar,
+                AR9170_MAC_REG_ACK_TABLE + (id - 1) * 8, mac);
+}
+
+int carl9170_update_multicast(struct ar9170 *ar, const u64 mc_hash)
+{
+        int err;
+
+        carl9170_regwrite_begin(ar);
+        carl9170_regwrite(AR9170_MAC_REG_GROUP_HASH_TBL_H, mc_hash >> 32);
+        carl9170_regwrite(AR9170_MAC_REG_GROUP_HASH_TBL_L, mc_hash);
+        carl9170_regwrite_finish();
+        err = carl9170_regwrite_result();
+        if (err)
+                return err;
+
+        ar->cur_mc_hash = mc_hash;
+        return 0;
+}
+
+int carl9170_set_operating_mode(struct ar9170 *ar)
+{
+        struct ieee80211_vif *vif;
+        struct ath_common *common = &ar->common;
+        u8 *mac_addr, *bssid;
+        u32 cam_mode = AR9170_MAC_CAM_DEFAULTS;
+        u32 enc_mode = AR9170_MAC_ENCRYPTION_DEFAULTS;
+        u32 rx_ctrl = AR9170_MAC_RX_CTRL_DEAGG |
+                      AR9170_MAC_RX_CTRL_SHORT_FILTER;
+        u32 sniffer = AR9170_MAC_SNIFFER_DEFAULTS;
+        int err = 0;
+
+        rcu_read_lock();
+        vif = carl9170_get_main_vif(ar);
+
+        if (vif) {
+                mac_addr = common->macaddr;
+                bssid = common->curbssid;
+
+                switch (vif->type) {
+                case NL80211_IFTYPE_MESH_POINT:
+                case NL80211_IFTYPE_ADHOC:
+                        cam_mode |= AR9170_MAC_CAM_IBSS;
+                        break;
+                case NL80211_IFTYPE_AP:
+                        cam_mode |= AR9170_MAC_CAM_AP;
+
+                        /* iwlagn 802.11n STA Workaround */
+                        rx_ctrl |= AR9170_MAC_RX_CTRL_PASS_TO_HOST;
+                        break;
+                case NL80211_IFTYPE_WDS:
+                        cam_mode |= AR9170_MAC_CAM_AP_WDS;
+                        rx_ctrl |= AR9170_MAC_RX_CTRL_PASS_TO_HOST;
+                        break;
+                case NL80211_IFTYPE_STATION:
+                        cam_mode |= AR9170_MAC_CAM_STA;
+                        rx_ctrl |= AR9170_MAC_RX_CTRL_PASS_TO_HOST;
+                        break;
+                default:
+                        WARN(1, "Unsupported operation mode %x\n", vif->type);
+                        err = -EOPNOTSUPP;
+                        break;
+                }
+        } else {
+                mac_addr = NULL;
+                bssid = NULL;
+        }
+        rcu_read_unlock();
+
+        if (err)
+                return err;
+
+        if (ar->rx_software_decryption)
+                enc_mode |= AR9170_MAC_ENCRYPTION_RX_SOFTWARE;
+
+        if (ar->sniffer_enabled) {
+                rx_ctrl |= AR9170_MAC_RX_CTRL_ACK_IN_SNIFFER;
+                sniffer |= AR9170_MAC_SNIFFER_ENABLE_PROMISC;
+                enc_mode |= AR9170_MAC_ENCRYPTION_RX_SOFTWARE;
+        }
+
+        err = carl9170_set_mac_reg(ar, AR9170_MAC_REG_MAC_ADDR_L, mac_addr);
+        if (err)
+                return err;
+
+        err = carl9170_set_mac_reg(ar, AR9170_MAC_REG_BSSID_L, bssid);
+        if (err)
+                return err;
+
+        carl9170_regwrite_begin(ar);
+        carl9170_regwrite(AR9170_MAC_REG_SNIFFER, sniffer);
+        carl9170_regwrite(AR9170_MAC_REG_CAM_MODE, cam_mode);
+        carl9170_regwrite(AR9170_MAC_REG_ENCRYPTION, enc_mode);
+        carl9170_regwrite(AR9170_MAC_REG_RX_CONTROL, rx_ctrl);
+        carl9170_regwrite_finish();
+
+        return carl9170_regwrite_result();
+}
+
+int carl9170_set_hwretry_limit(struct ar9170 *ar, const unsigned int max_retry)
+{
+        u32 tmp = min_t(u32, 0x33333, max_retry * 0x11111);
+
+        return carl9170_write_reg(ar, AR9170_MAC_REG_RETRY_MAX, tmp);
+}
+
+int carl9170_set_beacon_timers(struct ar9170 *ar)
+{
+        struct ieee80211_vif *vif;
+        u32 v = 0;
+        u32 pretbtt = 0;
+
+        rcu_read_lock();
+        vif = carl9170_get_main_vif(ar);
+
+        if (vif) {
+                struct carl9170_vif_info *mvif;
+                mvif = (void *) vif->drv_priv;
+
+                if (mvif->enable_beacon && !WARN_ON(!ar->beacon_enabled)) {
+                        ar->global_beacon_int = vif->bss_conf.beacon_int /
+                                                ar->beacon_enabled;
+
+                        SET_VAL(AR9170_MAC_BCN_DTIM, v,
+                                vif->bss_conf.dtim_period);
+
+                        switch (vif->type) {
+                        case NL80211_IFTYPE_MESH_POINT:
+                        case NL80211_IFTYPE_ADHOC:
+                                v |= AR9170_MAC_BCN_IBSS_MODE;
+                                break;
+                        case NL80211_IFTYPE_AP:
+                                v |= AR9170_MAC_BCN_AP_MODE;
+                                break;
+                        default:
+                                WARN_ON_ONCE(1);
+                                break;
+                        }
+                } else if (vif->type == NL80211_IFTYPE_STATION) {
+                        ar->global_beacon_int = vif->bss_conf.beacon_int;
+
+                        SET_VAL(AR9170_MAC_BCN_DTIM, v,
+                                ar->hw->conf.ps_dtim_period);
+
+                        v |= AR9170_MAC_BCN_STA_PS |
+                             AR9170_MAC_BCN_PWR_MGT;
+                }
+
+                if (ar->global_beacon_int) {
+                        if (ar->global_beacon_int < 15) {
+                                rcu_read_unlock();
+                                return -ERANGE;
+                        }
+
+                        ar->global_pretbtt = ar->global_beacon_int -
+                                        CARL9170_PRETBTT_KUS;
+                } else {
+                        ar->global_pretbtt = 0;
+                }
+        } else {
+                ar->global_beacon_int = 0;
+                ar->global_pretbtt = 0;
+        }
+
+        rcu_read_unlock();
+
+        SET_VAL(AR9170_MAC_BCN_PERIOD, v, ar->global_beacon_int);
+        SET_VAL(AR9170_MAC_PRETBTT, pretbtt, ar->global_pretbtt);
+        SET_VAL(AR9170_MAC_PRETBTT2, pretbtt, ar->global_pretbtt);
+
+        carl9170_regwrite_begin(ar);
+        carl9170_regwrite(AR9170_MAC_REG_PRETBTT, pretbtt);
+        carl9170_regwrite(AR9170_MAC_REG_BCN_PERIOD, v);
+        carl9170_regwrite_finish();
+        return carl9170_regwrite_result();
+}
+
+int carl9170_update_beacon(struct ar9170 *ar, const bool submit)
+{
+        struct sk_buff *skb;
+        struct carl9170_vif_info *cvif;
+        __le32 *data, *old = NULL;
+        u32 word, off, addr, len;
+        int i = 0, err = 0;
+
+        rcu_read_lock();
+        cvif = rcu_dereference(ar->beacon_iter);
+retry:
+        if (ar->vifs == 0 || !cvif)
+                goto out_unlock;
+
+        list_for_each_entry_continue_rcu(cvif, &ar->vif_list, list) {
+                if (cvif->active && cvif->enable_beacon)
+                        goto found;
+        }
+
+        if (!ar->beacon_enabled || i++)
+                goto out_unlock;
+
+        goto retry;
+
+found:
+        rcu_assign_pointer(ar->beacon_iter, cvif);
+
+        skb = ieee80211_beacon_get_tim(ar->hw, carl9170_get_vif(cvif),
+                NULL, NULL);
+
+        if (!skb) {
+                err = -ENOMEM;
+                goto out_unlock;
+        }
+
+        spin_lock_bh(&ar->beacon_lock);
+        data = (__le32 *)skb->data;
+        if (cvif->beacon)
+                old = (__le32 *)cvif->beacon->data;
+
+        off = cvif->id * AR9170_MAC_BCN_LENGTH_MAX;
+        addr = ar->fw.beacon_addr + off;
+        len = roundup(skb->len + FCS_LEN, 4);
+
+        if ((off + len) > ar->fw.beacon_max_len) {
+                if (net_ratelimit()) {
+                        wiphy_err(ar->hw->wiphy, "beacon does not "
+                                  "fit into device memory!\n");
+                }
+
+                spin_unlock_bh(&ar->beacon_lock);
+                dev_kfree_skb_any(skb);
+                err = -EINVAL;
+                goto out_unlock;
+        }
+
+        if (len > AR9170_MAC_BCN_LENGTH_MAX) {
+                if (net_ratelimit()) {
+                        wiphy_err(ar->hw->wiphy, "no support for beacons "
+                                "bigger than %d (yours:%d).\n",
+                                 AR9170_MAC_BCN_LENGTH_MAX, len);
+                }
+
+                spin_unlock_bh(&ar->beacon_lock);
+                dev_kfree_skb_any(skb);
+                err = -EMSGSIZE;
+                goto out_unlock;
+        }
+
+        carl9170_async_regwrite_begin(ar);
+
+        /* XXX: use skb->cb info */
+        if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ) {
+                carl9170_async_regwrite(AR9170_MAC_REG_BCN_PLCP,
+                                ((skb->len + FCS_LEN) << (3 + 16)) + 0x0400);
+        } else {
+                carl9170_async_regwrite(AR9170_MAC_REG_BCN_PLCP,
+                                ((skb->len + FCS_LEN) << 16) + 0x001b);
+        }
+
+        for (i = 0; i < DIV_ROUND_UP(skb->len, 4); i++) {
+                /*
+                 * XXX: This accesses beyond skb data for up
+                 *      to the last 3 bytes!!
+                 */
+
+                if (old && (data[i] == old[i]))
+                        continue;
+
+                word = le32_to_cpu(data[i]);
+                carl9170_async_regwrite(addr + 4 * i, word);
+        }
+        carl9170_async_regwrite_finish();
+
+        dev_kfree_skb_any(cvif->beacon);
+        cvif->beacon = NULL;
+
+        err = carl9170_async_regwrite_result();
+        if (!err)
+                cvif->beacon = skb;
+        spin_unlock_bh(&ar->beacon_lock);
+        if (err)
+                goto out_unlock;
+
+        if (submit) {
+                err = carl9170_bcn_ctrl(ar, cvif->id,
+                                        CARL9170_BCN_CTRL_CAB_TRIGGER,
+                                        addr, skb->len + FCS_LEN);
+
+                if (err)
+                        goto out_unlock;
+        }
+out_unlock:
+        rcu_read_unlock();
+        return err;
+}
+
+int carl9170_upload_key(struct ar9170 *ar, const u8 id, const u8 *mac,
+                        const u8 ktype, const u8 keyidx, const u8 *keydata,
+                        const int keylen)
+{
+        struct carl9170_set_key_cmd key = { };
+        static const u8 bcast[ETH_ALEN] = {
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+
+        mac = mac ? : bcast;
+
+        key.user = cpu_to_le16(id);
+        key.keyId = cpu_to_le16(keyidx);
+        key.type = cpu_to_le16(ktype);
+        memcpy(&key.macAddr, mac, ETH_ALEN);
+        if (keydata)
+                memcpy(&key.key, keydata, keylen);
+
+        return carl9170_exec_cmd(ar, CARL9170_CMD_EKEY,
+                sizeof(key), (u8 *)&key, 0, NULL);
+}
+
+int carl9170_disable_key(struct ar9170 *ar, const u8 id)
+{
+        struct carl9170_disable_key_cmd key = { };
+
+        key.user = cpu_to_le16(id);
+
+        return carl9170_exec_cmd(ar, CARL9170_CMD_DKEY,
+                sizeof(key), (u8 *)&key, 0, NULL);
+}
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
new file mode 100644
index 000000000000..3cc99f3f7ab5
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -0,0 +1,1891 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * mac80211 interaction code
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/random.h>
+#include <net/mac80211.h>
+#include <net/cfg80211.h>
+#include "hw.h"
+#include "carl9170.h"
+#include "cmd.h"
+
+static int modparam_nohwcrypt;
+module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
+MODULE_PARM_DESC(nohwcrypt, "Disable hardware crypto offload.");
+
+int modparam_noht;
+module_param_named(noht, modparam_noht, int, S_IRUGO);
+MODULE_PARM_DESC(noht, "Disable MPDU aggregation.");
+
+#define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
+        .bitrate        = (_bitrate),                   \
+        .flags          = (_flags),                     \
+        .hw_value       = (_hw_rate) | (_txpidx) << 4,  \
+}
+
+struct ieee80211_rate __carl9170_ratetable[] = {
+        RATE(10, 0, 0, 0),
+        RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(60, 0xb, 0, 0),
+        RATE(90, 0xf, 0, 0),
+        RATE(120, 0xa, 0, 0),
+        RATE(180, 0xe, 0, 0),
+        RATE(240, 0x9, 0, 0),
+        RATE(360, 0xd, 1, 0),
+        RATE(480, 0x8, 2, 0),
+        RATE(540, 0xc, 3, 0),
+};
+#undef RATE
+
+#define carl9170_g_ratetable    (__carl9170_ratetable + 0)
+#define carl9170_g_ratetable_size       12
+#define carl9170_a_ratetable    (__carl9170_ratetable + 4)
+#define carl9170_a_ratetable_size       8
+
+/*
+ * NB: The hw_value is used as an index into the carl9170_phy_freq_params
+ *     array in phy.c so that we don't have to do frequency lookups!
+ */
+#define CHAN(_freq, _idx) {             \
+        .center_freq    = (_freq),      \
+        .hw_value       = (_idx),       \
+        .max_power      = 18, /* XXX */ \
+}
+
+static struct ieee80211_channel carl9170_2ghz_chantable[] = {
+        CHAN(2412,  0),
+        CHAN(2417,  1),
+        CHAN(2422,  2),
+        CHAN(2427,  3),
+        CHAN(2432,  4),
+        CHAN(2437,  5),
+        CHAN(2442,  6),
+        CHAN(2447,  7),
+        CHAN(2452,  8),
+        CHAN(2457,  9),
+        CHAN(2462, 10),
+        CHAN(2467, 11),
+        CHAN(2472, 12),
+        CHAN(2484, 13),
+};
+
+static struct ieee80211_channel carl9170_5ghz_chantable[] = {
+        CHAN(4920, 14),
+        CHAN(4940, 15),
+        CHAN(4960, 16),
+        CHAN(4980, 17),
+        CHAN(5040, 18),
+        CHAN(5060, 19),
+        CHAN(5080, 20),
+        CHAN(5180, 21),
+        CHAN(5200, 22),
+        CHAN(5220, 23),
+        CHAN(5240, 24),
+        CHAN(5260, 25),
+        CHAN(5280, 26),
+        CHAN(5300, 27),
+        CHAN(5320, 28),
+        CHAN(5500, 29),
+        CHAN(5520, 30),
+        CHAN(5540, 31),
+        CHAN(5560, 32),
+        CHAN(5580, 33),
+        CHAN(5600, 34),
+        CHAN(5620, 35),
+        CHAN(5640, 36),
+        CHAN(5660, 37),
+        CHAN(5680, 38),
+        CHAN(5700, 39),
+        CHAN(5745, 40),
+        CHAN(5765, 41),
+        CHAN(5785, 42),
+        CHAN(5805, 43),
+        CHAN(5825, 44),
+        CHAN(5170, 45),
+        CHAN(5190, 46),
+        CHAN(5210, 47),
+        CHAN(5230, 48),
+};
+#undef CHAN
+
+#define CARL9170_HT_CAP                                                 \
+{                                                                       \
+        .ht_supported   = true,                                         \
+        .cap            = IEEE80211_HT_CAP_MAX_AMSDU |                  \
+                          IEEE80211_HT_CAP_SUP_WIDTH_20_40 |            \
+                          IEEE80211_HT_CAP_SGI_40 |                     \
+                          IEEE80211_HT_CAP_DSSSCCK40 |                  \
+                          IEEE80211_HT_CAP_SM_PS,                       \
+        .ampdu_factor   = IEEE80211_HT_MAX_AMPDU_64K,                   \
+        .ampdu_density  = IEEE80211_HT_MPDU_DENSITY_8,                  \
+        .mcs            = {                                             \
+                .rx_mask = { 0xff, 0xff, 0, 0, 0x1, 0, 0, 0, 0, 0, },   \
+                .rx_highest = cpu_to_le16(300),                         \
+                .tx_params = IEEE80211_HT_MCS_TX_DEFINED,               \
+        },                                                              \
+}
+
+static struct ieee80211_supported_band carl9170_band_2GHz = {
+        .channels       = carl9170_2ghz_chantable,
+        .n_channels     = ARRAY_SIZE(carl9170_2ghz_chantable),
+        .bitrates       = carl9170_g_ratetable,
+        .n_bitrates     = carl9170_g_ratetable_size,
+        .ht_cap         = CARL9170_HT_CAP,
+};
+
+static struct ieee80211_supported_band carl9170_band_5GHz = {
+        .channels       = carl9170_5ghz_chantable,
+        .n_channels     = ARRAY_SIZE(carl9170_5ghz_chantable),
+        .bitrates       = carl9170_a_ratetable,
+        .n_bitrates     = carl9170_a_ratetable_size,
+        .ht_cap         = CARL9170_HT_CAP,
+};
+
+static void carl9170_ampdu_gc(struct ar9170 *ar)
+{
+        struct carl9170_sta_tid *tid_info;
+        LIST_HEAD(tid_gc);
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(tid_info, &ar->tx_ampdu_list, list) {
+                spin_lock_bh(&ar->tx_ampdu_list_lock);
+                if (tid_info->state == CARL9170_TID_STATE_SHUTDOWN) {
+                        tid_info->state = CARL9170_TID_STATE_KILLED;
+                        list_del_rcu(&tid_info->list);
+                        ar->tx_ampdu_list_len--;
+                        list_add_tail(&tid_info->tmp_list, &tid_gc);
+                }
+                spin_unlock_bh(&ar->tx_ampdu_list_lock);
+
+        }
+        rcu_assign_pointer(ar->tx_ampdu_iter, tid_info);
+        rcu_read_unlock();
+
+        synchronize_rcu();
+
+        while (!list_empty(&tid_gc)) {
+                struct sk_buff *skb;
+                tid_info = list_first_entry(&tid_gc, struct carl9170_sta_tid,
+                                            tmp_list);
+
+                while ((skb = __skb_dequeue(&tid_info->queue)))
+                        carl9170_tx_status(ar, skb, false);
+
+                list_del_init(&tid_info->tmp_list);
+                kfree(tid_info);
+        }
+}
+
+static void carl9170_flush(struct ar9170 *ar, bool drop_queued)
+{
+        if (drop_queued) {
+                int i;
+
+                /*
+                 * We can only drop frames which have not been uploaded
+                 * to the device yet.
+                 */
+
+                for (i = 0; i < ar->hw->queues; i++) {
+                        struct sk_buff *skb;
+
+                        while ((skb = skb_dequeue(&ar->tx_pending[i]))) {
+                                struct ieee80211_tx_info *info;
+
+                                info = IEEE80211_SKB_CB(skb);
+                                if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                                        atomic_dec(&ar->tx_ampdu_upload);
+
+                                carl9170_tx_status(ar, skb, false);
+                        }
+                }
+        }
+
+        /* Wait for all other outstanding frames to timeout. */
+        if (atomic_read(&ar->tx_total_queued))
+                WARN_ON(wait_for_completion_timeout(&ar->tx_flush, HZ) == 0);
+}
+
+static void carl9170_flush_ba(struct ar9170 *ar)
+{
+        struct sk_buff_head free;
+        struct carl9170_sta_tid *tid_info;
+        struct sk_buff *skb;
+
+        __skb_queue_head_init(&free);
+
+        rcu_read_lock();
+        spin_lock_bh(&ar->tx_ampdu_list_lock);
+        list_for_each_entry_rcu(tid_info, &ar->tx_ampdu_list, list) {
+                if (tid_info->state > CARL9170_TID_STATE_SUSPEND) {
+                        tid_info->state = CARL9170_TID_STATE_SUSPEND;
+
+                        spin_lock(&tid_info->lock);
+                        while ((skb = __skb_dequeue(&tid_info->queue)))
+                                __skb_queue_tail(&free, skb);
+                        spin_unlock(&tid_info->lock);
+                }
+        }
+        spin_unlock_bh(&ar->tx_ampdu_list_lock);
+        rcu_read_unlock();
+
+        while ((skb = __skb_dequeue(&free)))
+                carl9170_tx_status(ar, skb, false);
+}
+
+static void carl9170_zap_queues(struct ar9170 *ar)
+{
+        struct carl9170_vif_info *cvif;
+        unsigned int i;
+
+        carl9170_ampdu_gc(ar);
+
+        carl9170_flush_ba(ar);
+        carl9170_flush(ar, true);
+
+        for (i = 0; i < ar->hw->queues; i++) {
+                spin_lock_bh(&ar->tx_status[i].lock);
+                while (!skb_queue_empty(&ar->tx_status[i])) {
+                        struct sk_buff *skb;
+
+                        skb = skb_peek(&ar->tx_status[i]);
+                        carl9170_tx_get_skb(skb);
+                        spin_unlock_bh(&ar->tx_status[i].lock);
+                        carl9170_tx_drop(ar, skb);
+                        spin_lock_bh(&ar->tx_status[i].lock);
+                        carl9170_tx_put_skb(skb);
+                }
+                spin_unlock_bh(&ar->tx_status[i].lock);
+        }
+
+        BUILD_BUG_ON(CARL9170_NUM_TX_LIMIT_SOFT < 1);
+        BUILD_BUG_ON(CARL9170_NUM_TX_LIMIT_HARD < CARL9170_NUM_TX_LIMIT_SOFT);
+        BUILD_BUG_ON(CARL9170_NUM_TX_LIMIT_HARD >= CARL9170_BAW_BITS);
+
+        /* reinitialize queues statistics */
+        memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
+        for (i = 0; i < ar->hw->queues; i++)
+                ar->tx_stats[i].limit = CARL9170_NUM_TX_LIMIT_HARD;
+
+        for (i = 0; i < DIV_ROUND_UP(ar->fw.mem_blocks, BITS_PER_LONG); i++)
+                ar->mem_bitmap[i] = 0;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(cvif, &ar->vif_list, list) {
+                spin_lock_bh(&ar->beacon_lock);
+                dev_kfree_skb_any(cvif->beacon);
+                cvif->beacon = NULL;
+                spin_unlock_bh(&ar->beacon_lock);
+        }
+        rcu_read_unlock();
+
+        atomic_set(&ar->tx_ampdu_upload, 0);
+        atomic_set(&ar->tx_ampdu_scheduler, 0);
+        atomic_set(&ar->tx_total_pending, 0);
+        atomic_set(&ar->tx_total_queued, 0);
+        atomic_set(&ar->mem_free_blocks, ar->fw.mem_blocks);
+}
+
+#define CARL9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)          \
+do {                                                                    \
+        queue.aifs = ai_fs;                                             \
+        queue.cw_min = cwmin;                                           \
+        queue.cw_max = cwmax;                                           \
+        queue.txop = _txop;                                             \
+} while (0)
+
+static int carl9170_op_start(struct ieee80211_hw *hw)
+{
+        struct ar9170 *ar = hw->priv;
+        int err, i;
+
+        mutex_lock(&ar->mutex);
+
+        carl9170_zap_queues(ar);
+
+        /* reset QoS defaults */
+        CARL9170_FILL_QUEUE(ar->edcf[0], 3, 15, 1023,  0); /* BEST EFFORT */
+        CARL9170_FILL_QUEUE(ar->edcf[1], 2, 7,    15, 94); /* VIDEO */
+        CARL9170_FILL_QUEUE(ar->edcf[2], 2, 3,     7, 47); /* VOICE */
+        CARL9170_FILL_QUEUE(ar->edcf[3], 7, 15, 1023,  0); /* BACKGROUND */
+        CARL9170_FILL_QUEUE(ar->edcf[4], 2, 3,     7,  0); /* SPECIAL */
+
+        ar->current_factor = ar->current_density = -1;
+        /* "The first key is unique." */
+        ar->usedkeys = 1;
+        ar->filter_state = 0;
+        ar->ps.last_action = jiffies;
+        ar->ps.last_slept = jiffies;
+        ar->erp_mode = CARL9170_ERP_AUTO;
+        ar->rx_software_decryption = false;
+        ar->disable_offload = false;
+
+        for (i = 0; i < ar->hw->queues; i++) {
+                ar->queue_stop_timeout[i] = jiffies;
+                ar->max_queue_stop_timeout[i] = 0;
+        }
+
+        atomic_set(&ar->mem_allocs, 0);
+
+        err = carl9170_usb_open(ar);
+        if (err)
+                goto out;
+
+        err = carl9170_init_mac(ar);
+        if (err)
+                goto out;
+
+        err = carl9170_set_qos(ar);
+        if (err)
+                goto out;
+
+        if (ar->fw.rx_filter) {
+                err = carl9170_rx_filter(ar, CARL9170_RX_FILTER_OTHER_RA |
+                        CARL9170_RX_FILTER_CTL_OTHER | CARL9170_RX_FILTER_BAD);
+                if (err)
+                        goto out;
+        }
+
+        err = carl9170_write_reg(ar, AR9170_MAC_REG_DMA_TRIGGER,
+                                 AR9170_DMA_TRIGGER_RXQ);
+        if (err)
+                goto out;
+
+        /* Clear key-cache */
+        for (i = 0; i < AR9170_CAM_MAX_USER + 4; i++) {
+                err = carl9170_upload_key(ar, i, NULL, AR9170_ENC_ALG_NONE,
+                                          0, NULL, 0);
+                if (err)
+                        goto out;
+
+                err = carl9170_upload_key(ar, i, NULL, AR9170_ENC_ALG_NONE,
+                                          1, NULL, 0);
+                if (err)
+                        goto out;
+
+                if (i < AR9170_CAM_MAX_USER) {
+                        err = carl9170_disable_key(ar, i);
+                        if (err)
+                                goto out;
+                }
+        }
+
+        carl9170_set_state_when(ar, CARL9170_IDLE, CARL9170_STARTED);
+
+        ieee80211_wake_queues(ar->hw);
+        err = 0;
+
+out:
+        mutex_unlock(&ar->mutex);
+        return err;
+}
+
+static void carl9170_cancel_worker(struct ar9170 *ar)
+{
+        cancel_delayed_work_sync(&ar->tx_janitor);
+#ifdef CONFIG_CARL9170_LEDS
+        cancel_delayed_work_sync(&ar->led_work);
+#endif /* CONFIG_CARL9170_LEDS */
+        cancel_work_sync(&ar->ps_work);
+        cancel_work_sync(&ar->ampdu_work);
+}
+
+static void carl9170_op_stop(struct ieee80211_hw *hw)
+{
+        struct ar9170 *ar = hw->priv;
+
+        carl9170_set_state_when(ar, CARL9170_STARTED, CARL9170_IDLE);
+
+        ieee80211_stop_queues(ar->hw);
+
+        mutex_lock(&ar->mutex);
+        if (IS_ACCEPTING_CMD(ar)) {
+                rcu_assign_pointer(ar->beacon_iter, NULL);
+
+                carl9170_led_set_state(ar, 0);
+
+                /* stop DMA */
+                carl9170_write_reg(ar, AR9170_MAC_REG_DMA_TRIGGER, 0);
+                carl9170_usb_stop(ar);
+        }
+
+        carl9170_zap_queues(ar);
+        mutex_unlock(&ar->mutex);
+
+        carl9170_cancel_worker(ar);
+}
+
+static void carl9170_restart_work(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170,
+                                         restart_work);
+        int err;
+
+        ar->usedkeys = 0;
+        ar->filter_state = 0;
+        carl9170_cancel_worker(ar);
+
+        mutex_lock(&ar->mutex);
+        err = carl9170_usb_restart(ar);
+        if (net_ratelimit()) {
+                if (err) {
+                        dev_err(&ar->udev->dev, "Failed to restart device "
+                                " (%d).\n", err);
+                 } else {
+                        dev_info(&ar->udev->dev, "device restarted "
+                                 "successfully.\n");
+                }
+        }
+
+        carl9170_zap_queues(ar);
+        mutex_unlock(&ar->mutex);
+        if (!err) {
+                ar->restart_counter++;
+                atomic_set(&ar->pending_restarts, 0);
+
+                ieee80211_restart_hw(ar->hw);
+        } else {
+                /*
+                 * The reset was unsuccessful and the device seems to
+                 * be dead. But there's still one option: a low-level
+                 * usb subsystem reset...
+                 */
+
+                carl9170_usb_reset(ar);
+        }
+}
+
+void carl9170_restart(struct ar9170 *ar, const enum carl9170_restart_reasons r)
+{
+        carl9170_set_state_when(ar, CARL9170_STARTED, CARL9170_IDLE);
+
+        /*
+         * Sometimes, an error can trigger several different reset events.
+         * By ignoring these *surplus* reset events, the device won't be
+         * killed again, right after it has recovered.
+         */
+        if (atomic_inc_return(&ar->pending_restarts) > 1) {
+                dev_dbg(&ar->udev->dev, "ignoring restart (%d)\n", r);
+                return;
+        }
+
+        ieee80211_stop_queues(ar->hw);
+
+        dev_err(&ar->udev->dev, "restart device (%d)\n", r);
+
+        if (!WARN_ON(r == CARL9170_RR_NO_REASON) ||
+            !WARN_ON(r >= __CARL9170_RR_LAST))
+                ar->last_reason = r;
+
+        if (!ar->registered)
+                return;
+
+        if (IS_ACCEPTING_CMD(ar) && !ar->needs_full_reset)
+                ieee80211_queue_work(ar->hw, &ar->restart_work);
+        else
+                carl9170_usb_reset(ar);
+
+        /*
+         * At this point, the device instance might have vanished/disabled.
+         * So, don't put any code which access the ar9170 struct
+         * without proper protection.
+         */
+}
+
+static int carl9170_init_interface(struct ar9170 *ar,
+                                   struct ieee80211_vif *vif)
+{
+        struct ath_common *common = &ar->common;
+        int err;
+
+        if (!vif) {
+                WARN_ON_ONCE(IS_STARTED(ar));
+                return 0;
+        }
+
+        memcpy(common->macaddr, vif->addr, ETH_ALEN);
+
+        if (modparam_nohwcrypt ||
+            ((vif->type != NL80211_IFTYPE_STATION) &&
+             (vif->type != NL80211_IFTYPE_AP))) {
+                ar->rx_software_decryption = true;
+                ar->disable_offload = true;
+        }
+
+        err = carl9170_set_operating_mode(ar);
+        return err;
+}
+
+static int carl9170_op_add_interface(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif)
+{
+        struct carl9170_vif_info *vif_priv = (void *) vif->drv_priv;
+        struct ieee80211_vif *main_vif;
+        struct ar9170 *ar = hw->priv;
+        int vif_id = -1, err = 0;
+
+        mutex_lock(&ar->mutex);
+        rcu_read_lock();
+        if (vif_priv->active) {
+                /*
+                 * Skip the interface structure initialization,
+                 * if the vif survived the _restart call.
+                 */
+                vif_id = vif_priv->id;
+                vif_priv->enable_beacon = false;
+
+                spin_lock_bh(&ar->beacon_lock);
+                dev_kfree_skb_any(vif_priv->beacon);
+                vif_priv->beacon = NULL;
+                spin_unlock_bh(&ar->beacon_lock);
+
+                goto init;
+        }
+
+        main_vif = carl9170_get_main_vif(ar);
+
+        if (main_vif) {
+                switch (main_vif->type) {
+                case NL80211_IFTYPE_STATION:
+                        if (vif->type == NL80211_IFTYPE_STATION)
+                                break;
+
+                        err = -EBUSY;
+                        rcu_read_unlock();
+
+                        goto unlock;
+
+                case NL80211_IFTYPE_AP:
+                        if ((vif->type == NL80211_IFTYPE_STATION) ||
+                            (vif->type == NL80211_IFTYPE_WDS) ||
+                            (vif->type == NL80211_IFTYPE_AP))
+                                break;
+
+                        err = -EBUSY;
+                        rcu_read_unlock();
+                        goto unlock;
+
+                default:
+                        rcu_read_unlock();
+                        goto unlock;
+                }
+        }
+
+        vif_id = bitmap_find_free_region(&ar->vif_bitmap, ar->fw.vif_num, 0);
+
+        if (vif_id < 0) {
+                rcu_read_unlock();
+
+                err = -ENOSPC;
+                goto unlock;
+        }
+
+        BUG_ON(ar->vif_priv[vif_id].id != vif_id);
+
+        vif_priv->active = true;
+        vif_priv->id = vif_id;
+        vif_priv->enable_beacon = false;
+        ar->vifs++;
+        list_add_tail_rcu(&vif_priv->list, &ar->vif_list);
+        rcu_assign_pointer(ar->vif_priv[vif_id].vif, vif);
+
+init:
+        if (carl9170_get_main_vif(ar) == vif) {
+                rcu_assign_pointer(ar->beacon_iter, vif_priv);
+                rcu_read_unlock();
+
+                err = carl9170_init_interface(ar, vif);
+                if (err)
+                        goto unlock;
+        } else {
+                err = carl9170_mod_virtual_mac(ar, vif_id, vif->addr);
+                rcu_read_unlock();
+
+                if (err)
+                        goto unlock;
+        }
+
+unlock:
+        if (err && (vif_id != -1)) {
+                vif_priv->active = false;
+                bitmap_release_region(&ar->vif_bitmap, vif_id, 0);
+                ar->vifs--;
+                rcu_assign_pointer(ar->vif_priv[vif_id].vif, NULL);
+                list_del_rcu(&vif_priv->list);
+                mutex_unlock(&ar->mutex);
+                synchronize_rcu();
+        } else {
+                if (ar->vifs > 1)
+                        ar->ps.off_override |= PS_OFF_VIF;
+
+                mutex_unlock(&ar->mutex);
+        }
+
+        return err;
+}
+
+static void carl9170_op_remove_interface(struct ieee80211_hw *hw,
+                                         struct ieee80211_vif *vif)
+{
+        struct carl9170_vif_info *vif_priv = (void *) vif->drv_priv;
+        struct ieee80211_vif *main_vif;
+        struct ar9170 *ar = hw->priv;
+        unsigned int id;
+
+        mutex_lock(&ar->mutex);
+
+        if (WARN_ON_ONCE(!vif_priv->active))
+                goto unlock;
+
+        ar->vifs--;
+
+        rcu_read_lock();
+        main_vif = carl9170_get_main_vif(ar);
+
+        id = vif_priv->id;
+
+        vif_priv->active = false;
+        WARN_ON(vif_priv->enable_beacon);
+        vif_priv->enable_beacon = false;
+        list_del_rcu(&vif_priv->list);
+        rcu_assign_pointer(ar->vif_priv[id].vif, NULL);
+
+        if (vif == main_vif) {
+                rcu_read_unlock();
+
+                if (ar->vifs) {
+                        WARN_ON(carl9170_init_interface(ar,
+                                        carl9170_get_main_vif(ar)));
+                } else {
+                        carl9170_set_operating_mode(ar);
+                }
+        } else {
+                rcu_read_unlock();
+
+                WARN_ON(carl9170_mod_virtual_mac(ar, id, NULL));
+        }
+
+        carl9170_update_beacon(ar, false);
+        carl9170_flush_cab(ar, id);
+
+        spin_lock_bh(&ar->beacon_lock);
+        dev_kfree_skb_any(vif_priv->beacon);
+        vif_priv->beacon = NULL;
+        spin_unlock_bh(&ar->beacon_lock);
+
+        bitmap_release_region(&ar->vif_bitmap, id, 0);
+
+        carl9170_set_beacon_timers(ar);
+
+        if (ar->vifs == 1)
+                ar->ps.off_override &= ~PS_OFF_VIF;
+
+unlock:
+        mutex_unlock(&ar->mutex);
+
+        synchronize_rcu();
+}
+
+void carl9170_ps_check(struct ar9170 *ar)
+{
+        ieee80211_queue_work(ar->hw, &ar->ps_work);
+}
+
+/* caller must hold ar->mutex */
+static int carl9170_ps_update(struct ar9170 *ar)
+{
+        bool ps = false;
+        int err = 0;
+
+        if (!ar->ps.off_override)
+                ps = (ar->hw->conf.flags & IEEE80211_CONF_PS);
+
+        if (ps != ar->ps.state) {
+                err = carl9170_powersave(ar, ps);
+                if (err)
+                        return err;
+
+                if (ar->ps.state && !ps) {
+                        ar->ps.sleep_ms = jiffies_to_msecs(jiffies -
+                                ar->ps.last_action);
+                }
+
+                if (ps)
+                        ar->ps.last_slept = jiffies;
+
+                ar->ps.last_action = jiffies;
+                ar->ps.state = ps;
+        }
+
+        return 0;
+}
+
+static void carl9170_ps_work(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170,
+                                         ps_work);
+        mutex_lock(&ar->mutex);
+        if (IS_STARTED(ar))
+                WARN_ON_ONCE(carl9170_ps_update(ar) != 0);
+        mutex_unlock(&ar->mutex);
+}
+
+
+static int carl9170_op_config(struct ieee80211_hw *hw, u32 changed)
+{
+        struct ar9170 *ar = hw->priv;
+        int err = 0;
+
+        mutex_lock(&ar->mutex);
+        if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
+                /* TODO */
+                err = 0;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_PS) {
+                err = carl9170_ps_update(ar);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_POWER) {
+                /* TODO */
+                err = 0;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_SMPS) {
+                /* TODO */
+                err = 0;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+                /* adjust slot time for 5 GHz */
+                err = carl9170_set_slot_time(ar);
+                if (err)
+                        goto out;
+
+                err = carl9170_set_channel(ar, hw->conf.channel,
+                        hw->conf.channel_type, CARL9170_RFI_NONE);
+                if (err)
+                        goto out;
+
+                err = carl9170_set_dyn_sifs_ack(ar);
+                if (err)
+                        goto out;
+
+                err = carl9170_set_rts_cts_rate(ar);
+                if (err)
+                        goto out;
+        }
+
+out:
+        mutex_unlock(&ar->mutex);
+        return err;
+}
+
+static u64 carl9170_op_prepare_multicast(struct ieee80211_hw *hw,
+                                         struct netdev_hw_addr_list *mc_list)
+{
+        struct netdev_hw_addr *ha;
+        u64 mchash;
+
+        /* always get broadcast frames */
+        mchash = 1ULL << (0xff >> 2);
+
+        netdev_hw_addr_list_for_each(ha, mc_list)
+                mchash |= 1ULL << (ha->addr[5] >> 2);
+
+        return mchash;
+}
+
+static void carl9170_op_configure_filter(struct ieee80211_hw *hw,
+                                         unsigned int changed_flags,
+                                         unsigned int *new_flags,
+                                         u64 multicast)
+{
+        struct ar9170 *ar = hw->priv;
+
+        /* mask supported flags */
+        *new_flags &= FIF_ALLMULTI | ar->rx_filter_caps;
+
+        if (!IS_ACCEPTING_CMD(ar))
+                return;
+
+        mutex_lock(&ar->mutex);
+
+        ar->filter_state = *new_flags;
+        /*
+         * We can support more by setting the sniffer bit and
+         * then checking the error flags, later.
+         */
+
+        if (changed_flags & FIF_ALLMULTI && *new_flags & FIF_ALLMULTI)
+                multicast = ~0ULL;
+
+        if (multicast != ar->cur_mc_hash)
+                WARN_ON(carl9170_update_multicast(ar, multicast));
+
+        if (changed_flags & (FIF_OTHER_BSS | FIF_PROMISC_IN_BSS)) {
+                ar->sniffer_enabled = !!(*new_flags &
+                        (FIF_OTHER_BSS | FIF_PROMISC_IN_BSS));
+
+                WARN_ON(carl9170_set_operating_mode(ar));
+        }
+
+        if (ar->fw.rx_filter && changed_flags & ar->rx_filter_caps) {
+                u32 rx_filter = 0;
+
+                if (!(*new_flags & (FIF_FCSFAIL | FIF_PLCPFAIL)))
+                        rx_filter |= CARL9170_RX_FILTER_BAD;
+
+                if (!(*new_flags & FIF_CONTROL))
+                        rx_filter |= CARL9170_RX_FILTER_CTL_OTHER;
+
+                if (!(*new_flags & FIF_PSPOLL))
+                        rx_filter |= CARL9170_RX_FILTER_CTL_PSPOLL;
+
+                if (!(*new_flags & (FIF_OTHER_BSS | FIF_PROMISC_IN_BSS))) {
+                        rx_filter |= CARL9170_RX_FILTER_OTHER_RA;
+                        rx_filter |= CARL9170_RX_FILTER_DECRY_FAIL;
+                }
+
+                WARN_ON(carl9170_rx_filter(ar, rx_filter));
+        }
+
+        mutex_unlock(&ar->mutex);
+}
+
+
+static void carl9170_op_bss_info_changed(struct ieee80211_hw *hw,
+                                         struct ieee80211_vif *vif,
+                                         struct ieee80211_bss_conf *bss_conf,
+                                         u32 changed)
+{
+        struct ar9170 *ar = hw->priv;
+        struct ath_common *common = &ar->common;
+        int err = 0;
+        struct carl9170_vif_info *vif_priv;
+        struct ieee80211_vif *main_vif;
+
+        mutex_lock(&ar->mutex);
+        vif_priv = (void *) vif->drv_priv;
+        main_vif = carl9170_get_main_vif(ar);
+        if (WARN_ON(!main_vif))
+                goto out;
+
+        if (changed & BSS_CHANGED_BEACON_ENABLED) {
+                struct carl9170_vif_info *iter;
+                int i = 0;
+
+                vif_priv->enable_beacon = bss_conf->enable_beacon;
+                rcu_read_lock();
+                list_for_each_entry_rcu(iter, &ar->vif_list, list) {
+                        if (iter->active && iter->enable_beacon)
+                                i++;
+
+                }
+                rcu_read_unlock();
+
+                ar->beacon_enabled = i;
+        }
+
+        if (changed & BSS_CHANGED_BEACON) {
+                err = carl9170_update_beacon(ar, false);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & (BSS_CHANGED_BEACON_ENABLED | BSS_CHANGED_BEACON |
+                       BSS_CHANGED_BEACON_INT)) {
+
+                if (main_vif != vif) {
+                        bss_conf->beacon_int = main_vif->bss_conf.beacon_int;
+                        bss_conf->dtim_period = main_vif->bss_conf.dtim_period;
+                }
+
+                /*
+                 * Therefore a hard limit for the broadcast traffic should
+                 * prevent false alarms.
+                 */
+                if (vif->type != NL80211_IFTYPE_STATION &&
+                    (bss_conf->beacon_int * bss_conf->dtim_period >=
+                     (CARL9170_QUEUE_STUCK_TIMEOUT / 2))) {
+                        err = -EINVAL;
+                        goto out;
+                }
+
+                err = carl9170_set_beacon_timers(ar);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & BSS_CHANGED_HT) {
+                /* TODO */
+                err = 0;
+                if (err)
+                        goto out;
+        }
+
+        if (main_vif != vif)
+                goto out;
+
+        /*
+         * The following settings can only be changed by the
+         * master interface.
+         */
+
+        if (changed & BSS_CHANGED_BSSID) {
+                memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
+                err = carl9170_set_operating_mode(ar);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & BSS_CHANGED_ASSOC) {
+                ar->common.curaid = bss_conf->aid;
+                err = carl9170_set_beacon_timers(ar);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                err = carl9170_set_slot_time(ar);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & BSS_CHANGED_BASIC_RATES) {
+                err = carl9170_set_mac_rates(ar);
+                if (err)
+                        goto out;
+        }
+
+out:
+        WARN_ON_ONCE(err && IS_STARTED(ar));
+        mutex_unlock(&ar->mutex);
+}
+
+static u64 carl9170_op_get_tsf(struct ieee80211_hw *hw)
+{
+        struct ar9170 *ar = hw->priv;
+        struct carl9170_tsf_rsp tsf;
+        int err;
+
+        mutex_lock(&ar->mutex);
+        err = carl9170_exec_cmd(ar, CARL9170_CMD_READ_TSF,
+                                0, NULL, sizeof(tsf), &tsf);
+        mutex_unlock(&ar->mutex);
+        if (WARN_ON(err))
+                return 0;
+
+        return le64_to_cpu(tsf.tsf_64);
+}
+
+static int carl9170_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta,
+                               struct ieee80211_key_conf *key)
+{
+        struct ar9170 *ar = hw->priv;
+        int err = 0, i;
+        u8 ktype;
+
+        if (ar->disable_offload || !vif)
+                return -EOPNOTSUPP;
+
+        /*
+         * We have to fall back to software encryption, whenever
+         * the user choose to participates in an IBSS or is connected
+         * to more than one network.
+         *
+         * This is very unfortunate, because some machines cannot handle
+         * the high througput speed in 802.11n networks.
+         */
+
+        if (!is_main_vif(ar, vif))
+                goto err_softw;
+
+        /*
+         * While the hardware supports *catch-all* key, for offloading
+         * group-key en-/de-cryption. The way of how the hardware
+         * decides which keyId maps to which key, remains a mystery...
+         */
+        if ((vif->type != NL80211_IFTYPE_STATION &&
+             vif->type != NL80211_IFTYPE_ADHOC) &&
+            !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                return -EOPNOTSUPP;
+
+        switch (key->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+                ktype = AR9170_ENC_ALG_WEP64;
+                break;
+        case WLAN_CIPHER_SUITE_WEP104:
+                ktype = AR9170_ENC_ALG_WEP128;
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                ktype = AR9170_ENC_ALG_TKIP;
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                ktype = AR9170_ENC_ALG_AESCCMP;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        mutex_lock(&ar->mutex);
+        if (cmd == SET_KEY) {
+                if (!IS_STARTED(ar)) {
+                        err = -EOPNOTSUPP;
+                        goto out;
+                }
+
+                if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+                        sta = NULL;
+
+                        i = 64 + key->keyidx;
+                } else {
+                        for (i = 0; i < 64; i++)
+                                if (!(ar->usedkeys & BIT(i)))
+                                        break;
+                        if (i == 64)
+                                goto err_softw;
+                }
+
+                key->hw_key_idx = i;
+
+                err = carl9170_upload_key(ar, i, sta ? sta->addr : NULL,
+                                          ktype, 0, key->key,
+                                          min_t(u8, 16, key->keylen));
+                if (err)
+                        goto out;
+
+                if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
+                        err = carl9170_upload_key(ar, i, sta ? sta->addr :
+                                                  NULL, ktype, 1,
+                                                  key->key + 16, 16);
+                        if (err)
+                                goto out;
+
+                        /*
+                         * hardware is not capable generating MMIC
+                         * of fragmented frames!
+                         */
+                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
+                }
+
+                if (i < 64)
+                        ar->usedkeys |= BIT(i);
+
+                key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+        } else {
+                if (!IS_STARTED(ar)) {
+                        /* The device is gone... together with the key ;-) */
+                        err = 0;
+                        goto out;
+                }
+
+                if (key->hw_key_idx < 64) {
+                        ar->usedkeys &= ~BIT(key->hw_key_idx);
+                } else {
+                        err = carl9170_upload_key(ar, key->hw_key_idx, NULL,
+                                                  AR9170_ENC_ALG_NONE, 0,
+                                                  NULL, 0);
+                        if (err)
+                                goto out;
+
+                        if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
+                                err = carl9170_upload_key(ar, key->hw_key_idx,
+                                                          NULL,
+                                                          AR9170_ENC_ALG_NONE,
+                                                          1, NULL, 0);
+                                if (err)
+                                        goto out;
+                        }
+
+                }
+
+                err = carl9170_disable_key(ar, key->hw_key_idx);
+                if (err)
+                        goto out;
+        }
+
+out:
+        mutex_unlock(&ar->mutex);
+        return err;
+
+err_softw:
+        if (!ar->rx_software_decryption) {
+                ar->rx_software_decryption = true;
+                carl9170_set_operating_mode(ar);
+        }
+        mutex_unlock(&ar->mutex);
+        return -ENOSPC;
+}
+
+static int carl9170_op_sta_add(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta)
+{
+        struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
+        unsigned int i;
+
+        if (sta->ht_cap.ht_supported) {
+                if (sta->ht_cap.ampdu_density > 6) {
+                        /*
+                         * HW does support 16us AMPDU density.
+                         * No HT-Xmit for station.
+                         */
+
+                        return 0;
+                }
+
+                for (i = 0; i < CARL9170_NUM_TID; i++)
+                        rcu_assign_pointer(sta_info->agg[i], NULL);
+
+                sta_info->ampdu_max_len = 1 << (3 + sta->ht_cap.ampdu_factor);
+                sta_info->ht_sta = true;
+        }
+
+        return 0;
+}
+
+static int carl9170_op_sta_remove(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_sta *sta)
+{
+        struct ar9170 *ar = hw->priv;
+        struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
+        unsigned int i;
+        bool cleanup = false;
+
+        if (sta->ht_cap.ht_supported) {
+
+                sta_info->ht_sta = false;
+
+                rcu_read_lock();
+                for (i = 0; i < CARL9170_NUM_TID; i++) {
+                        struct carl9170_sta_tid *tid_info;
+
+                        tid_info = rcu_dereference(sta_info->agg[i]);
+                        rcu_assign_pointer(sta_info->agg[i], NULL);
+
+                        if (!tid_info)
+                                continue;
+
+                        spin_lock_bh(&ar->tx_ampdu_list_lock);
+                        if (tid_info->state > CARL9170_TID_STATE_SHUTDOWN)
+                                tid_info->state = CARL9170_TID_STATE_SHUTDOWN;
+                        spin_unlock_bh(&ar->tx_ampdu_list_lock);
+                        cleanup = true;
+                }
+                rcu_read_unlock();
+
+                if (cleanup)
+                        carl9170_ampdu_gc(ar);
+        }
+
+        return 0;
+}
+
+static int carl9170_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
+                               const struct ieee80211_tx_queue_params *param)
+{
+        struct ar9170 *ar = hw->priv;
+        int ret;
+
+        mutex_lock(&ar->mutex);
+        if (queue < ar->hw->queues) {
+                memcpy(&ar->edcf[ar9170_qmap[queue]], param, sizeof(*param));
+                ret = carl9170_set_qos(ar);
+        } else {
+                ret = -EINVAL;
+        }
+
+        mutex_unlock(&ar->mutex);
+        return ret;
+}
+
+static void carl9170_ampdu_work(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170,
+                                         ampdu_work);
+
+        if (!IS_STARTED(ar))
+                return;
+
+        mutex_lock(&ar->mutex);
+        carl9170_ampdu_gc(ar);
+        mutex_unlock(&ar->mutex);
+}
+
+static int carl9170_op_ampdu_action(struct ieee80211_hw *hw,
+                                    struct ieee80211_vif *vif,
+                                    enum ieee80211_ampdu_mlme_action action,
+                                    struct ieee80211_sta *sta,
+                                    u16 tid, u16 *ssn)
+{
+        struct ar9170 *ar = hw->priv;
+        struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
+        struct carl9170_sta_tid *tid_info;
+
+        if (modparam_noht)
+                return -EOPNOTSUPP;
+
+        switch (action) {
+        case IEEE80211_AMPDU_TX_START:
+                if (!sta_info->ht_sta)
+                        return -EOPNOTSUPP;
+
+                rcu_read_lock();
+                if (rcu_dereference(sta_info->agg[tid])) {
+                        rcu_read_unlock();
+                        return -EBUSY;
+                }
+
+                tid_info = kzalloc(sizeof(struct carl9170_sta_tid),
+                                   GFP_ATOMIC);
+                if (!tid_info) {
+                        rcu_read_unlock();
+                        return -ENOMEM;
+                }
+
+                tid_info->hsn = tid_info->bsn = tid_info->snx = (*ssn);
+                tid_info->state = CARL9170_TID_STATE_PROGRESS;
+                tid_info->tid = tid;
+                tid_info->max = sta_info->ampdu_max_len;
+
+                INIT_LIST_HEAD(&tid_info->list);
+                INIT_LIST_HEAD(&tid_info->tmp_list);
+                skb_queue_head_init(&tid_info->queue);
+                spin_lock_init(&tid_info->lock);
+
+                spin_lock_bh(&ar->tx_ampdu_list_lock);
+                ar->tx_ampdu_list_len++;
+                list_add_tail_rcu(&tid_info->list, &ar->tx_ampdu_list);
+                rcu_assign_pointer(sta_info->agg[tid], tid_info);
+                spin_unlock_bh(&ar->tx_ampdu_list_lock);
+                rcu_read_unlock();
+
+                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+
+        case IEEE80211_AMPDU_TX_STOP:
+                rcu_read_lock();
+                tid_info = rcu_dereference(sta_info->agg[tid]);
+                if (tid_info) {
+                        spin_lock_bh(&ar->tx_ampdu_list_lock);
+                        if (tid_info->state > CARL9170_TID_STATE_SHUTDOWN)
+                                tid_info->state = CARL9170_TID_STATE_SHUTDOWN;
+                        spin_unlock_bh(&ar->tx_ampdu_list_lock);
+                }
+
+                rcu_assign_pointer(sta_info->agg[tid], NULL);
+                rcu_read_unlock();
+
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                ieee80211_queue_work(ar->hw, &ar->ampdu_work);
+                break;
+
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
+                rcu_read_lock();
+                tid_info = rcu_dereference(sta_info->agg[tid]);
+
+                sta_info->stats[tid].clear = true;
+
+                if (tid_info) {
+                        bitmap_zero(tid_info->bitmap, CARL9170_BAW_SIZE);
+                        tid_info->state = CARL9170_TID_STATE_IDLE;
+                }
+                rcu_read_unlock();
+
+                if (WARN_ON_ONCE(!tid_info))
+                        return -EFAULT;
+
+                break;
+
+        case IEEE80211_AMPDU_RX_START:
+        case IEEE80211_AMPDU_RX_STOP:
+                /* Handled by hardware */
+                break;
+
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        return 0;
+}
+
+#ifdef CONFIG_CARL9170_WPC
+static int carl9170_register_wps_button(struct ar9170 *ar)
+{
+        struct input_dev *input;
+        int err;
+
+        if (!(ar->features & CARL9170_WPS_BUTTON))
+                return 0;
+
+        input = input_allocate_device();
+        if (!input)
+                return -ENOMEM;
+
+        snprintf(ar->wps.name, sizeof(ar->wps.name), "%s WPS Button",
+                 wiphy_name(ar->hw->wiphy));
+
+        snprintf(ar->wps.phys, sizeof(ar->wps.phys),
+                 "ieee80211/%s/input0", wiphy_name(ar->hw->wiphy));
+
+        input->name = ar->wps.name;
+        input->phys = ar->wps.phys;
+        input->id.bustype = BUS_USB;
+        input->dev.parent = &ar->hw->wiphy->dev;
+
+        input_set_capability(input, EV_KEY, KEY_WPS_BUTTON);
+
+        err = input_register_device(input);
+        if (err) {
+                input_free_device(input);
+                return err;
+        }
+
+        ar->wps.pbc = input;
+        return 0;
+}
+#endif /* CONFIG_CARL9170_WPC */
+
+static int carl9170_op_get_survey(struct ieee80211_hw *hw, int idx,
+                                struct survey_info *survey)
+{
+        struct ar9170 *ar = hw->priv;
+        int err;
+
+        if (idx != 0)
+                return -ENOENT;
+
+        mutex_lock(&ar->mutex);
+        err = carl9170_get_noisefloor(ar);
+        mutex_unlock(&ar->mutex);
+        if (err)
+                return err;
+
+        survey->channel = ar->channel;
+        survey->filled = SURVEY_INFO_NOISE_DBM;
+        survey->noise = ar->noise[0];
+        return 0;
+}
+
+static void carl9170_op_flush(struct ieee80211_hw *hw, bool drop)
+{
+        struct ar9170 *ar = hw->priv;
+        unsigned int vid;
+
+        mutex_lock(&ar->mutex);
+        for_each_set_bit(vid, &ar->vif_bitmap, ar->fw.vif_num)
+                carl9170_flush_cab(ar, vid);
+
+        carl9170_flush(ar, drop);
+        mutex_unlock(&ar->mutex);
+}
+
+static int carl9170_op_get_stats(struct ieee80211_hw *hw,
+                                 struct ieee80211_low_level_stats *stats)
+{
+        struct ar9170 *ar = hw->priv;
+
+        memset(stats, 0, sizeof(*stats));
+        stats->dot11ACKFailureCount = ar->tx_ack_failures;
+        stats->dot11FCSErrorCount = ar->tx_fcs_errors;
+        return 0;
+}
+
+static void carl9170_op_sta_notify(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif,
+                                   enum sta_notify_cmd cmd,
+                                   struct ieee80211_sta *sta)
+{
+        struct ar9170 *ar = hw->priv;
+        struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
+        struct sk_buff *skb, *tmp;
+        struct sk_buff_head free;
+        int i;
+
+        switch (cmd) {
+        case STA_NOTIFY_SLEEP:
+                /*
+                 * Since the peer is no longer listening, we have to return
+                 * as many SKBs as possible back to the mac80211 stack.
+                 * It will deal with the retry procedure, once the peer
+                 * has become available again.
+                 *
+                 * NB: Ideally, the driver should return the all frames in
+                 * the correct, ascending order. However, I think that this
+                 * functionality should be implemented in the stack and not
+                 * here...
+                 */
+
+                __skb_queue_head_init(&free);
+
+                if (sta->ht_cap.ht_supported) {
+                        rcu_read_lock();
+                        for (i = 0; i < CARL9170_NUM_TID; i++) {
+                                struct carl9170_sta_tid *tid_info;
+
+                                tid_info = rcu_dereference(sta_info->agg[i]);
+
+                                if (!tid_info)
+                                        continue;
+
+                                spin_lock_bh(&ar->tx_ampdu_list_lock);
+                                if (tid_info->state >
+                                    CARL9170_TID_STATE_SUSPEND)
+                                        tid_info->state =
+                                                CARL9170_TID_STATE_SUSPEND;
+                                spin_unlock_bh(&ar->tx_ampdu_list_lock);
+
+                                spin_lock_bh(&tid_info->lock);
+                                while ((skb = __skb_dequeue(&tid_info->queue)))
+                                        __skb_queue_tail(&free, skb);
+                                spin_unlock_bh(&tid_info->lock);
+                        }
+                        rcu_read_unlock();
+                }
+
+                for (i = 0; i < ar->hw->queues; i++) {
+                        spin_lock_bh(&ar->tx_pending[i].lock);
+                        skb_queue_walk_safe(&ar->tx_pending[i], skb, tmp) {
+                                struct _carl9170_tx_superframe *super;
+                                struct ieee80211_hdr *hdr;
+                                struct ieee80211_tx_info *info;
+
+                                super = (void *) skb->data;
+                                hdr = (void *) super->frame_data;
+
+                                if (compare_ether_addr(hdr->addr1, sta->addr))
+                                        continue;
+
+                                __skb_unlink(skb, &ar->tx_pending[i]);
+
+                                info = IEEE80211_SKB_CB(skb);
+                                if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                                        atomic_dec(&ar->tx_ampdu_upload);
+
+                                carl9170_tx_status(ar, skb, false);
+                        }
+                        spin_unlock_bh(&ar->tx_pending[i].lock);
+                }
+
+                while ((skb = __skb_dequeue(&free)))
+                        carl9170_tx_status(ar, skb, false);
+
+                break;
+
+        case STA_NOTIFY_AWAKE:
+                if (!sta->ht_cap.ht_supported)
+                        return;
+
+                rcu_read_lock();
+                for (i = 0; i < CARL9170_NUM_TID; i++) {
+                        struct carl9170_sta_tid *tid_info;
+
+                        tid_info = rcu_dereference(sta_info->agg[i]);
+
+                        if (!tid_info)
+                                continue;
+
+                        if ((tid_info->state == CARL9170_TID_STATE_SUSPEND))
+                                tid_info->state = CARL9170_TID_STATE_IDLE;
+                }
+                rcu_read_unlock();
+                break;
+        }
+}
+
+static const struct ieee80211_ops carl9170_ops = {
+        .start                  = carl9170_op_start,
+        .stop                   = carl9170_op_stop,
+        .tx                     = carl9170_op_tx,
+        .flush                  = carl9170_op_flush,
+        .add_interface          = carl9170_op_add_interface,
+        .remove_interface       = carl9170_op_remove_interface,
+        .config                 = carl9170_op_config,
+        .prepare_multicast      = carl9170_op_prepare_multicast,
+        .configure_filter       = carl9170_op_configure_filter,
+        .conf_tx                = carl9170_op_conf_tx,
+        .bss_info_changed       = carl9170_op_bss_info_changed,
+        .get_tsf                = carl9170_op_get_tsf,
+        .set_key                = carl9170_op_set_key,
+        .sta_add                = carl9170_op_sta_add,
+        .sta_remove             = carl9170_op_sta_remove,
+        .sta_notify             = carl9170_op_sta_notify,
+        .get_survey             = carl9170_op_get_survey,
+        .get_stats              = carl9170_op_get_stats,
+        .ampdu_action           = carl9170_op_ampdu_action,
+};
+
+void *carl9170_alloc(size_t priv_size)
+{
+        struct ieee80211_hw *hw;
+        struct ar9170 *ar;
+        struct sk_buff *skb;
+        int i;
+
+        /*
+         * this buffer is used for rx stream reconstruction.
+         * Under heavy load this device (or the transport layer?)
+         * tends to split the streams into separate rx descriptors.
+         */
+
+        skb = __dev_alloc_skb(AR9170_RX_STREAM_MAX_SIZE, GFP_KERNEL);
+        if (!skb)
+                goto err_nomem;
+
+        hw = ieee80211_alloc_hw(priv_size, &carl9170_ops);
+        if (!hw)
+                goto err_nomem;
+
+        ar = hw->priv;
+        ar->hw = hw;
+        ar->rx_failover = skb;
+
+        memset(&ar->rx_plcp, 0, sizeof(struct ar9170_rx_head));
+        ar->rx_has_plcp = false;
+
+        /*
+         * Here's a hidden pitfall!
+         *
+         * All 4 AC queues work perfectly well under _legacy_ operation.
+         * However as soon as aggregation is enabled, the traffic flow
+         * gets very bumpy. Therefore we have to _switch_ to a
+         * software AC with a single HW queue.
+         */
+        hw->queues = __AR9170_NUM_TXQ;
+
+        mutex_init(&ar->mutex);
+        spin_lock_init(&ar->beacon_lock);
+        spin_lock_init(&ar->cmd_lock);
+        spin_lock_init(&ar->tx_stats_lock);
+        spin_lock_init(&ar->tx_ampdu_list_lock);
+        spin_lock_init(&ar->mem_lock);
+        spin_lock_init(&ar->state_lock);
+        atomic_set(&ar->pending_restarts, 0);
+        ar->vifs = 0;
+        for (i = 0; i < ar->hw->queues; i++) {
+                skb_queue_head_init(&ar->tx_status[i]);
+                skb_queue_head_init(&ar->tx_pending[i]);
+        }
+        INIT_WORK(&ar->ps_work, carl9170_ps_work);
+        INIT_WORK(&ar->restart_work, carl9170_restart_work);
+        INIT_WORK(&ar->ampdu_work, carl9170_ampdu_work);
+        INIT_DELAYED_WORK(&ar->tx_janitor, carl9170_tx_janitor);
+        INIT_LIST_HEAD(&ar->tx_ampdu_list);
+        rcu_assign_pointer(ar->tx_ampdu_iter,
+                           (struct carl9170_sta_tid *) &ar->tx_ampdu_list);
+
+        bitmap_zero(&ar->vif_bitmap, ar->fw.vif_num);
+        INIT_LIST_HEAD(&ar->vif_list);
+        init_completion(&ar->tx_flush);
+
+        /*
+         * Note:
+         * IBSS/ADHOC and AP mode are only enabled, if the firmware
+         * supports these modes. The code which will add the
+         * additional interface_modes is in fw.c.
+         */
+        hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+
+        hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
+                     IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+                     IEEE80211_HW_SUPPORTS_PS |
+                     IEEE80211_HW_PS_NULLFUNC_STACK |
+                     IEEE80211_HW_SIGNAL_DBM;
+
+        if (!modparam_noht) {
+                /*
+                 * see the comment above, why we allow the user
+                 * to disable HT by a module parameter.
+                 */
+                hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+        }
+
+        hw->extra_tx_headroom = sizeof(struct _carl9170_tx_superframe);
+        hw->sta_data_size = sizeof(struct carl9170_sta_info);
+        hw->vif_data_size = sizeof(struct carl9170_vif_info);
+
+        hw->max_rates = CARL9170_TX_MAX_RATES;
+        hw->max_rate_tries = CARL9170_TX_USER_RATE_TRIES;
+
+        for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
+                ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
+
+        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+        return ar;
+
+err_nomem:
+        kfree_skb(skb);
+        return ERR_PTR(-ENOMEM);
+}
+
+static int carl9170_read_eeprom(struct ar9170 *ar)
+{
+#define RW      8       /* number of words to read at once */
+#define RB      (sizeof(u32) * RW)
+        u8 *eeprom = (void *)&ar->eeprom;
+        __le32 offsets[RW];
+        int i, j, err;
+
+        BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
+
+        BUILD_BUG_ON(RB > CARL9170_MAX_CMD_LEN - 4);
+#ifndef __CHECKER__
+        /* don't want to handle trailing remains */
+        BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
+#endif
+
+        for (i = 0; i < sizeof(ar->eeprom)/RB; i++) {
+                for (j = 0; j < RW; j++)
+                        offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
+                                                 RB * i + 4 * j);
+
+                err = carl9170_exec_cmd(ar, CARL9170_CMD_RREG,
+                                        RB, (u8 *) &offsets,
+                                        RB, eeprom + RB * i);
+                if (err)
+                        return err;
+        }
+
+#undef RW
+#undef RB
+        return 0;
+}
+
+static int carl9170_parse_eeprom(struct ar9170 *ar)
+{
+        struct ath_regulatory *regulatory = &ar->common.regulatory;
+        unsigned int rx_streams, tx_streams, tx_params = 0;
+        int bands = 0;
+
+        if (ar->eeprom.length == cpu_to_le16(0xffff))
+                return -ENODATA;
+
+        rx_streams = hweight8(ar->eeprom.rx_mask);
+        tx_streams = hweight8(ar->eeprom.tx_mask);
+
+        if (rx_streams != tx_streams) {
+                tx_params = IEEE80211_HT_MCS_TX_RX_DIFF;
+
+                WARN_ON(!(tx_streams >= 1 && tx_streams <=
+                        IEEE80211_HT_MCS_TX_MAX_STREAMS));
+
+                tx_params = (tx_streams - 1) <<
+                            IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
+
+                carl9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params;
+                carl9170_band_5GHz.ht_cap.mcs.tx_params |= tx_params;
+        }
+
+        if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
+                ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
+                        &carl9170_band_2GHz;
+                bands++;
+        }
+        if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
+                ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
+                        &carl9170_band_5GHz;
+                bands++;
+        }
+
+        /*
+         * I measured this, a bandswitch takes roughly
+         * 135 ms and a frequency switch about 80.
+         *
+         * FIXME: measure these values again once EEPROM settings
+         *        are used, that will influence them!
+         */
+        if (bands == 2)
+                ar->hw->channel_change_time = 135 * 1000;
+        else
+                ar->hw->channel_change_time = 80 * 1000;
+
+        regulatory->current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
+        regulatory->current_rd_ext = le16_to_cpu(ar->eeprom.reg_domain[1]);
+
+        /* second part of wiphy init */
+        SET_IEEE80211_PERM_ADDR(ar->hw, ar->eeprom.mac_address);
+
+        return bands ? 0 : -EINVAL;
+}
+
+static int carl9170_reg_notifier(struct wiphy *wiphy,
+                                 struct regulatory_request *request)
+{
+        struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
+        struct ar9170 *ar = hw->priv;
+
+        return ath_reg_notifier_apply(wiphy, request, &ar->common.regulatory);
+}
+
+int carl9170_register(struct ar9170 *ar)
+{
+        struct ath_regulatory *regulatory = &ar->common.regulatory;
+        int err = 0, i;
+
+        if (WARN_ON(ar->mem_bitmap))
+                return -EINVAL;
+
+        ar->mem_bitmap = kzalloc(roundup(ar->fw.mem_blocks, BITS_PER_LONG) *
+                                 sizeof(unsigned long), GFP_KERNEL);
+
+        if (!ar->mem_bitmap)
+                return -ENOMEM;
+
+        /* try to read EEPROM, init MAC addr */
+        err = carl9170_read_eeprom(ar);
+        if (err)
+                return err;
+
+        err = carl9170_fw_fix_eeprom(ar);
+        if (err)
+                return err;
+
+        err = carl9170_parse_eeprom(ar);
+        if (err)
+                return err;
+
+        err = ath_regd_init(regulatory, ar->hw->wiphy,
+                            carl9170_reg_notifier);
+        if (err)
+                return err;
+
+        if (modparam_noht) {
+                carl9170_band_2GHz.ht_cap.ht_supported = false;
+                carl9170_band_5GHz.ht_cap.ht_supported = false;
+        }
+
+        for (i = 0; i < ar->fw.vif_num; i++) {
+                ar->vif_priv[i].id = i;
+                ar->vif_priv[i].vif = NULL;
+        }
+
+        err = ieee80211_register_hw(ar->hw);
+        if (err)
+                return err;
+
+        /* mac80211 interface is now registered */
+        ar->registered = true;
+
+        if (!ath_is_world_regd(regulatory))
+                regulatory_hint(ar->hw->wiphy, regulatory->alpha2);
+
+#ifdef CONFIG_CARL9170_DEBUGFS
+        carl9170_debugfs_register(ar);
+#endif /* CONFIG_CARL9170_DEBUGFS */
+
+        err = carl9170_led_init(ar);
+        if (err)
+                goto err_unreg;
+
+#ifdef CONFIG_CARL9170_LEDS
+        err = carl9170_led_register(ar);
+        if (err)
+                goto err_unreg;
+#endif /* CONFIG_CAR9L170_LEDS */
+
+#ifdef CONFIG_CARL9170_WPC
+        err = carl9170_register_wps_button(ar);
+        if (err)
+                goto err_unreg;
+#endif /* CONFIG_CARL9170_WPC */
+
+        dev_info(&ar->udev->dev, "Atheros AR9170 is registered as '%s'\n",
+                 wiphy_name(ar->hw->wiphy));
+
+        return 0;
+
+err_unreg:
+        carl9170_unregister(ar);
+        return err;
+}
+
+void carl9170_unregister(struct ar9170 *ar)
+{
+        if (!ar->registered)
+                return;
+
+        ar->registered = false;
+
+#ifdef CONFIG_CARL9170_LEDS
+        carl9170_led_unregister(ar);
+#endif /* CONFIG_CARL9170_LEDS */
+
+#ifdef CONFIG_CARL9170_DEBUGFS
+        carl9170_debugfs_unregister(ar);
+#endif /* CONFIG_CARL9170_DEBUGFS */
+
+#ifdef CONFIG_CARL9170_WPC
+        if (ar->wps.pbc) {
+                input_unregister_device(ar->wps.pbc);
+                ar->wps.pbc = NULL;
+        }
+#endif /* CONFIG_CARL9170_WPC */
+
+        carl9170_cancel_worker(ar);
+        cancel_work_sync(&ar->restart_work);
+
+        ieee80211_unregister_hw(ar->hw);
+}
+
+void carl9170_free(struct ar9170 *ar)
+{
+        WARN_ON(ar->registered);
+        WARN_ON(IS_INITIALIZED(ar));
+
+        kfree_skb(ar->rx_failover);
+        ar->rx_failover = NULL;
+
+        kfree(ar->mem_bitmap);
+        ar->mem_bitmap = NULL;
+
+        mutex_destroy(&ar->mutex);
+
+        ieee80211_free_hw(ar->hw);
+}
diff --git a/drivers/net/wireless/ath/carl9170/phy.c b/drivers/net/wireless/ath/carl9170/phy.c
new file mode 100644
index 000000000000..89deca37a988
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/phy.c
@@ -0,0 +1,1810 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * PHY and RF code
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/bitrev.h>
+#include "carl9170.h"
+#include "cmd.h"
+#include "phy.h"
+
+static int carl9170_init_power_cal(struct ar9170 *ar)
+{
+        carl9170_regwrite_begin(ar);
+
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE_MAX, 0x7f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE1, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE2, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE3, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE4, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE5, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE6, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE7, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE8, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE9, 0x3f3f3f3f);
+
+        carl9170_regwrite_finish();
+        return carl9170_regwrite_result();
+}
+
+struct carl9170_phy_init {
+        u32 reg, _5ghz_20, _5ghz_40, _2ghz_40, _2ghz_20;
+};
+
+static struct carl9170_phy_init ar5416_phy_init[] = {
+        { 0x1c5800, 0x00000007, 0x00000007, 0x00000007, 0x00000007, },
+        { 0x1c5804, 0x00000300, 0x000003c4, 0x000003c4, 0x00000300, },
+        { 0x1c5808, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c580c, 0xad848e19, 0xad848e19, 0xad848e19, 0xad848e19, },
+        { 0x1c5810, 0x7d14e000, 0x7d14e000, 0x7d14e000, 0x7d14e000, },
+        { 0x1c5814, 0x9c0a9f6b, 0x9c0a9f6b, 0x9c0a9f6b, 0x9c0a9f6b, },
+        { 0x1c5818, 0x00000090, 0x00000090, 0x00000090, 0x00000090, },
+        { 0x1c581c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5820, 0x02020200, 0x02020200, 0x02020200, 0x02020200, },
+        { 0x1c5824, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, },
+        { 0x1c5828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, },
+        { 0x1c582c, 0x0000a000, 0x0000a000, 0x0000a000, 0x0000a000, },
+        { 0x1c5830, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5834, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, },
+        { 0x1c5838, 0x00000007, 0x00000007, 0x00000007, 0x00000007, },
+        { 0x1c583c, 0x00200400, 0x00200400, 0x00200400, 0x00200400, },
+        { 0x1c5840, 0x206a002e, 0x206a002e, 0x206a002e, 0x206a002e, },
+        { 0x1c5844, 0x1372161e, 0x13721c1e, 0x13721c24, 0x137216a4, },
+        { 0x1c5848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, },
+        { 0x1c584c, 0x1284233c, 0x1284233c, 0x1284233c, 0x1284233c, },
+        { 0x1c5850, 0x6c48b4e4, 0x6d48b4e4, 0x6d48b0e4, 0x6c48b0e4, },
+        { 0x1c5854, 0x00000859, 0x00000859, 0x00000859, 0x00000859, },
+        { 0x1c5858, 0x7ec80d2e, 0x7ec80d2e, 0x7ec80d2e, 0x7ec80d2e, },
+        { 0x1c585c, 0x31395c5e, 0x3139605e, 0x3139605e, 0x31395c5e, },
+        { 0x1c5860, 0x0004dd10, 0x0004dd10, 0x0004dd20, 0x0004dd20, },
+        { 0x1c5864, 0x0001c600, 0x0001c600, 0x0001c600, 0x0001c600, },
+        { 0x1c5868, 0x409a4190, 0x409a4190, 0x409a4190, 0x409a4190, },
+        { 0x1c586c, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081, },
+        { 0x1c5900, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5904, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5908, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c590c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5914, 0x000007d0, 0x000007d0, 0x00000898, 0x00000898, },
+        { 0x1c5918, 0x00000118, 0x00000230, 0x00000268, 0x00000134, },
+        { 0x1c591c, 0x10000fff, 0x10000fff, 0x10000fff, 0x10000fff, },
+        { 0x1c5920, 0x0510081c, 0x0510081c, 0x0510001c, 0x0510001c, },
+        { 0x1c5924, 0xd0058a15, 0xd0058a15, 0xd0058a15, 0xd0058a15, },
+        { 0x1c5928, 0x00000001, 0x00000001, 0x00000001, 0x00000001, },
+        { 0x1c592c, 0x00000004, 0x00000004, 0x00000004, 0x00000004, },
+        { 0x1c5934, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c5938, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c593c, 0x0000007f, 0x0000007f, 0x0000007f, 0x0000007f, },
+        { 0x1c5944, 0xdfb81020, 0xdfb81020, 0xdfb81020, 0xdfb81020, },
+        { 0x1c5948, 0x9280b212, 0x9280b212, 0x9280b212, 0x9280b212, },
+        { 0x1c594c, 0x00020028, 0x00020028, 0x00020028, 0x00020028, },
+        { 0x1c5954, 0x5d50e188, 0x5d50e188, 0x5d50e188, 0x5d50e188, },
+        { 0x1c5958, 0x00081fff, 0x00081fff, 0x00081fff, 0x00081fff, },
+        { 0x1c5960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, },
+        { 0x1c5964, 0x00001120, 0x00001120, 0x00001120, 0x00001120, },
+        { 0x1c5970, 0x190fb515, 0x190fb515, 0x190fb515, 0x190fb515, },
+        { 0x1c5974, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5978, 0x00000001, 0x00000001, 0x00000001, 0x00000001, },
+        { 0x1c597c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5980, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5984, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5988, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c598c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5990, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5994, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5998, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c599c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59a0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59a4, 0x00000007, 0x00000007, 0x00000007, 0x00000007, },
+        { 0x1c59a8, 0x001fff00, 0x001fff00, 0x001fff00, 0x001fff00, },
+        { 0x1c59ac, 0x006f00c4, 0x006f00c4, 0x006f00c4, 0x006f00c4, },
+        { 0x1c59b0, 0x03051000, 0x03051000, 0x03051000, 0x03051000, },
+        { 0x1c59b4, 0x00000820, 0x00000820, 0x00000820, 0x00000820, },
+        { 0x1c59bc, 0x00181400, 0x00181400, 0x00181400, 0x00181400, },
+        { 0x1c59c0, 0x038919be, 0x038919be, 0x038919be, 0x038919be, },
+        { 0x1c59c4, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77, },
+        { 0x1c59c8, 0x6af6532c, 0x6af6532c, 0x6af6532c, 0x6af6532c, },
+        { 0x1c59cc, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8, },
+        { 0x1c59d0, 0x00046384, 0x00046384, 0x00046384, 0x00046384, },
+        { 0x1c59d4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59dc, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59e0, 0x00000200, 0x00000200, 0x00000200, 0x00000200, },
+        { 0x1c59e4, 0x64646464, 0x64646464, 0x64646464, 0x64646464, },
+        { 0x1c59e8, 0x3c787878, 0x3c787878, 0x3c787878, 0x3c787878, },
+        { 0x1c59ec, 0x000000aa, 0x000000aa, 0x000000aa, 0x000000aa, },
+        { 0x1c59f0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59fc, 0x00001042, 0x00001042, 0x00001042, 0x00001042, },
+        { 0x1c5a00, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5a04, 0x00000040, 0x00000040, 0x00000040, 0x00000040, },
+        { 0x1c5a08, 0x00000080, 0x00000080, 0x00000080, 0x00000080, },
+        { 0x1c5a0c, 0x000001a1, 0x000001a1, 0x00000141, 0x00000141, },
+        { 0x1c5a10, 0x000001e1, 0x000001e1, 0x00000181, 0x00000181, },
+        { 0x1c5a14, 0x00000021, 0x00000021, 0x000001c1, 0x000001c1, },
+        { 0x1c5a18, 0x00000061, 0x00000061, 0x00000001, 0x00000001, },
+        { 0x1c5a1c, 0x00000168, 0x00000168, 0x00000041, 0x00000041, },
+        { 0x1c5a20, 0x000001a8, 0x000001a8, 0x000001a8, 0x000001a8, },
+        { 0x1c5a24, 0x000001e8, 0x000001e8, 0x000001e8, 0x000001e8, },
+        { 0x1c5a28, 0x00000028, 0x00000028, 0x00000028, 0x00000028, },
+        { 0x1c5a2c, 0x00000068, 0x00000068, 0x00000068, 0x00000068, },
+        { 0x1c5a30, 0x00000189, 0x00000189, 0x000000a8, 0x000000a8, },
+        { 0x1c5a34, 0x000001c9, 0x000001c9, 0x00000169, 0x00000169, },
+        { 0x1c5a38, 0x00000009, 0x00000009, 0x000001a9, 0x000001a9, },
+        { 0x1c5a3c, 0x00000049, 0x00000049, 0x000001e9, 0x000001e9, },
+        { 0x1c5a40, 0x00000089, 0x00000089, 0x00000029, 0x00000029, },
+        { 0x1c5a44, 0x00000170, 0x00000170, 0x00000069, 0x00000069, },
+        { 0x1c5a48, 0x000001b0, 0x000001b0, 0x00000190, 0x00000190, },
+        { 0x1c5a4c, 0x000001f0, 0x000001f0, 0x000001d0, 0x000001d0, },
+        { 0x1c5a50, 0x00000030, 0x00000030, 0x00000010, 0x00000010, },
+        { 0x1c5a54, 0x00000070, 0x00000070, 0x00000050, 0x00000050, },
+        { 0x1c5a58, 0x00000191, 0x00000191, 0x00000090, 0x00000090, },
+        { 0x1c5a5c, 0x000001d1, 0x000001d1, 0x00000151, 0x00000151, },
+        { 0x1c5a60, 0x00000011, 0x00000011, 0x00000191, 0x00000191, },
+        { 0x1c5a64, 0x00000051, 0x00000051, 0x000001d1, 0x000001d1, },
+        { 0x1c5a68, 0x00000091, 0x00000091, 0x00000011, 0x00000011, },
+        { 0x1c5a6c, 0x000001b8, 0x000001b8, 0x00000051, 0x00000051, },
+        { 0x1c5a70, 0x000001f8, 0x000001f8, 0x00000198, 0x00000198, },
+        { 0x1c5a74, 0x00000038, 0x00000038, 0x000001d8, 0x000001d8, },
+        { 0x1c5a78, 0x00000078, 0x00000078, 0x00000018, 0x00000018, },
+        { 0x1c5a7c, 0x00000199, 0x00000199, 0x00000058, 0x00000058, },
+        { 0x1c5a80, 0x000001d9, 0x000001d9, 0x00000098, 0x00000098, },
+        { 0x1c5a84, 0x00000019, 0x00000019, 0x00000159, 0x00000159, },
+        { 0x1c5a88, 0x00000059, 0x00000059, 0x00000199, 0x00000199, },
+        { 0x1c5a8c, 0x00000099, 0x00000099, 0x000001d9, 0x000001d9, },
+        { 0x1c5a90, 0x000000d9, 0x000000d9, 0x00000019, 0x00000019, },
+        { 0x1c5a94, 0x000000f9, 0x000000f9, 0x00000059, 0x00000059, },
+        { 0x1c5a98, 0x000000f9, 0x000000f9, 0x00000099, 0x00000099, },
+        { 0x1c5a9c, 0x000000f9, 0x000000f9, 0x000000d9, 0x000000d9, },
+        { 0x1c5aa0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5aa4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5aa8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5aac, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ab0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ab4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ab8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5abc, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ac0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ac4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ac8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5acc, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ad0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ad4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ad8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5adc, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ae0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ae4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ae8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5aec, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5af0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5af4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5af8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5afc, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5b00, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5b04, 0x00000001, 0x00000001, 0x00000001, 0x00000001, },
+        { 0x1c5b08, 0x00000002, 0x00000002, 0x00000002, 0x00000002, },
+        { 0x1c5b0c, 0x00000003, 0x00000003, 0x00000003, 0x00000003, },
+        { 0x1c5b10, 0x00000004, 0x00000004, 0x00000004, 0x00000004, },
+        { 0x1c5b14, 0x00000005, 0x00000005, 0x00000005, 0x00000005, },
+        { 0x1c5b18, 0x00000008, 0x00000008, 0x00000008, 0x00000008, },
+        { 0x1c5b1c, 0x00000009, 0x00000009, 0x00000009, 0x00000009, },
+        { 0x1c5b20, 0x0000000a, 0x0000000a, 0x0000000a, 0x0000000a, },
+        { 0x1c5b24, 0x0000000b, 0x0000000b, 0x0000000b, 0x0000000b, },
+        { 0x1c5b28, 0x0000000c, 0x0000000c, 0x0000000c, 0x0000000c, },
+        { 0x1c5b2c, 0x0000000d, 0x0000000d, 0x0000000d, 0x0000000d, },
+        { 0x1c5b30, 0x00000010, 0x00000010, 0x00000010, 0x00000010, },
+        { 0x1c5b34, 0x00000011, 0x00000011, 0x00000011, 0x00000011, },
+        { 0x1c5b38, 0x00000012, 0x00000012, 0x00000012, 0x00000012, },
+        { 0x1c5b3c, 0x00000013, 0x00000013, 0x00000013, 0x00000013, },
+        { 0x1c5b40, 0x00000014, 0x00000014, 0x00000014, 0x00000014, },
+        { 0x1c5b44, 0x00000015, 0x00000015, 0x00000015, 0x00000015, },
+        { 0x1c5b48, 0x00000018, 0x00000018, 0x00000018, 0x00000018, },
+        { 0x1c5b4c, 0x00000019, 0x00000019, 0x00000019, 0x00000019, },
+        { 0x1c5b50, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a, },
+        { 0x1c5b54, 0x0000001b, 0x0000001b, 0x0000001b, 0x0000001b, },
+        { 0x1c5b58, 0x0000001c, 0x0000001c, 0x0000001c, 0x0000001c, },
+        { 0x1c5b5c, 0x0000001d, 0x0000001d, 0x0000001d, 0x0000001d, },
+        { 0x1c5b60, 0x00000020, 0x00000020, 0x00000020, 0x00000020, },
+        { 0x1c5b64, 0x00000021, 0x00000021, 0x00000021, 0x00000021, },
+        { 0x1c5b68, 0x00000022, 0x00000022, 0x00000022, 0x00000022, },
+        { 0x1c5b6c, 0x00000023, 0x00000023, 0x00000023, 0x00000023, },
+        { 0x1c5b70, 0x00000024, 0x00000024, 0x00000024, 0x00000024, },
+        { 0x1c5b74, 0x00000025, 0x00000025, 0x00000025, 0x00000025, },
+        { 0x1c5b78, 0x00000028, 0x00000028, 0x00000028, 0x00000028, },
+        { 0x1c5b7c, 0x00000029, 0x00000029, 0x00000029, 0x00000029, },
+        { 0x1c5b80, 0x0000002a, 0x0000002a, 0x0000002a, 0x0000002a, },
+        { 0x1c5b84, 0x0000002b, 0x0000002b, 0x0000002b, 0x0000002b, },
+        { 0x1c5b88, 0x0000002c, 0x0000002c, 0x0000002c, 0x0000002c, },
+        { 0x1c5b8c, 0x0000002d, 0x0000002d, 0x0000002d, 0x0000002d, },
+        { 0x1c5b90, 0x00000030, 0x00000030, 0x00000030, 0x00000030, },
+        { 0x1c5b94, 0x00000031, 0x00000031, 0x00000031, 0x00000031, },
+        { 0x1c5b98, 0x00000032, 0x00000032, 0x00000032, 0x00000032, },
+        { 0x1c5b9c, 0x00000033, 0x00000033, 0x00000033, 0x00000033, },
+        { 0x1c5ba0, 0x00000034, 0x00000034, 0x00000034, 0x00000034, },
+        { 0x1c5ba4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5ba8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bac, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bb0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bb4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bb8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bbc, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bc0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bc4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bc8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bcc, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bd0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bd4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bd8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bdc, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5be0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5be4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5be8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bec, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bf0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bf4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bf8, 0x00000010, 0x00000010, 0x00000010, 0x00000010, },
+        { 0x1c5bfc, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a, },
+        { 0x1c5c00, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c0c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c10, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c14, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c18, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c1c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c20, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c24, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c28, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c2c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c30, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c34, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c38, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c3c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5cf0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5cf4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5cf8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5cfc, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6200, 0x00000008, 0x00000008, 0x0000000e, 0x0000000e, },
+        { 0x1c6204, 0x00000440, 0x00000440, 0x00000440, 0x00000440, },
+        { 0x1c6208, 0xd6be4788, 0xd6be4788, 0xd03e4788, 0xd03e4788, },
+        { 0x1c620c, 0x012e8160, 0x012e8160, 0x012a8160, 0x012a8160, },
+        { 0x1c6210, 0x40806333, 0x40806333, 0x40806333, 0x40806333, },
+        { 0x1c6214, 0x00106c10, 0x00106c10, 0x00106c10, 0x00106c10, },
+        { 0x1c6218, 0x009c4060, 0x009c4060, 0x009c4060, 0x009c4060, },
+        { 0x1c621c, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a, },
+        { 0x1c6220, 0x018830c6, 0x018830c6, 0x018830c6, 0x018830c6, },
+        { 0x1c6224, 0x00000400, 0x00000400, 0x00000400, 0x00000400, },
+        { 0x1c6228, 0x000009b5, 0x000009b5, 0x000009b5, 0x000009b5, },
+        { 0x1c622c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6230, 0x00000108, 0x00000210, 0x00000210, 0x00000108, },
+        { 0x1c6234, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c6238, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c623c, 0x13c889af, 0x13c889af, 0x13c889af, 0x13c889af, },
+        { 0x1c6240, 0x38490a20, 0x38490a20, 0x38490a20, 0x38490a20, },
+        { 0x1c6244, 0x00007bb6, 0x00007bb6, 0x00007bb6, 0x00007bb6, },
+        { 0x1c6248, 0x0fff3ffc, 0x0fff3ffc, 0x0fff3ffc, 0x0fff3ffc, },
+        { 0x1c624c, 0x00000001, 0x00000001, 0x00000001, 0x00000001, },
+        { 0x1c6250, 0x0000a000, 0x0000a000, 0x0000a000, 0x0000a000, },
+        { 0x1c6254, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6258, 0x0cc75380, 0x0cc75380, 0x0cc75380, 0x0cc75380, },
+        { 0x1c625c, 0x0f0f0f01, 0x0f0f0f01, 0x0f0f0f01, 0x0f0f0f01, },
+        { 0x1c6260, 0xdfa91f01, 0xdfa91f01, 0xdfa91f01, 0xdfa91f01, },
+        { 0x1c6264, 0x00418a11, 0x00418a11, 0x00418a11, 0x00418a11, },
+        { 0x1c6268, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c626c, 0x09249126, 0x09249126, 0x09249126, 0x09249126, },
+        { 0x1c6274, 0x0a1a9caa, 0x0a1a9caa, 0x0a1a7caa, 0x0a1a7caa, },
+        { 0x1c6278, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, },
+        { 0x1c627c, 0x051701ce, 0x051701ce, 0x051701ce, 0x051701ce, },
+        { 0x1c6300, 0x18010000, 0x18010000, 0x18010000, 0x18010000, },
+        { 0x1c6304, 0x30032602, 0x30032602, 0x2e032402, 0x2e032402, },
+        { 0x1c6308, 0x48073e06, 0x48073e06, 0x4a0a3c06, 0x4a0a3c06, },
+        { 0x1c630c, 0x560b4c0a, 0x560b4c0a, 0x621a540b, 0x621a540b, },
+        { 0x1c6310, 0x641a600f, 0x641a600f, 0x764f6c1b, 0x764f6c1b, },
+        { 0x1c6314, 0x7a4f6e1b, 0x7a4f6e1b, 0x845b7a5a, 0x845b7a5a, },
+        { 0x1c6318, 0x8c5b7e5a, 0x8c5b7e5a, 0x950f8ccf, 0x950f8ccf, },
+        { 0x1c631c, 0x9d0f96cf, 0x9d0f96cf, 0xa5cf9b4f, 0xa5cf9b4f, },
+        { 0x1c6320, 0xb51fa69f, 0xb51fa69f, 0xbddfaf1f, 0xbddfaf1f, },
+        { 0x1c6324, 0xcb3fbd07, 0xcb3fbcbf, 0xd1ffc93f, 0xd1ffc93f, },
+        { 0x1c6328, 0x0000d7bf, 0x0000d7bf, 0x00000000, 0x00000000, },
+        { 0x1c632c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6330, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6334, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6338, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c633c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6340, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6344, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6348, 0x3fffffff, 0x3fffffff, 0x3fffffff, 0x3fffffff, },
+        { 0x1c634c, 0x3fffffff, 0x3fffffff, 0x3fffffff, 0x3fffffff, },
+        { 0x1c6350, 0x3fffffff, 0x3fffffff, 0x3fffffff, 0x3fffffff, },
+        { 0x1c6354, 0x0003ffff, 0x0003ffff, 0x0003ffff, 0x0003ffff, },
+        { 0x1c6358, 0x79a8aa1f, 0x79a8aa1f, 0x79a8aa1f, 0x79a8aa1f, },
+        { 0x1c6388, 0x08000000, 0x08000000, 0x08000000, 0x08000000, },
+        { 0x1c638c, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c6390, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c6394, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, },
+        { 0x1c6398, 0x000001ce, 0x000001ce, 0x000001ce, 0x000001ce, },
+        { 0x1c639c, 0x00000007, 0x00000007, 0x00000007, 0x00000007, },
+        { 0x1c63a0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63a4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63a8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63ac, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63b0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63b4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63b8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63bc, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63c0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63c4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63cc, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c63d0, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c63d4, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c63d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63dc, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, },
+        { 0x1c63e0, 0x000000c0, 0x000000c0, 0x000000c0, 0x000000c0, },
+        { 0x1c6848, 0x00180a65, 0x00180a65, 0x00180a68, 0x00180a68, },
+        { 0x1c6920, 0x0510001c, 0x0510001c, 0x0510001c, 0x0510001c, },
+        { 0x1c6960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, },
+        { 0x1c720c, 0x012e8160, 0x012e8160, 0x012a8160, 0x012a8160, },
+        { 0x1c726c, 0x09249126, 0x09249126, 0x09249126, 0x09249126, },
+        { 0x1c7848, 0x00180a65, 0x00180a65, 0x00180a68, 0x00180a68, },
+        { 0x1c7920, 0x0510001c, 0x0510001c, 0x0510001c, 0x0510001c, },
+        { 0x1c7960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, },
+        { 0x1c820c, 0x012e8160, 0x012e8160, 0x012a8160, 0x012a8160, },
+        { 0x1c826c, 0x09249126, 0x09249126, 0x09249126, 0x09249126, },
+/*      { 0x1c8864, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00, }, */
+        { 0x1c8864, 0x0001c600, 0x0001c600, 0x0001c600, 0x0001c600, },
+        { 0x1c895c, 0x004b6a8e, 0x004b6a8e, 0x004b6a8e, 0x004b6a8e, },
+        { 0x1c8968, 0x000003ce, 0x000003ce, 0x000003ce, 0x000003ce, },
+        { 0x1c89bc, 0x00181400, 0x00181400, 0x00181400, 0x00181400, },
+        { 0x1c9270, 0x00820820, 0x00820820, 0x00820820, 0x00820820, },
+        { 0x1c935c, 0x066c420f, 0x066c420f, 0x066c420f, 0x066c420f, },
+        { 0x1c9360, 0x0f282207, 0x0f282207, 0x0f282207, 0x0f282207, },
+        { 0x1c9364, 0x17601685, 0x17601685, 0x17601685, 0x17601685, },
+        { 0x1c9368, 0x1f801104, 0x1f801104, 0x1f801104, 0x1f801104, },
+        { 0x1c936c, 0x37a00c03, 0x37a00c03, 0x37a00c03, 0x37a00c03, },
+        { 0x1c9370, 0x3fc40883, 0x3fc40883, 0x3fc40883, 0x3fc40883, },
+        { 0x1c9374, 0x57c00803, 0x57c00803, 0x57c00803, 0x57c00803, },
+        { 0x1c9378, 0x5fd80682, 0x5fd80682, 0x5fd80682, 0x5fd80682, },
+        { 0x1c937c, 0x7fe00482, 0x7fe00482, 0x7fe00482, 0x7fe00482, },
+        { 0x1c9380, 0x7f3c7bba, 0x7f3c7bba, 0x7f3c7bba, 0x7f3c7bba, },
+        { 0x1c9384, 0xf3307ff0, 0xf3307ff0, 0xf3307ff0, 0xf3307ff0, }
+};
+
+/*
+ * look up a certain register in ar5416_phy_init[] and return the init. value
+ * for the band and bandwidth given. Return 0 if register address not found.
+ */
+static u32 carl9170_def_val(u32 reg, bool is_2ghz, bool is_40mhz)
+{
+        unsigned int i;
+        for (i = 0; i < ARRAY_SIZE(ar5416_phy_init); i++) {
+                if (ar5416_phy_init[i].reg != reg)
+                        continue;
+
+                if (is_2ghz) {
+                        if (is_40mhz)
+                                return ar5416_phy_init[i]._2ghz_40;
+                        else
+                                return ar5416_phy_init[i]._2ghz_20;
+                } else {
+                        if (is_40mhz)
+                                return ar5416_phy_init[i]._5ghz_40;
+                        else
+                                return ar5416_phy_init[i]._5ghz_20;
+                }
+        }
+        return 0;
+}
+
+/*
+ * initialize some phy regs from eeprom values in modal_header[]
+ * acc. to band and bandwith
+ */
+static int carl9170_init_phy_from_eeprom(struct ar9170 *ar,
+                                bool is_2ghz, bool is_40mhz)
+{
+        static const u8 xpd2pd[16] = {
+                0x2, 0x2, 0x2, 0x1, 0x2, 0x2, 0x6, 0x2,
+                0x2, 0x3, 0x7, 0x2, 0xb, 0x2, 0x2, 0x2
+        };
+        /* pointer to the modal_header acc. to band */
+        struct ar9170_eeprom_modal *m = &ar->eeprom.modal_header[is_2ghz];
+        u32 val;
+
+        carl9170_regwrite_begin(ar);
+
+        /* ant common control (index 0) */
+        carl9170_regwrite(AR9170_PHY_REG_SWITCH_COM,
+                le32_to_cpu(m->antCtrlCommon));
+
+        /* ant control chain 0 (index 1) */
+        carl9170_regwrite(AR9170_PHY_REG_SWITCH_CHAIN_0,
+                le32_to_cpu(m->antCtrlChain[0]));
+
+        /* ant control chain 2 (index 2) */
+        carl9170_regwrite(AR9170_PHY_REG_SWITCH_CHAIN_2,
+                le32_to_cpu(m->antCtrlChain[1]));
+
+        /* SwSettle (index 3) */
+        if (!is_40mhz) {
+                val = carl9170_def_val(AR9170_PHY_REG_SETTLING,
+                                     is_2ghz, is_40mhz);
+                SET_VAL(AR9170_PHY_SETTLING_SWITCH, val, m->switchSettling);
+                carl9170_regwrite(AR9170_PHY_REG_SETTLING, val);
+        }
+
+        /* adcDesired, pdaDesired (index 4) */
+        val = carl9170_def_val(AR9170_PHY_REG_DESIRED_SZ, is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_DESIRED_SZ_PGA, val, m->pgaDesiredSize);
+        SET_VAL(AR9170_PHY_DESIRED_SZ_ADC, val, m->adcDesiredSize);
+        carl9170_regwrite(AR9170_PHY_REG_DESIRED_SZ, val);
+
+        /* TxEndToXpaOff, TxFrameToXpaOn (index 5) */
+        val = carl9170_def_val(AR9170_PHY_REG_RF_CTL4, is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_RF_CTL4_TX_END_XPAB_OFF, val, m->txEndToXpaOff);
+        SET_VAL(AR9170_PHY_RF_CTL4_TX_END_XPAA_OFF, val, m->txEndToXpaOff);
+        SET_VAL(AR9170_PHY_RF_CTL4_FRAME_XPAB_ON, val, m->txFrameToXpaOn);
+        SET_VAL(AR9170_PHY_RF_CTL4_FRAME_XPAA_ON, val, m->txFrameToXpaOn);
+        carl9170_regwrite(AR9170_PHY_REG_RF_CTL4, val);
+
+        /* TxEndToRxOn (index 6) */
+        val = carl9170_def_val(AR9170_PHY_REG_RF_CTL3, is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_RF_CTL3_TX_END_TO_A2_RX_ON, val, m->txEndToRxOn);
+        carl9170_regwrite(AR9170_PHY_REG_RF_CTL3, val);
+
+        /* thresh62 (index 7) */
+        val = carl9170_def_val(0x1c8864, is_2ghz, is_40mhz);
+        val = (val & ~0x7f000) | (m->thresh62 << 12);
+        carl9170_regwrite(0x1c8864, val);
+
+        /* tx/rx attenuation chain 0 (index 8) */
+        val = carl9170_def_val(AR9170_PHY_REG_RXGAIN, is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_RXGAIN_TXRX_ATTEN, val, m->txRxAttenCh[0]);
+        carl9170_regwrite(AR9170_PHY_REG_RXGAIN, val);
+
+        /* tx/rx attenuation chain 2 (index 9) */
+        val = carl9170_def_val(AR9170_PHY_REG_RXGAIN_CHAIN_2,
+                               is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_RXGAIN_TXRX_ATTEN, val, m->txRxAttenCh[1]);
+        carl9170_regwrite(AR9170_PHY_REG_RXGAIN_CHAIN_2, val);
+
+        /* tx/rx margin chain 0 (index 10) */
+        val = carl9170_def_val(AR9170_PHY_REG_GAIN_2GHZ, is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_GAIN_2GHZ_RXTX_MARGIN, val, m->rxTxMarginCh[0]);
+        /* bsw margin chain 0 for 5GHz only */
+        if (!is_2ghz)
+                SET_VAL(AR9170_PHY_GAIN_2GHZ_BSW_MARGIN, val, m->bswMargin[0]);
+        carl9170_regwrite(AR9170_PHY_REG_GAIN_2GHZ, val);
+
+        /* tx/rx margin chain 2 (index 11) */
+        val = carl9170_def_val(AR9170_PHY_REG_GAIN_2GHZ_CHAIN_2,
+                               is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_GAIN_2GHZ_RXTX_MARGIN, val, m->rxTxMarginCh[1]);
+        carl9170_regwrite(AR9170_PHY_REG_GAIN_2GHZ_CHAIN_2, val);
+
+        /* iqCall, iqCallq chain 0 (index 12) */
+        val = carl9170_def_val(AR9170_PHY_REG_TIMING_CTRL4(0),
+                               is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF, val, m->iqCalICh[0]);
+        SET_VAL(AR9170_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF, val, m->iqCalQCh[0]);
+        carl9170_regwrite(AR9170_PHY_REG_TIMING_CTRL4(0), val);
+
+        /* iqCall, iqCallq chain 2 (index 13) */
+        val = carl9170_def_val(AR9170_PHY_REG_TIMING_CTRL4(2),
+                               is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF, val, m->iqCalICh[1]);
+        SET_VAL(AR9170_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF, val, m->iqCalQCh[1]);
+        carl9170_regwrite(AR9170_PHY_REG_TIMING_CTRL4(2), val);
+
+        /* xpd gain mask (index 14) */
+        val = carl9170_def_val(AR9170_PHY_REG_TPCRG1, is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_TPCRG1_PD_GAIN_1, val,
+                xpd2pd[m->xpdGain & 0xf] & 3);
+        SET_VAL(AR9170_PHY_TPCRG1_PD_GAIN_2, val,
+                xpd2pd[m->xpdGain & 0xf] >> 2);
+        carl9170_regwrite(AR9170_PHY_REG_TPCRG1, val);
+
+        carl9170_regwrite(AR9170_PHY_REG_RX_CHAINMASK, ar->eeprom.rx_mask);
+        carl9170_regwrite(AR9170_PHY_REG_CAL_CHAINMASK, ar->eeprom.rx_mask);
+
+        carl9170_regwrite_finish();
+        return carl9170_regwrite_result();
+}
+
+static int carl9170_init_phy(struct ar9170 *ar, enum ieee80211_band band)
+{
+        int i, err;
+        u32 val;
+        bool is_2ghz = band == IEEE80211_BAND_2GHZ;
+        bool is_40mhz = conf_is_ht40(&ar->hw->conf);
+
+        carl9170_regwrite_begin(ar);
+
+        for (i = 0; i < ARRAY_SIZE(ar5416_phy_init); i++) {
+                if (is_40mhz) {
+                        if (is_2ghz)
+                                val = ar5416_phy_init[i]._2ghz_40;
+                        else
+                                val = ar5416_phy_init[i]._5ghz_40;
+                } else {
+                        if (is_2ghz)
+                                val = ar5416_phy_init[i]._2ghz_20;
+                        else
+                                val = ar5416_phy_init[i]._5ghz_20;
+                }
+
+                carl9170_regwrite(ar5416_phy_init[i].reg, val);
+        }
+
+        carl9170_regwrite_finish();
+        err = carl9170_regwrite_result();
+        if (err)
+                return err;
+
+        err = carl9170_init_phy_from_eeprom(ar, is_2ghz, is_40mhz);
+        if (err)
+                return err;
+
+        err = carl9170_init_power_cal(ar);
+        if (err)
+                return err;
+
+        /* XXX: remove magic! */
+        if (is_2ghz)
+                err = carl9170_write_reg(ar, AR9170_PWR_REG_PLL_ADDAC, 0x5163);
+        else
+                err = carl9170_write_reg(ar, AR9170_PWR_REG_PLL_ADDAC, 0x5143);
+
+        return err;
+}
+
+struct carl9170_rf_initvals {
+        u32 reg, _5ghz, _2ghz;
+};
+
+static struct carl9170_rf_initvals carl9170_rf_initval[] = {
+        /* bank 0 */
+        { 0x1c58b0, 0x1e5795e5, 0x1e5795e5},
+        { 0x1c58e0, 0x02008020, 0x02008020},
+        /* bank 1 */
+        { 0x1c58b0, 0x02108421, 0x02108421},
+        { 0x1c58ec, 0x00000008, 0x00000008},
+        /* bank 2 */
+        { 0x1c58b0, 0x0e73ff17, 0x0e73ff17},
+        { 0x1c58e0, 0x00000420, 0x00000420},
+        /* bank 3 */
+        { 0x1c58f0, 0x01400018, 0x01c00018},
+        /* bank 4 */
+        { 0x1c58b0, 0x000001a1, 0x000001a1},
+        { 0x1c58e8, 0x00000001, 0x00000001},
+        /* bank 5 */
+        { 0x1c58b0, 0x00000013, 0x00000013},
+        { 0x1c58e4, 0x00000002, 0x00000002},
+        /* bank 6 */
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00004000, 0x00004000},
+        { 0x1c58b0, 0x00006c00, 0x00006c00},
+        { 0x1c58b0, 0x00002c00, 0x00002c00},
+        { 0x1c58b0, 0x00004800, 0x00004800},
+        { 0x1c58b0, 0x00004000, 0x00004000},
+        { 0x1c58b0, 0x00006000, 0x00006000},
+        { 0x1c58b0, 0x00001000, 0x00001000},
+        { 0x1c58b0, 0x00004000, 0x00004000},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00087c00, 0x00087c00},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00005400, 0x00005400},
+        { 0x1c58b0, 0x00000c00, 0x00000c00},
+        { 0x1c58b0, 0x00001800, 0x00001800},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00006c00, 0x00006c00},
+        { 0x1c58b0, 0x00006c00, 0x00006c00},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00002c00, 0x00002c00},
+        { 0x1c58b0, 0x00003c00, 0x00003c00},
+        { 0x1c58b0, 0x00003800, 0x00003800},
+        { 0x1c58b0, 0x00001c00, 0x00001c00},
+        { 0x1c58b0, 0x00000800, 0x00000800},
+        { 0x1c58b0, 0x00000408, 0x00000408},
+        { 0x1c58b0, 0x00004c15, 0x00004c15},
+        { 0x1c58b0, 0x00004188, 0x00004188},
+        { 0x1c58b0, 0x0000201e, 0x0000201e},
+        { 0x1c58b0, 0x00010408, 0x00010408},
+        { 0x1c58b0, 0x00000801, 0x00000801},
+        { 0x1c58b0, 0x00000c08, 0x00000c08},
+        { 0x1c58b0, 0x0000181e, 0x0000181e},
+        { 0x1c58b0, 0x00001016, 0x00001016},
+        { 0x1c58b0, 0x00002800, 0x00002800},
+        { 0x1c58b0, 0x00004010, 0x00004010},
+        { 0x1c58b0, 0x0000081c, 0x0000081c},
+        { 0x1c58b0, 0x00000115, 0x00000115},
+        { 0x1c58b0, 0x00000015, 0x00000015},
+        { 0x1c58b0, 0x00000066, 0x00000066},
+        { 0x1c58b0, 0x0000001c, 0x0000001c},
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00000004, 0x00000004},
+        { 0x1c58b0, 0x00000015, 0x00000015},
+        { 0x1c58b0, 0x0000001f, 0x0000001f},
+        { 0x1c58e0, 0x00000000, 0x00000400},
+        /* bank 7 */
+        { 0x1c58b0, 0x000000a0, 0x000000a0},
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00000040, 0x00000040},
+        { 0x1c58f0, 0x0000001c, 0x0000001c},
+};
+
+static int carl9170_init_rf_banks_0_7(struct ar9170 *ar, bool band5ghz)
+{
+        int err, i;
+
+        carl9170_regwrite_begin(ar);
+
+        for (i = 0; i < ARRAY_SIZE(carl9170_rf_initval); i++)
+                carl9170_regwrite(carl9170_rf_initval[i].reg,
+                                  band5ghz ? carl9170_rf_initval[i]._5ghz
+                                           : carl9170_rf_initval[i]._2ghz);
+
+        carl9170_regwrite_finish();
+        err = carl9170_regwrite_result();
+        if (err)
+                wiphy_err(ar->hw->wiphy, "rf init failed\n");
+
+        return err;
+}
+
+struct carl9170_phy_freq_params {
+        u8 coeff_exp;
+        u16 coeff_man;
+        u8 coeff_exp_shgi;
+        u16 coeff_man_shgi;
+};
+
+enum carl9170_bw {
+        CARL9170_BW_20,
+        CARL9170_BW_40_BELOW,
+        CARL9170_BW_40_ABOVE,
+
+        __CARL9170_NUM_BW,
+};
+
+struct carl9170_phy_freq_entry {
+        u16 freq;
+        struct carl9170_phy_freq_params params[__CARL9170_NUM_BW];
+};
+
+/* NB: must be in sync with channel tables in main! */
+static const struct carl9170_phy_freq_entry carl9170_phy_freq_params[] = {
+/*
+ *      freq,
+ *              20MHz,
+ *              40MHz (below),
+ *              40Mhz (above),
+ */
+        { 2412, {
+                { 3, 21737, 3, 19563, },
+                { 3, 21827, 3, 19644, },
+                { 3, 21647, 3, 19482, },
+        } },
+        { 2417, {
+                { 3, 21692, 3, 19523, },
+                { 3, 21782, 3, 19604, },
+                { 3, 21602, 3, 19442, },
+        } },
+        { 2422, {
+                { 3, 21647, 3, 19482, },
+                { 3, 21737, 3, 19563, },
+                { 3, 21558, 3, 19402, },
+        } },
+        { 2427, {
+                { 3, 21602, 3, 19442, },
+                { 3, 21692, 3, 19523, },
+                { 3, 21514, 3, 19362, },
+        } },
+        { 2432, {
+                { 3, 21558, 3, 19402, },
+                { 3, 21647, 3, 19482, },
+                { 3, 21470, 3, 19323, },
+        } },
+        { 2437, {
+                { 3, 21514, 3, 19362, },
+                { 3, 21602, 3, 19442, },
+                { 3, 21426, 3, 19283, },
+        } },
+        { 2442, {
+                { 3, 21470, 3, 19323, },
+                { 3, 21558, 3, 19402, },
+                { 3, 21382, 3, 19244, },
+        } },
+        { 2447, {
+                { 3, 21426, 3, 19283, },
+                { 3, 21514, 3, 19362, },
+                { 3, 21339, 3, 19205, },
+        } },
+        { 2452, {
+                { 3, 21382, 3, 19244, },
+                { 3, 21470, 3, 19323, },
+                { 3, 21295, 3, 19166, },
+        } },
+        { 2457, {
+                { 3, 21339, 3, 19205, },
+                { 3, 21426, 3, 19283, },
+                { 3, 21252, 3, 19127, },
+        } },
+        { 2462, {
+                { 3, 21295, 3, 19166, },
+                { 3, 21382, 3, 19244, },
+                { 3, 21209, 3, 19088, },
+        } },
+        { 2467, {
+                { 3, 21252, 3, 19127, },
+                { 3, 21339, 3, 19205, },
+                { 3, 21166, 3, 19050, },
+        } },
+        { 2472, {
+                { 3, 21209, 3, 19088, },
+                { 3, 21295, 3, 19166, },
+                { 3, 21124, 3, 19011, },
+        } },
+        { 2484, {
+                { 3, 21107, 3, 18996, },
+                { 3, 21192, 3, 19073, },
+                { 3, 21022, 3, 18920, },
+        } },
+        { 4920, {
+                { 4, 21313, 4, 19181, },
+                { 4, 21356, 4, 19220, },
+                { 4, 21269, 4, 19142, },
+        } },
+        { 4940, {
+                { 4, 21226, 4, 19104, },
+                { 4, 21269, 4, 19142, },
+                { 4, 21183, 4, 19065, },
+        } },
+        { 4960, {
+                { 4, 21141, 4, 19027, },
+                { 4, 21183, 4, 19065, },
+                { 4, 21098, 4, 18988, },
+        } },
+        { 4980, {
+                { 4, 21056, 4, 18950, },
+                { 4, 21098, 4, 18988, },
+                { 4, 21014, 4, 18912, },
+        } },
+        { 5040, {
+                { 4, 20805, 4, 18725, },
+                { 4, 20846, 4, 18762, },
+                { 4, 20764, 4, 18687, },
+        } },
+        { 5060, {
+                { 4, 20723, 4, 18651, },
+                { 4, 20764, 4, 18687, },
+                { 4, 20682, 4, 18614, },
+        } },
+        { 5080, {
+                { 4, 20641, 4, 18577, },
+                { 4, 20682, 4, 18614, },
+                { 4, 20601, 4, 18541, },
+        } },
+        { 5180, {
+                { 4, 20243, 4, 18219, },
+                { 4, 20282, 4, 18254, },
+                { 4, 20204, 4, 18183, },
+        } },
+        { 5200, {
+                { 4, 20165, 4, 18148, },
+                { 4, 20204, 4, 18183, },
+                { 4, 20126, 4, 18114, },
+        } },
+        { 5220, {
+                { 4, 20088, 4, 18079, },
+                { 4, 20126, 4, 18114, },
+                { 4, 20049, 4, 18044, },
+        } },
+        { 5240, {
+                { 4, 20011, 4, 18010, },
+                { 4, 20049, 4, 18044, },
+                { 4, 19973, 4, 17976, },
+        } },
+        { 5260, {
+                { 4, 19935, 4, 17941, },
+                { 4, 19973, 4, 17976, },
+                { 4, 19897, 4, 17907, },
+        } },
+        { 5280, {
+                { 4, 19859, 4, 17873, },
+                { 4, 19897, 4, 17907, },
+                { 4, 19822, 4, 17840, },
+        } },
+        { 5300, {
+                { 4, 19784, 4, 17806, },
+                { 4, 19822, 4, 17840, },
+                { 4, 19747, 4, 17772, },
+        } },
+        { 5320, {
+                { 4, 19710, 4, 17739, },
+                { 4, 19747, 4, 17772, },
+                { 4, 19673, 4, 17706, },
+        } },
+        { 5500, {
+                { 4, 19065, 4, 17159, },
+                { 4, 19100, 4, 17190, },
+                { 4, 19030, 4, 17127, },
+        } },
+        { 5520, {
+                { 4, 18996, 4, 17096, },
+                { 4, 19030, 4, 17127, },
+                { 4, 18962, 4, 17065, },
+        } },
+        { 5540, {
+                { 4, 18927, 4, 17035, },
+                { 4, 18962, 4, 17065, },
+                { 4, 18893, 4, 17004, },
+        } },
+        { 5560, {
+                { 4, 18859, 4, 16973, },
+                { 4, 18893, 4, 17004, },
+                { 4, 18825, 4, 16943, },
+        } },
+        { 5580, {
+                { 4, 18792, 4, 16913, },
+                { 4, 18825, 4, 16943, },
+                { 4, 18758, 4, 16882, },
+        } },
+        { 5600, {
+                { 4, 18725, 4, 16852, },
+                { 4, 18758, 4, 16882, },
+                { 4, 18691, 4, 16822, },
+        } },
+        { 5620, {
+                { 4, 18658, 4, 16792, },
+                { 4, 18691, 4, 16822, },
+                { 4, 18625, 4, 16762, },
+        } },
+        { 5640, {
+                { 4, 18592, 4, 16733, },
+                { 4, 18625, 4, 16762, },
+                { 4, 18559, 4, 16703, },
+        } },
+        { 5660, {
+                { 4, 18526, 4, 16673, },
+                { 4, 18559, 4, 16703, },
+                { 4, 18493, 4, 16644, },
+        } },
+        { 5680, {
+                { 4, 18461, 4, 16615, },
+                { 4, 18493, 4, 16644, },
+                { 4, 18428, 4, 16586, },
+        } },
+        { 5700, {
+                { 4, 18396, 4, 16556, },
+                { 4, 18428, 4, 16586, },
+                { 4, 18364, 4, 16527, },
+        } },
+        { 5745, {
+                { 4, 18252, 4, 16427, },
+                { 4, 18284, 4, 16455, },
+                { 4, 18220, 4, 16398, },
+        } },
+        { 5765, {
+                { 4, 18189, 5, 32740, },
+                { 4, 18220, 4, 16398, },
+                { 4, 18157, 5, 32683, },
+        } },
+        { 5785, {
+                { 4, 18126, 5, 32626, },
+                { 4, 18157, 5, 32683, },
+                { 4, 18094, 5, 32570, },
+        } },
+        { 5805, {
+                { 4, 18063, 5, 32514, },
+                { 4, 18094, 5, 32570, },
+                { 4, 18032, 5, 32458, },
+        } },
+        { 5825, {
+                { 4, 18001, 5, 32402, },
+                { 4, 18032, 5, 32458, },
+                { 4, 17970, 5, 32347, },
+        } },
+        { 5170, {
+                { 4, 20282, 4, 18254, },
+                { 4, 20321, 4, 18289, },
+                { 4, 20243, 4, 18219, },
+        } },
+        { 5190, {
+                { 4, 20204, 4, 18183, },
+                { 4, 20243, 4, 18219, },
+                { 4, 20165, 4, 18148, },
+        } },
+        { 5210, {
+                { 4, 20126, 4, 18114, },
+                { 4, 20165, 4, 18148, },
+                { 4, 20088, 4, 18079, },
+        } },
+        { 5230, {
+                { 4, 20049, 4, 18044, },
+                { 4, 20088, 4, 18079, },
+                { 4, 20011, 4, 18010, },
+        } },
+};
+
+static int carl9170_init_rf_bank4_pwr(struct ar9170 *ar, bool band5ghz,
+                                      u32 freq, enum carl9170_bw bw)
+{
+        int err;
+        u32 d0, d1, td0, td1, fd0, fd1;
+        u8 chansel;
+        u8 refsel0 = 1, refsel1 = 0;
+        u8 lf_synth = 0;
+
+        switch (bw) {
+        case CARL9170_BW_40_ABOVE:
+                freq += 10;
+                break;
+        case CARL9170_BW_40_BELOW:
+                freq -= 10;
+                break;
+        case CARL9170_BW_20:
+                break;
+        default:
+                BUG();
+                return -ENOSYS;
+        }
+
+        if (band5ghz) {
+                if (freq % 10) {
+                        chansel = (freq - 4800) / 5;
+                } else {
+                        chansel = ((freq - 4800) / 10) * 2;
+                        refsel0 = 0;
+                        refsel1 = 1;
+                }
+                chansel = byte_rev_table[chansel];
+        } else {
+                if (freq == 2484) {
+                        chansel = 10 + (freq - 2274) / 5;
+                        lf_synth = 1;
+                } else
+                        chansel = 16 + (freq - 2272) / 5;
+                chansel *= 4;
+                chansel = byte_rev_table[chansel];
+        }
+
+        d1 =    chansel;
+        d0 =    0x21 |
+                refsel0 << 3 |
+                refsel1 << 2 |
+                lf_synth << 1;
+        td0 =   d0 & 0x1f;
+        td1 =   d1 & 0x1f;
+        fd0 =   td1 << 5 | td0;
+
+        td0 =   (d0 >> 5) & 0x7;
+        td1 =   (d1 >> 5) & 0x7;
+        fd1 =   td1 << 5 | td0;
+
+        carl9170_regwrite_begin(ar);
+
+        carl9170_regwrite(0x1c58b0, fd0);
+        carl9170_regwrite(0x1c58e8, fd1);
+
+        carl9170_regwrite_finish();
+        err = carl9170_regwrite_result();
+        if (err)
+                return err;
+
+        msleep(20);
+
+        return 0;
+}
+
+static const struct carl9170_phy_freq_params *
+carl9170_get_hw_dyn_params(struct ieee80211_channel *channel,
+                           enum carl9170_bw bw)
+{
+        unsigned int chanidx = 0;
+        u16 freq = 2412;
+
+        if (channel) {
+                chanidx = channel->hw_value;
+                freq = channel->center_freq;
+        }
+
+        BUG_ON(chanidx >= ARRAY_SIZE(carl9170_phy_freq_params));
+
+        BUILD_BUG_ON(__CARL9170_NUM_BW != 3);
+
+        WARN_ON(carl9170_phy_freq_params[chanidx].freq != freq);
+
+        return &carl9170_phy_freq_params[chanidx].params[bw];
+}
+
+static int carl9170_find_freq_idx(int nfreqs, u8 *freqs, u8 f)
+{
+        int idx = nfreqs - 2;
+
+        while (idx >= 0) {
+                if (f >= freqs[idx])
+                        return idx;
+                idx--;
+        }
+
+        return 0;
+}
+
+static s32 carl9170_interpolate_s32(s32 x, s32 x1, s32 y1, s32 x2, s32 y2)
+{
+        /* nothing to interpolate, it's horizontal */
+        if (y2 == y1)
+                return y1;
+
+        /* check if we hit one of the edges */
+        if (x == x1)
+                return y1;
+        if (x == x2)
+                return y2;
+
+        /* x1 == x2 is bad, hopefully == x */
+        if (x2 == x1)
+                return y1;
+
+        return y1 + (((y2 - y1) * (x - x1)) / (x2 - x1));
+}
+
+static u8 carl9170_interpolate_u8(u8 x, u8 x1, u8 y1, u8 x2, u8 y2)
+{
+#define SHIFT           8
+        s32 y;
+
+        y = carl9170_interpolate_s32(x << SHIFT, x1 << SHIFT,
+                y1 << SHIFT, x2 << SHIFT, y2 << SHIFT);
+
+        /*
+         * XXX: unwrap this expression
+         *      Isn't it just DIV_ROUND_UP(y, 1<<SHIFT)?
+         *      Can we rely on the compiler to optimise away the div?
+         */
+        return (y >> SHIFT) + ((y & (1<<(SHIFT-1))) >> (SHIFT - 1));
+#undef SHIFT
+}
+
+static u8 carl9170_interpolate_val(u8 x, u8 *x_array, u8 *y_array)
+{
+        int i;
+
+        for (i = 0; i < 3; i++) {
+                if (x <= x_array[i + 1])
+                        break;
+        }
+
+        return carl9170_interpolate_u8(x, x_array[i], y_array[i],
+                x_array[i + 1], y_array[i + 1]);
+}
+
+static int carl9170_set_freq_cal_data(struct ar9170 *ar,
+        struct ieee80211_channel *channel)
+{
+        u8 *cal_freq_pier;
+        u8 vpds[2][AR5416_PD_GAIN_ICEPTS];
+        u8 pwrs[2][AR5416_PD_GAIN_ICEPTS];
+        int chain, idx, i;
+        u32 phy_data = 0;
+        u8 f, tmp;
+
+        switch (channel->band) {
+        case IEEE80211_BAND_2GHZ:
+                f = channel->center_freq - 2300;
+                cal_freq_pier = ar->eeprom.cal_freq_pier_2G;
+                i = AR5416_NUM_2G_CAL_PIERS - 1;
+                break;
+
+        case IEEE80211_BAND_5GHZ:
+                f = (channel->center_freq - 4800) / 5;
+                cal_freq_pier = ar->eeprom.cal_freq_pier_5G;
+                i = AR5416_NUM_5G_CAL_PIERS - 1;
+                break;
+
+        default:
+                return -EINVAL;
+                break;
+        }
+
+        for (; i >= 0; i--) {
+                if (cal_freq_pier[i] != 0xff)
+                        break;
+        }
+        if (i < 0)
+                return -EINVAL;
+
+        idx = carl9170_find_freq_idx(i, cal_freq_pier, f);
+
+        carl9170_regwrite_begin(ar);
+
+        for (chain = 0; chain < AR5416_MAX_CHAINS; chain++) {
+                for (i = 0; i < AR5416_PD_GAIN_ICEPTS; i++) {
+                        struct ar9170_calibration_data_per_freq *cal_pier_data;
+                        int j;
+
+                        switch (channel->band) {
+                        case IEEE80211_BAND_2GHZ:
+                                cal_pier_data = &ar->eeprom.
+                                        cal_pier_data_2G[chain][idx];
+                                break;
+
+                        case IEEE80211_BAND_5GHZ:
+                                cal_pier_data = &ar->eeprom.
+                                        cal_pier_data_5G[chain][idx];
+                                break;
+
+                        default:
+                                return -EINVAL;
+                        }
+
+                        for (j = 0; j < 2; j++) {
+                                vpds[j][i] = carl9170_interpolate_u8(f,
+                                        cal_freq_pier[idx],
+                                        cal_pier_data->vpd_pdg[j][i],
+                                        cal_freq_pier[idx + 1],
+                                        cal_pier_data[1].vpd_pdg[j][i]);
+
+                                pwrs[j][i] = carl9170_interpolate_u8(f,
+                                        cal_freq_pier[idx],
+                                        cal_pier_data->pwr_pdg[j][i],
+                                        cal_freq_pier[idx + 1],
+                                        cal_pier_data[1].pwr_pdg[j][i]) / 2;
+                        }
+                }
+
+                for (i = 0; i < 76; i++) {
+                        if (i < 25) {
+                                tmp = carl9170_interpolate_val(i, &pwrs[0][0],
+                                                               &vpds[0][0]);
+                        } else {
+                                tmp = carl9170_interpolate_val(i - 12,
+                                                               &pwrs[1][0],
+                                                               &vpds[1][0]);
+                        }
+
+                        phy_data |= tmp << ((i & 3) << 3);
+                        if ((i & 3) == 3) {
+                                carl9170_regwrite(0x1c6280 + chain * 0x1000 +
+                                                  (i & ~3), phy_data);
+                                phy_data = 0;
+                        }
+                }
+
+                for (i = 19; i < 32; i++)
+                        carl9170_regwrite(0x1c6280 + chain * 0x1000 + (i << 2),
+                                          0x0);
+        }
+
+        carl9170_regwrite_finish();
+        return carl9170_regwrite_result();
+}
+
+static u8 carl9170_get_max_edge_power(struct ar9170 *ar,
+        u32 freq, struct ar9170_calctl_edges edges[])
+{
+        int i;
+        u8 rc = AR5416_MAX_RATE_POWER;
+        u8 f;
+        if (freq < 3000)
+                f = freq - 2300;
+        else
+                f = (freq - 4800) / 5;
+
+        for (i = 0; i < AR5416_NUM_BAND_EDGES; i++) {
+                if (edges[i].channel == 0xff)
+                        break;
+                if (f == edges[i].channel) {
+                        /* exact freq match */
+                        rc = edges[i].power_flags & ~AR9170_CALCTL_EDGE_FLAGS;
+                        break;
+                }
+                if (i > 0 && f < edges[i].channel) {
+                        if (f > edges[i - 1].channel &&
+                            edges[i - 1].power_flags &
+                            AR9170_CALCTL_EDGE_FLAGS) {
+                                /* lower channel has the inband flag set */
+                                rc = edges[i - 1].power_flags &
+                                        ~AR9170_CALCTL_EDGE_FLAGS;
+                        }
+                        break;
+                }
+        }
+
+        if (i == AR5416_NUM_BAND_EDGES) {
+                if (f > edges[i - 1].channel &&
+                    edges[i - 1].power_flags & AR9170_CALCTL_EDGE_FLAGS) {
+                        /* lower channel has the inband flag set */
+                        rc = edges[i - 1].power_flags &
+                                ~AR9170_CALCTL_EDGE_FLAGS;
+                }
+        }
+        return rc;
+}
+
+static u8 carl9170_get_heavy_clip(struct ar9170 *ar, u32 freq,
+        enum carl9170_bw bw, struct ar9170_calctl_edges edges[])
+{
+        u8 f;
+        int i;
+        u8 rc = 0;
+
+        if (freq < 3000)
+                f = freq - 2300;
+        else
+                f = (freq - 4800) / 5;
+
+        if (bw == CARL9170_BW_40_BELOW || bw == CARL9170_BW_40_ABOVE)
+                rc |= 0xf0;
+
+        for (i = 0; i < AR5416_NUM_BAND_EDGES; i++) {
+                if (edges[i].channel == 0xff)
+                        break;
+                if (f == edges[i].channel) {
+                        if (!(edges[i].power_flags & AR9170_CALCTL_EDGE_FLAGS))
+                                rc |= 0x0f;
+                        break;
+                }
+        }
+
+        return rc;
+}
+
+/*
+ * calculate the conformance test limits and the heavy clip parameter
+ * and apply them to ar->power* (derived from otus hal/hpmain.c, line 3706)
+ */
+static void carl9170_calc_ctl(struct ar9170 *ar, u32 freq, enum carl9170_bw bw)
+{
+        u8 ctl_grp; /* CTL group */
+        u8 ctl_idx; /* CTL index */
+        int i, j;
+        struct ctl_modes {
+                u8 ctl_mode;
+                u8 max_power;
+                u8 *pwr_cal_data;
+                int pwr_cal_len;
+        } *modes;
+
+        /*
+         * order is relevant in the mode_list_*: we fall back to the
+         * lower indices if any mode is missed in the EEPROM.
+         */
+        struct ctl_modes mode_list_2ghz[] = {
+                { CTL_11B, 0, ar->power_2G_cck, 4 },
+                { CTL_11G, 0, ar->power_2G_ofdm, 4 },
+                { CTL_2GHT20, 0, ar->power_2G_ht20, 8 },
+                { CTL_2GHT40, 0, ar->power_2G_ht40, 8 },
+        };
+        struct ctl_modes mode_list_5ghz[] = {
+                { CTL_11A, 0, ar->power_5G_leg, 4 },
+                { CTL_5GHT20, 0, ar->power_5G_ht20, 8 },
+                { CTL_5GHT40, 0, ar->power_5G_ht40, 8 },
+        };
+        int nr_modes;
+
+#define EDGES(c, n) (ar->eeprom.ctl_data[c].control_edges[n])
+
+        ar->heavy_clip = 0;
+
+        /*
+         * TODO: investigate the differences between OTUS'
+         * hpreg.c::zfHpGetRegulatoryDomain() and
+         * ath/regd.c::ath_regd_get_band_ctl() -
+         * e.g. for FCC3_WORLD the OTUS procedure
+         * always returns CTL_FCC, while the one in ath/ delivers
+         * CTL_ETSI for 2GHz and CTL_FCC for 5GHz.
+         */
+        ctl_grp = ath_regd_get_band_ctl(&ar->common.regulatory,
+                                        ar->hw->conf.channel->band);
+
+        /* ctl group not found - either invalid band (NO_CTL) or ww roaming */
+        if (ctl_grp == NO_CTL || ctl_grp == SD_NO_CTL)
+                ctl_grp = CTL_FCC;
+
+        if (ctl_grp != CTL_FCC)
+                /* skip CTL and heavy clip for CTL_MKK and CTL_ETSI */
+                return;
+
+        if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ) {
+                modes = mode_list_2ghz;
+                nr_modes = ARRAY_SIZE(mode_list_2ghz);
+        } else {
+                modes = mode_list_5ghz;
+                nr_modes = ARRAY_SIZE(mode_list_5ghz);
+        }
+
+        for (i = 0; i < nr_modes; i++) {
+                u8 c = ctl_grp | modes[i].ctl_mode;
+                for (ctl_idx = 0; ctl_idx < AR5416_NUM_CTLS; ctl_idx++)
+                        if (c == ar->eeprom.ctl_index[ctl_idx])
+                                break;
+                if (ctl_idx < AR5416_NUM_CTLS) {
+                        int f_off = 0;
+
+                        /*
+                         * determine heavy clip parameter
+                         * from the 11G edges array
+                         */
+                        if (modes[i].ctl_mode == CTL_11G) {
+                                ar->heavy_clip =
+                                        carl9170_get_heavy_clip(ar,
+                                                freq, bw, EDGES(ctl_idx, 1));
+                        }
+
+                        /* adjust freq for 40MHz */
+                        if (modes[i].ctl_mode == CTL_2GHT40 ||
+                            modes[i].ctl_mode == CTL_5GHT40) {
+                                if (bw == CARL9170_BW_40_BELOW)
+                                        f_off = -10;
+                                else
+                                        f_off = 10;
+                        }
+
+                        modes[i].max_power =
+                                carl9170_get_max_edge_power(ar,
+                                        freq+f_off, EDGES(ctl_idx, 1));
+
+                        /*
+                         * TODO: check if the regulatory max. power is
+                         * controlled by cfg80211 for DFS.
+                         * (hpmain applies it to max_power itself for DFS freq)
+                         */
+
+                } else {
+                        /*
+                         * Workaround in otus driver, hpmain.c, line 3906:
+                         * if no data for 5GHT20 are found, take the
+                         * legacy 5G value. We extend this here to fallback
+                         * from any other HT* or 11G, too.
+                         */
+                        int k = i;
+
+                        modes[i].max_power = AR5416_MAX_RATE_POWER;
+                        while (k-- > 0) {
+                                if (modes[k].max_power !=
+                                    AR5416_MAX_RATE_POWER) {
+                                        modes[i].max_power = modes[k].max_power;
+                                        break;
+                                }
+                        }
+                }
+
+                /* apply max power to pwr_cal_data (ar->power_*) */
+                for (j = 0; j < modes[i].pwr_cal_len; j++) {
+                        modes[i].pwr_cal_data[j] = min(modes[i].pwr_cal_data[j],
+                                                       modes[i].max_power);
+                }
+        }
+
+        if (ar->heavy_clip & 0xf0) {
+                ar->power_2G_ht40[0]--;
+                ar->power_2G_ht40[1]--;
+                ar->power_2G_ht40[2]--;
+        }
+        if (ar->heavy_clip & 0xf) {
+                ar->power_2G_ht20[0]++;
+                ar->power_2G_ht20[1]++;
+                ar->power_2G_ht20[2]++;
+        }
+
+#undef EDGES
+}
+
+static int carl9170_set_power_cal(struct ar9170 *ar, u32 freq,
+                                  enum carl9170_bw bw)
+{
+        struct ar9170_calibration_target_power_legacy *ctpl;
+        struct ar9170_calibration_target_power_ht *ctph;
+        u8 *ctpres;
+        int ntargets;
+        int idx, i, n;
+        u8 ackpower, ackchains, f;
+        u8 pwr_freqs[AR5416_MAX_NUM_TGT_PWRS];
+
+        if (freq < 3000)
+                f = freq - 2300;
+        else
+                f = (freq - 4800)/5;
+
+        /*
+         * cycle through the various modes
+         *
+         * legacy modes first: 5G, 2G CCK, 2G OFDM
+         */
+        for (i = 0; i < 3; i++) {
+                switch (i) {
+                case 0: /* 5 GHz legacy */
+                        ctpl = &ar->eeprom.cal_tgt_pwr_5G[0];
+                        ntargets = AR5416_NUM_5G_TARGET_PWRS;
+                        ctpres = ar->power_5G_leg;
+                        break;
+                case 1: /* 2.4 GHz CCK */
+                        ctpl = &ar->eeprom.cal_tgt_pwr_2G_cck[0];
+                        ntargets = AR5416_NUM_2G_CCK_TARGET_PWRS;
+                        ctpres = ar->power_2G_cck;
+                        break;
+                case 2: /* 2.4 GHz OFDM */
+                        ctpl = &ar->eeprom.cal_tgt_pwr_2G_ofdm[0];
+                        ntargets = AR5416_NUM_2G_OFDM_TARGET_PWRS;
+                        ctpres = ar->power_2G_ofdm;
+                        break;
+                default:
+                        BUG();
+                }
+
+                for (n = 0; n < ntargets; n++) {
+                        if (ctpl[n].freq == 0xff)
+                                break;
+                        pwr_freqs[n] = ctpl[n].freq;
+                }
+                ntargets = n;
+                idx = carl9170_find_freq_idx(ntargets, pwr_freqs, f);
+                for (n = 0; n < 4; n++)
+                        ctpres[n] = carl9170_interpolate_u8(f,
+                                ctpl[idx + 0].freq, ctpl[idx + 0].power[n],
+                                ctpl[idx + 1].freq, ctpl[idx + 1].power[n]);
+        }
+
+        /* HT modes now: 5G HT20, 5G HT40, 2G CCK, 2G OFDM, 2G HT20, 2G HT40 */
+        for (i = 0; i < 4; i++) {
+                switch (i) {
+                case 0: /* 5 GHz HT 20 */
+                        ctph = &ar->eeprom.cal_tgt_pwr_5G_ht20[0];
+                        ntargets = AR5416_NUM_5G_TARGET_PWRS;
+                        ctpres = ar->power_5G_ht20;
+                        break;
+                case 1: /* 5 GHz HT 40 */
+                        ctph = &ar->eeprom.cal_tgt_pwr_5G_ht40[0];
+                        ntargets = AR5416_NUM_5G_TARGET_PWRS;
+                        ctpres = ar->power_5G_ht40;
+                        break;
+                case 2: /* 2.4 GHz HT 20 */
+                        ctph = &ar->eeprom.cal_tgt_pwr_2G_ht20[0];
+                        ntargets = AR5416_NUM_2G_OFDM_TARGET_PWRS;
+                        ctpres = ar->power_2G_ht20;
+                        break;
+                case 3: /* 2.4 GHz HT 40 */
+                        ctph = &ar->eeprom.cal_tgt_pwr_2G_ht40[0];
+                        ntargets = AR5416_NUM_2G_OFDM_TARGET_PWRS;
+                        ctpres = ar->power_2G_ht40;
+                        break;
+                default:
+                        BUG();
+                }
+
+                for (n = 0; n < ntargets; n++) {
+                        if (ctph[n].freq == 0xff)
+                                break;
+                        pwr_freqs[n] = ctph[n].freq;
+                }
+                ntargets = n;
+                idx = carl9170_find_freq_idx(ntargets, pwr_freqs, f);
+                for (n = 0; n < 8; n++)
+                        ctpres[n] = carl9170_interpolate_u8(f,
+                                ctph[idx + 0].freq, ctph[idx + 0].power[n],
+                                ctph[idx + 1].freq, ctph[idx + 1].power[n]);
+        }
+
+        /* calc. conformance test limits and apply to ar->power*[] */
+        carl9170_calc_ctl(ar, freq, bw);
+
+        /* set ACK/CTS TX power */
+        carl9170_regwrite_begin(ar);
+
+        if (ar->eeprom.tx_mask != 1)
+                ackchains = AR9170_TX_PHY_TXCHAIN_2;
+        else
+                ackchains = AR9170_TX_PHY_TXCHAIN_1;
+
+        if (freq < 3000)
+                ackpower = ar->power_2G_ofdm[0] & 0x3f;
+        else
+                ackpower = ar->power_5G_leg[0] & 0x3f;
+
+        carl9170_regwrite(AR9170_MAC_REG_ACK_TPC,
+                          0x3c1e | ackpower << 20 | ackchains << 26);
+        carl9170_regwrite(AR9170_MAC_REG_RTS_CTS_TPC,
+                          ackpower << 5 | ackchains << 11 |
+                          ackpower << 21 | ackchains << 27);
+
+        carl9170_regwrite(AR9170_MAC_REG_CFEND_QOSNULL_TPC,
+                          ackpower << 5 | ackchains << 11 |
+                          ackpower << 21 | ackchains << 27);
+
+        carl9170_regwrite_finish();
+        return carl9170_regwrite_result();
+}
+
+/* TODO: replace this with sign_extend32(noise, 8) */
+static int carl9170_calc_noise_dbm(u32 raw_noise)
+{
+        if (raw_noise & 0x100)
+                return ~0x1ff | raw_noise;
+        else
+                return raw_noise;
+}
+
+int carl9170_get_noisefloor(struct ar9170 *ar)
+{
+        static const u32 phy_regs[] = {
+                AR9170_PHY_REG_CCA, AR9170_PHY_REG_CH2_CCA,
+                AR9170_PHY_REG_EXT_CCA, AR9170_PHY_REG_CH2_EXT_CCA };
+        u32 phy_res[ARRAY_SIZE(phy_regs)];
+        int err, i;
+
+        BUILD_BUG_ON(ARRAY_SIZE(phy_regs) != ARRAY_SIZE(ar->noise));
+
+        err = carl9170_read_mreg(ar, ARRAY_SIZE(phy_regs), phy_regs, phy_res);
+        if (err)
+                return err;
+
+        for (i = 0; i < 2; i++) {
+                ar->noise[i] = carl9170_calc_noise_dbm(
+                        (phy_res[i] >> 19) & 0x1ff);
+
+                ar->noise[i + 2] = carl9170_calc_noise_dbm(
+                        (phy_res[i + 2] >> 23) & 0x1ff);
+        }
+
+        return 0;
+}
+
+static enum carl9170_bw nl80211_to_carl(enum nl80211_channel_type type)
+{
+        switch (type) {
+        case NL80211_CHAN_NO_HT:
+        case NL80211_CHAN_HT20:
+                return CARL9170_BW_20;
+        case NL80211_CHAN_HT40MINUS:
+                return CARL9170_BW_40_BELOW;
+        case NL80211_CHAN_HT40PLUS:
+                return CARL9170_BW_40_ABOVE;
+        default:
+                BUG();
+        }
+}
+
+int carl9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
+                         enum nl80211_channel_type _bw,
+                         enum carl9170_rf_init_mode rfi)
+{
+        const struct carl9170_phy_freq_params *freqpar;
+        struct carl9170_rf_init_result rf_res;
+        struct carl9170_rf_init rf;
+        u32 cmd, tmp, offs = 0, new_ht = 0;
+        int err;
+        enum carl9170_bw bw;
+        bool warm_reset;
+        struct ieee80211_channel *old_channel = NULL;
+
+        bw = nl80211_to_carl(_bw);
+
+        if (conf_is_ht(&ar->hw->conf))
+                new_ht |= CARL9170FW_PHY_HT_ENABLE;
+
+        if (conf_is_ht40(&ar->hw->conf))
+                new_ht |= CARL9170FW_PHY_HT_DYN2040;
+
+        /* may be NULL at first setup */
+        if (ar->channel) {
+                old_channel = ar->channel;
+                warm_reset = (old_channel->band != channel->band) ||
+                             (old_channel->center_freq ==
+                              channel->center_freq) ||
+                             (ar->ht_settings != new_ht);
+
+                ar->channel = NULL;
+        } else {
+                warm_reset = true;
+        }
+
+        /* HW workaround */
+        if (!ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] &&
+            channel->center_freq <= 2417)
+                warm_reset = true;
+
+        if (rfi != CARL9170_RFI_NONE || warm_reset) {
+                u32 val;
+
+                if (rfi == CARL9170_RFI_COLD)
+                        val = AR9170_PWR_RESET_BB_COLD_RESET;
+                else
+                        val = AR9170_PWR_RESET_BB_WARM_RESET;
+
+                /* warm/cold reset BB/ADDA */
+                err = carl9170_write_reg(ar, AR9170_PWR_REG_RESET, val);
+                if (err)
+                        return err;
+
+                err = carl9170_write_reg(ar, AR9170_PWR_REG_RESET, 0x0);
+                if (err)
+                        return err;
+
+                err = carl9170_init_phy(ar, channel->band);
+                if (err)
+                        return err;
+
+                err = carl9170_init_rf_banks_0_7(ar,
+                        channel->band == IEEE80211_BAND_5GHZ);
+                if (err)
+                        return err;
+
+                cmd = CARL9170_CMD_RF_INIT;
+
+                msleep(100);
+
+                err = carl9170_echo_test(ar, 0xaabbccdd);
+                if (err)
+                        return err;
+        } else {
+                cmd = CARL9170_CMD_FREQUENCY;
+        }
+
+        err = carl9170_exec_cmd(ar, CARL9170_CMD_FREQ_START, 0, NULL, 0, NULL);
+        if (err)
+                return err;
+
+        err = carl9170_write_reg(ar, AR9170_PHY_REG_HEAVY_CLIP_ENABLE,
+                                 0x200);
+
+        err = carl9170_init_rf_bank4_pwr(ar,
+                channel->band == IEEE80211_BAND_5GHZ,
+                channel->center_freq, bw);
+        if (err)
+                return err;
+
+        tmp = AR9170_PHY_TURBO_FC_SINGLE_HT_LTF1 |
+              AR9170_PHY_TURBO_FC_HT_EN;
+
+        switch (bw) {
+        case CARL9170_BW_20:
+                break;
+        case CARL9170_BW_40_BELOW:
+                tmp |= AR9170_PHY_TURBO_FC_DYN2040_EN |
+                       AR9170_PHY_TURBO_FC_SHORT_GI_40;
+                offs = 3;
+                break;
+        case CARL9170_BW_40_ABOVE:
+                tmp |= AR9170_PHY_TURBO_FC_DYN2040_EN |
+                       AR9170_PHY_TURBO_FC_SHORT_GI_40 |
+                       AR9170_PHY_TURBO_FC_DYN2040_PRI_CH;
+                offs = 1;
+                break;
+        default:
+                BUG();
+                return -ENOSYS;
+        }
+
+        if (ar->eeprom.tx_mask != 1)
+                tmp |= AR9170_PHY_TURBO_FC_WALSH;
+
+        err = carl9170_write_reg(ar, AR9170_PHY_REG_TURBO, tmp);
+        if (err)
+                return err;
+
+        err = carl9170_set_freq_cal_data(ar, channel);
+        if (err)
+                return err;
+
+        err = carl9170_set_power_cal(ar, channel->center_freq, bw);
+        if (err)
+                return err;
+
+        freqpar = carl9170_get_hw_dyn_params(channel, bw);
+
+        rf.ht_settings = new_ht;
+        if (conf_is_ht40(&ar->hw->conf))
+                SET_VAL(CARL9170FW_PHY_HT_EXT_CHAN_OFF, rf.ht_settings, offs);
+
+        rf.freq = cpu_to_le32(channel->center_freq * 1000);
+        rf.delta_slope_coeff_exp = cpu_to_le32(freqpar->coeff_exp);
+        rf.delta_slope_coeff_man = cpu_to_le32(freqpar->coeff_man);
+        rf.delta_slope_coeff_exp_shgi = cpu_to_le32(freqpar->coeff_exp_shgi);
+        rf.delta_slope_coeff_man_shgi = cpu_to_le32(freqpar->coeff_man_shgi);
+
+        if (rfi != CARL9170_RFI_NONE)
+                rf.finiteLoopCount = cpu_to_le32(2000);
+        else
+                rf.finiteLoopCount = cpu_to_le32(1000);
+
+        err = carl9170_exec_cmd(ar, cmd, sizeof(rf), &rf,
+                                sizeof(rf_res), &rf_res);
+        if (err)
+                return err;
+
+        err = le32_to_cpu(rf_res.ret);
+        if (err != 0) {
+                ar->chan_fail++;
+                ar->total_chan_fail++;
+
+                wiphy_err(ar->hw->wiphy, "channel change: %d -> %d "
+                          "failed (%d).\n", old_channel ?
+                          old_channel->center_freq : -1, channel->center_freq,
+                          err);
+
+                if ((rfi == CARL9170_RFI_COLD) || (ar->chan_fail > 3)) {
+                        /*
+                         * We have tried very hard to change to _another_
+                         * channel and we've failed to do so!
+                         * Chances are that the PHY/RF is no longer
+                         * operable (due to corruptions/fatal events/bugs?)
+                         * and we need to reset at a higher level.
+                         */
+                        carl9170_restart(ar, CARL9170_RR_TOO_MANY_PHY_ERRORS);
+                        return 0;
+                }
+
+                err = carl9170_set_channel(ar, channel, _bw,
+                                           CARL9170_RFI_COLD);
+                if (err)
+                        return err;
+        } else {
+                ar->chan_fail = 0;
+        }
+
+        err = carl9170_get_noisefloor(ar);
+        if (err)
+                return err;
+
+        if (ar->heavy_clip) {
+                err = carl9170_write_reg(ar, AR9170_PHY_REG_HEAVY_CLIP_ENABLE,
+                                         0x200 | ar->heavy_clip);
+                if (err) {
+                        if (net_ratelimit()) {
+                                wiphy_err(ar->hw->wiphy, "failed to set "
+                                       "heavy clip\n");
+                        }
+
+                        return err;
+                }
+        }
+
+        /* FIXME: PSM does not work in 5GHz Band */
+        if (channel->band == IEEE80211_BAND_5GHZ)
+                ar->ps.off_override |= PS_OFF_5GHZ;
+        else
+                ar->ps.off_override &= ~PS_OFF_5GHZ;
+
+        ar->channel = channel;
+        ar->ht_settings = new_ht;
+        return 0;
+}
diff --git a/drivers/net/wireless/ath/carl9170/phy.h b/drivers/net/wireless/ath/carl9170/phy.h
new file mode 100644
index 000000000000..02c34eb4ebde
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/phy.h
@@ -0,0 +1,564 @@
+/*
+ * Shared Atheros AR9170 Header
+ *
+ * PHY register map
+ *
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __CARL9170_SHARED_PHY_H
+#define __CARL9170_SHARED_PHY_H
+
+#define AR9170_PHY_REG_BASE                     (0x1bc000 + 0x9800)
+#define AR9170_PHY_REG(_n)                      (AR9170_PHY_REG_BASE + \
+                                                 ((_n) << 2))
+
+#define AR9170_PHY_REG_TEST                     (AR9170_PHY_REG_BASE + 0x0000)
+#define         AR9170_PHY_TEST_AGC_CLR                 0x10000000
+#define         AR9170_PHY_TEST_RFSILENT_BB             0x00002000
+
+#define AR9170_PHY_REG_TURBO                    (AR9170_PHY_REG_BASE + 0x0004)
+#define         AR9170_PHY_TURBO_FC_TURBO_MODE          0x00000001
+#define         AR9170_PHY_TURBO_FC_TURBO_SHORT         0x00000002
+#define         AR9170_PHY_TURBO_FC_DYN2040_EN          0x00000004
+#define         AR9170_PHY_TURBO_FC_DYN2040_PRI_ONLY    0x00000008
+#define         AR9170_PHY_TURBO_FC_DYN2040_PRI_CH      0x00000010
+/* For 25 MHz channel spacing -- not used but supported by hw */
+#define         AR9170_PHY_TURBO_FC_DYN2040_EXT_CH      0x00000020
+#define         AR9170_PHY_TURBO_FC_HT_EN               0x00000040
+#define         AR9170_PHY_TURBO_FC_SHORT_GI_40         0x00000080
+#define         AR9170_PHY_TURBO_FC_WALSH               0x00000100
+#define         AR9170_PHY_TURBO_FC_SINGLE_HT_LTF1      0x00000200
+#define         AR9170_PHY_TURBO_FC_ENABLE_DAC_FIFO     0x00000800
+
+#define AR9170_PHY_REG_TEST2                    (AR9170_PHY_REG_BASE + 0x0008)
+
+#define AR9170_PHY_REG_TIMING2                  (AR9170_PHY_REG_BASE + 0x0010)
+#define         AR9170_PHY_TIMING2_USE_FORCE            0x00001000
+#define         AR9170_PHY_TIMING2_FORCE                0x00000fff
+#define         AR9170_PHY_TIMING2_FORCE_S                       0
+
+#define AR9170_PHY_REG_TIMING3                  (AR9170_PHY_REG_BASE + 0x0014)
+#define         AR9170_PHY_TIMING3_DSC_EXP              0x0001e000
+#define         AR9170_PHY_TIMING3_DSC_EXP_S            13
+#define         AR9170_PHY_TIMING3_DSC_MAN              0xfffe0000
+#define         AR9170_PHY_TIMING3_DSC_MAN_S            17
+
+#define AR9170_PHY_REG_CHIP_ID                  (AR9170_PHY_REG_BASE + 0x0018)
+#define         AR9170_PHY_CHIP_ID_REV_0                0x80
+#define         AR9170_PHY_CHIP_ID_REV_1                0x81
+#define         AR9170_PHY_CHIP_ID_9160_REV_0           0xb0
+
+#define AR9170_PHY_REG_ACTIVE                   (AR9170_PHY_REG_BASE + 0x001c)
+#define         AR9170_PHY_ACTIVE_EN                    0x00000001
+#define         AR9170_PHY_ACTIVE_DIS                   0x00000000
+
+#define AR9170_PHY_REG_RF_CTL2                  (AR9170_PHY_REG_BASE + 0x0024)
+#define         AR9170_PHY_RF_CTL2_TX_END_DATA_START    0x000000ff
+#define         AR9170_PHY_RF_CTL2_TX_END_DATA_START_S  0
+#define         AR9170_PHY_RF_CTL2_TX_END_PA_ON         0x0000ff00
+#define         AR9170_PHY_RF_CTL2_TX_END_PA_ON_S       8
+
+#define AR9170_PHY_REG_RF_CTL3                  (AR9170_PHY_REG_BASE + 0x0028)
+#define         AR9170_PHY_RF_CTL3_TX_END_TO_A2_RX_ON   0x00ff0000
+#define         AR9170_PHY_RF_CTL3_TX_END_TO_A2_RX_ON_S 16
+
+#define AR9170_PHY_REG_ADC_CTL                  (AR9170_PHY_REG_BASE + 0x002c)
+#define         AR9170_PHY_ADC_CTL_OFF_INBUFGAIN        0x00000003
+#define         AR9170_PHY_ADC_CTL_OFF_INBUFGAIN_S      0
+#define         AR9170_PHY_ADC_CTL_OFF_PWDDAC           0x00002000
+#define         AR9170_PHY_ADC_CTL_OFF_PWDBANDGAP       0x00004000
+#define         AR9170_PHY_ADC_CTL_OFF_PWDADC           0x00008000
+#define         AR9170_PHY_ADC_CTL_ON_INBUFGAIN         0x00030000
+#define         AR9170_PHY_ADC_CTL_ON_INBUFGAIN_S       16
+
+#define AR9170_PHY_REG_ADC_SERIAL_CTL           (AR9170_PHY_REG_BASE + 0x0030)
+#define         AR9170_PHY_ADC_SCTL_SEL_INTERNAL_ADDAC  0x00000000
+#define         AR9170_PHY_ADC_SCTL_SEL_EXTERNAL_RADIO  0x00000001
+
+#define AR9170_PHY_REG_RF_CTL4                  (AR9170_PHY_REG_BASE + 0x0034)
+#define         AR9170_PHY_RF_CTL4_TX_END_XPAB_OFF      0xff000000
+#define         AR9170_PHY_RF_CTL4_TX_END_XPAB_OFF_S    24
+#define         AR9170_PHY_RF_CTL4_TX_END_XPAA_OFF      0x00ff0000
+#define         AR9170_PHY_RF_CTL4_TX_END_XPAA_OFF_S    16
+#define         AR9170_PHY_RF_CTL4_FRAME_XPAB_ON        0x0000ff00
+#define         AR9170_PHY_RF_CTL4_FRAME_XPAB_ON_S      8
+#define         AR9170_PHY_RF_CTL4_FRAME_XPAA_ON        0x000000ff
+#define         AR9170_PHY_RF_CTL4_FRAME_XPAA_ON_S      0
+
+#define AR9170_PHY_REG_TSTDAC_CONST             (AR9170_PHY_REG_BASE + 0x003c)
+
+#define AR9170_PHY_REG_SETTLING                 (AR9170_PHY_REG_BASE + 0x0044)
+#define         AR9170_PHY_SETTLING_SWITCH              0x00003f80
+#define         AR9170_PHY_SETTLING_SWITCH_S            7
+
+#define AR9170_PHY_REG_RXGAIN                   (AR9170_PHY_REG_BASE + 0x0048)
+#define AR9170_PHY_REG_RXGAIN_CHAIN_2           (AR9170_PHY_REG_BASE + 0x2048)
+#define         AR9170_PHY_RXGAIN_TXRX_ATTEN            0x0003f000
+#define         AR9170_PHY_RXGAIN_TXRX_ATTEN_S          12
+#define         AR9170_PHY_RXGAIN_TXRX_RF_MAX           0x007c0000
+#define         AR9170_PHY_RXGAIN_TXRX_RF_MAX_S         18
+
+#define AR9170_PHY_REG_DESIRED_SZ               (AR9170_PHY_REG_BASE + 0x0050)
+#define         AR9170_PHY_DESIRED_SZ_ADC               0x000000ff
+#define         AR9170_PHY_DESIRED_SZ_ADC_S             0
+#define         AR9170_PHY_DESIRED_SZ_PGA               0x0000ff00
+#define         AR9170_PHY_DESIRED_SZ_PGA_S             8
+#define         AR9170_PHY_DESIRED_SZ_TOT_DES           0x0ff00000
+#define         AR9170_PHY_DESIRED_SZ_TOT_DES_S         20
+
+#define AR9170_PHY_REG_FIND_SIG                 (AR9170_PHY_REG_BASE + 0x0058)
+#define         AR9170_PHY_FIND_SIG_FIRSTEP             0x0003f000
+#define         AR9170_PHY_FIND_SIG_FIRSTEP_S           12
+#define         AR9170_PHY_FIND_SIG_FIRPWR              0x03fc0000
+#define         AR9170_PHY_FIND_SIG_FIRPWR_S            18
+
+#define AR9170_PHY_REG_AGC_CTL1                 (AR9170_PHY_REG_BASE + 0x005c)
+#define         AR9170_PHY_AGC_CTL1_COARSE_LOW          0x00007f80
+#define         AR9170_PHY_AGC_CTL1_COARSE_LOW_S        7
+#define         AR9170_PHY_AGC_CTL1_COARSE_HIGH         0x003f8000
+#define         AR9170_PHY_AGC_CTL1_COARSE_HIGH_S       15
+
+#define AR9170_PHY_REG_AGC_CONTROL              (AR9170_PHY_REG_BASE + 0x0060)
+#define         AR9170_PHY_AGC_CONTROL_CAL              0x00000001
+#define         AR9170_PHY_AGC_CONTROL_NF               0x00000002
+#define         AR9170_PHY_AGC_CONTROL_ENABLE_NF        0x00008000
+#define         AR9170_PHY_AGC_CONTROL_FLTR_CAL         0x00010000
+#define         AR9170_PHY_AGC_CONTROL_NO_UPDATE_NF     0x00020000
+
+#define AR9170_PHY_REG_CCA                      (AR9170_PHY_REG_BASE + 0x0064)
+#define         AR9170_PHY_CCA_MINCCA_PWR               0x0ff80000
+#define         AR9170_PHY_CCA_MINCCA_PWR_S             19
+#define         AR9170_PHY_CCA_THRESH62                 0x0007f000
+#define         AR9170_PHY_CCA_THRESH62_S               12
+
+#define AR9170_PHY_REG_SFCORR                   (AR9170_PHY_REG_BASE + 0x0068)
+#define         AR9170_PHY_SFCORR_M2COUNT_THR           0x0000001f
+#define         AR9170_PHY_SFCORR_M2COUNT_THR_S         0
+#define         AR9170_PHY_SFCORR_M1_THRESH             0x00fe0000
+#define         AR9170_PHY_SFCORR_M1_THRESH_S           17
+#define         AR9170_PHY_SFCORR_M2_THRESH             0x7f000000
+#define         AR9170_PHY_SFCORR_M2_THRESH_S           24
+
+#define AR9170_PHY_REG_SFCORR_LOW               (AR9170_PHY_REG_BASE + 0x006c)
+#define         AR9170_PHY_SFCORR_LOW_USE_SELF_CORR_LOW 0x00000001
+#define         AR9170_PHY_SFCORR_LOW_M2COUNT_THR_LOW   0x00003f00
+#define         AR9170_PHY_SFCORR_LOW_M2COUNT_THR_LOW_S 8
+#define         AR9170_PHY_SFCORR_LOW_M1_THRESH_LOW     0x001fc000
+#define         AR9170_PHY_SFCORR_LOW_M1_THRESH_LOW_S   14
+#define         AR9170_PHY_SFCORR_LOW_M2_THRESH_LOW     0x0fe00000
+#define         AR9170_PHY_SFCORR_LOW_M2_THRESH_LOW_S   21
+
+#define AR9170_PHY_REG_SLEEP_CTR_CONTROL        (AR9170_PHY_REG_BASE + 0x0070)
+#define AR9170_PHY_REG_SLEEP_CTR_LIMIT          (AR9170_PHY_REG_BASE + 0x0074)
+#define AR9170_PHY_REG_SLEEP_SCAL               (AR9170_PHY_REG_BASE + 0x0078)
+
+#define AR9170_PHY_REG_PLL_CTL                  (AR9170_PHY_REG_BASE + 0x007c)
+#define         AR9170_PHY_PLL_CTL_40                   0xaa
+#define         AR9170_PHY_PLL_CTL_40_5413              0x04
+#define         AR9170_PHY_PLL_CTL_44                   0xab
+#define         AR9170_PHY_PLL_CTL_44_2133              0xeb
+#define         AR9170_PHY_PLL_CTL_40_2133              0xea
+
+#define AR9170_PHY_REG_BIN_MASK_1               (AR9170_PHY_REG_BASE + 0x0100)
+#define AR9170_PHY_REG_BIN_MASK_2               (AR9170_PHY_REG_BASE + 0x0104)
+#define AR9170_PHY_REG_BIN_MASK_3               (AR9170_PHY_REG_BASE + 0x0108)
+#define AR9170_PHY_REG_MASK_CTL                 (AR9170_PHY_REG_BASE + 0x010c)
+
+/* analogue power on time (100ns) */
+#define AR9170_PHY_REG_RX_DELAY                 (AR9170_PHY_REG_BASE + 0x0114)
+#define AR9170_PHY_REG_SEARCH_START_DELAY       (AR9170_PHY_REG_BASE + 0x0118)
+#define         AR9170_PHY_RX_DELAY_DELAY               0x00003fff
+
+#define AR9170_PHY_REG_TIMING_CTRL4(_i)         (AR9170_PHY_REG_BASE + \
+                                                (0x0120 + ((_i) << 12)))
+#define         AR9170_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF         0x01f
+#define         AR9170_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF_S       0
+#define         AR9170_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF         0x7e0
+#define         AR9170_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF_S       5
+#define         AR9170_PHY_TIMING_CTRL4_IQCORR_ENABLE           0x800
+#define         AR9170_PHY_TIMING_CTRL4_IQCAL_LOG_COUNT_MAX     0xf000
+#define         AR9170_PHY_TIMING_CTRL4_IQCAL_LOG_COUNT_MAX_S   12
+#define         AR9170_PHY_TIMING_CTRL4_DO_IQCAL                0x10000
+#define         AR9170_PHY_TIMING_CTRL4_ENABLE_SPUR_RSSI        0x80000000
+#define         AR9170_PHY_TIMING_CTRL4_ENABLE_SPUR_FILTER      0x40000000
+#define         AR9170_PHY_TIMING_CTRL4_ENABLE_CHAN_MASK        0x20000000
+#define         AR9170_PHY_TIMING_CTRL4_ENABLE_PILOT_MASK       0x10000000
+
+#define AR9170_PHY_REG_TIMING5                  (AR9170_PHY_REG_BASE + 0x0124)
+#define         AR9170_PHY_TIMING5_CYCPWR_THR1          0x000000fe
+#define         AR9170_PHY_TIMING5_CYCPWR_THR1_S        1
+
+#define AR9170_PHY_REG_POWER_TX_RATE1           (AR9170_PHY_REG_BASE + 0x0134)
+#define AR9170_PHY_REG_POWER_TX_RATE2           (AR9170_PHY_REG_BASE + 0x0138)
+#define AR9170_PHY_REG_POWER_TX_RATE_MAX        (AR9170_PHY_REG_BASE + 0x013c)
+#define         AR9170_PHY_POWER_TX_RATE_MAX_TPC_ENABLE 0x00000040
+
+#define AR9170_PHY_REG_FRAME_CTL                (AR9170_PHY_REG_BASE + 0x0144)
+#define         AR9170_PHY_FRAME_CTL_TX_CLIP            0x00000038
+#define         AR9170_PHY_FRAME_CTL_TX_CLIP_S          3
+
+#define AR9170_PHY_REG_SPUR_REG                 (AR9170_PHY_REG_BASE + 0x014c)
+#define         AR9170_PHY_SPUR_REG_MASK_RATE_CNTL      (0xff << 18)
+#define         AR9170_PHY_SPUR_REG_MASK_RATE_CNTL_S    18
+#define         AR9170_PHY_SPUR_REG_ENABLE_MASK_PPM     0x20000
+#define         AR9170_PHY_SPUR_REG_MASK_RATE_SELECT    (0xff << 9)
+#define         AR9170_PHY_SPUR_REG_MASK_RATE_SELECT_S  9
+#define         AR9170_PHY_SPUR_REG_ENABLE_VIT_SPUR_RSSI        0x100
+#define         AR9170_PHY_SPUR_REG_SPUR_RSSI_THRESH    0x7f
+#define         AR9170_PHY_SPUR_REG_SPUR_RSSI_THRESH_S  0
+
+#define AR9170_PHY_REG_RADAR_EXT                (AR9170_PHY_REG_BASE + 0x0140)
+#define         AR9170_PHY_RADAR_EXT_ENA                0x00004000
+
+#define AR9170_PHY_REG_RADAR_0                  (AR9170_PHY_REG_BASE + 0x0154)
+#define         AR9170_PHY_RADAR_0_ENA                  0x00000001
+#define         AR9170_PHY_RADAR_0_FFT_ENA              0x80000000
+/* inband pulse threshold */
+#define         AR9170_PHY_RADAR_0_INBAND               0x0000003e
+#define         AR9170_PHY_RADAR_0_INBAND_S             1
+/* pulse RSSI threshold */
+#define         AR9170_PHY_RADAR_0_PRSSI                0x00000fc0
+#define         AR9170_PHY_RADAR_0_PRSSI_S              6
+/* pulse height threshold */
+#define         AR9170_PHY_RADAR_0_HEIGHT               0x0003f000
+#define         AR9170_PHY_RADAR_0_HEIGHT_S             12
+/* radar RSSI threshold */
+#define         AR9170_PHY_RADAR_0_RRSSI                0x00fc0000
+#define         AR9170_PHY_RADAR_0_RRSSI_S              18
+/* radar firepower threshold */
+#define         AR9170_PHY_RADAR_0_FIRPWR               0x7f000000
+#define         AR9170_PHY_RADAR_0_FIRPWR_S             24
+
+#define AR9170_PHY_REG_RADAR_1                  (AR9170_PHY_REG_BASE + 0x0158)
+#define         AR9170_PHY_RADAR_1_RELPWR_ENA           0x00800000
+#define         AR9170_PHY_RADAR_1_USE_FIR128           0x00400000
+#define         AR9170_PHY_RADAR_1_RELPWR_THRESH        0x003f0000
+#define         AR9170_PHY_RADAR_1_RELPWR_THRESH_S      16
+#define         AR9170_PHY_RADAR_1_BLOCK_CHECK          0x00008000
+#define         AR9170_PHY_RADAR_1_MAX_RRSSI            0x00004000
+#define         AR9170_PHY_RADAR_1_RELSTEP_CHECK        0x00002000
+#define         AR9170_PHY_RADAR_1_RELSTEP_THRESH       0x00001f00
+#define         AR9170_PHY_RADAR_1_RELSTEP_THRESH_S     8
+#define         AR9170_PHY_RADAR_1_MAXLEN               0x000000ff
+#define         AR9170_PHY_RADAR_1_MAXLEN_S             0
+
+#define AR9170_PHY_REG_SWITCH_CHAIN_0           (AR9170_PHY_REG_BASE + 0x0160)
+#define AR9170_PHY_REG_SWITCH_CHAIN_2           (AR9170_PHY_REG_BASE + 0x2160)
+
+#define AR9170_PHY_REG_SWITCH_COM               (AR9170_PHY_REG_BASE + 0x0164)
+
+#define AR9170_PHY_REG_CCA_THRESHOLD            (AR9170_PHY_REG_BASE + 0x0168)
+
+#define AR9170_PHY_REG_SIGMA_DELTA              (AR9170_PHY_REG_BASE + 0x016c)
+#define         AR9170_PHY_SIGMA_DELTA_ADC_SEL          0x00000003
+#define         AR9170_PHY_SIGMA_DELTA_ADC_SEL_S        0
+#define         AR9170_PHY_SIGMA_DELTA_FILT2            0x000000f8
+#define         AR9170_PHY_SIGMA_DELTA_FILT2_S          3
+#define         AR9170_PHY_SIGMA_DELTA_FILT1            0x00001f00
+#define         AR9170_PHY_SIGMA_DELTA_FILT1_S          8
+#define         AR9170_PHY_SIGMA_DELTA_ADC_CLIP         0x01ffe000
+#define         AR9170_PHY_SIGMA_DELTA_ADC_CLIP_S       13
+
+#define AR9170_PHY_REG_RESTART                  (AR9170_PHY_REG_BASE + 0x0170)
+#define         AR9170_PHY_RESTART_DIV_GC               0x001c0000
+#define         AR9170_PHY_RESTART_DIV_GC_S             18
+
+#define AR9170_PHY_REG_RFBUS_REQ                (AR9170_PHY_REG_BASE + 0x017c)
+#define         AR9170_PHY_RFBUS_REQ_EN                 0x00000001
+
+#define AR9170_PHY_REG_TIMING7                  (AR9170_PHY_REG_BASE + 0x0180)
+#define AR9170_PHY_REG_TIMING8                  (AR9170_PHY_REG_BASE + 0x0184)
+#define         AR9170_PHY_TIMING8_PILOT_MASK_2         0x000fffff
+#define         AR9170_PHY_TIMING8_PILOT_MASK_2_S       0
+
+#define AR9170_PHY_REG_BIN_MASK2_1              (AR9170_PHY_REG_BASE + 0x0188)
+#define AR9170_PHY_REG_BIN_MASK2_2              (AR9170_PHY_REG_BASE + 0x018c)
+#define AR9170_PHY_REG_BIN_MASK2_3              (AR9170_PHY_REG_BASE + 0x0190)
+#define AR9170_PHY_REG_BIN_MASK2_4              (AR9170_PHY_REG_BASE + 0x0194)
+#define         AR9170_PHY_BIN_MASK2_4_MASK_4           0x00003fff
+#define         AR9170_PHY_BIN_MASK2_4_MASK_4_S         0
+
+#define AR9170_PHY_REG_TIMING9                  (AR9170_PHY_REG_BASE + 0x0198)
+#define AR9170_PHY_REG_TIMING10                 (AR9170_PHY_REG_BASE + 0x019c)
+#define         AR9170_PHY_TIMING10_PILOT_MASK_2        0x000fffff
+#define         AR9170_PHY_TIMING10_PILOT_MASK_2_S      0
+
+#define AR9170_PHY_REG_TIMING11                 (AR9170_PHY_REG_BASE + 0x01a0)
+#define         AR9170_PHY_TIMING11_SPUR_DELTA_PHASE    0x000fffff
+#define         AR9170_PHY_TIMING11_SPUR_DELTA_PHASE_S  0
+#define         AR9170_PHY_TIMING11_SPUR_FREQ_SD        0x3ff00000
+#define         AR9170_PHY_TIMING11_SPUR_FREQ_SD_S      20
+#define         AR9170_PHY_TIMING11_USE_SPUR_IN_AGC     0x40000000
+#define         AR9170_PHY_TIMING11_USE_SPUR_IN_SELFCOR 0x80000000
+
+#define AR9170_PHY_REG_RX_CHAINMASK             (AR9170_PHY_REG_BASE + 0x01a4)
+#define AR9170_PHY_REG_NEW_ADC_DC_GAIN_CORR(_i) (AR9170_PHY_REG_BASE + \
+                                                 0x01b4 + ((_i) << 12))
+#define         AR9170_PHY_NEW_ADC_GAIN_CORR_ENABLE             0x40000000
+#define         AR9170_PHY_NEW_ADC_DC_OFFSET_CORR_ENABLE        0x80000000
+
+#define AR9170_PHY_REG_MULTICHAIN_GAIN_CTL      (AR9170_PHY_REG_BASE + 0x01ac)
+#define         AR9170_PHY_9285_ANT_DIV_CTL_ALL         0x7f000000
+#define         AR9170_PHY_9285_ANT_DIV_CTL             0x01000000
+#define         AR9170_PHY_9285_ANT_DIV_CTL_S           24
+#define         AR9170_PHY_9285_ANT_DIV_ALT_LNACONF     0x06000000
+#define         AR9170_PHY_9285_ANT_DIV_ALT_LNACONF_S   25
+#define         AR9170_PHY_9285_ANT_DIV_MAIN_LNACONF    0x18000000
+#define         AR9170_PHY_9285_ANT_DIV_MAIN_LNACONF_S  27
+#define         AR9170_PHY_9285_ANT_DIV_ALT_GAINTB      0x20000000
+#define         AR9170_PHY_9285_ANT_DIV_ALT_GAINTB_S    29
+#define         AR9170_PHY_9285_ANT_DIV_MAIN_GAINTB     0x40000000
+#define         AR9170_PHY_9285_ANT_DIV_MAIN_GAINTB_S   30
+#define         AR9170_PHY_9285_ANT_DIV_LNA1            2
+#define         AR9170_PHY_9285_ANT_DIV_LNA2            1
+#define         AR9170_PHY_9285_ANT_DIV_LNA1_PLUS_LNA2  3
+#define         AR9170_PHY_9285_ANT_DIV_LNA1_MINUS_LNA2 0
+#define         AR9170_PHY_9285_ANT_DIV_GAINTB_0        0
+#define         AR9170_PHY_9285_ANT_DIV_GAINTB_1        1
+
+#define AR9170_PHY_REG_EXT_CCA0                 (AR9170_PHY_REG_BASE + 0x01b8)
+#define         AR9170_PHY_REG_EXT_CCA0_THRESH62        0x000000ff
+#define         AR9170_PHY_REG_EXT_CCA0_THRESH62_S      0
+
+#define AR9170_PHY_REG_EXT_CCA                  (AR9170_PHY_REG_BASE + 0x01bc)
+#define         AR9170_PHY_EXT_CCA_CYCPWR_THR1          0x0000fe00
+#define         AR9170_PHY_EXT_CCA_CYCPWR_THR1_S        9
+#define         AR9170_PHY_EXT_CCA_THRESH62             0x007f0000
+#define         AR9170_PHY_EXT_CCA_THRESH62_S           16
+#define         AR9170_PHY_EXT_MINCCA_PWR               0xff800000
+#define         AR9170_PHY_EXT_MINCCA_PWR_S             23
+
+#define AR9170_PHY_REG_SFCORR_EXT               (AR9170_PHY_REG_BASE + 0x01c0)
+#define         AR9170_PHY_SFCORR_EXT_M1_THRESH         0x0000007f
+#define         AR9170_PHY_SFCORR_EXT_M1_THRESH_S       0
+#define         AR9170_PHY_SFCORR_EXT_M2_THRESH         0x00003f80
+#define         AR9170_PHY_SFCORR_EXT_M2_THRESH_S       7
+#define         AR9170_PHY_SFCORR_EXT_M1_THRESH_LOW     0x001fc000
+#define         AR9170_PHY_SFCORR_EXT_M1_THRESH_LOW_S   14
+#define         AR9170_PHY_SFCORR_EXT_M2_THRESH_LOW     0x0fe00000
+#define         AR9170_PHY_SFCORR_EXT_M2_THRESH_LOW_S   21
+#define         AR9170_PHY_SFCORR_SPUR_SUBCHNL_SD_S     28
+
+#define AR9170_PHY_REG_HALFGI                   (AR9170_PHY_REG_BASE + 0x01d0)
+#define         AR9170_PHY_HALFGI_DSC_MAN               0x0007fff0
+#define         AR9170_PHY_HALFGI_DSC_MAN_S             4
+#define         AR9170_PHY_HALFGI_DSC_EXP               0x0000000f
+#define         AR9170_PHY_HALFGI_DSC_EXP_S             0
+
+#define AR9170_PHY_REG_CHANNEL_MASK_01_30       (AR9170_PHY_REG_BASE + 0x01d4)
+#define AR9170_PHY_REG_CHANNEL_MASK_31_60       (AR9170_PHY_REG_BASE + 0x01d8)
+
+#define AR9170_PHY_REG_CHAN_INFO_MEMORY         (AR9170_PHY_REG_BASE + 0x01dc)
+#define         AR9170_PHY_CHAN_INFO_MEMORY_CAPTURE_MASK        0x0001
+
+#define AR9170_PHY_REG_HEAVY_CLIP_ENABLE        (AR9170_PHY_REG_BASE + 0x01e0)
+#define AR9170_PHY_REG_HEAVY_CLIP_FACTOR_RIFS   (AR9170_PHY_REG_BASE + 0x01ec)
+#define         AR9170_PHY_RIFS_INIT_DELAY              0x03ff0000
+
+#define AR9170_PHY_REG_CALMODE                  (AR9170_PHY_REG_BASE + 0x01f0)
+#define         AR9170_PHY_CALMODE_IQ                   0x00000000
+#define         AR9170_PHY_CALMODE_ADC_GAIN             0x00000001
+#define         AR9170_PHY_CALMODE_ADC_DC_PER           0x00000002
+#define         AR9170_PHY_CALMODE_ADC_DC_INIT          0x00000003
+
+#define AR9170_PHY_REG_REFCLKDLY                (AR9170_PHY_REG_BASE + 0x01f4)
+#define AR9170_PHY_REG_REFCLKPD                 (AR9170_PHY_REG_BASE + 0x01f8)
+
+
+#define AR9170_PHY_REG_CAL_MEAS_0(_i)           (AR9170_PHY_REG_BASE + \
+                                                 0x0410 + ((_i) << 12))
+#define AR9170_PHY_REG_CAL_MEAS_1(_i)           (AR9170_PHY_REG_BASE + \
+                                                 0x0414 \ + ((_i) << 12))
+#define AR9170_PHY_REG_CAL_MEAS_2(_i)           (AR9170_PHY_REG_BASE + \
+                                                 0x0418 + ((_i) << 12))
+#define AR9170_PHY_REG_CAL_MEAS_3(_i)           (AR9170_PHY_REG_BASE + \
+                                                 0x041c + ((_i) << 12))
+
+#define AR9170_PHY_REG_CURRENT_RSSI             (AR9170_PHY_REG_BASE + 0x041c)
+
+#define AR9170_PHY_REG_RFBUS_GRANT              (AR9170_PHY_REG_BASE + 0x0420)
+#define         AR9170_PHY_RFBUS_GRANT_EN               0x00000001
+
+#define AR9170_PHY_REG_CHAN_INFO_GAIN_DIFF      (AR9170_PHY_REG_BASE + 0x04f4)
+#define         AR9170_PHY_CHAN_INFO_GAIN_DIFF_UPPER_LIMIT      320
+
+#define AR9170_PHY_REG_CHAN_INFO_GAIN           (AR9170_PHY_REG_BASE + 0x04fc)
+
+#define AR9170_PHY_REG_MODE                     (AR9170_PHY_REG_BASE + 0x0a00)
+#define         AR9170_PHY_MODE_ASYNCFIFO               0x80
+#define         AR9170_PHY_MODE_AR2133                  0x08
+#define         AR9170_PHY_MODE_AR5111                  0x00
+#define         AR9170_PHY_MODE_AR5112                  0x08
+#define         AR9170_PHY_MODE_DYNAMIC                 0x04
+#define         AR9170_PHY_MODE_RF2GHZ                  0x02
+#define         AR9170_PHY_MODE_RF5GHZ                  0x00
+#define         AR9170_PHY_MODE_CCK                     0x01
+#define         AR9170_PHY_MODE_OFDM                    0x00
+#define         AR9170_PHY_MODE_DYN_CCK_DISABLE         0x100
+
+#define AR9170_PHY_REG_CCK_TX_CTRL              (AR9170_PHY_REG_BASE + 0x0a04)
+#define         AR9170_PHY_CCK_TX_CTRL_JAPAN                    0x00000010
+#define         AR9170_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK         0x0000000c
+#define         AR9170_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK_S       2
+
+#define AR9170_PHY_REG_CCK_DETECT               (AR9170_PHY_REG_BASE + 0x0a08)
+#define         AR9170_PHY_CCK_DETECT_WEAK_SIG_THR_CCK          0x0000003f
+#define         AR9170_PHY_CCK_DETECT_WEAK_SIG_THR_CCK_S        0
+/* [12:6] settling time for antenna switch */
+#define         AR9170_PHY_CCK_DETECT_ANT_SWITCH_TIME           0x00001fc0
+#define         AR9170_PHY_CCK_DETECT_ANT_SWITCH_TIME_S         6
+#define         AR9170_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV    0x2000
+#define         AR9170_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV_S  13
+
+#define AR9170_PHY_REG_GAIN_2GHZ                (AR9170_PHY_REG_BASE + 0x0a0c)
+#define AR9170_PHY_REG_GAIN_2GHZ_CHAIN_2        (AR9170_PHY_REG_BASE + 0x2a0c)
+#define         AR9170_PHY_GAIN_2GHZ_RXTX_MARGIN        0x00fc0000
+#define         AR9170_PHY_GAIN_2GHZ_RXTX_MARGIN_S      18
+#define         AR9170_PHY_GAIN_2GHZ_BSW_MARGIN         0x00003c00
+#define         AR9170_PHY_GAIN_2GHZ_BSW_MARGIN_S       10
+#define         AR9170_PHY_GAIN_2GHZ_BSW_ATTEN          0x0000001f
+#define         AR9170_PHY_GAIN_2GHZ_BSW_ATTEN_S        0
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN2_MARGIN     0x003e0000
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN2_MARGIN_S   17
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN1_MARGIN     0x0001f000
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN1_MARGIN_S   12
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN2_DB         0x00000fc0
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN2_DB_S       6
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN1_DB         0x0000003f
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN1_DB_S       0
+
+#define AR9170_PHY_REG_CCK_RXCTRL4              (AR9170_PHY_REG_BASE + 0x0a1c)
+#define         AR9170_PHY_CCK_RXCTRL4_FREQ_EST_SHORT   0x01f80000
+#define         AR9170_PHY_CCK_RXCTRL4_FREQ_EST_SHORT_S 19
+
+#define AR9170_PHY_REG_DAG_CTRLCCK              (AR9170_PHY_REG_BASE + 0x0a28)
+#define         AR9170_REG_DAG_CTRLCCK_EN_RSSI_THR      0x00000200
+#define         AR9170_REG_DAG_CTRLCCK_RSSI_THR         0x0001fc00
+#define         AR9170_REG_DAG_CTRLCCK_RSSI_THR_S       10
+
+#define AR9170_PHY_REG_FORCE_CLKEN_CCK          (AR9170_PHY_REG_BASE + 0x0a2c)
+#define         AR9170_FORCE_CLKEN_CCK_MRC_MUX          0x00000040
+
+#define AR9170_PHY_REG_POWER_TX_RATE3           (AR9170_PHY_REG_BASE + 0x0a34)
+#define AR9170_PHY_REG_POWER_TX_RATE4           (AR9170_PHY_REG_BASE + 0x0a38)
+
+#define AR9170_PHY_REG_SCRM_SEQ_XR              (AR9170_PHY_REG_BASE + 0x0a3c)
+#define AR9170_PHY_REG_HEADER_DETECT_XR         (AR9170_PHY_REG_BASE + 0x0a40)
+#define AR9170_PHY_REG_CHIRP_DETECTED_XR        (AR9170_PHY_REG_BASE + 0x0a44)
+#define AR9170_PHY_REG_BLUETOOTH                (AR9170_PHY_REG_BASE + 0x0a54)
+
+#define AR9170_PHY_REG_TPCRG1                   (AR9170_PHY_REG_BASE + 0x0a58)
+#define         AR9170_PHY_TPCRG1_NUM_PD_GAIN           0x0000c000
+#define         AR9170_PHY_TPCRG1_NUM_PD_GAIN_S         14
+#define         AR9170_PHY_TPCRG1_PD_GAIN_1             0x00030000
+#define         AR9170_PHY_TPCRG1_PD_GAIN_1_S           16
+#define         AR9170_PHY_TPCRG1_PD_GAIN_2             0x000c0000
+#define         AR9170_PHY_TPCRG1_PD_GAIN_2_S           18
+#define         AR9170_PHY_TPCRG1_PD_GAIN_3             0x00300000
+#define         AR9170_PHY_TPCRG1_PD_GAIN_3_S           20
+#define         AR9170_PHY_TPCRG1_PD_CAL_ENABLE         0x00400000
+#define         AR9170_PHY_TPCRG1_PD_CAL_ENABLE_S       22
+
+#define AR9170_PHY_REG_TX_PWRCTRL4              (AR9170_PHY_REG_BASE + 0x0a64)
+#define         AR9170_PHY_TX_PWRCTRL_PD_AVG_VALID      0x00000001
+#define         AR9170_PHY_TX_PWRCTRL_PD_AVG_VALID_S    0
+#define         AR9170_PHY_TX_PWRCTRL_PD_AVG_OUT        0x000001fe
+#define         AR9170_PHY_TX_PWRCTRL_PD_AVG_OUT_S      1
+
+#define AR9170_PHY_REG_ANALOG_SWAP              (AR9170_PHY_REG_BASE + 0x0a68)
+#define         AR9170_PHY_ANALOG_SWAP_AB               0x0001
+#define         AR9170_PHY_ANALOG_SWAP_ALT_CHAIN        0x00000040
+
+#define AR9170_PHY_REG_TPCRG5                   (AR9170_PHY_REG_BASE + 0x0a6c)
+#define         AR9170_PHY_TPCRG5_PD_GAIN_OVERLAP       0x0000000f
+#define         AR9170_PHY_TPCRG5_PD_GAIN_OVERLAP_S     0
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_1    0x000003f0
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_1_S  4
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_2    0x0000fc00
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_2_S  10
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_3    0x003f0000
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_3_S  16
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_4    0x0fc00000
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_4_S  22
+
+#define AR9170_PHY_REG_TX_PWRCTRL6_0            (AR9170_PHY_REG_BASE + 0x0a70)
+#define AR9170_PHY_REG_TX_PWRCTRL6_1            (AR9170_PHY_REG_BASE + 0x1a70)
+#define         AR9170_PHY_TX_PWRCTRL_ERR_EST_MODE      0x03000000
+#define         AR9170_PHY_TX_PWRCTRL_ERR_EST_MODE_S    24
+
+#define AR9170_PHY_REG_TX_PWRCTRL7              (AR9170_PHY_REG_BASE + 0x0a74)
+#define         AR9170_PHY_TX_PWRCTRL_INIT_TX_GAIN      0x01f80000
+#define         AR9170_PHY_TX_PWRCTRL_INIT_TX_GAIN_S    19
+
+#define AR9170_PHY_REG_TX_PWRCTRL9              (AR9170_PHY_REG_BASE + 0x0a7c)
+#define         AR9170_PHY_TX_DESIRED_SCALE_CCK         0x00007c00
+#define         AR9170_PHY_TX_DESIRED_SCALE_CCK_S       10
+#define         AR9170_PHY_TX_PWRCTRL9_RES_DC_REMOVAL   0x80000000
+#define         AR9170_PHY_TX_PWRCTRL9_RES_DC_REMOVAL_S 31
+
+#define AR9170_PHY_REG_TX_GAIN_TBL1             (AR9170_PHY_REG_BASE + 0x0b00)
+#define         AR9170_PHY_TX_GAIN                      0x0007f000
+#define         AR9170_PHY_TX_GAIN_S                    12
+
+/* Carrier leak calibration control, do it after AGC calibration */
+#define AR9170_PHY_REG_CL_CAL_CTL               (AR9170_PHY_REG_BASE + 0x0b58)
+#define         AR9170_PHY_CL_CAL_ENABLE                0x00000002
+#define         AR9170_PHY_CL_CAL_PARALLEL_CAL_ENABLE   0x00000001
+
+#define AR9170_PHY_REG_POWER_TX_RATE5           (AR9170_PHY_REG_BASE + 0x0b8c)
+#define AR9170_PHY_REG_POWER_TX_RATE6           (AR9170_PHY_REG_BASE + 0x0b90)
+
+#define AR9170_PHY_REG_CH0_TX_PWRCTRL11         (AR9170_PHY_REG_BASE + 0x0b98)
+#define AR9170_PHY_REG_CH1_TX_PWRCTRL11         (AR9170_PHY_REG_BASE + 0x1b98)
+#define         AR9170_PHY_TX_CHX_PWRCTRL_OLPC_TEMP_COMP        0x0000fc00
+#define         AR9170_PHY_TX_CHX_PWRCTRL_OLPC_TEMP_COMP_S      10
+
+#define AR9170_PHY_REG_CAL_CHAINMASK            (AR9170_PHY_REG_BASE + 0x0b9c)
+#define AR9170_PHY_REG_VIT_MASK2_M_46_61        (AR9170_PHY_REG_BASE + 0x0ba0)
+#define AR9170_PHY_REG_MASK2_M_31_45            (AR9170_PHY_REG_BASE + 0x0ba4)
+#define AR9170_PHY_REG_MASK2_M_16_30            (AR9170_PHY_REG_BASE + 0x0ba8)
+#define AR9170_PHY_REG_MASK2_M_00_15            (AR9170_PHY_REG_BASE + 0x0bac)
+#define AR9170_PHY_REG_PILOT_MASK_01_30         (AR9170_PHY_REG_BASE + 0x0bb0)
+#define AR9170_PHY_REG_PILOT_MASK_31_60         (AR9170_PHY_REG_BASE + 0x0bb4)
+#define AR9170_PHY_REG_MASK2_P_15_01            (AR9170_PHY_REG_BASE + 0x0bb8)
+#define AR9170_PHY_REG_MASK2_P_30_16            (AR9170_PHY_REG_BASE + 0x0bbc)
+#define AR9170_PHY_REG_MASK2_P_45_31            (AR9170_PHY_REG_BASE + 0x0bc0)
+#define AR9170_PHY_REG_MASK2_P_61_45            (AR9170_PHY_REG_BASE + 0x0bc4)
+#define AR9170_PHY_REG_POWER_TX_SUB             (AR9170_PHY_REG_BASE + 0x0bc8)
+#define AR9170_PHY_REG_POWER_TX_RATE7           (AR9170_PHY_REG_BASE + 0x0bcc)
+#define AR9170_PHY_REG_POWER_TX_RATE8           (AR9170_PHY_REG_BASE + 0x0bd0)
+#define AR9170_PHY_REG_POWER_TX_RATE9           (AR9170_PHY_REG_BASE + 0x0bd4)
+#define AR9170_PHY_REG_XPA_CFG                  (AR9170_PHY_REG_BASE + 0x0bd8)
+#define         AR9170_PHY_FORCE_XPA_CFG                0x000000001
+#define         AR9170_PHY_FORCE_XPA_CFG_S              0
+
+#define AR9170_PHY_REG_CH1_CCA                  (AR9170_PHY_REG_BASE + 0x1064)
+#define         AR9170_PHY_CH1_MINCCA_PWR               0x0ff80000
+#define         AR9170_PHY_CH1_MINCCA_PWR_S             19
+
+#define AR9170_PHY_REG_CH2_CCA                  (AR9170_PHY_REG_BASE + 0x2064)
+#define         AR9170_PHY_CH2_MINCCA_PWR               0x0ff80000
+#define         AR9170_PHY_CH2_MINCCA_PWR_S             19
+
+#define AR9170_PHY_REG_CH1_EXT_CCA              (AR9170_PHY_REG_BASE + 0x11bc)
+#define         AR9170_PHY_CH1_EXT_MINCCA_PWR           0xff800000
+#define         AR9170_PHY_CH1_EXT_MINCCA_PWR_S         23
+
+#define AR9170_PHY_REG_CH2_EXT_CCA              (AR9170_PHY_REG_BASE + 0x21bc)
+#define         AR9170_PHY_CH2_EXT_MINCCA_PWR           0xff800000
+#define         AR9170_PHY_CH2_EXT_MINCCA_PWR_S         23
+
+#endif  /* __CARL9170_SHARED_PHY_H */
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
new file mode 100644
index 000000000000..939a0e96ed1f
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -0,0 +1,938 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * 802.11 & command trap routines
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/crc32.h>
+#include <net/mac80211.h>
+#include "carl9170.h"
+#include "hw.h"
+#include "cmd.h"
+
+static void carl9170_dbg_message(struct ar9170 *ar, const char *buf, u32 len)
+{
+        bool restart = false;
+        enum carl9170_restart_reasons reason = CARL9170_RR_NO_REASON;
+
+        if (len > 3) {
+                if (memcmp(buf, CARL9170_ERR_MAGIC, 3) == 0) {
+                        ar->fw.err_counter++;
+                        if (ar->fw.err_counter > 3) {
+                                restart = true;
+                                reason = CARL9170_RR_TOO_MANY_FIRMWARE_ERRORS;
+                        }
+                }
+
+                if (memcmp(buf, CARL9170_BUG_MAGIC, 3) == 0) {
+                        ar->fw.bug_counter++;
+                        restart = true;
+                        reason = CARL9170_RR_FATAL_FIRMWARE_ERROR;
+                }
+        }
+
+        wiphy_info(ar->hw->wiphy, "FW: %.*s\n", len, buf);
+
+        if (restart)
+                carl9170_restart(ar, reason);
+}
+
+static void carl9170_handle_ps(struct ar9170 *ar, struct carl9170_rsp *rsp)
+{
+        u32 ps;
+        bool new_ps;
+
+        ps = le32_to_cpu(rsp->psm.state);
+
+        new_ps = (ps & CARL9170_PSM_COUNTER) != CARL9170_PSM_WAKE;
+        if (ar->ps.state != new_ps) {
+                if (!new_ps) {
+                        ar->ps.sleep_ms = jiffies_to_msecs(jiffies -
+                                ar->ps.last_action);
+                }
+
+                ar->ps.last_action = jiffies;
+
+                ar->ps.state = new_ps;
+        }
+}
+
+static int carl9170_check_sequence(struct ar9170 *ar, unsigned int seq)
+{
+        if (ar->cmd_seq < -1)
+                return 0;
+
+        /*
+         * Initialize Counter
+         */
+        if (ar->cmd_seq < 0)
+                ar->cmd_seq = seq;
+
+        /*
+         * The sequence is strictly monotonic increasing and it never skips!
+         *
+         * Therefore we can safely assume that whenever we received an
+         * unexpected sequence we have lost some valuable data.
+         */
+        if (seq != ar->cmd_seq) {
+                int count;
+
+                count = (seq - ar->cmd_seq) % ar->fw.cmd_bufs;
+
+                wiphy_err(ar->hw->wiphy, "lost %d command responses/traps! "
+                          "w:%d g:%d\n", count, ar->cmd_seq, seq);
+
+                carl9170_restart(ar, CARL9170_RR_LOST_RSP);
+                return -EIO;
+        }
+
+        ar->cmd_seq = (ar->cmd_seq + 1) % ar->fw.cmd_bufs;
+        return 0;
+}
+
+static void carl9170_cmd_callback(struct ar9170 *ar, u32 len, void *buffer)
+{
+        /*
+         * Some commands may have a variable response length
+         * and we cannot predict the correct length in advance.
+         * So we only check if we provided enough space for the data.
+         */
+        if (unlikely(ar->readlen != (len - 4))) {
+                dev_warn(&ar->udev->dev, "received invalid command response:"
+                         "got %d, instead of %d\n", len - 4, ar->readlen);
+                print_hex_dump_bytes("carl9170 cmd:", DUMP_PREFIX_OFFSET,
+                        ar->cmd_buf, (ar->cmd.hdr.len + 4) & 0x3f);
+                print_hex_dump_bytes("carl9170 rsp:", DUMP_PREFIX_OFFSET,
+                        buffer, len);
+                /*
+                 * Do not complete. The command times out,
+                 * and we get a stack trace from there.
+                 */
+                carl9170_restart(ar, CARL9170_RR_INVALID_RSP);
+        }
+
+        spin_lock(&ar->cmd_lock);
+        if (ar->readbuf) {
+                if (len >= 4)
+                        memcpy(ar->readbuf, buffer + 4, len - 4);
+
+                ar->readbuf = NULL;
+        }
+        complete(&ar->cmd_wait);
+        spin_unlock(&ar->cmd_lock);
+}
+
+void carl9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len)
+{
+        struct carl9170_rsp *cmd = (void *) buf;
+        struct ieee80211_vif *vif;
+
+        if (carl9170_check_sequence(ar, cmd->hdr.seq))
+                return;
+
+        if ((cmd->hdr.cmd & CARL9170_RSP_FLAG) != CARL9170_RSP_FLAG) {
+                if (!(cmd->hdr.cmd & CARL9170_CMD_ASYNC_FLAG))
+                        carl9170_cmd_callback(ar, len, buf);
+
+                return;
+        }
+
+        if (unlikely(cmd->hdr.len != (len - 4))) {
+                if (net_ratelimit()) {
+                        wiphy_err(ar->hw->wiphy, "FW: received over-/under"
+                                "sized event %x (%d, but should be %d).\n",
+                               cmd->hdr.cmd, cmd->hdr.len, len - 4);
+
+                        print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE,
+                                             buf, len);
+                }
+
+                return;
+        }
+
+        /* hardware event handlers */
+        switch (cmd->hdr.cmd) {
+        case CARL9170_RSP_PRETBTT:
+                /* pre-TBTT event */
+                rcu_read_lock();
+                vif = carl9170_get_main_vif(ar);
+
+                if (!vif) {
+                        rcu_read_unlock();
+                        break;
+                }
+
+                switch (vif->type) {
+                case NL80211_IFTYPE_STATION:
+                        carl9170_handle_ps(ar, cmd);
+                        break;
+
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_ADHOC:
+                        carl9170_update_beacon(ar, true);
+                        break;
+
+                default:
+                        break;
+                }
+                rcu_read_unlock();
+
+                break;
+
+
+        case CARL9170_RSP_TXCOMP:
+                /* TX status notification */
+                carl9170_tx_process_status(ar, cmd);
+                break;
+
+        case CARL9170_RSP_BEACON_CONFIG:
+                /*
+                 * (IBSS) beacon send notification
+                 * bytes: 04 c2 XX YY B4 B3 B2 B1
+                 *
+                 * XX always 80
+                 * YY always 00
+                 * B1-B4 "should" be the number of send out beacons.
+                 */
+                break;
+
+        case CARL9170_RSP_ATIM:
+                /* End of Atim Window */
+                break;
+
+        case CARL9170_RSP_WATCHDOG:
+                /* Watchdog Interrupt */
+                carl9170_restart(ar, CARL9170_RR_WATCHDOG);
+                break;
+
+        case CARL9170_RSP_TEXT:
+                /* firmware debug */
+                carl9170_dbg_message(ar, (char *)buf + 4, len - 4);
+                break;
+
+        case CARL9170_RSP_HEXDUMP:
+                wiphy_dbg(ar->hw->wiphy, "FW: HD %d\n", len - 4);
+                print_hex_dump_bytes("FW:", DUMP_PREFIX_NONE,
+                                     (char *)buf + 4, len - 4);
+                break;
+
+        case CARL9170_RSP_RADAR:
+                if (!net_ratelimit())
+                        break;
+
+                wiphy_info(ar->hw->wiphy, "FW: RADAR! Please report this "
+                       "incident to linux-wireless@vger.kernel.org !\n");
+                break;
+
+        case CARL9170_RSP_GPIO:
+#ifdef CONFIG_CARL9170_WPC
+                if (ar->wps.pbc) {
+                        bool state = !!(cmd->gpio.gpio & cpu_to_le32(
+                                AR9170_GPIO_PORT_WPS_BUTTON_PRESSED));
+
+                        if (state != ar->wps.pbc_state) {
+                                ar->wps.pbc_state = state;
+                                input_report_key(ar->wps.pbc, KEY_WPS_BUTTON,
+                                                 state);
+                                input_sync(ar->wps.pbc);
+                        }
+                }
+#endif /* CONFIG_CARL9170_WPC */
+                break;
+
+        case CARL9170_RSP_BOOT:
+                complete(&ar->fw_boot_wait);
+                break;
+
+        default:
+                wiphy_err(ar->hw->wiphy, "FW: received unhandled event %x\n",
+                        cmd->hdr.cmd);
+                print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
+                break;
+        }
+}
+
+static int carl9170_rx_mac_status(struct ar9170 *ar,
+        struct ar9170_rx_head *head, struct ar9170_rx_macstatus *mac,
+        struct ieee80211_rx_status *status)
+{
+        struct ieee80211_channel *chan;
+        u8 error, decrypt;
+
+        BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
+        BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4);
+
+        error = mac->error;
+
+        if (error & AR9170_RX_ERROR_WRONG_RA) {
+                if (!ar->sniffer_enabled)
+                        return -EINVAL;
+        }
+
+        if (error & AR9170_RX_ERROR_PLCP) {
+                if (!(ar->filter_state & FIF_PLCPFAIL))
+                        return -EINVAL;
+
+                status->flag |= RX_FLAG_FAILED_PLCP_CRC;
+        }
+
+        if (error & AR9170_RX_ERROR_FCS) {
+                ar->tx_fcs_errors++;
+
+                if (!(ar->filter_state & FIF_FCSFAIL))
+                        return -EINVAL;
+
+                status->flag |= RX_FLAG_FAILED_FCS_CRC;
+        }
+
+        decrypt = ar9170_get_decrypt_type(mac);
+        if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
+            decrypt != AR9170_ENC_ALG_NONE) {
+                if ((decrypt == AR9170_ENC_ALG_TKIP) &&
+                    (error & AR9170_RX_ERROR_MMIC))
+                        status->flag |= RX_FLAG_MMIC_ERROR;
+
+                status->flag |= RX_FLAG_DECRYPTED;
+        }
+
+        if (error & AR9170_RX_ERROR_DECRYPT && !ar->sniffer_enabled)
+                return -ENODATA;
+
+        error &= ~(AR9170_RX_ERROR_MMIC |
+                   AR9170_RX_ERROR_FCS |
+                   AR9170_RX_ERROR_WRONG_RA |
+                   AR9170_RX_ERROR_DECRYPT |
+                   AR9170_RX_ERROR_PLCP);
+
+        /* drop any other error frames */
+        if (unlikely(error)) {
+                /* TODO: update netdevice's RX dropped/errors statistics */
+
+                if (net_ratelimit())
+                        wiphy_dbg(ar->hw->wiphy, "received frame with "
+                               "suspicious error code (%#x).\n", error);
+
+                return -EINVAL;
+        }
+
+        chan = ar->channel;
+        if (chan) {
+                status->band = chan->band;
+                status->freq = chan->center_freq;
+        }
+
+        switch (mac->status & AR9170_RX_STATUS_MODULATION) {
+        case AR9170_RX_STATUS_MODULATION_CCK:
+                if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
+                        status->flag |= RX_FLAG_SHORTPRE;
+                switch (head->plcp[0]) {
+                case AR9170_RX_PHY_RATE_CCK_1M:
+                        status->rate_idx = 0;
+                        break;
+                case AR9170_RX_PHY_RATE_CCK_2M:
+                        status->rate_idx = 1;
+                        break;
+                case AR9170_RX_PHY_RATE_CCK_5M:
+                        status->rate_idx = 2;
+                        break;
+                case AR9170_RX_PHY_RATE_CCK_11M:
+                        status->rate_idx = 3;
+                        break;
+                default:
+                        if (net_ratelimit()) {
+                                wiphy_err(ar->hw->wiphy, "invalid plcp cck "
+                                       "rate (%x).\n", head->plcp[0]);
+                        }
+
+                        return -EINVAL;
+                }
+                break;
+
+        case AR9170_RX_STATUS_MODULATION_DUPOFDM:
+        case AR9170_RX_STATUS_MODULATION_OFDM:
+                switch (head->plcp[0] & 0xf) {
+                case AR9170_TXRX_PHY_RATE_OFDM_6M:
+                        status->rate_idx = 0;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_9M:
+                        status->rate_idx = 1;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_12M:
+                        status->rate_idx = 2;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_18M:
+                        status->rate_idx = 3;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_24M:
+                        status->rate_idx = 4;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_36M:
+                        status->rate_idx = 5;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_48M:
+                        status->rate_idx = 6;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_54M:
+                        status->rate_idx = 7;
+                        break;
+                default:
+                        if (net_ratelimit()) {
+                                wiphy_err(ar->hw->wiphy, "invalid plcp ofdm "
+                                        "rate (%x).\n", head->plcp[0]);
+                        }
+
+                        return -EINVAL;
+                }
+                if (status->band == IEEE80211_BAND_2GHZ)
+                        status->rate_idx += 4;
+                break;
+
+        case AR9170_RX_STATUS_MODULATION_HT:
+                if (head->plcp[3] & 0x80)
+                        status->flag |= RX_FLAG_40MHZ;
+                if (head->plcp[6] & 0x80)
+                        status->flag |= RX_FLAG_SHORT_GI;
+
+                status->rate_idx = clamp(0, 75, head->plcp[3] & 0x7f);
+                status->flag |= RX_FLAG_HT;
+                break;
+
+        default:
+                BUG();
+                return -ENOSYS;
+        }
+
+        return 0;
+}
+
+static void carl9170_rx_phy_status(struct ar9170 *ar,
+        struct ar9170_rx_phystatus *phy, struct ieee80211_rx_status *status)
+{
+        int i;
+
+        BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20);
+
+        for (i = 0; i < 3; i++)
+                if (phy->rssi[i] != 0x80)
+                        status->antenna |= BIT(i);
+
+        /* post-process RSSI */
+        for (i = 0; i < 7; i++)
+                if (phy->rssi[i] & 0x80)
+                        phy->rssi[i] = ((phy->rssi[i] & 0x7f) + 1) & 0x7f;
+
+        /* TODO: we could do something with phy_errors */
+        status->signal = ar->noise[0] + phy->rssi_combined;
+}
+
+static struct sk_buff *carl9170_rx_copy_data(u8 *buf, int len)
+{
+        struct sk_buff *skb;
+        int reserved = 0;
+        struct ieee80211_hdr *hdr = (void *) buf;
+
+        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                u8 *qc = ieee80211_get_qos_ctl(hdr);
+                reserved += NET_IP_ALIGN;
+
+                if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
+                        reserved += NET_IP_ALIGN;
+        }
+
+        if (ieee80211_has_a4(hdr->frame_control))
+                reserved += NET_IP_ALIGN;
+
+        reserved = 32 + (reserved & NET_IP_ALIGN);
+
+        skb = dev_alloc_skb(len + reserved);
+        if (likely(skb)) {
+                skb_reserve(skb, reserved);
+                memcpy(skb_put(skb, len), buf, len);
+        }
+
+        return skb;
+}
+
+static u8 *carl9170_find_ie(u8 *data, unsigned int len, u8 ie)
+{
+        struct ieee80211_mgmt *mgmt = (void *)data;
+        u8 *pos, *end;
+
+        pos = (u8 *)mgmt->u.beacon.variable;
+        end = data + len;
+        while (pos < end) {
+                if (pos + 2 + pos[1] > end)
+                        return NULL;
+
+                if (pos[0] == ie)
+                        return pos;
+
+                pos += 2 + pos[1];
+        }
+        return NULL;
+}
+
+/*
+ * NOTE:
+ *
+ * The firmware is in charge of waking up the device just before
+ * the AP is expected to transmit the next beacon.
+ *
+ * This leaves the driver with the important task of deciding when
+ * to set the PHY back to bed again.
+ */
+static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
+{
+        struct ieee80211_hdr *hdr = (void *) data;
+        struct ieee80211_tim_ie *tim_ie;
+        u8 *tim;
+        u8 tim_len;
+        bool cam;
+
+        if (likely(!(ar->hw->conf.flags & IEEE80211_CONF_PS)))
+                return;
+
+        /* check if this really is a beacon */
+        if (!ieee80211_is_beacon(hdr->frame_control))
+                return;
+
+        /* min. beacon length + FCS_LEN */
+        if (len <= 40 + FCS_LEN)
+                return;
+
+        /* and only beacons from the associated BSSID, please */
+        if (compare_ether_addr(hdr->addr3, ar->common.curbssid) ||
+            !ar->common.curaid)
+                return;
+
+        ar->ps.last_beacon = jiffies;
+
+        tim = carl9170_find_ie(data, len - FCS_LEN, WLAN_EID_TIM);
+        if (!tim)
+                return;
+
+        if (tim[1] < sizeof(*tim_ie))
+                return;
+
+        tim_len = tim[1];
+        tim_ie = (struct ieee80211_tim_ie *) &tim[2];
+
+        if (!WARN_ON_ONCE(!ar->hw->conf.ps_dtim_period))
+                ar->ps.dtim_counter = (tim_ie->dtim_count - 1) %
+                        ar->hw->conf.ps_dtim_period;
+
+        /* Check whenever the PHY can be turned off again. */
+
+        /* 1. What about buffered unicast traffic for our AID? */
+        cam = ieee80211_check_tim(tim_ie, tim_len, ar->common.curaid);
+
+        /* 2. Maybe the AP wants to send multicast/broadcast data? */
+        cam = !!(tim_ie->bitmap_ctrl & 0x01);
+
+        if (!cam) {
+                /* back to low-power land. */
+                ar->ps.off_override &= ~PS_OFF_BCN;
+                carl9170_ps_check(ar);
+        } else {
+                /* force CAM */
+                ar->ps.off_override |= PS_OFF_BCN;
+        }
+}
+
+static bool carl9170_ampdu_check(struct ar9170 *ar, u8 *buf, u8 ms)
+{
+        __le16 fc;
+
+        if ((ms & AR9170_RX_STATUS_MPDU) == AR9170_RX_STATUS_MPDU_SINGLE) {
+                /*
+                 * This frame is not part of an aMPDU.
+                 * Therefore it is not subjected to any
+                 * of the following content restrictions.
+                 */
+                return true;
+        }
+
+        /*
+         * "802.11n - 7.4a.3 A-MPDU contents" describes in which contexts
+         * certain frame types can be part of an aMPDU.
+         *
+         * In order to keep the processing cost down, I opted for a
+         * stateless filter solely based on the frame control field.
+         */
+
+        fc = ((struct ieee80211_hdr *)buf)->frame_control;
+        if (ieee80211_is_data_qos(fc) && ieee80211_is_data_present(fc))
+                return true;
+
+        if (ieee80211_is_ack(fc) || ieee80211_is_back(fc) ||
+            ieee80211_is_back_req(fc))
+                return true;
+
+        if (ieee80211_is_action(fc))
+                return true;
+
+        return false;
+}
+
+/*
+ * If the frame alignment is right (or the kernel has
+ * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
+ * is only a single MPDU in the USB frame, then we could
+ * submit to mac80211 the SKB directly. However, since
+ * there may be multiple packets in one SKB in stream
+ * mode, and we need to observe the proper ordering,
+ * this is non-trivial.
+ */
+
+static void carl9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
+{
+        struct ar9170_rx_head *head;
+        struct ar9170_rx_macstatus *mac;
+        struct ar9170_rx_phystatus *phy = NULL;
+        struct ieee80211_rx_status status;
+        struct sk_buff *skb;
+        int mpdu_len;
+        u8 mac_status;
+
+        if (!IS_STARTED(ar))
+                return;
+
+        if (unlikely(len < sizeof(*mac)))
+                goto drop;
+
+        mpdu_len = len - sizeof(*mac);
+
+        mac = (void *)(buf + mpdu_len);
+        mac_status = mac->status;
+        switch (mac_status & AR9170_RX_STATUS_MPDU) {
+        case AR9170_RX_STATUS_MPDU_FIRST:
+                /* Aggregated MPDUs start with an PLCP header */
+                if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) {
+                        head = (void *) buf;
+
+                        /*
+                         * The PLCP header needs to be cached for the
+                         * following MIDDLE + LAST A-MPDU packets.
+                         *
+                         * So, if you are wondering why all frames seem
+                         * to share a common RX status information,
+                         * then you have the answer right here...
+                         */
+                        memcpy(&ar->rx_plcp, (void *) buf,
+                               sizeof(struct ar9170_rx_head));
+
+                        mpdu_len -= sizeof(struct ar9170_rx_head);
+                        buf += sizeof(struct ar9170_rx_head);
+
+                        ar->rx_has_plcp = true;
+                } else {
+                        if (net_ratelimit()) {
+                                wiphy_err(ar->hw->wiphy, "plcp info "
+                                        "is clipped.\n");
+                        }
+
+                        goto drop;
+                }
+                break;
+
+        case AR9170_RX_STATUS_MPDU_LAST:
+                /*
+                 * The last frame of an A-MPDU has an extra tail
+                 * which does contain the phy status of the whole
+                 * aggregate.
+                 */
+
+                if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) {
+                        mpdu_len -= sizeof(struct ar9170_rx_phystatus);
+                        phy = (void *)(buf + mpdu_len);
+                } else {
+                        if (net_ratelimit()) {
+                                wiphy_err(ar->hw->wiphy, "frame tail "
+                                        "is clipped.\n");
+                        }
+
+                        goto drop;
+                }
+
+        case AR9170_RX_STATUS_MPDU_MIDDLE:
+                /*  These are just data + mac status */
+                if (unlikely(!ar->rx_has_plcp)) {
+                        if (!net_ratelimit())
+                                return;
+
+                        wiphy_err(ar->hw->wiphy, "rx stream does not start "
+                                        "with a first_mpdu frame tag.\n");
+
+                        goto drop;
+                }
+
+                head = &ar->rx_plcp;
+                break;
+
+        case AR9170_RX_STATUS_MPDU_SINGLE:
+                /* single mpdu has both: plcp (head) and phy status (tail) */
+                head = (void *) buf;
+
+                mpdu_len -= sizeof(struct ar9170_rx_head);
+                mpdu_len -= sizeof(struct ar9170_rx_phystatus);
+
+                buf += sizeof(struct ar9170_rx_head);
+                phy = (void *)(buf + mpdu_len);
+                break;
+
+        default:
+                BUG_ON(1);
+                break;
+        }
+
+        /* FC + DU + RA + FCS */
+        if (unlikely(mpdu_len < (2 + 2 + ETH_ALEN + FCS_LEN)))
+                goto drop;
+
+        memset(&status, 0, sizeof(status));
+        if (unlikely(carl9170_rx_mac_status(ar, head, mac, &status)))
+                goto drop;
+
+        if (!carl9170_ampdu_check(ar, buf, mac_status))
+                goto drop;
+
+        if (phy)
+                carl9170_rx_phy_status(ar, phy, &status);
+
+        carl9170_ps_beacon(ar, buf, mpdu_len);
+
+        skb = carl9170_rx_copy_data(buf, mpdu_len);
+        if (!skb)
+                goto drop;
+
+        memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
+        ieee80211_rx(ar->hw, skb);
+        return;
+
+drop:
+        ar->rx_dropped++;
+}
+
+static void carl9170_rx_untie_cmds(struct ar9170 *ar, const u8 *respbuf,
+                                   const unsigned int resplen)
+{
+        struct carl9170_rsp *cmd;
+        int i = 0;
+
+        while (i < resplen) {
+                cmd = (void *) &respbuf[i];
+
+                i += cmd->hdr.len + 4;
+                if (unlikely(i > resplen))
+                        break;
+
+                carl9170_handle_command_response(ar, cmd, cmd->hdr.len + 4);
+        }
+
+        if (unlikely(i != resplen)) {
+                if (!net_ratelimit())
+                        return;
+
+                wiphy_err(ar->hw->wiphy, "malformed firmware trap:\n");
+                print_hex_dump_bytes("rxcmd:", DUMP_PREFIX_OFFSET,
+                                     respbuf, resplen);
+        }
+}
+
+static void __carl9170_rx(struct ar9170 *ar, u8 *buf, unsigned int len)
+{
+        unsigned int i = 0;
+
+        /* weird thing, but this is the same in the original driver */
+        while (len > 2 && i < 12 && buf[0] == 0xff && buf[1] == 0xff) {
+                i += 2;
+                len -= 2;
+                buf += 2;
+        }
+
+        if (unlikely(len < 4))
+                return;
+
+        /* found the 6 * 0xffff marker? */
+        if (i == 12)
+                carl9170_rx_untie_cmds(ar, buf, len);
+        else
+                carl9170_handle_mpdu(ar, buf, len);
+}
+
+static void carl9170_rx_stream(struct ar9170 *ar, void *buf, unsigned int len)
+{
+        unsigned int tlen, wlen = 0, clen = 0;
+        struct ar9170_stream *rx_stream;
+        u8 *tbuf;
+
+        tbuf = buf;
+        tlen = len;
+
+        while (tlen >= 4) {
+                rx_stream = (void *) tbuf;
+                clen = le16_to_cpu(rx_stream->length);
+                wlen = ALIGN(clen, 4);
+
+                /* check if this is stream has a valid tag.*/
+                if (rx_stream->tag != cpu_to_le16(AR9170_RX_STREAM_TAG)) {
+                        /*
+                         * TODO: handle the highly unlikely event that the
+                         * corrupted stream has the TAG at the right position.
+                         */
+
+                        /* check if the frame can be repaired. */
+                        if (!ar->rx_failover_missing) {
+
+                                /* this is not "short read". */
+                                if (net_ratelimit()) {
+                                        wiphy_err(ar->hw->wiphy,
+                                                "missing tag!\n");
+                                }
+
+                                __carl9170_rx(ar, tbuf, tlen);
+                                return;
+                        }
+
+                        if (ar->rx_failover_missing > tlen) {
+                                if (net_ratelimit()) {
+                                        wiphy_err(ar->hw->wiphy,
+                                                "possible multi "
+                                                "stream corruption!\n");
+                                        goto err_telluser;
+                                } else {
+                                        goto err_silent;
+                                }
+                        }
+
+                        memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
+                        ar->rx_failover_missing -= tlen;
+
+                        if (ar->rx_failover_missing <= 0) {
+                                /*
+                                 * nested carl9170_rx_stream call!
+                                 *
+                                 * termination is guranteed, even when the
+                                 * combined frame also have an element with
+                                 * a bad tag.
+                                 */
+
+                                ar->rx_failover_missing = 0;
+                                carl9170_rx_stream(ar, ar->rx_failover->data,
+                                                   ar->rx_failover->len);
+
+                                skb_reset_tail_pointer(ar->rx_failover);
+                                skb_trim(ar->rx_failover, 0);
+                        }
+
+                        return;
+                }
+
+                /* check if stream is clipped */
+                if (wlen > tlen - 4) {
+                        if (ar->rx_failover_missing) {
+                                /* TODO: handle double stream corruption. */
+                                if (net_ratelimit()) {
+                                        wiphy_err(ar->hw->wiphy, "double rx "
+                                                "stream corruption!\n");
+                                        goto err_telluser;
+                                } else {
+                                        goto err_silent;
+                                }
+                        }
+
+                        /*
+                         * save incomplete data set.
+                         * the firmware will resend the missing bits when
+                         * the rx - descriptor comes round again.
+                         */
+
+                        memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
+                        ar->rx_failover_missing = clen - tlen;
+                        return;
+                }
+                __carl9170_rx(ar, rx_stream->payload, clen);
+
+                tbuf += wlen + 4;
+                tlen -= wlen + 4;
+        }
+
+        if (tlen) {
+                if (net_ratelimit()) {
+                        wiphy_err(ar->hw->wiphy, "%d bytes of unprocessed "
+                                "data left in rx stream!\n", tlen);
+                }
+
+                goto err_telluser;
+        }
+
+        return;
+
+err_telluser:
+        wiphy_err(ar->hw->wiphy, "damaged RX stream data [want:%d, "
+                "data:%d, rx:%d, pending:%d ]\n", clen, wlen, tlen,
+                ar->rx_failover_missing);
+
+        if (ar->rx_failover_missing)
+                print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET,
+                                     ar->rx_failover->data,
+                                     ar->rx_failover->len);
+
+        print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET,
+                             buf, len);
+
+        wiphy_err(ar->hw->wiphy, "please check your hardware and cables, if "
+                "you see this message frequently.\n");
+
+err_silent:
+        if (ar->rx_failover_missing) {
+                skb_reset_tail_pointer(ar->rx_failover);
+                skb_trim(ar->rx_failover, 0);
+                ar->rx_failover_missing = 0;
+        }
+}
+
+void carl9170_rx(struct ar9170 *ar, void *buf, unsigned int len)
+{
+        if (ar->fw.rx_stream)
+                carl9170_rx_stream(ar, buf, len);
+        else
+                __carl9170_rx(ar, buf, len);
+}
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
new file mode 100644
index 000000000000..b575c865142d
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -0,0 +1,1335 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * 802.11 xmit & status routines
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <net/mac80211.h>
+#include "carl9170.h"
+#include "hw.h"
+#include "cmd.h"
+
+static inline unsigned int __carl9170_get_queue(struct ar9170 *ar,
+                                                unsigned int queue)
+{
+        if (unlikely(modparam_noht)) {
+                return queue;
+        } else {
+                /*
+                 * This is just another workaround, until
+                 * someone figures out how to get QoS and
+                 * AMPDU to play nicely together.
+                 */
+
+                return 2;               /* AC_BE */
+        }
+}
+
+static inline unsigned int carl9170_get_queue(struct ar9170 *ar,
+                                              struct sk_buff *skb)
+{
+        return __carl9170_get_queue(ar, skb_get_queue_mapping(skb));
+}
+
+static bool is_mem_full(struct ar9170 *ar)
+{
+        return (DIV_ROUND_UP(IEEE80211_MAX_FRAME_LEN, ar->fw.mem_block_size) >
+                atomic_read(&ar->mem_free_blocks));
+}
+
+static void carl9170_tx_accounting(struct ar9170 *ar, struct sk_buff *skb)
+{
+        int queue, i;
+        bool mem_full;
+
+        atomic_inc(&ar->tx_total_queued);
+
+        queue = skb_get_queue_mapping(skb);
+        spin_lock_bh(&ar->tx_stats_lock);
+
+        /*
+         * The driver has to accept the frame, regardless if the queue is
+         * full to the brim, or not. We have to do the queuing internally,
+         * since mac80211 assumes that a driver which can operate with
+         * aggregated frames does not reject frames for this reason.
+         */
+        ar->tx_stats[queue].len++;
+        ar->tx_stats[queue].count++;
+
+        mem_full = is_mem_full(ar);
+        for (i = 0; i < ar->hw->queues; i++) {
+                if (mem_full || ar->tx_stats[i].len >= ar->tx_stats[i].limit) {
+                        ieee80211_stop_queue(ar->hw, i);
+                        ar->queue_stop_timeout[i] = jiffies;
+                }
+        }
+
+        spin_unlock_bh(&ar->tx_stats_lock);
+}
+
+static void carl9170_tx_accounting_free(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *txinfo;
+        int queue;
+
+        txinfo = IEEE80211_SKB_CB(skb);
+        queue = skb_get_queue_mapping(skb);
+
+        spin_lock_bh(&ar->tx_stats_lock);
+
+        ar->tx_stats[queue].len--;
+
+        if (!is_mem_full(ar)) {
+                unsigned int i;
+                for (i = 0; i < ar->hw->queues; i++) {
+                        if (ar->tx_stats[i].len >= CARL9170_NUM_TX_LIMIT_SOFT)
+                                continue;
+
+                        if (ieee80211_queue_stopped(ar->hw, i)) {
+                                unsigned long tmp;
+
+                                tmp = jiffies - ar->queue_stop_timeout[i];
+                                if (tmp > ar->max_queue_stop_timeout[i])
+                                        ar->max_queue_stop_timeout[i] = tmp;
+                        }
+
+                        ieee80211_wake_queue(ar->hw, i);
+                }
+        }
+
+        spin_unlock_bh(&ar->tx_stats_lock);
+        if (atomic_dec_and_test(&ar->tx_total_queued))
+                complete(&ar->tx_flush);
+}
+
+static int carl9170_alloc_dev_space(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct _carl9170_tx_superframe *super = (void *) skb->data;
+        unsigned int chunks;
+        int cookie = -1;
+
+        atomic_inc(&ar->mem_allocs);
+
+        chunks = DIV_ROUND_UP(skb->len, ar->fw.mem_block_size);
+        if (unlikely(atomic_sub_return(chunks, &ar->mem_free_blocks) < 0)) {
+                atomic_add(chunks, &ar->mem_free_blocks);
+                return -ENOSPC;
+        }
+
+        spin_lock_bh(&ar->mem_lock);
+        cookie = bitmap_find_free_region(ar->mem_bitmap, ar->fw.mem_blocks, 0);
+        spin_unlock_bh(&ar->mem_lock);
+
+        if (unlikely(cookie < 0)) {
+                atomic_add(chunks, &ar->mem_free_blocks);
+                return -ENOSPC;
+        }
+
+        super = (void *) skb->data;
+
+        /*
+         * Cookie #0 serves two special purposes:
+         *  1. The firmware might use it generate BlockACK frames
+         *     in responds of an incoming BlockAckReqs.
+         *
+         *  2. Prevent double-free bugs.
+         */
+        super->s.cookie = (u8) cookie + 1;
+        return 0;
+}
+
+static void carl9170_release_dev_space(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct _carl9170_tx_superframe *super = (void *) skb->data;
+        int cookie;
+
+        /* make a local copy of the cookie */
+        cookie = super->s.cookie;
+        /* invalidate cookie */
+        super->s.cookie = 0;
+
+        /*
+         * Do a out-of-bounds check on the cookie:
+         *
+         *  * cookie "0" is reserved and won't be assigned to any
+         *    out-going frame. Internally however, it is used to
+         *    mark no longer/un-accounted frames and serves as a
+         *    cheap way of preventing frames from being freed
+         *    twice by _accident_. NB: There is a tiny race...
+         *
+         *  * obviously, cookie number is limited by the amount
+         *    of available memory blocks, so the number can
+         *    never execeed the mem_blocks count.
+         */
+        if (unlikely(WARN_ON_ONCE(cookie == 0) ||
+            WARN_ON_ONCE(cookie > ar->fw.mem_blocks)))
+                return;
+
+        atomic_add(DIV_ROUND_UP(skb->len, ar->fw.mem_block_size),
+                   &ar->mem_free_blocks);
+
+        spin_lock_bh(&ar->mem_lock);
+        bitmap_release_region(ar->mem_bitmap, cookie - 1, 0);
+        spin_unlock_bh(&ar->mem_lock);
+}
+
+/* Called from any context */
+static void carl9170_tx_release(struct kref *ref)
+{
+        struct ar9170 *ar;
+        struct carl9170_tx_info *arinfo;
+        struct ieee80211_tx_info *txinfo;
+        struct sk_buff *skb;
+
+        arinfo = container_of(ref, struct carl9170_tx_info, ref);
+        txinfo = container_of((void *) arinfo, struct ieee80211_tx_info,
+                              rate_driver_data);
+        skb = container_of((void *) txinfo, struct sk_buff, cb);
+
+        ar = arinfo->ar;
+        if (WARN_ON_ONCE(!ar))
+                return;
+
+        BUILD_BUG_ON(
+            offsetof(struct ieee80211_tx_info, status.ampdu_ack_len) != 23);
+
+        memset(&txinfo->status.ampdu_ack_len, 0,
+               sizeof(struct ieee80211_tx_info) -
+               offsetof(struct ieee80211_tx_info, status.ampdu_ack_len));
+
+        if (atomic_read(&ar->tx_total_queued))
+                ar->tx_schedule = true;
+
+        if (txinfo->flags & IEEE80211_TX_CTL_AMPDU) {
+                if (!atomic_read(&ar->tx_ampdu_upload))
+                        ar->tx_ampdu_schedule = true;
+
+                if (txinfo->flags & IEEE80211_TX_STAT_AMPDU) {
+                        txinfo->status.ampdu_len = txinfo->pad[0];
+                        txinfo->status.ampdu_ack_len = txinfo->pad[1];
+                        txinfo->pad[0] = txinfo->pad[1] = 0;
+                } else if (txinfo->flags & IEEE80211_TX_STAT_ACK) {
+                        /*
+                         * drop redundant tx_status reports:
+                         *
+                         * 1. ampdu_ack_len of the final tx_status does
+                         *    include the feedback of this particular frame.
+                         *
+                         * 2. tx_status_irqsafe only queues up to 128
+                         *    tx feedback reports and discards the rest.
+                         *
+                         * 3. minstrel_ht is picky, it only accepts
+                         *    reports of frames with the TX_STATUS_AMPDU flag.
+                         */
+
+                        dev_kfree_skb_any(skb);
+                        return;
+                } else {
+                        /*
+                         * Frame has failed, but we want to keep it in
+                         * case it was lost due to a power-state
+                         * transition.
+                         */
+                }
+        }
+
+        skb_pull(skb, sizeof(struct _carl9170_tx_superframe));
+        ieee80211_tx_status_irqsafe(ar->hw, skb);
+}
+
+void carl9170_tx_get_skb(struct sk_buff *skb)
+{
+        struct carl9170_tx_info *arinfo = (void *)
+                (IEEE80211_SKB_CB(skb))->rate_driver_data;
+        kref_get(&arinfo->ref);
+}
+
+int carl9170_tx_put_skb(struct sk_buff *skb)
+{
+        struct carl9170_tx_info *arinfo = (void *)
+                (IEEE80211_SKB_CB(skb))->rate_driver_data;
+
+        return kref_put(&arinfo->ref, carl9170_tx_release);
+}
+
+/* Caller must hold the tid_info->lock & rcu_read_lock */
+static void carl9170_tx_shift_bm(struct ar9170 *ar,
+        struct carl9170_sta_tid *tid_info, u16 seq)
+{
+        u16 off;
+
+        off = SEQ_DIFF(seq, tid_info->bsn);
+
+        if (WARN_ON_ONCE(off >= CARL9170_BAW_BITS))
+                return;
+
+        /*
+         * Sanity check. For each MPDU we set the bit in bitmap and
+         * clear it once we received the tx_status.
+         * But if the bit is already cleared then we've been bitten
+         * by a bug.
+         */
+        WARN_ON_ONCE(!test_and_clear_bit(off, tid_info->bitmap));
+
+        off = SEQ_DIFF(tid_info->snx, tid_info->bsn);
+        if (WARN_ON_ONCE(off >= CARL9170_BAW_BITS))
+                return;
+
+        if (!bitmap_empty(tid_info->bitmap, off))
+                off = find_first_bit(tid_info->bitmap, off);
+
+        tid_info->bsn += off;
+        tid_info->bsn &= 0x0fff;
+
+        bitmap_shift_right(tid_info->bitmap, tid_info->bitmap,
+                           off, CARL9170_BAW_BITS);
+}
+
+static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
+        struct sk_buff *skb, struct ieee80211_tx_info *txinfo)
+{
+        struct _carl9170_tx_superframe *super = (void *) skb->data;
+        struct ieee80211_hdr *hdr = (void *) super->frame_data;
+        struct ieee80211_tx_info *tx_info;
+        struct carl9170_tx_info *ar_info;
+        struct carl9170_sta_info *sta_info;
+        struct ieee80211_sta *sta;
+        struct carl9170_sta_tid *tid_info;
+        struct ieee80211_vif *vif;
+        unsigned int vif_id;
+        u8 tid;
+
+        if (!(txinfo->flags & IEEE80211_TX_CTL_AMPDU) ||
+            txinfo->flags & IEEE80211_TX_CTL_INJECTED)
+                return;
+
+        tx_info = IEEE80211_SKB_CB(skb);
+        ar_info = (void *) tx_info->rate_driver_data;
+
+        vif_id = (super->s.misc & CARL9170_TX_SUPER_MISC_VIF_ID) >>
+                 CARL9170_TX_SUPER_MISC_VIF_ID_S;
+
+        if (WARN_ON_ONCE(vif_id >= AR9170_MAX_VIRTUAL_MAC))
+                return;
+
+        rcu_read_lock();
+        vif = rcu_dereference(ar->vif_priv[vif_id].vif);
+        if (unlikely(!vif))
+                goto out_rcu;
+
+        /*
+         * Normally we should use wrappers like ieee80211_get_DA to get
+         * the correct peer ieee80211_sta.
+         *
+         * But there is a problem with indirect traffic (broadcasts, or
+         * data which is designated for other stations) in station mode.
+         * The frame will be directed to the AP for distribution and not
+         * to the actual destination.
+         */
+        sta = ieee80211_find_sta(vif, hdr->addr1);
+        if (unlikely(!sta))
+                goto out_rcu;
+
+        tid = get_tid_h(hdr);
+
+        sta_info = (void *) sta->drv_priv;
+        tid_info = rcu_dereference(sta_info->agg[tid]);
+        if (!tid_info)
+                goto out_rcu;
+
+        spin_lock_bh(&tid_info->lock);
+        if (likely(tid_info->state >= CARL9170_TID_STATE_IDLE))
+                carl9170_tx_shift_bm(ar, tid_info, get_seq_h(hdr));
+
+        if (sta_info->stats[tid].clear) {
+                sta_info->stats[tid].clear = false;
+                sta_info->stats[tid].ampdu_len = 0;
+                sta_info->stats[tid].ampdu_ack_len = 0;
+        }
+
+        sta_info->stats[tid].ampdu_len++;
+        if (txinfo->status.rates[0].count == 1)
+                sta_info->stats[tid].ampdu_ack_len++;
+
+        if (super->f.mac_control & cpu_to_le16(AR9170_TX_MAC_IMM_BA)) {
+                txinfo->pad[0] = sta_info->stats[tid].ampdu_len;
+                txinfo->pad[1] = sta_info->stats[tid].ampdu_ack_len;
+                txinfo->flags |= IEEE80211_TX_STAT_AMPDU;
+                sta_info->stats[tid].clear = true;
+        }
+        spin_unlock_bh(&tid_info->lock);
+
+out_rcu:
+        rcu_read_unlock();
+}
+
+void carl9170_tx_status(struct ar9170 *ar, struct sk_buff *skb,
+                        const bool success)
+{
+        struct ieee80211_tx_info *txinfo;
+
+        carl9170_tx_accounting_free(ar, skb);
+
+        txinfo = IEEE80211_SKB_CB(skb);
+
+        if (success)
+                txinfo->flags |= IEEE80211_TX_STAT_ACK;
+        else
+                ar->tx_ack_failures++;
+
+        if (txinfo->flags & IEEE80211_TX_CTL_AMPDU)
+                carl9170_tx_status_process_ampdu(ar, skb, txinfo);
+
+        carl9170_tx_put_skb(skb);
+}
+
+/* This function may be called form any context */
+void carl9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
+
+        atomic_dec(&ar->tx_total_pending);
+
+        if (txinfo->flags & IEEE80211_TX_CTL_AMPDU)
+                atomic_dec(&ar->tx_ampdu_upload);
+
+        if (carl9170_tx_put_skb(skb))
+                tasklet_hi_schedule(&ar->usb_tasklet);
+}
+
+static struct sk_buff *carl9170_get_queued_skb(struct ar9170 *ar, u8 cookie,
+                                               struct sk_buff_head *queue)
+{
+        struct sk_buff *skb;
+
+        spin_lock_bh(&queue->lock);
+        skb_queue_walk(queue, skb) {
+                struct _carl9170_tx_superframe *txc = (void *) skb->data;
+
+                if (txc->s.cookie != cookie)
+                        continue;
+
+                __skb_unlink(skb, queue);
+                spin_unlock_bh(&queue->lock);
+
+                carl9170_release_dev_space(ar, skb);
+                return skb;
+        }
+        spin_unlock_bh(&queue->lock);
+
+        return NULL;
+}
+
+static void carl9170_tx_fill_rateinfo(struct ar9170 *ar, unsigned int rix,
+        unsigned int tries, struct ieee80211_tx_info *txinfo)
+{
+        unsigned int i;
+
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                if (txinfo->status.rates[i].idx < 0)
+                        break;
+
+                if (i == rix) {
+                        txinfo->status.rates[i].count = tries;
+                        i++;
+                        break;
+                }
+        }
+
+        for (; i < IEEE80211_TX_MAX_RATES; i++) {
+                txinfo->status.rates[i].idx = -1;
+                txinfo->status.rates[i].count = 0;
+        }
+}
+
+static void carl9170_check_queue_stop_timeout(struct ar9170 *ar)
+{
+        int i;
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *txinfo;
+        struct carl9170_tx_info *arinfo;
+        bool restart = false;
+
+        for (i = 0; i < ar->hw->queues; i++) {
+                spin_lock_bh(&ar->tx_status[i].lock);
+
+                skb = skb_peek(&ar->tx_status[i]);
+
+                if (!skb)
+                        goto next;
+
+                txinfo = IEEE80211_SKB_CB(skb);
+                arinfo = (void *) txinfo->rate_driver_data;
+
+                if (time_is_before_jiffies(arinfo->timeout +
+                    msecs_to_jiffies(CARL9170_QUEUE_STUCK_TIMEOUT)) == true)
+                        restart = true;
+
+next:
+                spin_unlock_bh(&ar->tx_status[i].lock);
+        }
+
+        if (restart) {
+                /*
+                 * At least one queue has been stuck for long enough.
+                 * Give the device a kick and hope it gets back to
+                 * work.
+                 *
+                 * possible reasons may include:
+                 *  - frames got lost/corrupted (bad connection to the device)
+                 *  - stalled rx processing/usb controller hiccups
+                 *  - firmware errors/bugs
+                 *  - every bug you can think of.
+                 *  - all bugs you can't...
+                 *  - ...
+                 */
+                carl9170_restart(ar, CARL9170_RR_STUCK_TX);
+        }
+}
+
+void carl9170_tx_janitor(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170,
+                                         tx_janitor.work);
+        if (!IS_STARTED(ar))
+                return;
+
+        ar->tx_janitor_last_run = jiffies;
+
+        carl9170_check_queue_stop_timeout(ar);
+
+        if (!atomic_read(&ar->tx_total_queued))
+                return;
+
+        ieee80211_queue_delayed_work(ar->hw, &ar->tx_janitor,
+                msecs_to_jiffies(CARL9170_TX_TIMEOUT));
+}
+
+static void __carl9170_tx_process_status(struct ar9170 *ar,
+        const uint8_t cookie, const uint8_t info)
+{
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *txinfo;
+        struct carl9170_tx_info *arinfo;
+        unsigned int r, t, q;
+        bool success = true;
+
+        q = ar9170_qmap[info & CARL9170_TX_STATUS_QUEUE];
+
+        skb = carl9170_get_queued_skb(ar, cookie, &ar->tx_status[q]);
+        if (!skb) {
+                /*
+                 * We have lost the race to another thread.
+                 */
+
+                return ;
+        }
+
+        txinfo = IEEE80211_SKB_CB(skb);
+        arinfo = (void *) txinfo->rate_driver_data;
+
+        if (!(info & CARL9170_TX_STATUS_SUCCESS))
+                success = false;
+
+        r = (info & CARL9170_TX_STATUS_RIX) >> CARL9170_TX_STATUS_RIX_S;
+        t = (info & CARL9170_TX_STATUS_TRIES) >> CARL9170_TX_STATUS_TRIES_S;
+
+        carl9170_tx_fill_rateinfo(ar, r, t, txinfo);
+        carl9170_tx_status(ar, skb, success);
+}
+
+void carl9170_tx_process_status(struct ar9170 *ar,
+                                const struct carl9170_rsp *cmd)
+{
+        unsigned int i;
+
+        for (i = 0;  i < cmd->hdr.ext; i++) {
+                if (WARN_ON(i > ((cmd->hdr.len / 2) + 1))) {
+                        print_hex_dump_bytes("UU:", DUMP_PREFIX_NONE,
+                                             (void *) cmd, cmd->hdr.len + 4);
+                        break;
+                }
+
+                __carl9170_tx_process_status(ar, cmd->_tx_status[i].cookie,
+                                             cmd->_tx_status[i].info);
+        }
+}
+
+static __le32 carl9170_tx_physet(struct ar9170 *ar,
+        struct ieee80211_tx_info *info, struct ieee80211_tx_rate *txrate)
+{
+        struct ieee80211_rate *rate = NULL;
+        u32 power, chains;
+        __le32 tmp;
+
+        tmp = cpu_to_le32(0);
+
+        if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                tmp |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ <<
+                        AR9170_TX_PHY_BW_S);
+        /* this works because 40 MHz is 2 and dup is 3 */
+        if (txrate->flags & IEEE80211_TX_RC_DUP_DATA)
+                tmp |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ_DUP <<
+                        AR9170_TX_PHY_BW_S);
+
+        if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
+                tmp |= cpu_to_le32(AR9170_TX_PHY_SHORT_GI);
+
+        if (txrate->flags & IEEE80211_TX_RC_MCS) {
+                u32 r = txrate->idx;
+                u8 *txpower;
+
+                /* heavy clip control */
+                tmp |= cpu_to_le32((r & 0x7) <<
+                        AR9170_TX_PHY_TX_HEAVY_CLIP_S);
+
+                if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
+                        if (info->band == IEEE80211_BAND_5GHZ)
+                                txpower = ar->power_5G_ht40;
+                        else
+                                txpower = ar->power_2G_ht40;
+                } else {
+                        if (info->band == IEEE80211_BAND_5GHZ)
+                                txpower = ar->power_5G_ht20;
+                        else
+                                txpower = ar->power_2G_ht20;
+                }
+
+                power = txpower[r & 7];
+
+                /* +1 dBm for HT40 */
+                if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                        power += 2;
+
+                r <<= AR9170_TX_PHY_MCS_S;
+                BUG_ON(r & ~AR9170_TX_PHY_MCS);
+
+                tmp |= cpu_to_le32(r & AR9170_TX_PHY_MCS);
+                tmp |= cpu_to_le32(AR9170_TX_PHY_MOD_HT);
+
+                /*
+                 * green field preamble does not work.
+                 *
+                 * if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
+                 * tmp |= cpu_to_le32(AR9170_TX_PHY_GREENFIELD);
+                 */
+        } else {
+                u8 *txpower;
+                u32 mod;
+                u32 phyrate;
+                u8 idx = txrate->idx;
+
+                if (info->band != IEEE80211_BAND_2GHZ) {
+                        idx += 4;
+                        txpower = ar->power_5G_leg;
+                        mod = AR9170_TX_PHY_MOD_OFDM;
+                } else {
+                        if (idx < 4) {
+                                txpower = ar->power_2G_cck;
+                                mod = AR9170_TX_PHY_MOD_CCK;
+                        } else {
+                                mod = AR9170_TX_PHY_MOD_OFDM;
+                                txpower = ar->power_2G_ofdm;
+                        }
+                }
+
+                rate = &__carl9170_ratetable[idx];
+
+                phyrate = rate->hw_value & 0xF;
+                power = txpower[(rate->hw_value & 0x30) >> 4];
+                phyrate <<= AR9170_TX_PHY_MCS_S;
+
+                tmp |= cpu_to_le32(mod);
+                tmp |= cpu_to_le32(phyrate);
+
+                /*
+                 * short preamble seems to be broken too.
+                 *
+                 * if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
+                 *      tmp |= cpu_to_le32(AR9170_TX_PHY_SHORT_PREAMBLE);
+                 */
+        }
+        power <<= AR9170_TX_PHY_TX_PWR_S;
+        power &= AR9170_TX_PHY_TX_PWR;
+        tmp |= cpu_to_le32(power);
+
+        /* set TX chains */
+        if (ar->eeprom.tx_mask == 1) {
+                chains = AR9170_TX_PHY_TXCHAIN_1;
+        } else {
+                chains = AR9170_TX_PHY_TXCHAIN_2;
+
+                /* >= 36M legacy OFDM - use only one chain */
+                if (rate && rate->bitrate >= 360 &&
+                    !(txrate->flags & IEEE80211_TX_RC_MCS))
+                        chains = AR9170_TX_PHY_TXCHAIN_1;
+        }
+        tmp |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_S);
+
+        return tmp;
+}
+
+static bool carl9170_tx_rts_check(struct ar9170 *ar,
+                                  struct ieee80211_tx_rate *rate,
+                                  bool ampdu, bool multi)
+{
+        switch (ar->erp_mode) {
+        case CARL9170_ERP_AUTO:
+                if (ampdu)
+                        break;
+
+        case CARL9170_ERP_MAC80211:
+                if (!(rate->flags & IEEE80211_TX_RC_USE_RTS_CTS))
+                        break;
+
+        case CARL9170_ERP_RTS:
+                if (likely(!multi))
+                        return true;
+
+        default:
+                break;
+        }
+
+        return false;
+}
+
+static bool carl9170_tx_cts_check(struct ar9170 *ar,
+                                  struct ieee80211_tx_rate *rate)
+{
+        switch (ar->erp_mode) {
+        case CARL9170_ERP_AUTO:
+        case CARL9170_ERP_MAC80211:
+                if (!(rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
+                        break;
+
+        case CARL9170_ERP_CTS:
+                return true;
+
+        default:
+                break;
+        }
+
+        return false;
+}
+
+static int carl9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr;
+        struct _carl9170_tx_superframe *txc;
+        struct carl9170_vif_info *cvif;
+        struct ieee80211_tx_info *info;
+        struct ieee80211_tx_rate *txrate;
+        struct ieee80211_sta *sta;
+        struct carl9170_tx_info *arinfo;
+        unsigned int hw_queue;
+        int i;
+        __le16 mac_tmp;
+        u16 len;
+        bool ampdu, no_ack;
+
+        BUILD_BUG_ON(sizeof(*arinfo) > sizeof(info->rate_driver_data));
+        BUILD_BUG_ON(sizeof(struct _carl9170_tx_superdesc) !=
+                     CARL9170_TX_SUPERDESC_LEN);
+
+        BUILD_BUG_ON(sizeof(struct _ar9170_tx_hwdesc) !=
+                     AR9170_TX_HWDESC_LEN);
+
+        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES < CARL9170_TX_MAX_RATES);
+
+        BUILD_BUG_ON(AR9170_MAX_VIRTUAL_MAC >
+                ((CARL9170_TX_SUPER_MISC_VIF_ID >>
+                 CARL9170_TX_SUPER_MISC_VIF_ID_S) + 1));
+
+        hw_queue = ar9170_qmap[carl9170_get_queue(ar, skb)];
+
+        hdr = (void *)skb->data;
+        info = IEEE80211_SKB_CB(skb);
+        len = skb->len;
+
+        /*
+         * Note: If the frame was sent through a monitor interface,
+         * the ieee80211_vif pointer can be NULL.
+         */
+        if (likely(info->control.vif))
+                cvif = (void *) info->control.vif->drv_priv;
+        else
+                cvif = NULL;
+
+        sta = info->control.sta;
+
+        txc = (void *)skb_push(skb, sizeof(*txc));
+        memset(txc, 0, sizeof(*txc));
+
+        SET_VAL(CARL9170_TX_SUPER_MISC_QUEUE, txc->s.misc, hw_queue);
+
+        if (likely(cvif))
+                SET_VAL(CARL9170_TX_SUPER_MISC_VIF_ID, txc->s.misc, cvif->id);
+
+        if (unlikely(info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM))
+                txc->s.misc |= CARL9170_TX_SUPER_MISC_CAB;
+
+        if (unlikely(ieee80211_is_probe_resp(hdr->frame_control)))
+                txc->s.misc |= CARL9170_TX_SUPER_MISC_FILL_IN_TSF;
+
+        mac_tmp = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
+                              AR9170_TX_MAC_BACKOFF);
+        mac_tmp |= cpu_to_le16((hw_queue << AR9170_TX_MAC_QOS_S) &&
+                               AR9170_TX_MAC_QOS);
+
+        no_ack = !!(info->flags & IEEE80211_TX_CTL_NO_ACK);
+        if (unlikely(no_ack))
+                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_NO_ACK);
+
+        if (info->control.hw_key) {
+                len += info->control.hw_key->icv_len;
+
+                switch (info->control.hw_key->cipher) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
+                case WLAN_CIPHER_SUITE_TKIP:
+                        mac_tmp |= cpu_to_le16(AR9170_TX_MAC_ENCR_RC4);
+                        break;
+                case WLAN_CIPHER_SUITE_CCMP:
+                        mac_tmp |= cpu_to_le16(AR9170_TX_MAC_ENCR_AES);
+                        break;
+                default:
+                        WARN_ON(1);
+                        goto err_out;
+                }
+        }
+
+        ampdu = !!(info->flags & IEEE80211_TX_CTL_AMPDU);
+        if (ampdu) {
+                unsigned int density, factor;
+
+                if (unlikely(!sta || !cvif))
+                        goto err_out;
+
+                factor = min_t(unsigned int, 1u,
+                         info->control.sta->ht_cap.ampdu_factor);
+
+                density = info->control.sta->ht_cap.ampdu_density;
+
+                if (density) {
+                        /*
+                         * Watch out!
+                         *
+                         * Otus uses slightly different density values than
+                         * those from the 802.11n spec.
+                         */
+
+                        density = max_t(unsigned int, density + 1, 7u);
+                }
+
+                SET_VAL(CARL9170_TX_SUPER_AMPDU_DENSITY,
+                        txc->s.ampdu_settings, density);
+
+                SET_VAL(CARL9170_TX_SUPER_AMPDU_FACTOR,
+                        txc->s.ampdu_settings, factor);
+
+                for (i = 0; i < CARL9170_TX_MAX_RATES; i++) {
+                        txrate = &info->control.rates[i];
+                        if (txrate->idx >= 0) {
+                                txc->s.ri[i] =
+                                        CARL9170_TX_SUPER_RI_AMPDU;
+
+                                if (WARN_ON(!(txrate->flags &
+                                              IEEE80211_TX_RC_MCS))) {
+                                        /*
+                                         * Not sure if it's even possible
+                                         * to aggregate non-ht rates with
+                                         * this HW.
+                                         */
+                                        goto err_out;
+                                }
+                                continue;
+                        }
+
+                        txrate->idx = 0;
+                        txrate->count = ar->hw->max_rate_tries;
+                }
+
+                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_AGGR);
+        }
+
+        /*
+         * NOTE: For the first rate, the ERP & AMPDU flags are directly
+         * taken from mac_control. For all fallback rate, the firmware
+         * updates the mac_control flags from the rate info field.
+         */
+        for (i = 1; i < CARL9170_TX_MAX_RATES; i++) {
+                txrate = &info->control.rates[i];
+                if (txrate->idx < 0)
+                        break;
+
+                SET_VAL(CARL9170_TX_SUPER_RI_TRIES, txc->s.ri[i],
+                        txrate->count);
+
+                if (carl9170_tx_rts_check(ar, txrate, ampdu, no_ack))
+                        txc->s.ri[i] |= (AR9170_TX_MAC_PROT_RTS <<
+                                CARL9170_TX_SUPER_RI_ERP_PROT_S);
+                else if (carl9170_tx_cts_check(ar, txrate))
+                        txc->s.ri[i] |= (AR9170_TX_MAC_PROT_CTS <<
+                                CARL9170_TX_SUPER_RI_ERP_PROT_S);
+
+                txc->s.rr[i - 1] = carl9170_tx_physet(ar, info, txrate);
+        }
+
+        txrate = &info->control.rates[0];
+        SET_VAL(CARL9170_TX_SUPER_RI_TRIES, txc->s.ri[0], txrate->count);
+
+        if (carl9170_tx_rts_check(ar, txrate, ampdu, no_ack))
+                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
+        else if (carl9170_tx_cts_check(ar, txrate))
+                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
+
+        txc->s.len = cpu_to_le16(skb->len);
+        txc->f.length = cpu_to_le16(len + FCS_LEN);
+        txc->f.mac_control = mac_tmp;
+        txc->f.phy_control = carl9170_tx_physet(ar, info, txrate);
+
+        arinfo = (void *)info->rate_driver_data;
+        arinfo->timeout = jiffies;
+        arinfo->ar = ar;
+        kref_init(&arinfo->ref);
+        return 0;
+
+err_out:
+        skb_pull(skb, sizeof(*txc));
+        return -EINVAL;
+}
+
+static void carl9170_set_immba(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct _carl9170_tx_superframe *super;
+
+        super = (void *) skb->data;
+        super->f.mac_control |= cpu_to_le16(AR9170_TX_MAC_IMM_BA);
+}
+
+static void carl9170_set_ampdu_params(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct _carl9170_tx_superframe *super;
+        int tmp;
+
+        super = (void *) skb->data;
+
+        tmp = (super->s.ampdu_settings & CARL9170_TX_SUPER_AMPDU_DENSITY) <<
+                CARL9170_TX_SUPER_AMPDU_DENSITY_S;
+
+        /*
+         * If you haven't noticed carl9170_tx_prepare has already filled
+         * in all ampdu spacing & factor parameters.
+         * Now it's the time to check whenever the settings have to be
+         * updated by the firmware, or if everything is still the same.
+         *
+         * There's no sane way to handle different density values with
+         * this hardware, so we may as well just do the compare in the
+         * driver.
+         */
+
+        if (tmp != ar->current_density) {
+                ar->current_density = tmp;
+                super->s.ampdu_settings |=
+                        CARL9170_TX_SUPER_AMPDU_COMMIT_DENSITY;
+        }
+
+        tmp = (super->s.ampdu_settings & CARL9170_TX_SUPER_AMPDU_FACTOR) <<
+                CARL9170_TX_SUPER_AMPDU_FACTOR_S;
+
+        if (tmp != ar->current_factor) {
+                ar->current_factor = tmp;
+                super->s.ampdu_settings |=
+                        CARL9170_TX_SUPER_AMPDU_COMMIT_FACTOR;
+        }
+}
+
+static bool carl9170_tx_rate_check(struct ar9170 *ar, struct sk_buff *_dest,
+                                   struct sk_buff *_src)
+{
+        struct _carl9170_tx_superframe *dest, *src;
+
+        dest = (void *) _dest->data;
+        src = (void *) _src->data;
+
+        /*
+         * The mac80211 rate control algorithm expects that all MPDUs in
+         * an AMPDU share the same tx vectors.
+         * This is not really obvious right now, because the hardware
+         * does the AMPDU setup according to its own rulebook.
+         * Our nicely assembled, strictly monotonic increasing mpdu
+         * chains will be broken up, mashed back together...
+         */
+
+        return (dest->f.phy_control == src->f.phy_control);
+}
+
+static void carl9170_tx_ampdu(struct ar9170 *ar)
+{
+        struct sk_buff_head agg;
+        struct carl9170_sta_tid *tid_info;
+        struct sk_buff *skb, *first;
+        unsigned int i = 0, done_ampdus = 0;
+        u16 seq, queue, tmpssn;
+
+        atomic_inc(&ar->tx_ampdu_scheduler);
+        ar->tx_ampdu_schedule = false;
+
+        if (atomic_read(&ar->tx_ampdu_upload))
+                return;
+
+        if (!ar->tx_ampdu_list_len)
+                return;
+
+        __skb_queue_head_init(&agg);
+
+        rcu_read_lock();
+        tid_info = rcu_dereference(ar->tx_ampdu_iter);
+        if (WARN_ON_ONCE(!tid_info)) {
+                rcu_read_unlock();
+                return;
+        }
+
+retry:
+        list_for_each_entry_continue_rcu(tid_info, &ar->tx_ampdu_list, list) {
+                i++;
+
+                if (tid_info->state < CARL9170_TID_STATE_PROGRESS)
+                        continue;
+
+                queue = TID_TO_WME_AC(tid_info->tid);
+
+                spin_lock_bh(&tid_info->lock);
+                if (tid_info->state != CARL9170_TID_STATE_XMIT)
+                        goto processed;
+
+                tid_info->counter++;
+                first = skb_peek(&tid_info->queue);
+                tmpssn = carl9170_get_seq(first);
+                seq = tid_info->snx;
+
+                if (unlikely(tmpssn != seq)) {
+                        tid_info->state = CARL9170_TID_STATE_IDLE;
+
+                        goto processed;
+                }
+
+                while ((skb = skb_peek(&tid_info->queue))) {
+                        /* strict 0, 1, ..., n - 1, n frame sequence order */
+                        if (unlikely(carl9170_get_seq(skb) != seq))
+                                break;
+
+                        /* don't upload more than AMPDU FACTOR allows. */
+                        if (unlikely(SEQ_DIFF(tid_info->snx, tid_info->bsn) >=
+                            (tid_info->max - 1)))
+                                break;
+
+                        if (!carl9170_tx_rate_check(ar, skb, first))
+                                break;
+
+                        atomic_inc(&ar->tx_ampdu_upload);
+                        tid_info->snx = seq = SEQ_NEXT(seq);
+                        __skb_unlink(skb, &tid_info->queue);
+
+                        __skb_queue_tail(&agg, skb);
+
+                        if (skb_queue_len(&agg) >= CARL9170_NUM_TX_AGG_MAX)
+                                break;
+                }
+
+                if (skb_queue_empty(&tid_info->queue) ||
+                    carl9170_get_seq(skb_peek(&tid_info->queue)) !=
+                    tid_info->snx) {
+                        /*
+                         * stop TID, if A-MPDU frames are still missing,
+                         * or whenever the queue is empty.
+                         */
+
+                        tid_info->state = CARL9170_TID_STATE_IDLE;
+                }
+                done_ampdus++;
+
+processed:
+                spin_unlock_bh(&tid_info->lock);
+
+                if (skb_queue_empty(&agg))
+                        continue;
+
+                /* apply ampdu spacing & factor settings */
+                carl9170_set_ampdu_params(ar, skb_peek(&agg));
+
+                /* set aggregation push bit */
+                carl9170_set_immba(ar, skb_peek_tail(&agg));
+
+                spin_lock_bh(&ar->tx_pending[queue].lock);
+                skb_queue_splice_tail_init(&agg, &ar->tx_pending[queue]);
+                spin_unlock_bh(&ar->tx_pending[queue].lock);
+                ar->tx_schedule = true;
+        }
+        if ((done_ampdus++ == 0) && (i++ == 0))
+                goto retry;
+
+        rcu_assign_pointer(ar->tx_ampdu_iter, tid_info);
+        rcu_read_unlock();
+}
+
+static struct sk_buff *carl9170_tx_pick_skb(struct ar9170 *ar,
+                                            struct sk_buff_head *queue)
+{
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *info;
+        struct carl9170_tx_info *arinfo;
+
+        BUILD_BUG_ON(sizeof(*arinfo) > sizeof(info->rate_driver_data));
+
+        spin_lock_bh(&queue->lock);
+        skb = skb_peek(queue);
+        if (unlikely(!skb))
+                goto err_unlock;
+
+        if (carl9170_alloc_dev_space(ar, skb))
+                goto err_unlock;
+
+        __skb_unlink(skb, queue);
+        spin_unlock_bh(&queue->lock);
+
+        info = IEEE80211_SKB_CB(skb);
+        arinfo = (void *) info->rate_driver_data;
+
+        arinfo->timeout = jiffies;
+
+        /*
+         * increase ref count to "2".
+         * Ref counting is the easiest way to solve the race between
+         * the the urb's completion routine: carl9170_tx_callback and
+         * wlan tx status functions: carl9170_tx_status/janitor.
+         */
+        carl9170_tx_get_skb(skb);
+
+        return skb;
+
+err_unlock:
+        spin_unlock_bh(&queue->lock);
+        return NULL;
+}
+
+void carl9170_tx_drop(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct _carl9170_tx_superframe *super;
+        uint8_t q = 0;
+
+        ar->tx_dropped++;
+
+        super = (void *)skb->data;
+        SET_VAL(CARL9170_TX_SUPER_MISC_QUEUE, q,
+                ar9170_qmap[carl9170_get_queue(ar, skb)]);
+        __carl9170_tx_process_status(ar, super->s.cookie, q);
+}
+
+static void carl9170_tx(struct ar9170 *ar)
+{
+        struct sk_buff *skb;
+        unsigned int i, q;
+        bool schedule_garbagecollector = false;
+
+        ar->tx_schedule = false;
+
+        if (unlikely(!IS_STARTED(ar)))
+                return;
+
+        carl9170_usb_handle_tx_err(ar);
+
+        for (i = 0; i < ar->hw->queues; i++) {
+                while (!skb_queue_empty(&ar->tx_pending[i])) {
+                        skb = carl9170_tx_pick_skb(ar, &ar->tx_pending[i]);
+                        if (unlikely(!skb))
+                                break;
+
+                        atomic_inc(&ar->tx_total_pending);
+
+                        q = __carl9170_get_queue(ar, i);
+                        /*
+                         * NB: tx_status[i] vs. tx_status[q],
+                         * TODO: Move into pick_skb or alloc_dev_space.
+                         */
+                        skb_queue_tail(&ar->tx_status[q], skb);
+
+                        carl9170_usb_tx(ar, skb);
+                        schedule_garbagecollector = true;
+                }
+        }
+
+        if (!schedule_garbagecollector)
+                return;
+
+        ieee80211_queue_delayed_work(ar->hw, &ar->tx_janitor,
+                msecs_to_jiffies(CARL9170_TX_TIMEOUT));
+}
+
+static bool carl9170_tx_ampdu_queue(struct ar9170 *ar,
+        struct ieee80211_sta *sta, struct sk_buff *skb)
+{
+        struct carl9170_sta_info *sta_info;
+        struct carl9170_sta_tid *agg;
+        struct sk_buff *iter;
+        unsigned int max;
+        u16 tid, seq, qseq, off;
+        bool run = false;
+
+        tid = carl9170_get_tid(skb);
+        seq = carl9170_get_seq(skb);
+        sta_info = (void *) sta->drv_priv;
+
+        rcu_read_lock();
+        agg = rcu_dereference(sta_info->agg[tid]);
+        max = sta_info->ampdu_max_len;
+
+        if (!agg)
+                goto err_unlock_rcu;
+
+        spin_lock_bh(&agg->lock);
+        if (unlikely(agg->state < CARL9170_TID_STATE_IDLE))
+                goto err_unlock;
+
+        /* check if sequence is within the BA window */
+        if (unlikely(!BAW_WITHIN(agg->bsn, CARL9170_BAW_BITS, seq)))
+                goto err_unlock;
+
+        if (WARN_ON_ONCE(!BAW_WITHIN(agg->snx, CARL9170_BAW_BITS, seq)))
+                goto err_unlock;
+
+        off = SEQ_DIFF(seq, agg->bsn);
+        if (WARN_ON_ONCE(test_and_set_bit(off, agg->bitmap)))
+                goto err_unlock;
+
+        if (likely(BAW_WITHIN(agg->hsn, CARL9170_BAW_BITS, seq))) {
+                __skb_queue_tail(&agg->queue, skb);
+                agg->hsn = seq;
+                goto queued;
+        }
+
+        skb_queue_reverse_walk(&agg->queue, iter) {
+                qseq = carl9170_get_seq(iter);
+
+                if (BAW_WITHIN(qseq, CARL9170_BAW_BITS, seq)) {
+                        __skb_queue_after(&agg->queue, iter, skb);
+                        goto queued;
+                }
+        }
+
+        __skb_queue_head(&agg->queue, skb);
+queued:
+
+        if (unlikely(agg->state != CARL9170_TID_STATE_XMIT)) {
+                if (agg->snx == carl9170_get_seq(skb_peek(&agg->queue))) {
+                        agg->state = CARL9170_TID_STATE_XMIT;
+                        run = true;
+                }
+        }
+
+        spin_unlock_bh(&agg->lock);
+        rcu_read_unlock();
+
+        return run;
+
+err_unlock:
+        spin_unlock_bh(&agg->lock);
+
+err_unlock_rcu:
+        rcu_read_unlock();
+        carl9170_tx_status(ar, skb, false);
+        ar->tx_dropped++;
+        return false;
+}
+
+int carl9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct ar9170 *ar = hw->priv;
+        struct ieee80211_tx_info *info;
+        struct ieee80211_sta *sta;
+        bool run;
+
+        if (unlikely(!IS_STARTED(ar)))
+                goto err_free;
+
+        info = IEEE80211_SKB_CB(skb);
+        sta = info->control.sta;
+
+        if (unlikely(carl9170_tx_prepare(ar, skb)))
+                goto err_free;
+
+        carl9170_tx_accounting(ar, skb);
+        /*
+         * from now on, one has to use carl9170_tx_status to free
+         * all ressouces which are associated with the frame.
+         */
+
+        if (info->flags & IEEE80211_TX_CTL_AMPDU) {
+                if (WARN_ON_ONCE(!sta))
+                        goto err_free;
+
+                run = carl9170_tx_ampdu_queue(ar, sta, skb);
+                if (run)
+                        carl9170_tx_ampdu(ar);
+
+        } else {
+                unsigned int queue = skb_get_queue_mapping(skb);
+
+                skb_queue_tail(&ar->tx_pending[queue], skb);
+        }
+
+        carl9170_tx(ar);
+        return NETDEV_TX_OK;
+
+err_free:
+        ar->tx_dropped++;
+        dev_kfree_skb_any(skb);
+        return NETDEV_TX_OK;
+}
+
+void carl9170_tx_scheduler(struct ar9170 *ar)
+{
+
+        if (ar->tx_ampdu_schedule)
+                carl9170_tx_ampdu(ar);
+
+        if (ar->tx_schedule)
+                carl9170_tx(ar);
+}
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
new file mode 100644
index 000000000000..c7f6193934ea
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -0,0 +1,1136 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * USB - frontend
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/usb.h>
+#include <linux/firmware.h>
+#include <linux/etherdevice.h>
+#include <linux/device.h>
+#include <net/mac80211.h>
+#include "carl9170.h"
+#include "cmd.h"
+#include "hw.h"
+#include "fwcmd.h"
+
+MODULE_AUTHOR("Johannes Berg <johannes@sipsolutions.net>");
+MODULE_AUTHOR("Christian Lamparter <chunkeey@googlemail.com>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Atheros AR9170 802.11n USB wireless");
+MODULE_FIRMWARE(CARL9170FW_NAME);
+MODULE_ALIAS("ar9170usb");
+MODULE_ALIAS("arusb_lnx");
+
+/*
+ * Note:
+ *
+ * Always update our wiki's device list (located at:
+ * http://wireless.kernel.org/en/users/Drivers/ar9170/devices ),
+ * whenever you add a new device.
+ */
+static struct usb_device_id carl9170_usb_ids[] = {
+        /* Atheros 9170 */
+        { USB_DEVICE(0x0cf3, 0x9170) },
+        /* Atheros TG121N */
+        { USB_DEVICE(0x0cf3, 0x1001) },
+        /* TP-Link TL-WN821N v2 */
+        { USB_DEVICE(0x0cf3, 0x1002), .driver_info = CARL9170_WPS_BUTTON |
+                 CARL9170_ONE_LED },
+        /* 3Com Dual Band 802.11n USB Adapter */
+        { USB_DEVICE(0x0cf3, 0x1010) },
+        /* H3C Dual Band 802.11n USB Adapter */
+        { USB_DEVICE(0x0cf3, 0x1011) },
+        /* Cace Airpcap NX */
+        { USB_DEVICE(0xcace, 0x0300) },
+        /* D-Link DWA 160 A1 */
+        { USB_DEVICE(0x07d1, 0x3c10) },
+        /* D-Link DWA 160 A2 */
+        { USB_DEVICE(0x07d1, 0x3a09) },
+        /* Netgear WNA1000 */
+        { USB_DEVICE(0x0846, 0x9040) },
+        /* Netgear WNDA3100 */
+        { USB_DEVICE(0x0846, 0x9010) },
+        /* Netgear WN111 v2 */
+        { USB_DEVICE(0x0846, 0x9001), .driver_info = CARL9170_ONE_LED },
+        /* Zydas ZD1221 */
+        { USB_DEVICE(0x0ace, 0x1221) },
+        /* Proxim ORiNOCO 802.11n USB */
+        { USB_DEVICE(0x1435, 0x0804) },
+        /* WNC Generic 11n USB Dongle */
+        { USB_DEVICE(0x1435, 0x0326) },
+        /* ZyXEL NWD271N */
+        { USB_DEVICE(0x0586, 0x3417) },
+        /* Z-Com UB81 BG */
+        { USB_DEVICE(0x0cde, 0x0023) },
+        /* Z-Com UB82 ABG */
+        { USB_DEVICE(0x0cde, 0x0026) },
+        /* Sphairon Homelink 1202 */
+        { USB_DEVICE(0x0cde, 0x0027) },
+        /* Arcadyan WN7512 */
+        { USB_DEVICE(0x083a, 0xf522) },
+        /* Planex GWUS300 */
+        { USB_DEVICE(0x2019, 0x5304) },
+        /* IO-Data WNGDNUS2 */
+        { USB_DEVICE(0x04bb, 0x093f) },
+        /* NEC WL300NU-G */
+        { USB_DEVICE(0x0409, 0x0249) },
+        /* AVM FRITZ!WLAN USB Stick N */
+        { USB_DEVICE(0x057c, 0x8401) },
+        /* AVM FRITZ!WLAN USB Stick N 2.4 */
+        { USB_DEVICE(0x057c, 0x8402) },
+        /* Qwest/Actiontec 802AIN Wireless N USB Network Adapter */
+        { USB_DEVICE(0x1668, 0x1200) },
+
+        /* terminate */
+        {}
+};
+MODULE_DEVICE_TABLE(usb, carl9170_usb_ids);
+
+static void carl9170_usb_submit_data_urb(struct ar9170 *ar)
+{
+        struct urb *urb;
+        int err;
+
+        if (atomic_inc_return(&ar->tx_anch_urbs) > AR9170_NUM_TX_URBS)
+                goto err_acc;
+
+        urb = usb_get_from_anchor(&ar->tx_wait);
+        if (!urb)
+                goto err_acc;
+
+        usb_anchor_urb(urb, &ar->tx_anch);
+
+        err = usb_submit_urb(urb, GFP_ATOMIC);
+        if (unlikely(err)) {
+                if (net_ratelimit()) {
+                        dev_err(&ar->udev->dev, "tx submit failed (%d)\n",
+                                urb->status);
+                }
+
+                usb_unanchor_urb(urb);
+                usb_anchor_urb(urb, &ar->tx_err);
+        }
+
+        usb_free_urb(urb);
+
+        if (likely(err == 0))
+                return;
+
+err_acc:
+        atomic_dec(&ar->tx_anch_urbs);
+}
+
+static void carl9170_usb_tx_data_complete(struct urb *urb)
+{
+        struct ar9170 *ar = (struct ar9170 *)
+              usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+
+        if (WARN_ON_ONCE(!ar)) {
+                dev_kfree_skb_irq(urb->context);
+                return;
+        }
+
+        atomic_dec(&ar->tx_anch_urbs);
+
+        switch (urb->status) {
+        /* everything is fine */
+        case 0:
+                carl9170_tx_callback(ar, (void *)urb->context);
+                break;
+
+        /* disconnect */
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                /*
+                 * Defer the frame clean-up to the tasklet worker.
+                 * This is necessary, because carl9170_tx_drop
+                 * does not work in an irqsave context.
+                 */
+                usb_anchor_urb(urb, &ar->tx_err);
+                return;
+
+        /* a random transmission error has occurred? */
+        default:
+                if (net_ratelimit()) {
+                        dev_err(&ar->udev->dev, "tx failed (%d)\n",
+                                urb->status);
+                }
+
+                usb_anchor_urb(urb, &ar->tx_err);
+                break;
+        }
+
+        if (likely(IS_STARTED(ar)))
+                carl9170_usb_submit_data_urb(ar);
+}
+
+static int carl9170_usb_submit_cmd_urb(struct ar9170 *ar)
+{
+        struct urb *urb;
+        int err;
+
+        if (atomic_inc_return(&ar->tx_cmd_urbs) != 1) {
+                atomic_dec(&ar->tx_cmd_urbs);
+                return 0;
+        }
+
+        urb = usb_get_from_anchor(&ar->tx_cmd);
+        if (!urb) {
+                atomic_dec(&ar->tx_cmd_urbs);
+                return 0;
+        }
+
+        usb_anchor_urb(urb, &ar->tx_anch);
+        err = usb_submit_urb(urb, GFP_ATOMIC);
+        if (unlikely(err)) {
+                usb_unanchor_urb(urb);
+                atomic_dec(&ar->tx_cmd_urbs);
+        }
+        usb_free_urb(urb);
+
+        return err;
+}
+
+static void carl9170_usb_cmd_complete(struct urb *urb)
+{
+        struct ar9170 *ar = urb->context;
+        int err = 0;
+
+        if (WARN_ON_ONCE(!ar))
+                return;
+
+        atomic_dec(&ar->tx_cmd_urbs);
+
+        switch (urb->status) {
+        /* everything is fine */
+        case 0:
+                break;
+
+        /* disconnect */
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                return;
+
+        default:
+                err = urb->status;
+                break;
+        }
+
+        if (!IS_INITIALIZED(ar))
+                return;
+
+        if (err)
+                dev_err(&ar->udev->dev, "submit cmd cb failed (%d).\n", err);
+
+        err = carl9170_usb_submit_cmd_urb(ar);
+        if (err)
+                dev_err(&ar->udev->dev, "submit cmd failed (%d).\n", err);
+}
+
+static void carl9170_usb_rx_irq_complete(struct urb *urb)
+{
+        struct ar9170 *ar = urb->context;
+
+        if (WARN_ON_ONCE(!ar))
+                return;
+
+        switch (urb->status) {
+        /* everything is fine */
+        case 0:
+                break;
+
+        /* disconnect */
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                return;
+
+        default:
+                goto resubmit;
+        }
+
+        carl9170_handle_command_response(ar, urb->transfer_buffer,
+                                         urb->actual_length);
+
+resubmit:
+        usb_anchor_urb(urb, &ar->rx_anch);
+        if (unlikely(usb_submit_urb(urb, GFP_ATOMIC)))
+                usb_unanchor_urb(urb);
+}
+
+static int carl9170_usb_submit_rx_urb(struct ar9170 *ar, gfp_t gfp)
+{
+        struct urb *urb;
+        int err = 0, runs = 0;
+
+        while ((atomic_read(&ar->rx_anch_urbs) < AR9170_NUM_RX_URBS) &&
+                (runs++ < AR9170_NUM_RX_URBS)) {
+                err = -ENOSPC;
+                urb = usb_get_from_anchor(&ar->rx_pool);
+                if (urb) {
+                        usb_anchor_urb(urb, &ar->rx_anch);
+                        err = usb_submit_urb(urb, gfp);
+                        if (unlikely(err)) {
+                                usb_unanchor_urb(urb);
+                                usb_anchor_urb(urb, &ar->rx_pool);
+                        } else {
+                                atomic_dec(&ar->rx_pool_urbs);
+                                atomic_inc(&ar->rx_anch_urbs);
+                        }
+                        usb_free_urb(urb);
+                }
+        }
+
+        return err;
+}
+
+static void carl9170_usb_rx_work(struct ar9170 *ar)
+{
+        struct urb *urb;
+        int i;
+
+        for (i = 0; i < AR9170_NUM_RX_URBS_POOL; i++) {
+                urb = usb_get_from_anchor(&ar->rx_work);
+                if (!urb)
+                        break;
+
+                atomic_dec(&ar->rx_work_urbs);
+                if (IS_INITIALIZED(ar)) {
+                        carl9170_rx(ar, urb->transfer_buffer,
+                                    urb->actual_length);
+                }
+
+                usb_anchor_urb(urb, &ar->rx_pool);
+                atomic_inc(&ar->rx_pool_urbs);
+
+                usb_free_urb(urb);
+
+                carl9170_usb_submit_rx_urb(ar, GFP_ATOMIC);
+        }
+}
+
+void carl9170_usb_handle_tx_err(struct ar9170 *ar)
+{
+        struct urb *urb;
+
+        while ((urb = usb_get_from_anchor(&ar->tx_err))) {
+                struct sk_buff *skb = (void *)urb->context;
+
+                carl9170_tx_drop(ar, skb);
+                carl9170_tx_callback(ar, skb);
+                usb_free_urb(urb);
+        }
+}
+
+static void carl9170_usb_tasklet(unsigned long data)
+{
+        struct ar9170 *ar = (struct ar9170 *) data;
+
+        if (!IS_INITIALIZED(ar))
+                return;
+
+        carl9170_usb_rx_work(ar);
+
+        /*
+         * Strictly speaking: The tx scheduler is not part of the USB system.
+         * But the rx worker returns frames back to the mac80211-stack and
+         * this is the _perfect_ place to generate the next transmissions.
+         */
+        if (IS_STARTED(ar))
+                carl9170_tx_scheduler(ar);
+}
+
+static void carl9170_usb_rx_complete(struct urb *urb)
+{
+        struct ar9170 *ar = (struct ar9170 *)urb->context;
+        int err;
+
+        if (WARN_ON_ONCE(!ar))
+                return;
+
+        atomic_dec(&ar->rx_anch_urbs);
+
+        switch (urb->status) {
+        case 0:
+                /* rx path */
+                usb_anchor_urb(urb, &ar->rx_work);
+                atomic_inc(&ar->rx_work_urbs);
+                break;
+
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                /* handle disconnect events*/
+                return;
+
+        default:
+                /* handle all other errors */
+                usb_anchor_urb(urb, &ar->rx_pool);
+                atomic_inc(&ar->rx_pool_urbs);
+                break;
+        }
+
+        err = carl9170_usb_submit_rx_urb(ar, GFP_ATOMIC);
+        if (unlikely(err)) {
+                /*
+                 * usb_submit_rx_urb reported a problem.
+                 * In case this is due to a rx buffer shortage,
+                 * elevate the tasklet worker priority to
+                 * the highest available level.
+                 */
+                tasklet_hi_schedule(&ar->usb_tasklet);
+
+                if (atomic_read(&ar->rx_anch_urbs) == 0) {
+                        /*
+                         * The system is too slow to cope with
+                         * the enormous workload. We have simply
+                         * run out of active rx urbs and this
+                         * unfortunatly leads to an unpredictable
+                         * device.
+                         */
+
+                        carl9170_restart(ar, CARL9170_RR_SLOW_SYSTEM);
+                }
+        } else {
+                /*
+                 * Using anything less than _high_ priority absolutely
+                 * kills the rx performance my UP-System...
+                 */
+                tasklet_hi_schedule(&ar->usb_tasklet);
+        }
+}
+
+static struct urb *carl9170_usb_alloc_rx_urb(struct ar9170 *ar, gfp_t gfp)
+{
+        struct urb *urb;
+        void *buf;
+
+        buf = kmalloc(ar->fw.rx_size, gfp);
+        if (!buf)
+                return NULL;
+
+        urb = usb_alloc_urb(0, gfp);
+        if (!urb) {
+                kfree(buf);
+                return NULL;
+        }
+
+        usb_fill_bulk_urb(urb, ar->udev, usb_rcvbulkpipe(ar->udev,
+                          AR9170_USB_EP_RX), buf, ar->fw.rx_size,
+                          carl9170_usb_rx_complete, ar);
+
+        urb->transfer_flags |= URB_FREE_BUFFER;
+
+        return urb;
+}
+
+static int carl9170_usb_send_rx_irq_urb(struct ar9170 *ar)
+{
+        struct urb *urb = NULL;
+        void *ibuf;
+        int err = -ENOMEM;
+
+        urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (!urb)
+                goto out;
+
+        ibuf = kmalloc(AR9170_USB_EP_CTRL_MAX, GFP_KERNEL);
+        if (!ibuf)
+                goto out;
+
+        usb_fill_int_urb(urb, ar->udev, usb_rcvintpipe(ar->udev,
+                         AR9170_USB_EP_IRQ), ibuf, AR9170_USB_EP_CTRL_MAX,
+                         carl9170_usb_rx_irq_complete, ar, 1);
+
+        urb->transfer_flags |= URB_FREE_BUFFER;
+
+        usb_anchor_urb(urb, &ar->rx_anch);
+        err = usb_submit_urb(urb, GFP_KERNEL);
+        if (err)
+                usb_unanchor_urb(urb);
+
+out:
+        usb_free_urb(urb);
+        return err;
+}
+
+static int carl9170_usb_init_rx_bulk_urbs(struct ar9170 *ar)
+{
+        struct urb *urb;
+        int i, err = -EINVAL;
+
+        /*
+         * The driver actively maintains a second shadow
+         * pool for inactive, but fully-prepared rx urbs.
+         *
+         * The pool should help the driver to master huge
+         * workload spikes without running the risk of
+         * undersupplying the hardware or wasting time by
+         * processing rx data (streams) inside the urb
+         * completion (hardirq context).
+         */
+        for (i = 0; i < AR9170_NUM_RX_URBS_POOL; i++) {
+                urb = carl9170_usb_alloc_rx_urb(ar, GFP_KERNEL);
+                if (!urb) {
+                        err = -ENOMEM;
+                        goto err_out;
+                }
+
+                usb_anchor_urb(urb, &ar->rx_pool);
+                atomic_inc(&ar->rx_pool_urbs);
+                usb_free_urb(urb);
+        }
+
+        err = carl9170_usb_submit_rx_urb(ar, GFP_KERNEL);
+        if (err)
+                goto err_out;
+
+        /* the device now waiting for the firmware. */
+        carl9170_set_state_when(ar, CARL9170_STOPPED, CARL9170_IDLE);
+        return 0;
+
+err_out:
+
+        usb_scuttle_anchored_urbs(&ar->rx_pool);
+        usb_scuttle_anchored_urbs(&ar->rx_work);
+        usb_kill_anchored_urbs(&ar->rx_anch);
+        return err;
+}
+
+static int carl9170_usb_flush(struct ar9170 *ar)
+{
+        struct urb *urb;
+        int ret, err = 0;
+
+        while ((urb = usb_get_from_anchor(&ar->tx_wait))) {
+                struct sk_buff *skb = (void *)urb->context;
+                carl9170_tx_drop(ar, skb);
+                carl9170_tx_callback(ar, skb);
+                usb_free_urb(urb);
+        }
+
+        ret = usb_wait_anchor_empty_timeout(&ar->tx_cmd, HZ);
+        if (ret == 0)
+                err = -ETIMEDOUT;
+
+        /* lets wait a while until the tx - queues are dried out */
+        ret = usb_wait_anchor_empty_timeout(&ar->tx_anch, HZ);
+        if (ret == 0)
+                err = -ETIMEDOUT;
+
+        usb_kill_anchored_urbs(&ar->tx_anch);
+        carl9170_usb_handle_tx_err(ar);
+
+        return err;
+}
+
+static void carl9170_usb_cancel_urbs(struct ar9170 *ar)
+{
+        int err;
+
+        carl9170_set_state(ar, CARL9170_UNKNOWN_STATE);
+
+        err = carl9170_usb_flush(ar);
+        if (err)
+                dev_err(&ar->udev->dev, "stuck tx urbs!\n");
+
+        usb_poison_anchored_urbs(&ar->tx_anch);
+        carl9170_usb_handle_tx_err(ar);
+        usb_poison_anchored_urbs(&ar->rx_anch);
+
+        tasklet_kill(&ar->usb_tasklet);
+
+        usb_scuttle_anchored_urbs(&ar->rx_work);
+        usb_scuttle_anchored_urbs(&ar->rx_pool);
+        usb_scuttle_anchored_urbs(&ar->tx_cmd);
+}
+
+int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd,
+                        const bool free_buf)
+{
+        struct urb *urb;
+
+        if (!IS_INITIALIZED(ar))
+                return -EPERM;
+
+        if (WARN_ON(cmd->hdr.len > CARL9170_MAX_CMD_LEN - 4))
+                return -EINVAL;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb)
+                return -ENOMEM;
+
+        usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,
+                AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
+                carl9170_usb_cmd_complete, ar, 1);
+
+        if (free_buf)
+                urb->transfer_flags |= URB_FREE_BUFFER;
+
+        usb_anchor_urb(urb, &ar->tx_cmd);
+        usb_free_urb(urb);
+
+        return carl9170_usb_submit_cmd_urb(ar);
+}
+
+int carl9170_exec_cmd(struct ar9170 *ar, const enum carl9170_cmd_oids cmd,
+        unsigned int plen, void *payload, unsigned int outlen, void *out)
+{
+        int err = -ENOMEM;
+
+        if (!IS_ACCEPTING_CMD(ar))
+                return -EIO;
+
+        if (!(cmd & CARL9170_CMD_ASYNC_FLAG))
+                might_sleep();
+
+        ar->cmd.hdr.len = plen;
+        ar->cmd.hdr.cmd = cmd;
+        /* writing multiple regs fills this buffer already */
+        if (plen && payload != (u8 *)(ar->cmd.data))
+                memcpy(ar->cmd.data, payload, plen);
+
+        spin_lock_bh(&ar->cmd_lock);
+        ar->readbuf = (u8 *)out;
+        ar->readlen = outlen;
+        spin_unlock_bh(&ar->cmd_lock);
+
+        err = __carl9170_exec_cmd(ar, &ar->cmd, false);
+
+        if (!(cmd & CARL9170_CMD_ASYNC_FLAG)) {
+                err = wait_for_completion_timeout(&ar->cmd_wait, HZ);
+                if (err == 0) {
+                        err = -ETIMEDOUT;
+                        goto err_unbuf;
+                }
+
+                if (ar->readlen != outlen) {
+                        err = -EMSGSIZE;
+                        goto err_unbuf;
+                }
+        }
+
+        return 0;
+
+err_unbuf:
+        /* Maybe the device was removed in the moment we were waiting? */
+        if (IS_STARTED(ar)) {
+                dev_err(&ar->udev->dev, "no command feedback "
+                        "received (%d).\n", err);
+
+                /* provide some maybe useful debug information */
+                print_hex_dump_bytes("carl9170 cmd: ", DUMP_PREFIX_NONE,
+                                     &ar->cmd, plen + 4);
+
+                carl9170_restart(ar, CARL9170_RR_COMMAND_TIMEOUT);
+        }
+
+        /* invalidate to avoid completing the next command prematurely */
+        spin_lock_bh(&ar->cmd_lock);
+        ar->readbuf = NULL;
+        ar->readlen = 0;
+        spin_unlock_bh(&ar->cmd_lock);
+
+        return err;
+}
+
+void carl9170_usb_tx(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct urb *urb;
+        struct ar9170_stream *tx_stream;
+        void *data;
+        unsigned int len;
+
+        if (!IS_STARTED(ar))
+                goto err_drop;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb)
+                goto err_drop;
+
+        if (ar->fw.tx_stream) {
+                tx_stream = (void *) (skb->data - sizeof(*tx_stream));
+
+                len = skb->len + sizeof(*tx_stream);
+                tx_stream->length = cpu_to_le16(len);
+                tx_stream->tag = cpu_to_le16(AR9170_TX_STREAM_TAG);
+                data = tx_stream;
+        } else {
+                data = skb->data;
+                len = skb->len;
+        }
+
+        usb_fill_bulk_urb(urb, ar->udev, usb_sndbulkpipe(ar->udev,
+                AR9170_USB_EP_TX), data, len,
+                carl9170_usb_tx_data_complete, skb);
+
+        urb->transfer_flags |= URB_ZERO_PACKET;
+
+        usb_anchor_urb(urb, &ar->tx_wait);
+
+        usb_free_urb(urb);
+
+        carl9170_usb_submit_data_urb(ar);
+        return;
+
+err_drop:
+        carl9170_tx_drop(ar, skb);
+        carl9170_tx_callback(ar, skb);
+}
+
+static void carl9170_release_firmware(struct ar9170 *ar)
+{
+        if (ar->fw.fw) {
+                release_firmware(ar->fw.fw);
+                memset(&ar->fw, 0, sizeof(ar->fw));
+        }
+}
+
+void carl9170_usb_stop(struct ar9170 *ar)
+{
+        int ret;
+
+        carl9170_set_state_when(ar, CARL9170_IDLE, CARL9170_STOPPED);
+
+        ret = carl9170_usb_flush(ar);
+        if (ret)
+                dev_err(&ar->udev->dev, "kill pending tx urbs.\n");
+
+        usb_poison_anchored_urbs(&ar->tx_anch);
+        carl9170_usb_handle_tx_err(ar);
+
+        /* kill any pending command */
+        spin_lock_bh(&ar->cmd_lock);
+        ar->readlen = 0;
+        spin_unlock_bh(&ar->cmd_lock);
+        complete_all(&ar->cmd_wait);
+
+        /* This is required to prevent an early completion on _start */
+        INIT_COMPLETION(ar->cmd_wait);
+
+        /*
+         * Note:
+         * So far we freed all tx urbs, but we won't dare to touch any rx urbs.
+         * Else we would end up with a unresponsive device...
+         */
+}
+
+int carl9170_usb_open(struct ar9170 *ar)
+{
+        usb_unpoison_anchored_urbs(&ar->tx_anch);
+
+        carl9170_set_state_when(ar, CARL9170_STOPPED, CARL9170_IDLE);
+        return 0;
+}
+
+static int carl9170_usb_load_firmware(struct ar9170 *ar)
+{
+        const u8 *data;
+        u8 *buf;
+        unsigned int transfer;
+        size_t len;
+        u32 addr;
+        int err = 0;
+
+        buf = kmalloc(4096, GFP_KERNEL);
+        if (!buf) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+
+        data = ar->fw.fw->data;
+        len = ar->fw.fw->size;
+        addr = ar->fw.address;
+
+        /* this removes the miniboot image */
+        data += ar->fw.offset;
+        len -= ar->fw.offset;
+
+        while (len) {
+                transfer = min_t(unsigned int, len, 4096u);
+                memcpy(buf, data, transfer);
+
+                err = usb_control_msg(ar->udev, usb_sndctrlpipe(ar->udev, 0),
+                                      0x30 /* FW DL */, 0x40 | USB_DIR_OUT,
+                                      addr >> 8, 0, buf, transfer, 100);
+
+                if (err < 0) {
+                        kfree(buf);
+                        goto err_out;
+                }
+
+                len -= transfer;
+                data += transfer;
+                addr += transfer;
+        }
+        kfree(buf);
+
+        err = usb_control_msg(ar->udev, usb_sndctrlpipe(ar->udev, 0),
+                              0x31 /* FW DL COMPLETE */,
+                              0x40 | USB_DIR_OUT, 0, 0, NULL, 0, 200);
+
+        if (wait_for_completion_timeout(&ar->fw_boot_wait, HZ) == 0) {
+                err = -ETIMEDOUT;
+                goto err_out;
+        }
+
+        err = carl9170_echo_test(ar, 0x4a110123);
+        if (err)
+                goto err_out;
+
+        /* firmware restarts cmd counter */
+        ar->cmd_seq = -1;
+
+        return 0;
+
+err_out:
+        dev_err(&ar->udev->dev, "firmware upload failed (%d).\n", err);
+        return err;
+}
+
+int carl9170_usb_restart(struct ar9170 *ar)
+{
+        int err = 0;
+
+        if (ar->intf->condition != USB_INTERFACE_BOUND)
+                return 0;
+
+        /* Disable command response sequence counter. */
+        ar->cmd_seq = -2;
+
+        err = carl9170_reboot(ar);
+
+        carl9170_usb_stop(ar);
+
+        if (err)
+                goto err_out;
+
+        tasklet_schedule(&ar->usb_tasklet);
+
+        /* The reboot procedure can take quite a while to complete. */
+        msleep(1100);
+
+        err = carl9170_usb_open(ar);
+        if (err)
+                goto err_out;
+
+        err = carl9170_usb_load_firmware(ar);
+        if (err)
+                goto err_out;
+
+        return 0;
+
+err_out:
+        carl9170_usb_cancel_urbs(ar);
+        return err;
+}
+
+void carl9170_usb_reset(struct ar9170 *ar)
+{
+        /*
+         * This is the last resort to get the device going again
+         * without any *user replugging action*.
+         *
+         * But there is a catch: usb_reset really is like a physical
+         * *reconnect*. The mac80211 state will be lost in the process.
+         * Therefore a userspace application, which is monitoring
+         * the link must step in.
+         */
+        carl9170_usb_cancel_urbs(ar);
+
+        carl9170_usb_stop(ar);
+
+        usb_queue_reset_device(ar->intf);
+}
+
+static int carl9170_usb_init_device(struct ar9170 *ar)
+{
+        int err;
+
+        err = carl9170_usb_send_rx_irq_urb(ar);
+        if (err)
+                goto err_out;
+
+        err = carl9170_usb_init_rx_bulk_urbs(ar);
+        if (err)
+                goto err_unrx;
+
+        mutex_lock(&ar->mutex);
+        err = carl9170_usb_load_firmware(ar);
+        mutex_unlock(&ar->mutex);
+        if (err)
+                goto err_unrx;
+
+        return 0;
+
+err_unrx:
+        carl9170_usb_cancel_urbs(ar);
+
+err_out:
+        return err;
+}
+
+static void carl9170_usb_firmware_failed(struct ar9170 *ar)
+{
+        struct device *parent = ar->udev->dev.parent;
+        struct usb_device *udev;
+
+        /*
+         * Store a copy of the usb_device pointer locally.
+         * This is because device_release_driver initiates
+         * carl9170_usb_disconnect, which in turn frees our
+         * driver context (ar).
+         */
+        udev = ar->udev;
+
+        complete(&ar->fw_load_wait);
+
+        /* unbind anything failed */
+        if (parent)
+                device_lock(parent);
+
+        device_release_driver(&udev->dev);
+        if (parent)
+                device_unlock(parent);
+
+        usb_put_dev(udev);
+}
+
+static void carl9170_usb_firmware_finish(struct ar9170 *ar)
+{
+        int err;
+
+        err = carl9170_parse_firmware(ar);
+        if (err)
+                goto err_freefw;
+
+        err = carl9170_usb_init_device(ar);
+        if (err)
+                goto err_freefw;
+
+        err = carl9170_usb_open(ar);
+        if (err)
+                goto err_unrx;
+
+        err = carl9170_register(ar);
+
+        carl9170_usb_stop(ar);
+        if (err)
+                goto err_unrx;
+
+        complete(&ar->fw_load_wait);
+        usb_put_dev(ar->udev);
+        return;
+
+err_unrx:
+        carl9170_usb_cancel_urbs(ar);
+
+err_freefw:
+        carl9170_release_firmware(ar);
+        carl9170_usb_firmware_failed(ar);
+}
+
+static void carl9170_usb_firmware_step2(const struct firmware *fw,
+                                        void *context)
+{
+        struct ar9170 *ar = context;
+
+        if (fw) {
+                ar->fw.fw = fw;
+                carl9170_usb_firmware_finish(ar);
+                return;
+        }
+
+        dev_err(&ar->udev->dev, "firmware not found.\n");
+        carl9170_usb_firmware_failed(ar);
+}
+
+static int carl9170_usb_probe(struct usb_interface *intf,
+                              const struct usb_device_id *id)
+{
+        struct ar9170 *ar;
+        struct usb_device *udev;
+        int err;
+
+        err = usb_reset_device(interface_to_usbdev(intf));
+        if (err)
+                return err;
+
+        ar = carl9170_alloc(sizeof(*ar));
+        if (IS_ERR(ar))
+                return PTR_ERR(ar);
+
+        udev = interface_to_usbdev(intf);
+        usb_get_dev(udev);
+        ar->udev = udev;
+        ar->intf = intf;
+        ar->features = id->driver_info;
+
+        usb_set_intfdata(intf, ar);
+        SET_IEEE80211_DEV(ar->hw, &intf->dev);
+
+        init_usb_anchor(&ar->rx_anch);
+        init_usb_anchor(&ar->rx_pool);
+        init_usb_anchor(&ar->rx_work);
+        init_usb_anchor(&ar->tx_wait);
+        init_usb_anchor(&ar->tx_anch);
+        init_usb_anchor(&ar->tx_cmd);
+        init_usb_anchor(&ar->tx_err);
+        init_completion(&ar->cmd_wait);
+        init_completion(&ar->fw_boot_wait);
+        init_completion(&ar->fw_load_wait);
+        tasklet_init(&ar->usb_tasklet, carl9170_usb_tasklet,
+                     (unsigned long)ar);
+
+        atomic_set(&ar->tx_cmd_urbs, 0);
+        atomic_set(&ar->tx_anch_urbs, 0);
+        atomic_set(&ar->rx_work_urbs, 0);
+        atomic_set(&ar->rx_anch_urbs, 0);
+        atomic_set(&ar->rx_pool_urbs, 0);
+        ar->cmd_seq = -2;
+
+        usb_get_dev(ar->udev);
+
+        carl9170_set_state(ar, CARL9170_STOPPED);
+
+        return request_firmware_nowait(THIS_MODULE, 1, CARL9170FW_NAME,
+                &ar->udev->dev, GFP_KERNEL, ar, carl9170_usb_firmware_step2);
+}
+
+static void carl9170_usb_disconnect(struct usb_interface *intf)
+{
+        struct ar9170 *ar = usb_get_intfdata(intf);
+        struct usb_device *udev;
+
+        if (WARN_ON(!ar))
+                return;
+
+        udev = ar->udev;
+        wait_for_completion(&ar->fw_load_wait);
+
+        if (IS_INITIALIZED(ar)) {
+                carl9170_reboot(ar);
+                carl9170_usb_stop(ar);
+        }
+
+        carl9170_usb_cancel_urbs(ar);
+        carl9170_unregister(ar);
+
+        usb_set_intfdata(intf, NULL);
+
+        carl9170_release_firmware(ar);
+        carl9170_free(ar);
+        usb_put_dev(udev);
+}
+
+#ifdef CONFIG_PM
+static int carl9170_usb_suspend(struct usb_interface *intf,
+                                pm_message_t message)
+{
+        struct ar9170 *ar = usb_get_intfdata(intf);
+
+        if (!ar)
+                return -ENODEV;
+
+        carl9170_usb_cancel_urbs(ar);
+
+        /*
+         * firmware automatically reboots for usb suspend.
+         */
+
+        return 0;
+}
+
+static int carl9170_usb_resume(struct usb_interface *intf)
+{
+        struct ar9170 *ar = usb_get_intfdata(intf);
+        int err;
+
+        if (!ar)
+                return -ENODEV;
+
+        usb_unpoison_anchored_urbs(&ar->rx_anch);
+
+        err = carl9170_usb_init_device(ar);
+        if (err)
+                goto err_unrx;
+
+        err = carl9170_usb_open(ar);
+        if (err)
+                goto err_unrx;
+
+        return 0;
+
+err_unrx:
+        carl9170_usb_cancel_urbs(ar);
+
+        return err;
+}
+#endif /* CONFIG_PM */
+
+static struct usb_driver carl9170_driver = {
+        .name = KBUILD_MODNAME,
+        .probe = carl9170_usb_probe,
+        .disconnect = carl9170_usb_disconnect,
+        .id_table = carl9170_usb_ids,
+        .soft_unbind = 1,
+#ifdef CONFIG_PM
+        .suspend = carl9170_usb_suspend,
+        .resume = carl9170_usb_resume,
+#endif /* CONFIG_PM */
+};
+
+static int __init carl9170_usb_init(void)
+{
+        return usb_register(&carl9170_driver);
+}
+
+static void __exit carl9170_usb_exit(void)
+{
+        usb_deregister(&carl9170_driver);
+}
+
+module_init(carl9170_usb_init);
+module_exit(carl9170_usb_exit);
diff --git a/drivers/net/wireless/ath/carl9170/version.h b/drivers/net/wireless/ath/carl9170/version.h
new file mode 100644
index 000000000000..ff53f078a0b5
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/version.h
@@ -0,0 +1,7 @@
+#ifndef __CARL9170_SHARED_VERSION_H
+#define __CARL9170_SHARED_VERSION_H
+#define CARL9170FW_VERSION_YEAR 10
+#define CARL9170FW_VERSION_MONTH 9
+#define CARL9170FW_VERSION_DAY 28
+#define CARL9170FW_VERSION_GIT "1.8.8.3"
+#endif /* __CARL9170_SHARED_VERSION_H */
diff --git a/drivers/net/wireless/ath/carl9170/wlan.h b/drivers/net/wireless/ath/carl9170/wlan.h
new file mode 100644
index 000000000000..24d63b583b6b
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/wlan.h
@@ -0,0 +1,420 @@
+/*
+ * Shared Atheros AR9170 Header
+ *
+ * RX/TX meta descriptor format
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __CARL9170_SHARED_WLAN_H
+#define __CARL9170_SHARED_WLAN_H
+
+#include "fwcmd.h"
+
+#define AR9170_RX_PHY_RATE_CCK_1M               0x0a
+#define AR9170_RX_PHY_RATE_CCK_2M               0x14
+#define AR9170_RX_PHY_RATE_CCK_5M               0x37
+#define AR9170_RX_PHY_RATE_CCK_11M              0x6e
+
+#define AR9170_ENC_ALG_NONE                     0x0
+#define AR9170_ENC_ALG_WEP64                    0x1
+#define AR9170_ENC_ALG_TKIP                     0x2
+#define AR9170_ENC_ALG_AESCCMP                  0x4
+#define AR9170_ENC_ALG_WEP128                   0x5
+#define AR9170_ENC_ALG_WEP256                   0x6
+#define AR9170_ENC_ALG_CENC                     0x7
+
+#define AR9170_RX_ENC_SOFTWARE                  0x8
+
+#define AR9170_RX_STATUS_MODULATION             0x03
+#define AR9170_RX_STATUS_MODULATION_S           0
+#define AR9170_RX_STATUS_MODULATION_CCK         0x00
+#define AR9170_RX_STATUS_MODULATION_OFDM        0x01
+#define AR9170_RX_STATUS_MODULATION_HT          0x02
+#define AR9170_RX_STATUS_MODULATION_DUPOFDM     0x03
+
+/* depends on modulation */
+#define AR9170_RX_STATUS_SHORT_PREAMBLE         0x08
+#define AR9170_RX_STATUS_GREENFIELD             0x08
+
+#define AR9170_RX_STATUS_MPDU                   0x30
+#define AR9170_RX_STATUS_MPDU_S                 4
+#define AR9170_RX_STATUS_MPDU_SINGLE            0x00
+#define AR9170_RX_STATUS_MPDU_FIRST             0x20
+#define AR9170_RX_STATUS_MPDU_MIDDLE            0x30
+#define AR9170_RX_STATUS_MPDU_LAST              0x10
+
+#define AR9170_RX_STATUS_CONT_AGGR              0x40
+#define AR9170_RX_STATUS_TOTAL_ERROR            0x80
+
+#define AR9170_RX_ERROR_RXTO                    0x01
+#define AR9170_RX_ERROR_OVERRUN                 0x02
+#define AR9170_RX_ERROR_DECRYPT                 0x04
+#define AR9170_RX_ERROR_FCS                     0x08
+#define AR9170_RX_ERROR_WRONG_RA                0x10
+#define AR9170_RX_ERROR_PLCP                    0x20
+#define AR9170_RX_ERROR_MMIC                    0x40
+
+/* these are either-or */
+#define AR9170_TX_MAC_PROT_RTS                  0x0001
+#define AR9170_TX_MAC_PROT_CTS                  0x0002
+#define AR9170_TX_MAC_PROT                      0x0003
+
+#define AR9170_TX_MAC_NO_ACK                    0x0004
+/* if unset, MAC will only do SIFS space before frame */
+#define AR9170_TX_MAC_BACKOFF                   0x0008
+#define AR9170_TX_MAC_BURST                     0x0010
+#define AR9170_TX_MAC_AGGR                      0x0020
+
+/* encryption is a two-bit field */
+#define AR9170_TX_MAC_ENCR_NONE                 0x0000
+#define AR9170_TX_MAC_ENCR_RC4                  0x0040
+#define AR9170_TX_MAC_ENCR_CENC                 0x0080
+#define AR9170_TX_MAC_ENCR_AES                  0x00c0
+
+#define AR9170_TX_MAC_MMIC                      0x0100
+#define AR9170_TX_MAC_HW_DURATION               0x0200
+#define AR9170_TX_MAC_QOS_S                     10
+#define AR9170_TX_MAC_QOS                       0x0c00
+#define AR9170_TX_MAC_DISABLE_TXOP              0x1000
+#define AR9170_TX_MAC_TXOP_RIFS                 0x2000
+#define AR9170_TX_MAC_IMM_BA                    0x4000
+
+/* either-or */
+#define AR9170_TX_PHY_MOD_CCK                   0x00000000
+#define AR9170_TX_PHY_MOD_OFDM                  0x00000001
+#define AR9170_TX_PHY_MOD_HT                    0x00000002
+
+/* depends on modulation */
+#define AR9170_TX_PHY_SHORT_PREAMBLE            0x00000004
+#define AR9170_TX_PHY_GREENFIELD                0x00000004
+
+#define AR9170_TX_PHY_BW_S                      3
+#define AR9170_TX_PHY_BW                        (3 << AR9170_TX_PHY_BW_SHIFT)
+#define AR9170_TX_PHY_BW_20MHZ                  0
+#define AR9170_TX_PHY_BW_40MHZ                  2
+#define AR9170_TX_PHY_BW_40MHZ_DUP              3
+
+#define AR9170_TX_PHY_TX_HEAVY_CLIP_S           6
+#define AR9170_TX_PHY_TX_HEAVY_CLIP             (7 << \
+                                                 AR9170_TX_PHY_TX_HEAVY_CLIP_S)
+
+#define AR9170_TX_PHY_TX_PWR_S                  9
+#define AR9170_TX_PHY_TX_PWR                    (0x3f << \
+                                                 AR9170_TX_PHY_TX_PWR_S)
+
+#define AR9170_TX_PHY_TXCHAIN_S                 15
+#define AR9170_TX_PHY_TXCHAIN                   (7 << \
+                                                 AR9170_TX_PHY_TXCHAIN_S)
+#define AR9170_TX_PHY_TXCHAIN_1                 1
+/* use for cck, ofdm 6/9/12/18/24 and HT if capable */
+#define AR9170_TX_PHY_TXCHAIN_2                 5
+
+#define AR9170_TX_PHY_MCS_S                     18
+#define AR9170_TX_PHY_MCS                       (0x7f << \
+                                                 AR9170_TX_PHY_MCS_S)
+
+#define AR9170_TX_PHY_RATE_CCK_1M               0x0
+#define AR9170_TX_PHY_RATE_CCK_2M               0x1
+#define AR9170_TX_PHY_RATE_CCK_5M               0x2
+#define AR9170_TX_PHY_RATE_CCK_11M              0x3
+
+/* same as AR9170_RX_PHY_RATE */
+#define AR9170_TXRX_PHY_RATE_OFDM_6M            0xb
+#define AR9170_TXRX_PHY_RATE_OFDM_9M            0xf
+#define AR9170_TXRX_PHY_RATE_OFDM_12M           0xa
+#define AR9170_TXRX_PHY_RATE_OFDM_18M           0xe
+#define AR9170_TXRX_PHY_RATE_OFDM_24M           0x9
+#define AR9170_TXRX_PHY_RATE_OFDM_36M           0xd
+#define AR9170_TXRX_PHY_RATE_OFDM_48M           0x8
+#define AR9170_TXRX_PHY_RATE_OFDM_54M           0xc
+
+#define AR9170_TXRX_PHY_RATE_HT_MCS0            0x0
+#define AR9170_TXRX_PHY_RATE_HT_MCS1            0x1
+#define AR9170_TXRX_PHY_RATE_HT_MCS2            0x2
+#define AR9170_TXRX_PHY_RATE_HT_MCS3            0x3
+#define AR9170_TXRX_PHY_RATE_HT_MCS4            0x4
+#define AR9170_TXRX_PHY_RATE_HT_MCS5            0x5
+#define AR9170_TXRX_PHY_RATE_HT_MCS6            0x6
+#define AR9170_TXRX_PHY_RATE_HT_MCS7            0x7
+#define AR9170_TXRX_PHY_RATE_HT_MCS8            0x8
+#define AR9170_TXRX_PHY_RATE_HT_MCS9            0x9
+#define AR9170_TXRX_PHY_RATE_HT_MCS10           0xa
+#define AR9170_TXRX_PHY_RATE_HT_MCS11           0xb
+#define AR9170_TXRX_PHY_RATE_HT_MCS12           0xc
+#define AR9170_TXRX_PHY_RATE_HT_MCS13           0xd
+#define AR9170_TXRX_PHY_RATE_HT_MCS14           0xe
+#define AR9170_TXRX_PHY_RATE_HT_MCS15           0xf
+
+#define AR9170_TX_PHY_SHORT_GI                  0x80000000
+
+#ifdef __CARL9170FW__
+struct ar9170_tx_hw_mac_control {
+        union {
+                struct {
+                        /*
+                         * Beware of compiler bugs in all gcc pre 4.4!
+                         */
+
+                        u8 erp_prot:2;
+                        u8 no_ack:1;
+                        u8 backoff:1;
+                        u8 burst:1;
+                        u8 ampdu:1;
+
+                        u8 enc_mode:2;
+
+                        u8 hw_mmic:1;
+                        u8 hw_duration:1;
+
+                        u8 qos_queue:2;
+
+                        u8 disable_txop:1;
+                        u8 txop_rifs:1;
+
+                        u8 ba_end:1;
+                        u8 probe:1;
+                } __packed;
+
+                __le16 set;
+        } __packed;
+} __packed;
+
+struct ar9170_tx_hw_phy_control {
+        union {
+                struct {
+                        /*
+                         * Beware of compiler bugs in all gcc pre 4.4!
+                         */
+
+                        u8 modulation:2;
+                        u8 preamble:1;
+                        u8 bandwidth:2;
+                        u8:1;
+                        u8 heavy_clip:3;
+                        u8 tx_power:6;
+                        u8 chains:3;
+                        u8 mcs:7;
+                        u8:6;
+                        u8 short_gi:1;
+                } __packed;
+
+                __le32 set;
+        } __packed;
+} __packed;
+
+struct ar9170_tx_rate_info {
+        u8 tries:3;
+        u8 erp_prot:2;
+        u8 ampdu:1;
+        u8 free:2; /* free for use (e.g.:RIFS/TXOP/AMPDU) */
+} __packed;
+
+struct carl9170_tx_superdesc {
+        __le16 len;
+        u8 rix;
+        u8 cnt;
+        u8 cookie;
+        u8 ampdu_density:3;
+        u8 ampdu_factor:2;
+        u8 ampdu_commit_density:1;
+        u8 ampdu_commit_factor:1;
+        u8 ampdu_unused_bit:1;
+        u8 queue:2;
+        u8 reserved:1;
+        u8 vif_id:3;
+        u8 fill_in_tsf:1;
+        u8 cab:1;
+        u8 padding2;
+        struct ar9170_tx_rate_info ri[CARL9170_TX_MAX_RATES];
+        struct ar9170_tx_hw_phy_control rr[CARL9170_TX_MAX_RETRY_RATES];
+} __packed;
+
+struct ar9170_tx_hwdesc {
+        __le16 length;
+        struct ar9170_tx_hw_mac_control mac;
+        struct ar9170_tx_hw_phy_control phy;
+} __packed;
+
+struct ar9170_tx_frame {
+        struct ar9170_tx_hwdesc hdr;
+
+        union {
+                struct ieee80211_hdr i3e;
+                u8 payload[0];
+        } data;
+} __packed;
+
+struct carl9170_tx_superframe {
+        struct carl9170_tx_superdesc s;
+        struct ar9170_tx_frame f;
+} __packed;
+
+#endif /* __CARL9170FW__ */
+
+struct _ar9170_tx_hwdesc {
+        __le16 length;
+        __le16 mac_control;
+        __le32 phy_control;
+} __packed;
+
+#define CARL9170_TX_SUPER_AMPDU_DENSITY_S               0
+#define CARL9170_TX_SUPER_AMPDU_DENSITY                 0x7
+#define CARL9170_TX_SUPER_AMPDU_FACTOR                  0x18
+#define CARL9170_TX_SUPER_AMPDU_FACTOR_S                3
+#define CARL9170_TX_SUPER_AMPDU_COMMIT_DENSITY          0x20
+#define CARL9170_TX_SUPER_AMPDU_COMMIT_DENSITY_S        5
+#define CARL9170_TX_SUPER_AMPDU_COMMIT_FACTOR           0x40
+#define CARL9170_TX_SUPER_AMPDU_COMMIT_FACTOR_S         6
+
+#define CARL9170_TX_SUPER_MISC_QUEUE                    0x3
+#define CARL9170_TX_SUPER_MISC_QUEUE_S                  0
+#define CARL9170_TX_SUPER_MISC_VIF_ID                   0x38
+#define CARL9170_TX_SUPER_MISC_VIF_ID_S                 3
+#define CARL9170_TX_SUPER_MISC_FILL_IN_TSF              0x40
+#define CARL9170_TX_SUPER_MISC_CAB                      0x80
+
+#define CARL9170_TX_SUPER_RI_TRIES                      0x7
+#define CARL9170_TX_SUPER_RI_TRIES_S                    0
+#define CARL9170_TX_SUPER_RI_ERP_PROT                   0x18
+#define CARL9170_TX_SUPER_RI_ERP_PROT_S                 3
+#define CARL9170_TX_SUPER_RI_AMPDU                      0x20
+#define CARL9170_TX_SUPER_RI_AMPDU_S                    5
+
+struct _carl9170_tx_superdesc {
+        __le16 len;
+        u8 rix;
+        u8 cnt;
+        u8 cookie;
+        u8 ampdu_settings;
+        u8 misc;
+        u8 padding;
+        u8 ri[CARL9170_TX_MAX_RATES];
+        __le32 rr[CARL9170_TX_MAX_RETRY_RATES];
+} __packed;
+
+struct _carl9170_tx_superframe {
+        struct _carl9170_tx_superdesc s;
+        struct _ar9170_tx_hwdesc f;
+        u8 frame_data[0];
+} __packed;
+
+#define CARL9170_TX_SUPERDESC_LEN               24
+#define AR9170_TX_HWDESC_LEN                    8
+#define CARL9170_TX_SUPERFRAME_LEN              (CARL9170_TX_SUPERDESC_LEN + \
+                                                 AR9170_TX_HWDESC_LEN)
+
+struct ar9170_rx_head {
+        u8 plcp[12];
+} __packed;
+
+#define AR9170_RX_HEAD_LEN                      12
+
+struct ar9170_rx_phystatus {
+        union {
+                struct {
+                        u8 rssi_ant0, rssi_ant1, rssi_ant2,
+                                rssi_ant0x, rssi_ant1x, rssi_ant2x,
+                                rssi_combined;
+                } __packed;
+                u8 rssi[7];
+        } __packed;
+
+        u8 evm_stream0[6], evm_stream1[6];
+        u8 phy_err;
+} __packed;
+
+#define AR9170_RX_PHYSTATUS_LEN                 20
+
+struct ar9170_rx_macstatus {
+        u8 SAidx, DAidx;
+        u8 error;
+        u8 status;
+} __packed;
+
+#define AR9170_RX_MACSTATUS_LEN                 4
+
+struct ar9170_rx_frame_single {
+        struct ar9170_rx_head phy_head;
+        struct ieee80211_hdr i3e;
+        struct ar9170_rx_phystatus phy_tail;
+        struct ar9170_rx_macstatus macstatus;
+} __packed;
+
+struct ar9170_rx_frame_head {
+        struct ar9170_rx_head phy_head;
+        struct ieee80211_hdr i3e;
+        struct ar9170_rx_macstatus macstatus;
+} __packed;
+
+struct ar9170_rx_frame_middle {
+        struct ieee80211_hdr i3e;
+        struct ar9170_rx_macstatus macstatus;
+} __packed;
+
+struct ar9170_rx_frame_tail {
+        struct ieee80211_hdr i3e;
+        struct ar9170_rx_phystatus phy_tail;
+        struct ar9170_rx_macstatus macstatus;
+} __packed;
+
+struct ar9170_rx_frame {
+        union {
+                struct ar9170_rx_frame_single single;
+                struct ar9170_rx_frame_head head;
+                struct ar9170_rx_frame_middle middle;
+                struct ar9170_rx_frame_tail tail;
+        } __packed;
+} __packed;
+
+static inline u8 ar9170_get_decrypt_type(struct ar9170_rx_macstatus *t)
+{
+        return (t->SAidx & 0xc0) >> 4 |
+               (t->DAidx & 0xc0) >> 6;
+}
+
+enum ar9170_txq {
+        AR9170_TXQ_BE,
+
+        AR9170_TXQ_VI,
+        AR9170_TXQ_VO,
+        AR9170_TXQ_BK,
+
+        __AR9170_NUM_TXQ,
+};
+
+static const u8 ar9170_qmap[__AR9170_NUM_TXQ] = { 2, 1, 0, 3 };
+
+#define AR9170_TXQ_DEPTH                        32
+
+#endif /* __CARL9170_SHARED_WLAN_H */
diff --git a/drivers/net/wireless/ath/debug.c b/drivers/net/wireless/ath/debug.c
index 53e77bd131b9..dacfb234f491 100644
--- a/drivers/net/wireless/ath/debug.c
+++ b/drivers/net/wireless/ath/debug.c
@@ -30,3 +30,32 @@ void ath_print(struct ath_common *common, int dbg_mask, const char *fmt, ...)
         va_end(args);
 }
 EXPORT_SYMBOL(ath_print);
+
+const char *ath_opmode_to_string(enum nl80211_iftype opmode)
+{
+        switch (opmode) {
+        case NL80211_IFTYPE_UNSPECIFIED:
+                return "UNSPEC";
+        case NL80211_IFTYPE_ADHOC:
+                return "ADHOC";
+        case NL80211_IFTYPE_STATION:
+                return "STATION";
+        case NL80211_IFTYPE_AP:
+                return "AP";
+        case NL80211_IFTYPE_AP_VLAN:
+                return "AP-VLAN";
+        case NL80211_IFTYPE_WDS:
+                return "WDS";
+        case NL80211_IFTYPE_MONITOR:
+                return "MONITOR";
+        case NL80211_IFTYPE_MESH_POINT:
+                return "MESH";
+        case NL80211_IFTYPE_P2P_CLIENT:
+                return "P2P-CLIENT";
+        case NL80211_IFTYPE_P2P_GO:
+                return "P2P-GO";
+        default:
+                return "UNKNOWN";
+        }
+}
+EXPORT_SYMBOL(ath_opmode_to_string);
diff --git a/drivers/net/wireless/ath/debug.h b/drivers/net/wireless/ath/debug.h
index fd3a020682dc..64e4af2c2887 100644
--- a/drivers/net/wireless/ath/debug.h
+++ b/drivers/net/wireless/ath/debug.h
@@ -77,4 +77,14 @@ ath_print(struct ath_common *common, int dbg_mask, const char *fmt, ...)
 }
 #endif /* CONFIG_ATH_DEBUG */
 
+/** Returns string describing opmode, or NULL if unknown mode. */
+#ifdef CONFIG_ATH_DEBUG
+const char *ath_opmode_to_string(enum nl80211_iftype opmode);
+#else
+static inline const char *ath_opmode_to_string(enum nl80211_iftype opmode)
+{
+        return "UNKNOWN";
+}
+#endif
+
 #endif /* ATH_DEBUG_H */
diff --git a/drivers/net/wireless/ath/hw.c b/drivers/net/wireless/ath/hw.c
index a8f81ea09f14..183c28281385 100644
--- a/drivers/net/wireless/ath/hw.c
+++ b/drivers/net/wireless/ath/hw.c
@@ -124,3 +124,62 @@ void ath_hw_setbssidmask(struct ath_common *common)
         REG_WRITE(ah, get_unaligned_le16(common->bssidmask + 4), AR_BSSMSKU);
 }
 EXPORT_SYMBOL(ath_hw_setbssidmask);
+
+
+/**
+ * ath_hw_cycle_counters_update - common function to update cycle counters
+ *
+ * @common: the ath_common struct for the device.
+ *
+ * This function is used to update all cycle counters in one place.
+ * It has to be called while holding common->cc_lock!
+ */
+void ath_hw_cycle_counters_update(struct ath_common *common)
+{
+        u32 cycles, busy, rx, tx;
+        void *ah = common->ah;
+
+        /* freeze */
+        REG_WRITE(ah, AR_MIBC_FMC, AR_MIBC);
+
+        /* read */
+        cycles = REG_READ(ah, AR_CCCNT);
+        busy = REG_READ(ah, AR_RCCNT);
+        rx = REG_READ(ah, AR_RFCNT);
+        tx = REG_READ(ah, AR_TFCNT);
+
+        /* clear */
+        REG_WRITE(ah, 0, AR_CCCNT);
+        REG_WRITE(ah, 0, AR_RFCNT);
+        REG_WRITE(ah, 0, AR_RCCNT);
+        REG_WRITE(ah, 0, AR_TFCNT);
+
+        /* unfreeze */
+        REG_WRITE(ah, 0, AR_MIBC);
+
+        /* update all cycle counters here */
+        common->cc_ani.cycles += cycles;
+        common->cc_ani.rx_busy += busy;
+        common->cc_ani.rx_frame += rx;
+        common->cc_ani.tx_frame += tx;
+
+        common->cc_survey.cycles += cycles;
+        common->cc_survey.rx_busy += busy;
+        common->cc_survey.rx_frame += rx;
+        common->cc_survey.tx_frame += tx;
+}
+EXPORT_SYMBOL(ath_hw_cycle_counters_update);
+
+int32_t ath_hw_get_listen_time(struct ath_common *common)
+{
+        struct ath_cycle_counters *cc = &common->cc_ani;
+        int32_t listen_time;
+
+        listen_time = (cc->cycles - cc->rx_frame - cc->tx_frame) /
+                      (common->clockrate * 1000);
+
+        memset(cc, 0, sizeof(*cc));
+
+        return listen_time;
+}
+EXPORT_SYMBOL(ath_hw_get_listen_time);
diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c
new file mode 100644
index 000000000000..bd21a4d82085
--- /dev/null
+++ b/drivers/net/wireless/ath/key.c
@@ -0,0 +1,568 @@
+/*
+ * Copyright (c) 2009 Atheros Communications Inc.
+ * Copyright (c) 2010 Bruno Randolf <br1@einfach.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <asm/unaligned.h>
+#include <net/mac80211.h>
+
+#include "ath.h"
+#include "reg.h"
+#include "debug.h"
+
+#define REG_READ                        (common->ops->read)
+#define REG_WRITE(_ah, _reg, _val)      (common->ops->write)(_ah, _val, _reg)
+
+#define IEEE80211_WEP_NKID      4       /* number of key ids */
+
+/************************/
+/* Key Cache Management */
+/************************/
+
+bool ath_hw_keyreset(struct ath_common *common, u16 entry)
+{
+        u32 keyType;
+        void *ah = common->ah;
+
+        if (entry >= common->keymax) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "keychache entry %u out of range\n", entry);
+                return false;
+        }
+
+        keyType = REG_READ(ah, AR_KEYTABLE_TYPE(entry));
+
+        REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), 0);
+        REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), 0);
+        REG_WRITE(ah, AR_KEYTABLE_KEY2(entry), 0);
+        REG_WRITE(ah, AR_KEYTABLE_KEY3(entry), 0);
+        REG_WRITE(ah, AR_KEYTABLE_KEY4(entry), 0);
+        REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), AR_KEYTABLE_TYPE_CLR);
+        REG_WRITE(ah, AR_KEYTABLE_MAC0(entry), 0);
+        REG_WRITE(ah, AR_KEYTABLE_MAC1(entry), 0);
+
+        if (keyType == AR_KEYTABLE_TYPE_TKIP) {
+                u16 micentry = entry + 64;
+
+                REG_WRITE(ah, AR_KEYTABLE_KEY0(micentry), 0);
+                REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), 0);
+                REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), 0);
+                REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), 0);
+
+        }
+
+        return true;
+}
+EXPORT_SYMBOL(ath_hw_keyreset);
+
+bool ath_hw_keysetmac(struct ath_common *common, u16 entry, const u8 *mac)
+{
+        u32 macHi, macLo;
+        u32 unicast_flag = AR_KEYTABLE_VALID;
+        void *ah = common->ah;
+
+        if (entry >= common->keymax) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "keychache entry %u out of range\n", entry);
+                return false;
+        }
+
+        if (mac != NULL) {
+                /*
+                 * AR_KEYTABLE_VALID indicates that the address is a unicast
+                 * address, which must match the transmitter address for
+                 * decrypting frames.
+                 * Not setting this bit allows the hardware to use the key
+                 * for multicast frame decryption.
+                 */
+                if (mac[0] & 0x01)
+                        unicast_flag = 0;
+
+                macHi = (mac[5] << 8) | mac[4];
+                macLo = (mac[3] << 24) |
+                        (mac[2] << 16) |
+                        (mac[1] << 8) |
+                        mac[0];
+                macLo >>= 1;
+                macLo |= (macHi & 1) << 31;
+                macHi >>= 1;
+        } else {
+                macLo = macHi = 0;
+        }
+        REG_WRITE(ah, AR_KEYTABLE_MAC0(entry), macLo);
+        REG_WRITE(ah, AR_KEYTABLE_MAC1(entry), macHi | unicast_flag);
+
+        return true;
+}
+
+bool ath_hw_set_keycache_entry(struct ath_common *common, u16 entry,
+                                 const struct ath_keyval *k,
+                                 const u8 *mac)
+{
+        void *ah = common->ah;
+        u32 key0, key1, key2, key3, key4;
+        u32 keyType;
+
+        if (entry >= common->keymax) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "keycache entry %u out of range\n", entry);
+                return false;
+        }
+
+        switch (k->kv_type) {
+        case ATH_CIPHER_AES_OCB:
+                keyType = AR_KEYTABLE_TYPE_AES;
+                break;
+        case ATH_CIPHER_AES_CCM:
+                if (!(common->crypt_caps & ATH_CRYPT_CAP_CIPHER_AESCCM)) {
+                        ath_print(common, ATH_DBG_ANY,
+                                  "AES-CCM not supported by this mac rev\n");
+                        return false;
+                }
+                keyType = AR_KEYTABLE_TYPE_CCM;
+                break;
+        case ATH_CIPHER_TKIP:
+                keyType = AR_KEYTABLE_TYPE_TKIP;
+                if (entry + 64 >= common->keymax) {
+                        ath_print(common, ATH_DBG_ANY,
+                                  "entry %u inappropriate for TKIP\n", entry);
+                        return false;
+                }
+                break;
+        case ATH_CIPHER_WEP:
+                if (k->kv_len < WLAN_KEY_LEN_WEP40) {
+                        ath_print(common, ATH_DBG_ANY,
+                                  "WEP key length %u too small\n", k->kv_len);
+                        return false;
+                }
+                if (k->kv_len <= WLAN_KEY_LEN_WEP40)
+                        keyType = AR_KEYTABLE_TYPE_40;
+                else if (k->kv_len <= WLAN_KEY_LEN_WEP104)
+                        keyType = AR_KEYTABLE_TYPE_104;
+                else
+                        keyType = AR_KEYTABLE_TYPE_128;
+                break;
+        case ATH_CIPHER_CLR:
+                keyType = AR_KEYTABLE_TYPE_CLR;
+                break;
+        default:
+                ath_print(common, ATH_DBG_FATAL,
+                          "cipher %u not supported\n", k->kv_type);
+                return false;
+        }
+
+        key0 = get_unaligned_le32(k->kv_val + 0);
+        key1 = get_unaligned_le16(k->kv_val + 4);
+        key2 = get_unaligned_le32(k->kv_val + 6);
+        key3 = get_unaligned_le16(k->kv_val + 10);
+        key4 = get_unaligned_le32(k->kv_val + 12);
+        if (k->kv_len <= WLAN_KEY_LEN_WEP104)
+                key4 &= 0xff;
+
+        /*
+         * Note: Key cache registers access special memory area that requires
+         * two 32-bit writes to actually update the values in the internal
+         * memory. Consequently, the exact order and pairs used here must be
+         * maintained.
+         */
+
+        if (keyType == AR_KEYTABLE_TYPE_TKIP) {
+                u16 micentry = entry + 64;
+
+                /*
+                 * Write inverted key[47:0] first to avoid Michael MIC errors
+                 * on frames that could be sent or received at the same time.
+                 * The correct key will be written in the end once everything
+                 * else is ready.
+                 */
+                REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), ~key0);
+                REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), ~key1);
+
+                /* Write key[95:48] */
+                REG_WRITE(ah, AR_KEYTABLE_KEY2(entry), key2);
+                REG_WRITE(ah, AR_KEYTABLE_KEY3(entry), key3);
+
+                /* Write key[127:96] and key type */
+                REG_WRITE(ah, AR_KEYTABLE_KEY4(entry), key4);
+                REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), keyType);
+
+                /* Write MAC address for the entry */
+                (void) ath_hw_keysetmac(common, entry, mac);
+
+                if (common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED) {
+                        /*
+                         * TKIP uses two key cache entries:
+                         * Michael MIC TX/RX keys in the same key cache entry
+                         * (idx = main index + 64):
+                         * key0 [31:0] = RX key [31:0]
+                         * key1 [15:0] = TX key [31:16]
+                         * key1 [31:16] = reserved
+                         * key2 [31:0] = RX key [63:32]
+                         * key3 [15:0] = TX key [15:0]
+                         * key3 [31:16] = reserved
+                         * key4 [31:0] = TX key [63:32]
+                         */
+                        u32 mic0, mic1, mic2, mic3, mic4;
+
+                        mic0 = get_unaligned_le32(k->kv_mic + 0);
+                        mic2 = get_unaligned_le32(k->kv_mic + 4);
+                        mic1 = get_unaligned_le16(k->kv_txmic + 2) & 0xffff;
+                        mic3 = get_unaligned_le16(k->kv_txmic + 0) & 0xffff;
+                        mic4 = get_unaligned_le32(k->kv_txmic + 4);
+
+                        /* Write RX[31:0] and TX[31:16] */
+                        REG_WRITE(ah, AR_KEYTABLE_KEY0(micentry), mic0);
+                        REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), mic1);
+
+                        /* Write RX[63:32] and TX[15:0] */
+                        REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), mic2);
+                        REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), mic3);
+
+                        /* Write TX[63:32] and keyType(reserved) */
+                        REG_WRITE(ah, AR_KEYTABLE_KEY4(micentry), mic4);
+                        REG_WRITE(ah, AR_KEYTABLE_TYPE(micentry),
+                                  AR_KEYTABLE_TYPE_CLR);
+
+                } else {
+                        /*
+                         * TKIP uses four key cache entries (two for group
+                         * keys):
+                         * Michael MIC TX/RX keys are in different key cache
+                         * entries (idx = main index + 64 for TX and
+                         * main index + 32 + 96 for RX):
+                         * key0 [31:0] = TX/RX MIC key [31:0]
+                         * key1 [31:0] = reserved
+                         * key2 [31:0] = TX/RX MIC key [63:32]
+                         * key3 [31:0] = reserved
+                         * key4 [31:0] = reserved
+                         *
+                         * Upper layer code will call this function separately
+                         * for TX and RX keys when these registers offsets are
+                         * used.
+                         */
+                        u32 mic0, mic2;
+
+                        mic0 = get_unaligned_le32(k->kv_mic + 0);
+                        mic2 = get_unaligned_le32(k->kv_mic + 4);
+
+                        /* Write MIC key[31:0] */
+                        REG_WRITE(ah, AR_KEYTABLE_KEY0(micentry), mic0);
+                        REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), 0);
+
+                        /* Write MIC key[63:32] */
+                        REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), mic2);
+                        REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), 0);
+
+                        /* Write TX[63:32] and keyType(reserved) */
+                        REG_WRITE(ah, AR_KEYTABLE_KEY4(micentry), 0);
+                        REG_WRITE(ah, AR_KEYTABLE_TYPE(micentry),
+                                  AR_KEYTABLE_TYPE_CLR);
+                }
+
+                /* MAC address registers are reserved for the MIC entry */
+                REG_WRITE(ah, AR_KEYTABLE_MAC0(micentry), 0);
+                REG_WRITE(ah, AR_KEYTABLE_MAC1(micentry), 0);
+
+                /*
+                 * Write the correct (un-inverted) key[47:0] last to enable
+                 * TKIP now that all other registers are set with correct
+                 * values.
+                 */
+                REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), key0);
+                REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), key1);
+        } else {
+                /* Write key[47:0] */
+                REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), key0);
+                REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), key1);
+
+                /* Write key[95:48] */
+                REG_WRITE(ah, AR_KEYTABLE_KEY2(entry), key2);
+                REG_WRITE(ah, AR_KEYTABLE_KEY3(entry), key3);
+
+                /* Write key[127:96] and key type */
+                REG_WRITE(ah, AR_KEYTABLE_KEY4(entry), key4);
+                REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), keyType);
+
+                /* Write MAC address for the entry */
+                (void) ath_hw_keysetmac(common, entry, mac);
+        }
+
+        return true;
+}
+
+static int ath_setkey_tkip(struct ath_common *common, u16 keyix, const u8 *key,
+                           struct ath_keyval *hk, const u8 *addr,
+                           bool authenticator)
+{
+        const u8 *key_rxmic;
+        const u8 *key_txmic;
+
+        key_txmic = key + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
+        key_rxmic = key + NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
+
+        if (addr == NULL) {
+                /*
+                 * Group key installation - only two key cache entries are used
+                 * regardless of splitmic capability since group key is only
+                 * used either for TX or RX.
+                 */
+                if (authenticator) {
+                        memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
+                        memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_mic));
+                } else {
+                        memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
+                        memcpy(hk->kv_txmic, key_rxmic, sizeof(hk->kv_mic));
+                }
+                return ath_hw_set_keycache_entry(common, keyix, hk, addr);
+        }
+        if (common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED) {
+                /* TX and RX keys share the same key cache entry. */
+                memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
+                memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_txmic));
+                return ath_hw_set_keycache_entry(common, keyix, hk, addr);
+        }
+
+        /* Separate key cache entries for TX and RX */
+
+        /* TX key goes at first index, RX key at +32. */
+        memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
+        if (!ath_hw_set_keycache_entry(common, keyix, hk, NULL)) {
+                /* TX MIC entry failed. No need to proceed further */
+                ath_print(common, ATH_DBG_FATAL,
+                          "Setting TX MIC Key Failed\n");
+                return 0;
+        }
+
+        memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
+        /* XXX delete tx key on failure? */
+        return ath_hw_set_keycache_entry(common, keyix + 32, hk, addr);
+}
+
+static int ath_reserve_key_cache_slot_tkip(struct ath_common *common)
+{
+        int i;
+
+        for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
+                if (test_bit(i, common->keymap) ||
+                    test_bit(i + 64, common->keymap))
+                        continue; /* At least one part of TKIP key allocated */
+                if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED) &&
+                    (test_bit(i + 32, common->keymap) ||
+                     test_bit(i + 64 + 32, common->keymap)))
+                        continue; /* At least one part of TKIP key allocated */
+
+                /* Found a free slot for a TKIP key */
+                return i;
+        }
+        return -1;
+}
+
+static int ath_reserve_key_cache_slot(struct ath_common *common,
+                                      u32 cipher)
+{
+        int i;
+
+        if (cipher == WLAN_CIPHER_SUITE_TKIP)
+                return ath_reserve_key_cache_slot_tkip(common);
+
+        /* First, try to find slots that would not be available for TKIP. */
+        if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)) {
+                for (i = IEEE80211_WEP_NKID; i < common->keymax / 4; i++) {
+                        if (!test_bit(i, common->keymap) &&
+                            (test_bit(i + 32, common->keymap) ||
+                             test_bit(i + 64, common->keymap) ||
+                             test_bit(i + 64 + 32, common->keymap)))
+                                return i;
+                        if (!test_bit(i + 32, common->keymap) &&
+                            (test_bit(i, common->keymap) ||
+                             test_bit(i + 64, common->keymap) ||
+                             test_bit(i + 64 + 32, common->keymap)))
+                                return i + 32;
+                        if (!test_bit(i + 64, common->keymap) &&
+                            (test_bit(i , common->keymap) ||
+                             test_bit(i + 32, common->keymap) ||
+                             test_bit(i + 64 + 32, common->keymap)))
+                                return i + 64;
+                        if (!test_bit(i + 64 + 32, common->keymap) &&
+                            (test_bit(i, common->keymap) ||
+                             test_bit(i + 32, common->keymap) ||
+                             test_bit(i + 64, common->keymap)))
+                                return i + 64 + 32;
+                }
+        } else {
+                for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
+                        if (!test_bit(i, common->keymap) &&
+                            test_bit(i + 64, common->keymap))
+                                return i;
+                        if (test_bit(i, common->keymap) &&
+                            !test_bit(i + 64, common->keymap))
+                                return i + 64;
+                }
+        }
+
+        /* No partially used TKIP slots, pick any available slot */
+        for (i = IEEE80211_WEP_NKID; i < common->keymax; i++) {
+                /* Do not allow slots that could be needed for TKIP group keys
+                 * to be used. This limitation could be removed if we know that
+                 * TKIP will not be used. */
+                if (i >= 64 && i < 64 + IEEE80211_WEP_NKID)
+                        continue;
+                if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)) {
+                        if (i >= 32 && i < 32 + IEEE80211_WEP_NKID)
+                                continue;
+                        if (i >= 64 + 32 && i < 64 + 32 + IEEE80211_WEP_NKID)
+                                continue;
+                }
+
+                if (!test_bit(i, common->keymap))
+                        return i; /* Found a free slot for a key */
+        }
+
+        /* No free slot found */
+        return -1;
+}
+
+/*
+ * Configure encryption in the HW.
+ */
+int ath_key_config(struct ath_common *common,
+                          struct ieee80211_vif *vif,
+                          struct ieee80211_sta *sta,
+                          struct ieee80211_key_conf *key)
+{
+        struct ath_keyval hk;
+        const u8 *mac = NULL;
+        u8 gmac[ETH_ALEN];
+        int ret = 0;
+        int idx;
+
+        memset(&hk, 0, sizeof(hk));
+
+        switch (key->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
+                hk.kv_type = ATH_CIPHER_WEP;
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                hk.kv_type = ATH_CIPHER_TKIP;
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                hk.kv_type = ATH_CIPHER_AES_CCM;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        hk.kv_len = key->keylen;
+        memcpy(hk.kv_val, key->key, key->keylen);
+
+        if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+                switch (vif->type) {
+                case NL80211_IFTYPE_AP:
+                        memcpy(gmac, vif->addr, ETH_ALEN);
+                        gmac[0] |= 0x01;
+                        mac = gmac;
+                        idx = ath_reserve_key_cache_slot(common, key->cipher);
+                        break;
+                case NL80211_IFTYPE_ADHOC:
+                        if (!sta) {
+                                idx = key->keyidx;
+                                break;
+                        }
+                        memcpy(gmac, sta->addr, ETH_ALEN);
+                        gmac[0] |= 0x01;
+                        mac = gmac;
+                        idx = ath_reserve_key_cache_slot(common, key->cipher);
+                        break;
+                default:
+                        idx = key->keyidx;
+                        break;
+                }
+        } else if (key->keyidx) {
+                if (WARN_ON(!sta))
+                        return -EOPNOTSUPP;
+                mac = sta->addr;
+
+                if (vif->type != NL80211_IFTYPE_AP) {
+                        /* Only keyidx 0 should be used with unicast key, but
+                         * allow this for client mode for now. */
+                        idx = key->keyidx;
+                } else
+                        return -EIO;
+        } else {
+                if (WARN_ON(!sta))
+                        return -EOPNOTSUPP;
+                mac = sta->addr;
+
+                idx = ath_reserve_key_cache_slot(common, key->cipher);
+        }
+
+        if (idx < 0)
+                return -ENOSPC; /* no free key cache entries */
+
+        if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
+                ret = ath_setkey_tkip(common, idx, key->key, &hk, mac,
+                                      vif->type == NL80211_IFTYPE_AP);
+        else
+                ret = ath_hw_set_keycache_entry(common, idx, &hk, mac);
+
+        if (!ret)
+                return -EIO;
+
+        set_bit(idx, common->keymap);
+        if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
+                set_bit(idx + 64, common->keymap);
+                set_bit(idx, common->tkip_keymap);
+                set_bit(idx + 64, common->tkip_keymap);
+                if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)) {
+                        set_bit(idx + 32, common->keymap);
+                        set_bit(idx + 64 + 32, common->keymap);
+                        set_bit(idx + 32, common->tkip_keymap);
+                        set_bit(idx + 64 + 32, common->tkip_keymap);
+                }
+        }
+
+        return idx;
+}
+EXPORT_SYMBOL(ath_key_config);
+
+/*
+ * Delete Key.
+ */
+void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key)
+{
+        ath_hw_keyreset(common, key->hw_key_idx);
+        if (key->hw_key_idx < IEEE80211_WEP_NKID)
+                return;
+
+        clear_bit(key->hw_key_idx, common->keymap);
+        if (key->cipher != WLAN_CIPHER_SUITE_TKIP)
+                return;
+
+        clear_bit(key->hw_key_idx + 64, common->keymap);
+
+        clear_bit(key->hw_key_idx, common->tkip_keymap);
+        clear_bit(key->hw_key_idx + 64, common->tkip_keymap);
+
+        if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)) {
+                ath_hw_keyreset(common, key->hw_key_idx + 32);
+                clear_bit(key->hw_key_idx + 32, common->keymap);
+                clear_bit(key->hw_key_idx + 64 + 32, common->keymap);
+
+                clear_bit(key->hw_key_idx + 32, common->tkip_keymap);
+                clear_bit(key->hw_key_idx + 64 + 32, common->tkip_keymap);
+        }
+}
+EXPORT_SYMBOL(ath_key_delete);
diff --git a/drivers/net/wireless/ath/reg.h b/drivers/net/wireless/ath/reg.h
index dfe1fbec24f5..298e53f3fa48 100644
--- a/drivers/net/wireless/ath/reg.h
+++ b/drivers/net/wireless/ath/reg.h
@@ -17,6 +17,12 @@
 #ifndef ATH_REGISTERS_H
 #define ATH_REGISTERS_H
 
+#define AR_MIBC                 0x0040
+#define AR_MIBC_COW             0x00000001
+#define AR_MIBC_FMC             0x00000002
+#define AR_MIBC_CMC             0x00000004
+#define AR_MIBC_MCS             0x00000008
+
 /*
  * BSSID mask registers. See ath_hw_set_bssid_mask()
  * for detailed documentation about these registers.
@@ -24,4 +30,32 @@
 #define AR_BSSMSKL              0x80e0
 #define AR_BSSMSKU              0x80e4
 
+#define AR_TFCNT                0x80ec
+#define AR_RFCNT                0x80f0
+#define AR_RCCNT                0x80f4
+#define AR_CCCNT                0x80f8
+
+#define AR_KEYTABLE_0           0x8800
+#define AR_KEYTABLE(_n)         (AR_KEYTABLE_0 + ((_n)*32))
+#define AR_KEY_CACHE_SIZE       128
+#define AR_RSVD_KEYTABLE_ENTRIES 4
+#define AR_KEY_TYPE             0x00000007
+#define AR_KEYTABLE_TYPE_40     0x00000000
+#define AR_KEYTABLE_TYPE_104    0x00000001
+#define AR_KEYTABLE_TYPE_128    0x00000003
+#define AR_KEYTABLE_TYPE_TKIP   0x00000004
+#define AR_KEYTABLE_TYPE_AES    0x00000005
+#define AR_KEYTABLE_TYPE_CCM    0x00000006
+#define AR_KEYTABLE_TYPE_CLR    0x00000007
+#define AR_KEYTABLE_ANT         0x00000008
+#define AR_KEYTABLE_VALID       0x00008000
+#define AR_KEYTABLE_KEY0(_n)    (AR_KEYTABLE(_n) + 0)
+#define AR_KEYTABLE_KEY1(_n)    (AR_KEYTABLE(_n) + 4)
+#define AR_KEYTABLE_KEY2(_n)    (AR_KEYTABLE(_n) + 8)
+#define AR_KEYTABLE_KEY3(_n)    (AR_KEYTABLE(_n) + 12)
+#define AR_KEYTABLE_KEY4(_n)    (AR_KEYTABLE(_n) + 16)
+#define AR_KEYTABLE_TYPE(_n)    (AR_KEYTABLE(_n) + 20)
+#define AR_KEYTABLE_MAC0(_n)    (AR_KEYTABLE(_n) + 24)
+#define AR_KEYTABLE_MAC1(_n)    (AR_KEYTABLE(_n) + 28)
+
 #endif /* ATH_REGISTERS_H */
diff --git a/drivers/net/wireless/b43/Makefile b/drivers/net/wireless/b43/Makefile
index 5e83b6f0a3a0..69d4af09a6cb 100644
--- a/drivers/net/wireless/b43/Makefile
+++ b/drivers/net/wireless/b43/Makefile
@@ -1,6 +1,8 @@
 b43-y                           += main.o
 b43-y                           += tables.o
 b43-$(CONFIG_B43_NPHY)          += tables_nphy.o
+b43-$(CONFIG_B43_NPHY)          += radio_2055.o
+b43-$(CONFIG_B43_NPHY)          += radio_2056.o
 b43-y                           += phy_common.o
 b43-y                           += phy_g.o
 b43-y                           += phy_a.o
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 8674a99356af..72821c456b02 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -186,7 +186,8 @@ enum {
 #define B43_SHM_SH_PHYTXNOI             0x006E  /* PHY noise directly after TX (lower 8bit only) */
 #define B43_SHM_SH_RFRXSP1              0x0072  /* RF RX SP Register 1 */
 #define B43_SHM_SH_CHAN                 0x00A0  /* Current channel (low 8bit only) */
-#define  B43_SHM_SH_CHAN_5GHZ           0x0100  /* Bit set, if 5Ghz channel */
+#define  B43_SHM_SH_CHAN_5GHZ           0x0100  /* Bit set, if 5 Ghz channel */
+#define  B43_SHM_SH_CHAN_40MHZ          0x0200  /* Bit set, if 40 Mhz channel width */
 #define B43_SHM_SH_BCMCFIFOID           0x0108  /* Last posted cookie to the bcast/mcast FIFO */
 /* TSSI information */
 #define B43_SHM_SH_TSSI_CCK             0x0058  /* TSSI for last 4 CCK frames (32bit) */
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 8f7d7eff2d80..7b2ea6781457 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -294,8 +294,10 @@ int b43_switch_channel(struct b43_wldev *dev, unsigned int new_channel)
          */
         channelcookie = new_channel;
         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
-                channelcookie |= 0x100;
-        //FIXME set 40Mhz flag if required
+                channelcookie |= B43_SHM_SH_CHAN_5GHZ;
+        /* FIXME: set 40Mhz flag if required */
+        if (0)
+                channelcookie |= B43_SHM_SH_CHAN_40MHZ;
         savedcookie = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_CHAN);
         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_CHAN, channelcookie);
 
diff --git a/drivers/net/wireless/b43/phy_common.h b/drivers/net/wireless/b43/phy_common.h
index bd480b481bfc..0e6194228845 100644
--- a/drivers/net/wireless/b43/phy_common.h
+++ b/drivers/net/wireless/b43/phy_common.h
@@ -2,6 +2,7 @@
 #define LINUX_B43_PHY_COMMON_H_
 
 #include <linux/types.h>
+#include <linux/nl80211.h>
 
 struct b43_wldev;
 
@@ -250,8 +251,10 @@ struct b43_phy {
          * check is needed. */
         unsigned long next_txpwr_check_time;
 
-        /* current channel */
+        /* Current channel */
         unsigned int channel;
+        u16 channel_freq;
+        enum nl80211_channel_type channel_type;
 
         /* PHY TX errors counter. */
         atomic_t txerr_cnt;
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 2466c0a52e5d..dfec5496055e 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -29,6 +29,8 @@
 #include "b43.h"
 #include "phy_n.h"
 #include "tables_nphy.h"
+#include "radio_2055.h"
+#include "radio_2056.h"
 #include "main.h"
 
 struct nphy_txgains {
@@ -73,21 +75,12 @@ static void b43_nphy_rf_control_override(struct b43_wldev *dev, u16 field,
                                                 u16 value, u8 core, bool off);
 static void b43_nphy_rf_control_intc_override(struct b43_wldev *dev, u8 field,
                                                 u16 value, u8 core);
-static int nphy_channel_switch(struct b43_wldev *dev, unsigned int channel);
 
-static inline bool b43_empty_chanspec(struct b43_chanspec *chanspec)
+static inline bool b43_channel_type_is_40mhz(
+                                        enum nl80211_channel_type channel_type)
 {
-        return !chanspec->channel && !chanspec->sideband &&
-                !chanspec->b_width && !chanspec->b_freq;
-}
-
-static inline bool b43_eq_chanspecs(struct b43_chanspec *chanspec1,
-                                        struct b43_chanspec *chanspec2)
-{
-        return (chanspec1->channel == chanspec2->channel &&
-                chanspec1->sideband == chanspec2->sideband &&
-                chanspec1->b_width == chanspec2->b_width &&
-                chanspec1->b_freq == chanspec2->b_freq);
+        return (channel_type == NL80211_CHAN_HT40MINUS ||
+                channel_type == NL80211_CHAN_HT40PLUS);
 }
 
 void b43_nphy_set_rxantenna(struct b43_wldev *dev, int antenna)
@@ -223,7 +216,7 @@ static void b43_radio_init2055_post(struct b43_wldev *dev)
         if (i)
                 b43err(dev->wl, "radio post init timeout\n");
         b43_radio_mask(dev, B2055_CAL_LPOCTL, 0xFF7F);
-        nphy_channel_switch(dev, dev->phy.channel);
+        b43_switch_channel(dev, dev->phy.channel);
         b43_radio_write(dev, B2055_C1_RX_BB_LPF, 0x9);
         b43_radio_write(dev, B2055_C2_RX_BB_LPF, 0x9);
         b43_radio_write(dev, B2055_C1_RX_BB_MIDACHP, 0x83);
@@ -782,7 +775,7 @@ static void b43_nphy_spur_workaround(struct b43_wldev *dev)
 {
         struct b43_phy_n *nphy = dev->phy.n;
 
-        u8 channel = nphy->radio_chanspec.channel;
+        u8 channel = dev->phy.channel;
         int tone[2] = { 57, 58 };
         u32 noise[2] = { 0x3FF, 0x3FF };
 
@@ -856,9 +849,9 @@ static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev)
                         gain[0] = 6;
                         gain[1] = 6;
                 } else {
-                        tmp = 40370 - 315 * nphy->radio_chanspec.channel;
+                        tmp = 40370 - 315 * dev->phy.channel;
                         gain[0] = ((tmp >> 13) + ((tmp >> 12) & 1));
-                        tmp = 23242 - 224 * nphy->radio_chanspec.channel;
+                        tmp = 23242 - 224 * dev->phy.channel;
                         gain[1] = ((tmp >> 13) + ((tmp >> 12) & 1));
                 }
         } else {
@@ -2084,12 +2077,12 @@ static void b43_nphy_restore_rssi_cal(struct b43_wldev *dev)
         u16 *rssical_phy_regs = NULL;
 
         if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
-                if (b43_empty_chanspec(&nphy->rssical_chanspec_2G))
+                if (!nphy->rssical_chanspec_2G.center_freq)
                         return;
                 rssical_radio_regs = nphy->rssical_cache.rssical_radio_regs_2G;
                 rssical_phy_regs = nphy->rssical_cache.rssical_phy_regs_2G;
         } else {
-                if (b43_empty_chanspec(&nphy->rssical_chanspec_5G))
+                if (!nphy->rssical_chanspec_5G.center_freq)
                         return;
                 rssical_radio_regs = nphy->rssical_cache.rssical_radio_regs_5G;
                 rssical_phy_regs = nphy->rssical_cache.rssical_phy_regs_5G;
@@ -2545,8 +2538,9 @@ static void b43_nphy_save_cal(struct b43_wldev *dev)
                 txcal_radio_regs[2] = b43_radio_read(dev, 0x8D);
                 txcal_radio_regs[3] = b43_radio_read(dev, 0xBC);
         }
-        *iqcal_chanspec = nphy->radio_chanspec;
-        b43_ntab_write_bulk(dev, B43_NTAB16(15, 80), 8, table);
+        iqcal_chanspec->center_freq = dev->phy.channel_freq;
+        iqcal_chanspec->channel_type = dev->phy.channel_type;
+        b43_ntab_read_bulk(dev, B43_NTAB16(15, 80), 8, table);
 
         if (nphy->hang_avoid)
                 b43_nphy_stay_in_carrier_search(dev, 0);
@@ -2566,12 +2560,12 @@ static void b43_nphy_restore_cal(struct b43_wldev *dev)
         struct b43_phy_n_iq_comp *rxcal_coeffs = NULL;
 
         if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
-                if (b43_empty_chanspec(&nphy->iqcal_chanspec_2G))
+                if (!nphy->iqcal_chanspec_2G.center_freq)
                         return;
                 table = nphy->cal_cache.txcal_coeffs_2G;
                 loft = &nphy->cal_cache.txcal_coeffs_2G[5];
         } else {
-                if (b43_empty_chanspec(&nphy->iqcal_chanspec_5G))
+                if (!nphy->iqcal_chanspec_5G.center_freq)
                         return;
                 table = nphy->cal_cache.txcal_coeffs_5G;
                 loft = &nphy->cal_cache.txcal_coeffs_5G[5];
@@ -2816,7 +2810,10 @@ static int b43_nphy_cal_tx_iq_lo(struct b43_wldev *dev,
                         b43_ntab_read_bulk(dev, B43_NTAB16(15, 96), length,
                                                 nphy->txiqlocal_bestc);
                         nphy->txiqlocal_coeffsvalid = true;
-                        nphy->txiqlocal_chanspec = nphy->radio_chanspec;
+                        nphy->txiqlocal_chanspec.center_freq =
+                                                        dev->phy.channel_freq;
+                        nphy->txiqlocal_chanspec.channel_type =
+                                                        dev->phy.channel_type;
                 } else {
                         length = 11;
                         if (dev->phy.rev < 3)
@@ -2852,7 +2849,8 @@ static void b43_nphy_reapply_tx_cal_coeffs(struct b43_wldev *dev)
         bool equal = true;
 
         if (!nphy->txiqlocal_coeffsvalid ||
-            b43_eq_chanspecs(&nphy->txiqlocal_chanspec, &nphy->radio_chanspec))
+            nphy->txiqlocal_chanspec.center_freq != dev->phy.channel_freq ||
+            nphy->txiqlocal_chanspec.channel_type != dev->phy.channel_type)
                 return;
 
         b43_ntab_read_bulk(dev, B43_NTAB16(15, 80), 7, buffer);
@@ -3258,11 +3256,9 @@ int b43_phy_initn(struct b43_wldev *dev)
         do_rssi_cal = false;
         if (phy->rev >= 3) {
                 if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
-                        do_rssi_cal =
-                                b43_empty_chanspec(&nphy->rssical_chanspec_2G);
+                        do_rssi_cal = !nphy->rssical_chanspec_2G.center_freq;
                 else
-                        do_rssi_cal =
-                                b43_empty_chanspec(&nphy->rssical_chanspec_5G);
+                        do_rssi_cal = !nphy->rssical_chanspec_5G.center_freq;
 
                 if (do_rssi_cal)
                         b43_nphy_rssi_cal(dev);
@@ -3274,9 +3270,9 @@ int b43_phy_initn(struct b43_wldev *dev)
 
         if (!((nphy->measure_hold & 0x6) != 0)) {
                 if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
-                        do_cal = b43_empty_chanspec(&nphy->iqcal_chanspec_2G);
+                        do_cal = !nphy->iqcal_chanspec_2G.center_freq;
                 else
-                        do_cal = b43_empty_chanspec(&nphy->iqcal_chanspec_5G);
+                        do_cal = !nphy->iqcal_chanspec_5G.center_freq;
 
                 if (nphy->mute)
                         do_cal = false;
@@ -3324,24 +3320,25 @@ int b43_phy_initn(struct b43_wldev *dev)
 }
 
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/ChanspecSetup */
-static void b43_nphy_chanspec_setup(struct b43_wldev *dev,
+static void b43_nphy_channel_setup(struct b43_wldev *dev,
                                 const struct b43_phy_n_sfo_cfg *e,
-                                struct b43_chanspec chanspec)
+                                struct ieee80211_channel *new_channel)
 {
         struct b43_phy *phy = &dev->phy;
         struct b43_phy_n *nphy = dev->phy.n;
 
-        u16 tmp;
+        u16 old_band_5ghz;
         u32 tmp32;
 
-        tmp = b43_phy_read(dev, B43_NPHY_BANDCTL) & B43_NPHY_BANDCTL_5GHZ;
-        if (chanspec.b_freq == 1 && tmp == 0) {
+        old_band_5ghz =
+                b43_phy_read(dev, B43_NPHY_BANDCTL) & B43_NPHY_BANDCTL_5GHZ;
+        if (new_channel->band == IEEE80211_BAND_5GHZ && !old_band_5ghz) {
                 tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR);
                 b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4);
                 b43_phy_set(dev, B43_PHY_B_BBCFG, 0xC000);
                 b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32);
                 b43_phy_set(dev, B43_NPHY_BANDCTL, B43_NPHY_BANDCTL_5GHZ);
-        } else if (chanspec.b_freq == 1) {
+        } else if (new_channel->band == IEEE80211_BAND_2GHZ && old_band_5ghz) {
                 b43_phy_mask(dev, B43_NPHY_BANDCTL, ~B43_NPHY_BANDCTL_5GHZ);
                 tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR);
                 b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4);
@@ -3351,19 +3348,12 @@ static void b43_nphy_chanspec_setup(struct b43_wldev *dev,
 
         b43_chantab_phy_upload(dev, e);
 
-        tmp = chanspec.channel;
-        if (chanspec.b_freq == 1)
-                tmp |= 0x0100;
-        if (chanspec.b_width == 3)
-                tmp |= 0x0200;
-        b43_shm_write16(dev, B43_SHM_SHARED, 0xA0, tmp);
-
-        if (nphy->radio_chanspec.channel == 14) {
+        if (new_channel->hw_value == 14) {
                 b43_nphy_classifier(dev, 2, 0);
                 b43_phy_set(dev, B43_PHY_B_TEST, 0x0800);
         } else {
                 b43_nphy_classifier(dev, 2, 2);
-                if (chanspec.b_freq == 2)
+                if (new_channel->band == IEEE80211_BAND_2GHZ)
                         b43_phy_mask(dev, B43_PHY_B_TEST, ~0x840);
         }
 
@@ -3386,70 +3376,62 @@ static void b43_nphy_chanspec_setup(struct b43_wldev *dev,
 }
 
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/SetChanspec */
-static int b43_nphy_set_chanspec(struct b43_wldev *dev,
-                                        struct b43_chanspec chanspec)
+static int b43_nphy_set_channel(struct b43_wldev *dev,
+                                struct ieee80211_channel *channel,
+                                enum nl80211_channel_type channel_type)
 {
+        struct b43_phy *phy = &dev->phy;
         struct b43_phy_n *nphy = dev->phy.n;
 
         const struct b43_nphy_channeltab_entry_rev2 *tabent_r2;
         const struct b43_nphy_channeltab_entry_rev3 *tabent_r3;
 
         u8 tmp;
-        u8 channel = chanspec.channel;
 
         if (dev->phy.rev >= 3) {
-                /* TODO */
+                tabent_r3 = b43_nphy_get_chantabent_rev3(dev,
+                                                        channel->center_freq);
                 tabent_r3 = NULL;
                 if (!tabent_r3)
                         return -ESRCH;
         } else {
-                tabent_r2 = b43_nphy_get_chantabent_rev2(dev, channel);
+                tabent_r2 = b43_nphy_get_chantabent_rev2(dev,
+                                                        channel->hw_value);
                 if (!tabent_r2)
                         return -ESRCH;
         }
 
-        nphy->radio_chanspec = chanspec;
+        /* Channel is set later in common code, but we need to set it on our
+           own to let this function's subcalls work properly. */
+        phy->channel = channel->hw_value;
+        phy->channel_freq = channel->center_freq;
 
-        if (chanspec.b_width != nphy->b_width)
-                ; /* TODO: BMAC BW Set (chanspec.b_width) */
+        if (b43_channel_type_is_40mhz(phy->channel_type) !=
+                b43_channel_type_is_40mhz(channel_type))
+                ; /* TODO: BMAC BW Set (channel_type) */
 
-        /* TODO: use defines */
-        if (chanspec.b_width == 3) {
-                if (chanspec.sideband == 2)
-                        b43_phy_set(dev, B43_NPHY_RXCTL,
-                                        B43_NPHY_RXCTL_BSELU20);
-                else
-                        b43_phy_mask(dev, B43_NPHY_RXCTL,
-                                        ~B43_NPHY_RXCTL_BSELU20);
-        }
+        if (channel_type == NL80211_CHAN_HT40PLUS)
+                b43_phy_set(dev, B43_NPHY_RXCTL,
+                                B43_NPHY_RXCTL_BSELU20);
+        else if (channel_type == NL80211_CHAN_HT40MINUS)
+                b43_phy_mask(dev, B43_NPHY_RXCTL,
+                                ~B43_NPHY_RXCTL_BSELU20);
 
         if (dev->phy.rev >= 3) {
-                tmp = (chanspec.b_freq == 1) ? 4 : 0;
+                tmp = (channel->band == IEEE80211_BAND_5GHZ) ? 4 : 0;
                 b43_radio_maskset(dev, 0x08, 0xFFFB, tmp);
                 /* TODO: PHY Radio2056 Setup (dev, tabent_r3); */
-                b43_nphy_chanspec_setup(dev, &(tabent_r3->phy_regs), chanspec);
+                b43_nphy_channel_setup(dev, &(tabent_r3->phy_regs), channel);
         } else {
-                tmp = (chanspec.b_freq == 1) ? 0x0020 : 0x0050;
+                tmp = (channel->band == IEEE80211_BAND_5GHZ) ? 0x0020 : 0x0050;
                 b43_radio_maskset(dev, B2055_MASTER1, 0xFF8F, tmp);
                 b43_radio_2055_setup(dev, tabent_r2);
-                b43_nphy_chanspec_setup(dev, &(tabent_r2->phy_regs), chanspec);
+                b43_nphy_channel_setup(dev, &(tabent_r2->phy_regs), channel);
         }
 
         return 0;
 }
 
-/* Tune the hardware to a new channel */
-static int nphy_channel_switch(struct b43_wldev *dev, unsigned int channel)
-{
-        struct b43_phy_n *nphy = dev->phy.n;
-
-        struct b43_chanspec chanspec;
-        chanspec = nphy->radio_chanspec;
-        chanspec.channel = channel;
-
-        return b43_nphy_set_chanspec(dev, chanspec);
-}
-
 static int b43_nphy_op_allocate(struct b43_wldev *dev)
 {
         struct b43_phy_n *nphy;
@@ -3570,7 +3552,7 @@ static void b43_nphy_op_software_rfkill(struct b43_wldev *dev,
         } else {
                 if (dev->phy.rev >= 3) {
                         b43_radio_init2056(dev);
-                        b43_nphy_set_chanspec(dev, nphy->radio_chanspec);
+                        b43_switch_channel(dev, dev->phy.channel);
                 } else {
                         b43_radio_init2055(dev);
                 }
@@ -3586,6 +3568,9 @@ static void b43_nphy_op_switch_analog(struct b43_wldev *dev, bool on)
 static int b43_nphy_op_switch_channel(struct b43_wldev *dev,
                                       unsigned int new_channel)
 {
+        struct ieee80211_channel *channel = dev->wl->hw->conf.channel;
+        enum nl80211_channel_type channel_type = dev->wl->hw->conf.channel_type;
+
         if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
                 if ((new_channel < 1) || (new_channel > 14))
                         return -EINVAL;
@@ -3594,7 +3579,7 @@ static int b43_nphy_op_switch_channel(struct b43_wldev *dev,
                         return -EINVAL;
         }
 
-        return nphy_channel_switch(dev, new_channel);
+        return b43_nphy_set_channel(dev, channel, channel_type);
 }
 
 static unsigned int b43_nphy_op_get_default_chan(struct b43_wldev *dev)
diff --git a/drivers/net/wireless/b43/phy_n.h b/drivers/net/wireless/b43/phy_n.h
index 8b6d570dd0aa..c144e59a708b 100644
--- a/drivers/net/wireless/b43/phy_n.h
+++ b/drivers/net/wireless/b43/phy_n.h
@@ -714,223 +714,11 @@
 #define B43_PHY_B_BBCFG                         B43_PHY_N_BMODE(0x001) /* BB config */
 #define B43_PHY_B_TEST                          B43_PHY_N_BMODE(0x00A)
 
-
-/* Broadcom 2055 radio registers */
-
-#define B2055_GEN_SPARE                 0x00 /* GEN spare */
-#define B2055_SP_PINPD                  0x02 /* SP PIN PD */
-#define B2055_C1_SP_RSSI                0x03 /* SP RSSI Core 1 */
-#define B2055_C1_SP_PDMISC              0x04 /* SP PD MISC Core 1 */
-#define B2055_C2_SP_RSSI                0x05 /* SP RSSI Core 2 */
-#define B2055_C2_SP_PDMISC              0x06 /* SP PD MISC Core 2 */
-#define B2055_C1_SP_RXGC1               0x07 /* SP RX GC1 Core 1 */
-#define B2055_C1_SP_RXGC2               0x08 /* SP RX GC2 Core 1 */
-#define B2055_C2_SP_RXGC1               0x09 /* SP RX GC1 Core 2 */
-#define B2055_C2_SP_RXGC2               0x0A /* SP RX GC2 Core 2 */
-#define B2055_C1_SP_LPFBWSEL            0x0B /* SP LPF BW select Core 1 */
-#define B2055_C2_SP_LPFBWSEL            0x0C /* SP LPF BW select Core 2 */
-#define B2055_C1_SP_TXGC1               0x0D /* SP TX GC1 Core 1 */
-#define B2055_C1_SP_TXGC2               0x0E /* SP TX GC2 Core 1 */
-#define B2055_C2_SP_TXGC1               0x0F /* SP TX GC1 Core 2 */
-#define B2055_C2_SP_TXGC2               0x10 /* SP TX GC2 Core 2 */
-#define B2055_MASTER1                   0x11 /* Master control 1 */
-#define B2055_MASTER2                   0x12 /* Master control 2 */
-#define B2055_PD_LGEN                   0x13 /* PD LGEN */
-#define B2055_PD_PLLTS                  0x14 /* PD PLL TS */
-#define B2055_C1_PD_LGBUF               0x15 /* PD Core 1 LGBUF */
-#define B2055_C1_PD_TX                  0x16 /* PD Core 1 TX */
-#define B2055_C1_PD_RXTX                0x17 /* PD Core 1 RXTX */
-#define B2055_C1_PD_RSSIMISC            0x18 /* PD Core 1 RSSI MISC */
-#define B2055_C2_PD_LGBUF               0x19 /* PD Core 2 LGBUF */
-#define B2055_C2_PD_TX                  0x1A /* PD Core 2 TX */
-#define B2055_C2_PD_RXTX                0x1B /* PD Core 2 RXTX */
-#define B2055_C2_PD_RSSIMISC            0x1C /* PD Core 2 RSSI MISC */
-#define B2055_PWRDET_LGEN               0x1D /* PWRDET LGEN */
-#define B2055_C1_PWRDET_LGBUF           0x1E /* PWRDET LGBUF Core 1 */
-#define B2055_C1_PWRDET_RXTX            0x1F /* PWRDET RXTX Core 1 */
-#define B2055_C2_PWRDET_LGBUF           0x20 /* PWRDET LGBUF Core 2 */
-#define B2055_C2_PWRDET_RXTX            0x21 /* PWRDET RXTX Core 2 */
-#define B2055_RRCCAL_CS                 0x22 /* RRCCAL Control spare */
-#define B2055_RRCCAL_NOPTSEL            0x23 /* RRCCAL N OPT SEL */
-#define B2055_CAL_MISC                  0x24 /* CAL MISC */
-#define B2055_CAL_COUT                  0x25 /* CAL Counter out */
-#define B2055_CAL_COUT2                 0x26 /* CAL Counter out 2 */
-#define B2055_CAL_CVARCTL               0x27 /* CAL CVAR Control */
-#define B2055_CAL_RVARCTL               0x28 /* CAL RVAR Control */
-#define B2055_CAL_LPOCTL                0x29 /* CAL LPO Control */
-#define B2055_CAL_TS                    0x2A /* CAL TS */
-#define B2055_CAL_RCCALRTS              0x2B /* CAL RCCAL READ TS */
-#define B2055_CAL_RCALRTS               0x2C /* CAL RCAL READ TS */
-#define B2055_PADDRV                    0x2D /* PAD driver */
-#define B2055_XOCTL1                    0x2E /* XO Control 1 */
-#define B2055_XOCTL2                    0x2F /* XO Control 2 */
-#define B2055_XOREGUL                   0x30 /* XO Regulator */
-#define B2055_XOMISC                    0x31 /* XO misc */
-#define B2055_PLL_LFC1                  0x32 /* PLL LF C1 */
-#define B2055_PLL_CALVTH                0x33 /* PLL CAL VTH */
-#define B2055_PLL_LFC2                  0x34 /* PLL LF C2 */
-#define B2055_PLL_REF                   0x35 /* PLL reference */
-#define B2055_PLL_LFR1                  0x36 /* PLL LF R1 */
-#define B2055_PLL_PFDCP                 0x37 /* PLL PFD CP */
-#define B2055_PLL_IDAC_CPOPAMP          0x38 /* PLL IDAC CPOPAMP */
-#define B2055_PLL_CPREG                 0x39 /* PLL CP Regulator */
-#define B2055_PLL_RCAL                  0x3A /* PLL RCAL */
-#define B2055_RF_PLLMOD0                0x3B /* RF PLL MOD0 */
-#define B2055_RF_PLLMOD1                0x3C /* RF PLL MOD1 */
-#define B2055_RF_MMDIDAC1               0x3D /* RF MMD IDAC 1 */
-#define B2055_RF_MMDIDAC0               0x3E /* RF MMD IDAC 0 */
-#define B2055_RF_MMDSP                  0x3F /* RF MMD spare */
-#define B2055_VCO_CAL1                  0x40 /* VCO cal 1 */
-#define B2055_VCO_CAL2                  0x41 /* VCO cal 2 */
-#define B2055_VCO_CAL3                  0x42 /* VCO cal 3 */
-#define B2055_VCO_CAL4                  0x43 /* VCO cal 4 */
-#define B2055_VCO_CAL5                  0x44 /* VCO cal 5 */
-#define B2055_VCO_CAL6                  0x45 /* VCO cal 6 */
-#define B2055_VCO_CAL7                  0x46 /* VCO cal 7 */
-#define B2055_VCO_CAL8                  0x47 /* VCO cal 8 */
-#define B2055_VCO_CAL9                  0x48 /* VCO cal 9 */
-#define B2055_VCO_CAL10                 0x49 /* VCO cal 10 */
-#define B2055_VCO_CAL11                 0x4A /* VCO cal 11 */
-#define B2055_VCO_CAL12                 0x4B /* VCO cal 12 */
-#define B2055_VCO_CAL13                 0x4C /* VCO cal 13 */
-#define B2055_VCO_CAL14                 0x4D /* VCO cal 14 */
-#define B2055_VCO_CAL15                 0x4E /* VCO cal 15 */
-#define B2055_VCO_CAL16                 0x4F /* VCO cal 16 */
-#define B2055_VCO_KVCO                  0x50 /* VCO KVCO */
-#define B2055_VCO_CAPTAIL               0x51 /* VCO CAP TAIL */
-#define B2055_VCO_IDACVCO               0x52 /* VCO IDAC VCO */
-#define B2055_VCO_REG                   0x53 /* VCO Regulator */
-#define B2055_PLL_RFVTH                 0x54 /* PLL RF VTH */
-#define B2055_LGBUF_CENBUF              0x55 /* LGBUF CEN BUF */
-#define B2055_LGEN_TUNE1                0x56 /* LGEN tune 1 */
-#define B2055_LGEN_TUNE2                0x57 /* LGEN tune 2 */
-#define B2055_LGEN_IDAC1                0x58 /* LGEN IDAC 1 */
-#define B2055_LGEN_IDAC2                0x59 /* LGEN IDAC 2 */
-#define B2055_LGEN_BIASC                0x5A /* LGEN BIAS counter */
-#define B2055_LGEN_BIASIDAC             0x5B /* LGEN BIAS IDAC */
-#define B2055_LGEN_RCAL                 0x5C /* LGEN RCAL */
-#define B2055_LGEN_DIV                  0x5D /* LGEN div */
-#define B2055_LGEN_SPARE2               0x5E /* LGEN spare 2 */
-#define B2055_C1_LGBUF_ATUNE            0x5F /* Core 1 LGBUF A tune */
-#define B2055_C1_LGBUF_GTUNE            0x60 /* Core 1 LGBUF G tune */
-#define B2055_C1_LGBUF_DIV              0x61 /* Core 1 LGBUF div */
-#define B2055_C1_LGBUF_AIDAC            0x62 /* Core 1 LGBUF A IDAC */
-#define B2055_C1_LGBUF_GIDAC            0x63 /* Core 1 LGBUF G IDAC */
-#define B2055_C1_LGBUF_IDACFO           0x64 /* Core 1 LGBUF IDAC filter override */
-#define B2055_C1_LGBUF_SPARE            0x65 /* Core 1 LGBUF spare */
-#define B2055_C1_RX_RFSPC1              0x66 /* Core 1 RX RF SPC1 */
-#define B2055_C1_RX_RFR1                0x67 /* Core 1 RX RF reg 1 */
-#define B2055_C1_RX_RFR2                0x68 /* Core 1 RX RF reg 2 */
-#define B2055_C1_RX_RFRCAL              0x69 /* Core 1 RX RF RCAL */
-#define B2055_C1_RX_BB_BLCMP            0x6A /* Core 1 RX Baseband BUFI LPF CMP */
-#define B2055_C1_RX_BB_LPF              0x6B /* Core 1 RX Baseband LPF */
-#define B2055_C1_RX_BB_MIDACHP          0x6C /* Core 1 RX Baseband MIDAC High-pass */
-#define B2055_C1_RX_BB_VGA1IDAC         0x6D /* Core 1 RX Baseband VGA1 IDAC */
-#define B2055_C1_RX_BB_VGA2IDAC         0x6E /* Core 1 RX Baseband VGA2 IDAC */
-#define B2055_C1_RX_BB_VGA3IDAC         0x6F /* Core 1 RX Baseband VGA3 IDAC */
-#define B2055_C1_RX_BB_BUFOCTL          0x70 /* Core 1 RX Baseband BUFO Control */
-#define B2055_C1_RX_BB_RCCALCTL         0x71 /* Core 1 RX Baseband RCCAL Control */
-#define B2055_C1_RX_BB_RSSICTL1         0x72 /* Core 1 RX Baseband RSSI Control 1 */
-#define B2055_C1_RX_BB_RSSICTL2         0x73 /* Core 1 RX Baseband RSSI Control 2 */
-#define B2055_C1_RX_BB_RSSICTL3         0x74 /* Core 1 RX Baseband RSSI Control 3 */
-#define B2055_C1_RX_BB_RSSICTL4         0x75 /* Core 1 RX Baseband RSSI Control 4 */
-#define B2055_C1_RX_BB_RSSICTL5         0x76 /* Core 1 RX Baseband RSSI Control 5 */
-#define B2055_C1_RX_BB_REG              0x77 /* Core 1 RX Baseband Regulator */
-#define B2055_C1_RX_BB_SPARE1           0x78 /* Core 1 RX Baseband spare 1 */
-#define B2055_C1_RX_TXBBRCAL            0x79 /* Core 1 RX TX BB RCAL */
-#define B2055_C1_TX_RF_SPGA             0x7A /* Core 1 TX RF SGM PGA */
-#define B2055_C1_TX_RF_SPAD             0x7B /* Core 1 TX RF SGM PAD */
-#define B2055_C1_TX_RF_CNTPGA1          0x7C /* Core 1 TX RF counter PGA 1 */
-#define B2055_C1_TX_RF_CNTPAD1          0x7D /* Core 1 TX RF counter PAD 1 */
-#define B2055_C1_TX_RF_PGAIDAC          0x7E /* Core 1 TX RF PGA IDAC */
-#define B2055_C1_TX_PGAPADTN            0x7F /* Core 1 TX PGA PAD TN */
-#define B2055_C1_TX_PADIDAC1            0x80 /* Core 1 TX PAD IDAC 1 */
-#define B2055_C1_TX_PADIDAC2            0x81 /* Core 1 TX PAD IDAC 2 */
-#define B2055_C1_TX_MXBGTRIM            0x82 /* Core 1 TX MX B/G TRIM */
-#define B2055_C1_TX_RF_RCAL             0x83 /* Core 1 TX RF RCAL */
-#define B2055_C1_TX_RF_PADTSSI1         0x84 /* Core 1 TX RF PAD TSSI1 */
-#define B2055_C1_TX_RF_PADTSSI2         0x85 /* Core 1 TX RF PAD TSSI2 */
-#define B2055_C1_TX_RF_SPARE            0x86 /* Core 1 TX RF spare */
-#define B2055_C1_TX_RF_IQCAL1           0x87 /* Core 1 TX RF I/Q CAL 1 */
-#define B2055_C1_TX_RF_IQCAL2           0x88 /* Core 1 TX RF I/Q CAL 2 */
-#define B2055_C1_TXBB_RCCAL             0x89 /* Core 1 TXBB RC CAL Control */
-#define B2055_C1_TXBB_LPF1              0x8A /* Core 1 TXBB LPF 1 */
-#define B2055_C1_TX_VOSCNCL             0x8B /* Core 1 TX VOS CNCL */
-#define B2055_C1_TX_LPF_MXGMIDAC        0x8C /* Core 1 TX LPF MXGM IDAC */
-#define B2055_C1_TX_BB_MXGM             0x8D /* Core 1 TX BB MXGM */
-#define B2055_C2_LGBUF_ATUNE            0x8E /* Core 2 LGBUF A tune */
-#define B2055_C2_LGBUF_GTUNE            0x8F /* Core 2 LGBUF G tune */
-#define B2055_C2_LGBUF_DIV              0x90 /* Core 2 LGBUF div */
-#define B2055_C2_LGBUF_AIDAC            0x91 /* Core 2 LGBUF A IDAC */
-#define B2055_C2_LGBUF_GIDAC            0x92 /* Core 2 LGBUF G IDAC */
-#define B2055_C2_LGBUF_IDACFO           0x93 /* Core 2 LGBUF IDAC filter override */
-#define B2055_C2_LGBUF_SPARE            0x94 /* Core 2 LGBUF spare */
-#define B2055_C2_RX_RFSPC1              0x95 /* Core 2 RX RF SPC1 */
-#define B2055_C2_RX_RFR1                0x96 /* Core 2 RX RF reg 1 */
-#define B2055_C2_RX_RFR2                0x97 /* Core 2 RX RF reg 2 */
-#define B2055_C2_RX_RFRCAL              0x98 /* Core 2 RX RF RCAL */
-#define B2055_C2_RX_BB_BLCMP            0x99 /* Core 2 RX Baseband BUFI LPF CMP */
-#define B2055_C2_RX_BB_LPF              0x9A /* Core 2 RX Baseband LPF */
-#define B2055_C2_RX_BB_MIDACHP          0x9B /* Core 2 RX Baseband MIDAC High-pass */
-#define B2055_C2_RX_BB_VGA1IDAC         0x9C /* Core 2 RX Baseband VGA1 IDAC */
-#define B2055_C2_RX_BB_VGA2IDAC         0x9D /* Core 2 RX Baseband VGA2 IDAC */
-#define B2055_C2_RX_BB_VGA3IDAC         0x9E /* Core 2 RX Baseband VGA3 IDAC */
-#define B2055_C2_RX_BB_BUFOCTL          0x9F /* Core 2 RX Baseband BUFO Control */
-#define B2055_C2_RX_BB_RCCALCTL         0xA0 /* Core 2 RX Baseband RCCAL Control */
-#define B2055_C2_RX_BB_RSSICTL1         0xA1 /* Core 2 RX Baseband RSSI Control 1 */
-#define B2055_C2_RX_BB_RSSICTL2         0xA2 /* Core 2 RX Baseband RSSI Control 2 */
-#define B2055_C2_RX_BB_RSSICTL3         0xA3 /* Core 2 RX Baseband RSSI Control 3 */
-#define B2055_C2_RX_BB_RSSICTL4         0xA4 /* Core 2 RX Baseband RSSI Control 4 */
-#define B2055_C2_RX_BB_RSSICTL5         0xA5 /* Core 2 RX Baseband RSSI Control 5 */
-#define B2055_C2_RX_BB_REG              0xA6 /* Core 2 RX Baseband Regulator */
-#define B2055_C2_RX_BB_SPARE1           0xA7 /* Core 2 RX Baseband spare 1 */
-#define B2055_C2_RX_TXBBRCAL            0xA8 /* Core 2 RX TX BB RCAL */
-#define B2055_C2_TX_RF_SPGA             0xA9 /* Core 2 TX RF SGM PGA */
-#define B2055_C2_TX_RF_SPAD             0xAA /* Core 2 TX RF SGM PAD */
-#define B2055_C2_TX_RF_CNTPGA1          0xAB /* Core 2 TX RF counter PGA 1 */
-#define B2055_C2_TX_RF_CNTPAD1          0xAC /* Core 2 TX RF counter PAD 1 */
-#define B2055_C2_TX_RF_PGAIDAC          0xAD /* Core 2 TX RF PGA IDAC */
-#define B2055_C2_TX_PGAPADTN            0xAE /* Core 2 TX PGA PAD TN */
-#define B2055_C2_TX_PADIDAC1            0xAF /* Core 2 TX PAD IDAC 1 */
-#define B2055_C2_TX_PADIDAC2            0xB0 /* Core 2 TX PAD IDAC 2 */
-#define B2055_C2_TX_MXBGTRIM            0xB1 /* Core 2 TX MX B/G TRIM */
-#define B2055_C2_TX_RF_RCAL             0xB2 /* Core 2 TX RF RCAL */
-#define B2055_C2_TX_RF_PADTSSI1         0xB3 /* Core 2 TX RF PAD TSSI1 */
-#define B2055_C2_TX_RF_PADTSSI2         0xB4 /* Core 2 TX RF PAD TSSI2 */
-#define B2055_C2_TX_RF_SPARE            0xB5 /* Core 2 TX RF spare */
-#define B2055_C2_TX_RF_IQCAL1           0xB6 /* Core 2 TX RF I/Q CAL 1 */
-#define B2055_C2_TX_RF_IQCAL2           0xB7 /* Core 2 TX RF I/Q CAL 2 */
-#define B2055_C2_TXBB_RCCAL             0xB8 /* Core 2 TXBB RC CAL Control */
-#define B2055_C2_TXBB_LPF1              0xB9 /* Core 2 TXBB LPF 1 */
-#define B2055_C2_TX_VOSCNCL             0xBA /* Core 2 TX VOS CNCL */
-#define B2055_C2_TX_LPF_MXGMIDAC        0xBB /* Core 2 TX LPF MXGM IDAC */
-#define B2055_C2_TX_BB_MXGM             0xBC /* Core 2 TX BB MXGM */
-#define B2055_PRG_GCHP21                0xBD /* PRG GC HPVGA23 21 */
-#define B2055_PRG_GCHP22                0xBE /* PRG GC HPVGA23 22 */
-#define B2055_PRG_GCHP23                0xBF /* PRG GC HPVGA23 23 */
-#define B2055_PRG_GCHP24                0xC0 /* PRG GC HPVGA23 24 */
-#define B2055_PRG_GCHP25                0xC1 /* PRG GC HPVGA23 25 */
-#define B2055_PRG_GCHP26                0xC2 /* PRG GC HPVGA23 26 */
-#define B2055_PRG_GCHP27                0xC3 /* PRG GC HPVGA23 27 */
-#define B2055_PRG_GCHP28                0xC4 /* PRG GC HPVGA23 28 */
-#define B2055_PRG_GCHP29                0xC5 /* PRG GC HPVGA23 29 */
-#define B2055_PRG_GCHP30                0xC6 /* PRG GC HPVGA23 30 */
-#define B2055_C1_LNA_GAINBST            0xCD /* Core 1 LNA GAINBST */
-#define B2055_C1_B0NB_RSSIVCM           0xD2 /* Core 1 B0 narrow-band RSSI VCM */
-#define B2055_C1_GENSPARE2              0xD6 /* Core 1 GEN spare 2 */
-#define B2055_C2_LNA_GAINBST            0xD9 /* Core 2 LNA GAINBST */
-#define B2055_C2_B0NB_RSSIVCM           0xDE /* Core 2 B0 narrow-band RSSI VCM */
-#define B2055_C2_GENSPARE2              0xE2 /* Core 2 GEN spare 2 */
-
-
-
 struct b43_wldev;
 
 struct b43_chanspec {
-        u8 channel;
-        u8 sideband;
-        u8 b_width;
-        u8 b_freq;
+        u16 center_freq;
+        enum nl80211_channel_type channel_type;
 };
 
 struct b43_phy_n_iq_comp {
@@ -984,8 +772,6 @@ struct b43_phy_n {
         u16 papd_epsilon_offset[2];
         s32 preamble_override;
         u32 bb_mult_save;
-        u8 b_width;
-        struct b43_chanspec radio_chanspec;
 
         bool gain_boost;
         bool elna_gain_config;
diff --git a/drivers/net/wireless/b43/radio_2055.c b/drivers/net/wireless/b43/radio_2055.c
new file mode 100644
index 000000000000..1b5316586cbf
--- /dev/null
+++ b/drivers/net/wireless/b43/radio_2055.c
@@ -0,0 +1,1332 @@
+/*
+
+  Broadcom B43 wireless driver
+  IEEE 802.11n PHY and radio device data tables
+
+  Copyright (c) 2008 Michael Buesch <mb@bu3sch.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; see the file COPYING.  If not, write to
+  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
+  Boston, MA 02110-1301, USA.
+
+*/
+
+#include "b43.h"
+#include "radio_2055.h"
+#include "phy_common.h"
+
+struct b2055_inittab_entry {
+        /* Value to write if we use the 5GHz band. */
+        u16 ghz5;
+        /* Value to write if we use the 2.4GHz band. */
+        u16 ghz2;
+        /* Flags */
+        u8 flags;
+#define B2055_INITTAB_ENTRY_OK  0x01
+#define B2055_INITTAB_UPLOAD    0x02
+};
+#define UPLOAD          .flags = B2055_INITTAB_ENTRY_OK | B2055_INITTAB_UPLOAD
+#define NOUPLOAD        .flags = B2055_INITTAB_ENTRY_OK
+
+static const struct b2055_inittab_entry b2055_inittab [] = {
+  [B2055_SP_PINPD]              = { .ghz5 = 0x0080, .ghz2 = 0x0080, NOUPLOAD, },
+  [B2055_C1_SP_RSSI]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C1_SP_PDMISC]          = { .ghz5 = 0x0027, .ghz2 = 0x0027, NOUPLOAD, },
+  [B2055_C2_SP_RSSI]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C2_SP_PDMISC]          = { .ghz5 = 0x0027, .ghz2 = 0x0027, NOUPLOAD, },
+  [B2055_C1_SP_RXGC1]           = { .ghz5 = 0x007F, .ghz2 = 0x007F, UPLOAD, },
+  [B2055_C1_SP_RXGC2]           = { .ghz5 = 0x0007, .ghz2 = 0x0007, UPLOAD, },
+  [B2055_C2_SP_RXGC1]           = { .ghz5 = 0x007F, .ghz2 = 0x007F, UPLOAD, },
+  [B2055_C2_SP_RXGC2]           = { .ghz5 = 0x0007, .ghz2 = 0x0007, UPLOAD, },
+  [B2055_C1_SP_LPFBWSEL]        = { .ghz5 = 0x0015, .ghz2 = 0x0015, NOUPLOAD, },
+  [B2055_C2_SP_LPFBWSEL]        = { .ghz5 = 0x0015, .ghz2 = 0x0015, NOUPLOAD, },
+  [B2055_C1_SP_TXGC1]           = { .ghz5 = 0x004F, .ghz2 = 0x004F, UPLOAD, },
+  [B2055_C1_SP_TXGC2]           = { .ghz5 = 0x0005, .ghz2 = 0x0005, UPLOAD, },
+  [B2055_C2_SP_TXGC1]           = { .ghz5 = 0x004F, .ghz2 = 0x004F, UPLOAD, },
+  [B2055_C2_SP_TXGC2]           = { .ghz5 = 0x0005, .ghz2 = 0x0005, UPLOAD, },
+  [B2055_MASTER1]               = { .ghz5 = 0x00D0, .ghz2 = 0x00D0, NOUPLOAD, },
+  [B2055_MASTER2]               = { .ghz5 = 0x0002, .ghz2 = 0x0002, NOUPLOAD, },
+  [B2055_PD_LGEN]               = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_PD_PLLTS]              = { .ghz5 = 0x0040, .ghz2 = 0x0040, NOUPLOAD, },
+  [B2055_C1_PD_LGBUF]           = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C1_PD_TX]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C1_PD_RXTX]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C1_PD_RSSIMISC]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C2_PD_LGBUF]           = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C2_PD_TX]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C2_PD_RXTX]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C2_PD_RSSIMISC]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_PWRDET_LGEN]           = { .ghz5 = 0x00C0, .ghz2 = 0x00C0, NOUPLOAD, },
+  [B2055_C1_PWRDET_LGBUF]       = { .ghz5 = 0x00FF, .ghz2 = 0x00FF, NOUPLOAD, },
+  [B2055_C1_PWRDET_RXTX]        = { .ghz5 = 0x00C0, .ghz2 = 0x00C0, NOUPLOAD, },
+  [B2055_C2_PWRDET_LGBUF]       = { .ghz5 = 0x00FF, .ghz2 = 0x00FF, NOUPLOAD, },
+  [B2055_C2_PWRDET_RXTX]        = { .ghz5 = 0x00C0, .ghz2 = 0x00C0, NOUPLOAD, },
+  [B2055_RRCCAL_CS]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_RRCCAL_NOPTSEL]        = { .ghz5 = 0x002C, .ghz2 = 0x002C, NOUPLOAD, },
+  [B2055_CAL_MISC]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_CAL_COUT]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_CAL_COUT2]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_CAL_CVARCTL]           = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_CAL_RVARCTL]           = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_CAL_LPOCTL]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_CAL_TS]                = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_CAL_RCCALRTS]          = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_CAL_RCALRTS]           = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_PADDRV]                = { .ghz5 = 0x00A4, .ghz2 = 0x00A4, NOUPLOAD, },
+  [B2055_XOCTL1]                = { .ghz5 = 0x0038, .ghz2 = 0x0038, NOUPLOAD, },
+  [B2055_XOCTL2]                = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_XOREGUL]               = { .ghz5 = 0x0004, .ghz2 = 0x0004, UPLOAD, },
+  [B2055_XOMISC]                = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_PLL_LFC1]              = { .ghz5 = 0x000A, .ghz2 = 0x000A, NOUPLOAD, },
+  [B2055_PLL_CALVTH]            = { .ghz5 = 0x0087, .ghz2 = 0x0087, NOUPLOAD, },
+  [B2055_PLL_LFC2]              = { .ghz5 = 0x0009, .ghz2 = 0x0009, NOUPLOAD, },
+  [B2055_PLL_REF]               = { .ghz5 = 0x0070, .ghz2 = 0x0070, NOUPLOAD, },
+  [B2055_PLL_LFR1]              = { .ghz5 = 0x0011, .ghz2 = 0x0011, NOUPLOAD, },
+  [B2055_PLL_PFDCP]             = { .ghz5 = 0x0018, .ghz2 = 0x0018, UPLOAD, },
+  [B2055_PLL_IDAC_CPOPAMP]      = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
+  [B2055_PLL_CPREG]             = { .ghz5 = 0x0004, .ghz2 = 0x0004, UPLOAD, },
+  [B2055_PLL_RCAL]              = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
+  [B2055_RF_PLLMOD0]            = { .ghz5 = 0x009E, .ghz2 = 0x009E, NOUPLOAD, },
+  [B2055_RF_PLLMOD1]            = { .ghz5 = 0x0009, .ghz2 = 0x0009, NOUPLOAD, },
+  [B2055_RF_MMDIDAC1]           = { .ghz5 = 0x00C8, .ghz2 = 0x00C8, UPLOAD, },
+  [B2055_RF_MMDIDAC0]           = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [B2055_RF_MMDSP]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_VCO_CAL1]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_VCO_CAL2]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_VCO_CAL3]              = { .ghz5 = 0x0001, .ghz2 = 0x0001, NOUPLOAD, },
+  [B2055_VCO_CAL4]              = { .ghz5 = 0x0002, .ghz2 = 0x0002, NOUPLOAD, },
+  [B2055_VCO_CAL5]              = { .ghz5 = 0x0096, .ghz2 = 0x0096, NOUPLOAD, },
+  [B2055_VCO_CAL6]              = { .ghz5 = 0x003E, .ghz2 = 0x003E, NOUPLOAD, },
+  [B2055_VCO_CAL7]              = { .ghz5 = 0x003E, .ghz2 = 0x003E, NOUPLOAD, },
+  [B2055_VCO_CAL8]              = { .ghz5 = 0x0013, .ghz2 = 0x0013, NOUPLOAD, },
+  [B2055_VCO_CAL9]              = { .ghz5 = 0x0002, .ghz2 = 0x0002, NOUPLOAD, },
+  [B2055_VCO_CAL10]             = { .ghz5 = 0x0015, .ghz2 = 0x0015, NOUPLOAD, },
+  [B2055_VCO_CAL11]             = { .ghz5 = 0x0007, .ghz2 = 0x0007, NOUPLOAD, },
+  [B2055_VCO_CAL12]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_VCO_CAL13]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_VCO_CAL14]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_VCO_CAL15]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_VCO_CAL16]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_VCO_KVCO]              = { .ghz5 = 0x0008, .ghz2 = 0x0008, NOUPLOAD, },
+  [B2055_VCO_CAPTAIL]           = { .ghz5 = 0x0008, .ghz2 = 0x0008, NOUPLOAD, },
+  [B2055_VCO_IDACVCO]           = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
+  [B2055_VCO_REG]               = { .ghz5 = 0x0084, .ghz2 = 0x0084, UPLOAD, },
+  [B2055_PLL_RFVTH]             = { .ghz5 = 0x00C3, .ghz2 = 0x00C3, NOUPLOAD, },
+  [B2055_LGBUF_CENBUF]          = { .ghz5 = 0x008F, .ghz2 = 0x008F, NOUPLOAD, },
+  [B2055_LGEN_TUNE1]            = { .ghz5 = 0x00FF, .ghz2 = 0x00FF, NOUPLOAD, },
+  [B2055_LGEN_TUNE2]            = { .ghz5 = 0x00FF, .ghz2 = 0x00FF, NOUPLOAD, },
+  [B2055_LGEN_IDAC1]            = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [B2055_LGEN_IDAC2]            = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [B2055_LGEN_BIASC]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_LGEN_BIASIDAC]         = { .ghz5 = 0x00CC, .ghz2 = 0x00CC, NOUPLOAD, },
+  [B2055_LGEN_RCAL]             = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
+  [B2055_LGEN_DIV]              = { .ghz5 = 0x0080, .ghz2 = 0x0080, NOUPLOAD, },
+  [B2055_LGEN_SPARE2]           = { .ghz5 = 0x0080, .ghz2 = 0x0080, NOUPLOAD, },
+  [B2055_C1_LGBUF_ATUNE]        = { .ghz5 = 0x00F8, .ghz2 = 0x00F8, NOUPLOAD, },
+  [B2055_C1_LGBUF_GTUNE]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [B2055_C1_LGBUF_DIV]          = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [B2055_C1_LGBUF_AIDAC]        = { .ghz5 = 0x0088, .ghz2 = 0x0008, UPLOAD, },
+  [B2055_C1_LGBUF_GIDAC]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [B2055_C1_LGBUF_IDACFO]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C1_LGBUF_SPARE]        = { .ghz5 = 0x0001, .ghz2 = 0x0001, UPLOAD, },
+  [B2055_C1_RX_RFSPC1]          = { .ghz5 = 0x008A, .ghz2 = 0x008A, NOUPLOAD, },
+  [B2055_C1_RX_RFR1]            = { .ghz5 = 0x0008, .ghz2 = 0x0008, NOUPLOAD, },
+  [B2055_C1_RX_RFR2]            = { .ghz5 = 0x0083, .ghz2 = 0x0083, NOUPLOAD, },
+  [B2055_C1_RX_RFRCAL]          = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
+  [B2055_C1_RX_BB_BLCMP]        = { .ghz5 = 0x00A0, .ghz2 = 0x00A0, NOUPLOAD, },
+  [B2055_C1_RX_BB_LPF]          = { .ghz5 = 0x000A, .ghz2 = 0x000A, NOUPLOAD, },
+  [B2055_C1_RX_BB_MIDACHP]      = { .ghz5 = 0x0087, .ghz2 = 0x0087, UPLOAD, },
+  [B2055_C1_RX_BB_VGA1IDAC]     = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
+  [B2055_C1_RX_BB_VGA2IDAC]     = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
+  [B2055_C1_RX_BB_VGA3IDAC]     = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
+  [B2055_C1_RX_BB_BUFOCTL]      = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
+  [B2055_C1_RX_BB_RCCALCTL]     = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
+  [B2055_C1_RX_BB_RSSICTL1]     = { .ghz5 = 0x006A, .ghz2 = 0x006A, UPLOAD, },
+  [B2055_C1_RX_BB_RSSICTL2]     = { .ghz5 = 0x00AB, .ghz2 = 0x00AB, UPLOAD, },
+  [B2055_C1_RX_BB_RSSICTL3]     = { .ghz5 = 0x0013, .ghz2 = 0x0013, UPLOAD, },
+  [B2055_C1_RX_BB_RSSICTL4]     = { .ghz5 = 0x00C1, .ghz2 = 0x00C1, UPLOAD, },
+  [B2055_C1_RX_BB_RSSICTL5]     = { .ghz5 = 0x00AA, .ghz2 = 0x00AA, UPLOAD, },
+  [B2055_C1_RX_BB_REG]          = { .ghz5 = 0x0087, .ghz2 = 0x0087, UPLOAD, },
+  [B2055_C1_RX_BB_SPARE1]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C1_RX_TXBBRCAL]        = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
+  [B2055_C1_TX_RF_SPGA]         = { .ghz5 = 0x0007, .ghz2 = 0x0007, NOUPLOAD, },
+  [B2055_C1_TX_RF_SPAD]         = { .ghz5 = 0x0007, .ghz2 = 0x0007, NOUPLOAD, },
+  [B2055_C1_TX_RF_CNTPGA1]      = { .ghz5 = 0x0015, .ghz2 = 0x0015, NOUPLOAD, },
+  [B2055_C1_TX_RF_CNTPAD1]      = { .ghz5 = 0x0055, .ghz2 = 0x0055, NOUPLOAD, },
+  [B2055_C1_TX_RF_PGAIDAC]      = { .ghz5 = 0x0097, .ghz2 = 0x0097, UPLOAD, },
+  [B2055_C1_TX_PGAPADTN]        = { .ghz5 = 0x0008, .ghz2 = 0x0008, NOUPLOAD, },
+  [B2055_C1_TX_PADIDAC1]        = { .ghz5 = 0x0014, .ghz2 = 0x0014, UPLOAD, },
+  [B2055_C1_TX_PADIDAC2]        = { .ghz5 = 0x0033, .ghz2 = 0x0033, NOUPLOAD, },
+  [B2055_C1_TX_MXBGTRIM]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [B2055_C1_TX_RF_RCAL]         = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
+  [B2055_C1_TX_RF_PADTSSI1]     = { .ghz5 = 0x0003, .ghz2 = 0x0003, UPLOAD, },
+  [B2055_C1_TX_RF_PADTSSI2]     = { .ghz5 = 0x000A, .ghz2 = 0x000A, NOUPLOAD, },
+  [B2055_C1_TX_RF_SPARE]        = { .ghz5 = 0x0003, .ghz2 = 0x0003, UPLOAD, },
+  [B2055_C1_TX_RF_IQCAL1]       = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
+  [B2055_C1_TX_RF_IQCAL2]       = { .ghz5 = 0x00A4, .ghz2 = 0x00A4, NOUPLOAD, },
+  [B2055_C1_TXBB_RCCAL]         = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
+  [B2055_C1_TXBB_LPF1]          = { .ghz5 = 0x0028, .ghz2 = 0x0028, NOUPLOAD, },
+  [B2055_C1_TX_VOSCNCL]         = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C1_TX_LPF_MXGMIDAC]    = { .ghz5 = 0x004A, .ghz2 = 0x004A, NOUPLOAD, },
+  [B2055_C1_TX_BB_MXGM]         = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C2_LGBUF_ATUNE]        = { .ghz5 = 0x00F8, .ghz2 = 0x00F8, NOUPLOAD, },
+  [B2055_C2_LGBUF_GTUNE]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [B2055_C2_LGBUF_DIV]          = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [B2055_C2_LGBUF_AIDAC]        = { .ghz5 = 0x0088, .ghz2 = 0x0008, UPLOAD, },
+  [B2055_C2_LGBUF_GIDAC]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [B2055_C2_LGBUF_IDACFO]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C2_LGBUF_SPARE]        = { .ghz5 = 0x0001, .ghz2 = 0x0001, UPLOAD, },
+  [B2055_C2_RX_RFSPC1]          = { .ghz5 = 0x008A, .ghz2 = 0x008A, NOUPLOAD, },
+  [B2055_C2_RX_RFR1]            = { .ghz5 = 0x0008, .ghz2 = 0x0008, NOUPLOAD, },
+  [B2055_C2_RX_RFR2]            = { .ghz5 = 0x0083, .ghz2 = 0x0083, NOUPLOAD, },
+  [B2055_C2_RX_RFRCAL]          = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
+  [B2055_C2_RX_BB_BLCMP]        = { .ghz5 = 0x00A0, .ghz2 = 0x00A0, NOUPLOAD, },
+  [B2055_C2_RX_BB_LPF]          = { .ghz5 = 0x000A, .ghz2 = 0x000A, NOUPLOAD, },
+  [B2055_C2_RX_BB_MIDACHP]      = { .ghz5 = 0x0087, .ghz2 = 0x0087, UPLOAD, },
+  [B2055_C2_RX_BB_VGA1IDAC]     = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
+  [B2055_C2_RX_BB_VGA2IDAC]     = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
+  [B2055_C2_RX_BB_VGA3IDAC]     = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
+  [B2055_C2_RX_BB_BUFOCTL]      = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
+  [B2055_C2_RX_BB_RCCALCTL]     = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
+  [B2055_C2_RX_BB_RSSICTL1]     = { .ghz5 = 0x006A, .ghz2 = 0x006A, UPLOAD, },
+  [B2055_C2_RX_BB_RSSICTL2]     = { .ghz5 = 0x00AB, .ghz2 = 0x00AB, UPLOAD, },
+  [B2055_C2_RX_BB_RSSICTL3]     = { .ghz5 = 0x0013, .ghz2 = 0x0013, UPLOAD, },
+  [B2055_C2_RX_BB_RSSICTL4]     = { .ghz5 = 0x00C1, .ghz2 = 0x00C1, UPLOAD, },
+  [B2055_C2_RX_BB_RSSICTL5]     = { .ghz5 = 0x00AA, .ghz2 = 0x00AA, UPLOAD, },
+  [B2055_C2_RX_BB_REG]          = { .ghz5 = 0x0087, .ghz2 = 0x0087, UPLOAD, },
+  [B2055_C2_RX_BB_SPARE1]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C2_RX_TXBBRCAL]        = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
+  [B2055_C2_TX_RF_SPGA]         = { .ghz5 = 0x0007, .ghz2 = 0x0007, NOUPLOAD, },
+  [B2055_C2_TX_RF_SPAD]         = { .ghz5 = 0x0007, .ghz2 = 0x0007, NOUPLOAD, },
+  [B2055_C2_TX_RF_CNTPGA1]      = { .ghz5 = 0x0015, .ghz2 = 0x0015, NOUPLOAD, },
+  [B2055_C2_TX_RF_CNTPAD1]      = { .ghz5 = 0x0055, .ghz2 = 0x0055, NOUPLOAD, },
+  [B2055_C2_TX_RF_PGAIDAC]      = { .ghz5 = 0x0097, .ghz2 = 0x0097, UPLOAD, },
+  [B2055_C2_TX_PGAPADTN]        = { .ghz5 = 0x0008, .ghz2 = 0x0008, NOUPLOAD, },
+  [B2055_C2_TX_PADIDAC1]        = { .ghz5 = 0x0014, .ghz2 = 0x0014, UPLOAD, },
+  [B2055_C2_TX_PADIDAC2]        = { .ghz5 = 0x0033, .ghz2 = 0x0033, NOUPLOAD, },
+  [B2055_C2_TX_MXBGTRIM]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [B2055_C2_TX_RF_RCAL]         = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
+  [B2055_C2_TX_RF_PADTSSI1]     = { .ghz5 = 0x0003, .ghz2 = 0x0003, UPLOAD, },
+  [B2055_C2_TX_RF_PADTSSI2]     = { .ghz5 = 0x000A, .ghz2 = 0x000A, NOUPLOAD, },
+  [B2055_C2_TX_RF_SPARE]        = { .ghz5 = 0x0003, .ghz2 = 0x0003, UPLOAD, },
+  [B2055_C2_TX_RF_IQCAL1]       = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
+  [B2055_C2_TX_RF_IQCAL2]       = { .ghz5 = 0x00A4, .ghz2 = 0x00A4, NOUPLOAD, },
+  [B2055_C2_TXBB_RCCAL]         = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
+  [B2055_C2_TXBB_LPF1]          = { .ghz5 = 0x0028, .ghz2 = 0x0028, NOUPLOAD, },
+  [B2055_C2_TX_VOSCNCL]         = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C2_TX_LPF_MXGMIDAC]    = { .ghz5 = 0x004A, .ghz2 = 0x004A, NOUPLOAD, },
+  [B2055_C2_TX_BB_MXGM]         = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_PRG_GCHP21]            = { .ghz5 = 0x0071, .ghz2 = 0x0071, NOUPLOAD, },
+  [B2055_PRG_GCHP22]            = { .ghz5 = 0x0072, .ghz2 = 0x0072, NOUPLOAD, },
+  [B2055_PRG_GCHP23]            = { .ghz5 = 0x0073, .ghz2 = 0x0073, NOUPLOAD, },
+  [B2055_PRG_GCHP24]            = { .ghz5 = 0x0074, .ghz2 = 0x0074, NOUPLOAD, },
+  [B2055_PRG_GCHP25]            = { .ghz5 = 0x0075, .ghz2 = 0x0075, NOUPLOAD, },
+  [B2055_PRG_GCHP26]            = { .ghz5 = 0x0076, .ghz2 = 0x0076, NOUPLOAD, },
+  [B2055_PRG_GCHP27]            = { .ghz5 = 0x0077, .ghz2 = 0x0077, NOUPLOAD, },
+  [B2055_PRG_GCHP28]            = { .ghz5 = 0x0078, .ghz2 = 0x0078, NOUPLOAD, },
+  [B2055_PRG_GCHP29]            = { .ghz5 = 0x0079, .ghz2 = 0x0079, NOUPLOAD, },
+  [B2055_PRG_GCHP30]            = { .ghz5 = 0x007A, .ghz2 = 0x007A, NOUPLOAD, },
+  [0xC7]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xC8]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xC9]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xCA]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xCB]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xCC]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C1_LNA_GAINBST]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xCE]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xCF]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xD0]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xD1]                        = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
+  [B2055_C1_B0NB_RSSIVCM]       = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [0xD3]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xD4]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xD5]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C1_GENSPARE2]          = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xD7]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xD8]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C2_LNA_GAINBST]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xDA]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xDB]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xDC]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xDD]                        = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
+  [B2055_C2_B0NB_RSSIVCM]       = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
+  [0xDF]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xE0]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xE1]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [B2055_C2_GENSPARE2]          = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+};
+
+#define RADIOREGS(r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, \
+                  r12, r13, r14, r15, r16, r17, r18, r19, r20, r21) \
+        .radio_pll_ref          = r0,   \
+        .radio_rf_pllmod0       = r1,   \
+        .radio_rf_pllmod1       = r2,   \
+        .radio_vco_captail      = r3,   \
+        .radio_vco_cal1         = r4,   \
+        .radio_vco_cal2         = r5,   \
+        .radio_pll_lfc1         = r6,   \
+        .radio_pll_lfr1         = r7,   \
+        .radio_pll_lfc2         = r8,   \
+        .radio_lgbuf_cenbuf     = r9,   \
+        .radio_lgen_tune1       = r10,  \
+        .radio_lgen_tune2       = r11,  \
+        .radio_c1_lgbuf_atune   = r12,  \
+        .radio_c1_lgbuf_gtune   = r13,  \
+        .radio_c1_rx_rfr1       = r14,  \
+        .radio_c1_tx_pgapadtn   = r15,  \
+        .radio_c1_tx_mxbgtrim   = r16,  \
+        .radio_c2_lgbuf_atune   = r17,  \
+        .radio_c2_lgbuf_gtune   = r18,  \
+        .radio_c2_rx_rfr1       = r19,  \
+        .radio_c2_tx_pgapadtn   = r20,  \
+        .radio_c2_tx_mxbgtrim   = r21
+
+#define PHYREGS(r0, r1, r2, r3, r4, r5) \
+        .phy_regs.phy_bw1a      = r0,   \
+        .phy_regs.phy_bw2       = r1,   \
+        .phy_regs.phy_bw3       = r2,   \
+        .phy_regs.phy_bw4       = r3,   \
+        .phy_regs.phy_bw5       = r4,   \
+        .phy_regs.phy_bw6       = r5
+
+static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] = {
+  {     .channel                = 184,
+        .freq                   = 4920, /* MHz */
+        .unk2                   = 3280,
+        RADIOREGS(0x71, 0x01, 0xEC, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xFF, 0xFF, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xB407, 0xB007, 0xAC07, 0x1402, 0x1502, 0x1602),
+  },
+  {     .channel                = 186,
+        .freq                   = 4930, /* MHz */
+        .unk2                   = 3287,
+        RADIOREGS(0x71, 0x01, 0xED, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xFF, 0xFF, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xB807, 0xB407, 0xB007, 0x1302, 0x1402, 0x1502),
+  },
+  {     .channel                = 188,
+        .freq                   = 4940, /* MHz */
+        .unk2                   = 3293,
+        RADIOREGS(0x71, 0x01, 0xEE, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xEE, 0xEE, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xBC07, 0xB807, 0xB407, 0x1202, 0x1302, 0x1402),
+  },
+  {     .channel                = 190,
+        .freq                   = 4950, /* MHz */
+        .unk2                   = 3300,
+        RADIOREGS(0x71, 0x01, 0xEF, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xEE, 0xEE, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xC007, 0xBC07, 0xB807, 0x1102, 0x1202, 0x1302),
+  },
+  {     .channel                = 192,
+        .freq                   = 4960, /* MHz */
+        .unk2                   = 3307,
+        RADIOREGS(0x71, 0x01, 0xF0, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xEE, 0xEE, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xC407, 0xC007, 0xBC07, 0x0F02, 0x1102, 0x1202),
+  },
+  {     .channel                = 194,
+        .freq                   = 4970, /* MHz */
+        .unk2                   = 3313,
+        RADIOREGS(0x71, 0x01, 0xF1, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xEE, 0xEE, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xC807, 0xC407, 0xC007, 0x0E02, 0x0F02, 0x1102),
+  },
+  {     .channel                = 196,
+        .freq                   = 4980, /* MHz */
+        .unk2                   = 3320,
+        RADIOREGS(0x71, 0x01, 0xF2, 0x0E, 0xFF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xDD, 0xDD, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xCC07, 0xC807, 0xC407, 0x0D02, 0x0E02, 0x0F02),
+  },
+  {     .channel                = 198,
+        .freq                   = 4990, /* MHz */
+        .unk2                   = 3327,
+        RADIOREGS(0x71, 0x01, 0xF3, 0x0E, 0xFF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xDD, 0xDD, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xD007, 0xCC07, 0xC807, 0x0C02, 0x0D02, 0x0E02),
+  },
+  {     .channel                = 200,
+        .freq                   = 5000, /* MHz */
+        .unk2                   = 3333,
+        RADIOREGS(0x71, 0x01, 0xF4, 0x0E, 0xFF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xDD, 0xDD, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xD407, 0xD007, 0xCC07, 0x0B02, 0x0C02, 0x0D02),
+  },
+  {     .channel                = 202,
+        .freq                   = 5010, /* MHz */
+        .unk2                   = 3340,
+        RADIOREGS(0x71, 0x01, 0xF5, 0x0E, 0xFF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xDD, 0xDD, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xD807, 0xD407, 0xD007, 0x0A02, 0x0B02, 0x0C02),
+  },
+  {     .channel                = 204,
+        .freq                   = 5020, /* MHz */
+        .unk2                   = 3347,
+        RADIOREGS(0x71, 0x01, 0xF6, 0x0E, 0xF7, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xCC, 0xCC, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xDC07, 0xD807, 0xD407, 0x0902, 0x0A02, 0x0B02),
+  },
+  {     .channel                = 206,
+        .freq                   = 5030, /* MHz */
+        .unk2                   = 3353,
+        RADIOREGS(0x71, 0x01, 0xF7, 0x0E, 0xF7, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xCC, 0xCC, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xE007, 0xDC07, 0xD807, 0x0802, 0x0902, 0x0A02),
+  },
+  {     .channel                = 208,
+        .freq                   = 5040, /* MHz */
+        .unk2                   = 3360,
+        RADIOREGS(0x71, 0x01, 0xF8, 0x0D, 0xEF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xCC, 0xCC, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xE407, 0xE007, 0xDC07, 0x0702, 0x0802, 0x0902),
+  },
+  {     .channel                = 210,
+        .freq                   = 5050, /* MHz */
+        .unk2                   = 3367,
+        RADIOREGS(0x71, 0x01, 0xF9, 0x0D, 0xEF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xCC, 0xCC, 0xFF, 0x00, 0x0F, 0x0F,
+                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
+        PHYREGS(0xE807, 0xE407, 0xE007, 0x0602, 0x0702, 0x0802),
+  },
+  {     .channel                = 212,
+        .freq                   = 5060, /* MHz */
+        .unk2                   = 3373,
+        RADIOREGS(0x71, 0x01, 0xFA, 0x0D, 0xE6, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xBB, 0xBB, 0xFF, 0x00, 0x0E, 0x0F,
+                  0x8E, 0xFF, 0x00, 0x0E, 0x0F, 0x8E),
+        PHYREGS(0xEC07, 0xE807, 0xE407, 0x0502, 0x0602, 0x0702),
+  },
+  {     .channel                = 214,
+        .freq                   = 5070, /* MHz */
+        .unk2                   = 3380,
+        RADIOREGS(0x71, 0x01, 0xFB, 0x0D, 0xE6, 0x01, 0x04, 0x0A,
+                  0x00, 0x8F, 0xBB, 0xBB, 0xFF, 0x00, 0x0E, 0x0F,
+                  0x8E, 0xFF, 0x00, 0x0E, 0x0F, 0x8E),
+        PHYREGS(0xF007, 0xEC07, 0xE807, 0x0402, 0x0502, 0x0602),
+  },
+  {     .channel                = 216,
+        .freq                   = 5080, /* MHz */
+        .unk2                   = 3387,
+        RADIOREGS(0x71, 0x01, 0xFC, 0x0D, 0xDE, 0x01, 0x04, 0x0A,
+                  0x00, 0x8E, 0xBB, 0xBB, 0xEE, 0x00, 0x0E, 0x0F,
+                  0x8D, 0xEE, 0x00, 0x0E, 0x0F, 0x8D),
+        PHYREGS(0xF407, 0xF007, 0xEC07, 0x0302, 0x0402, 0x0502),
+  },
+  {     .channel                = 218,
+        .freq                   = 5090, /* MHz */
+        .unk2                   = 3393,
+        RADIOREGS(0x71, 0x01, 0xFD, 0x0D, 0xDE, 0x01, 0x04, 0x0A,
+                  0x00, 0x8E, 0xBB, 0xBB, 0xEE, 0x00, 0x0E, 0x0F,
+                  0x8D, 0xEE, 0x00, 0x0E, 0x0F, 0x8D),
+        PHYREGS(0xF807, 0xF407, 0xF007, 0x0202, 0x0302, 0x0402),
+  },
+  {     .channel                = 220,
+        .freq                   = 5100, /* MHz */
+        .unk2                   = 3400,
+        RADIOREGS(0x71, 0x01, 0xFE, 0x0C, 0xD6, 0x01, 0x04, 0x0A,
+                  0x00, 0x8E, 0xAA, 0xAA, 0xEE, 0x00, 0x0D, 0x0F,
+                  0x8D, 0xEE, 0x00, 0x0D, 0x0F, 0x8D),
+        PHYREGS(0xFC07, 0xF807, 0xF407, 0x0102, 0x0202, 0x0302),
+  },
+  {     .channel                = 222,
+        .freq                   = 5110, /* MHz */
+        .unk2                   = 3407,
+        RADIOREGS(0x71, 0x01, 0xFF, 0x0C, 0xD6, 0x01, 0x04, 0x0A,
+                  0x00, 0x8E, 0xAA, 0xAA, 0xEE, 0x00, 0x0D, 0x0F,
+                  0x8D, 0xEE, 0x00, 0x0D, 0x0F, 0x8D),
+        PHYREGS(0x0008, 0xFC07, 0xF807, 0x0002, 0x0102, 0x0202),
+  },
+  {     .channel                = 224,
+        .freq                   = 5120, /* MHz */
+        .unk2                   = 3413,
+        RADIOREGS(0x71, 0x02, 0x00, 0x0C, 0xCE, 0x01, 0x04, 0x0A,
+                  0x00, 0x8D, 0xAA, 0xAA, 0xDD, 0x00, 0x0D, 0x0F,
+                  0x8C, 0xDD, 0x00, 0x0D, 0x0F, 0x8C),
+        PHYREGS(0x0408, 0x0008, 0xFC07, 0xFF01, 0x0002, 0x0102),
+  },
+  {     .channel                = 226,
+        .freq                   = 5130, /* MHz */
+        .unk2                   = 3420,
+        RADIOREGS(0x71, 0x02, 0x01, 0x0C, 0xCE, 0x01, 0x04, 0x0A,
+                  0x00, 0x8D, 0xAA, 0xAA, 0xDD, 0x00, 0x0D, 0x0F,
+                  0x8C, 0xDD, 0x00, 0x0D, 0x0F, 0x8C),
+        PHYREGS(0x0808, 0x0408, 0x0008, 0xFE01, 0xFF01, 0x0002),
+  },
+  {     .channel                = 228,
+        .freq                   = 5140, /* MHz */
+        .unk2                   = 3427,
+        RADIOREGS(0x71, 0x02, 0x02, 0x0C, 0xC6, 0x01, 0x04, 0x0A,
+                  0x00, 0x8D, 0x99, 0x99, 0xDD, 0x00, 0x0C, 0x0E,
+                  0x8B, 0xDD, 0x00, 0x0C, 0x0E, 0x8B),
+        PHYREGS(0x0C08, 0x0808, 0x0408, 0xFD01, 0xFE01, 0xFF01),
+  },
+  {     .channel                = 32,
+        .freq                   = 5160, /* MHz */
+        .unk2                   = 3440,
+        RADIOREGS(0x71, 0x02, 0x04, 0x0B, 0xBE, 0x01, 0x04, 0x0A,
+                  0x00, 0x8C, 0x99, 0x99, 0xCC, 0x00, 0x0B, 0x0D,
+                  0x8A, 0xCC, 0x00, 0x0B, 0x0D, 0x8A),
+        PHYREGS(0x1408, 0x1008, 0x0C08, 0xFB01, 0xFC01, 0xFD01),
+  },
+  {     .channel                = 34,
+        .freq                   = 5170, /* MHz */
+        .unk2                   = 3447,
+        RADIOREGS(0x71, 0x02, 0x05, 0x0B, 0xBE, 0x01, 0x04, 0x0A,
+                  0x00, 0x8C, 0x99, 0x99, 0xCC, 0x00, 0x0B, 0x0D,
+                  0x8A, 0xCC, 0x00, 0x0B, 0x0D, 0x8A),
+        PHYREGS(0x1808, 0x1408, 0x1008, 0xFA01, 0xFB01, 0xFC01),
+  },
+  {     .channel                = 36,
+        .freq                   = 5180, /* MHz */
+        .unk2                   = 3453,
+        RADIOREGS(0x71, 0x02, 0x06, 0x0B, 0xB6, 0x01, 0x04, 0x0A,
+                  0x00, 0x8C, 0x88, 0x88, 0xCC, 0x00, 0x0B, 0x0C,
+                  0x89, 0xCC, 0x00, 0x0B, 0x0C, 0x89),
+        PHYREGS(0x1C08, 0x1808, 0x1408, 0xF901, 0xFA01, 0xFB01),
+  },
+  {     .channel                = 38,
+        .freq                   = 5190, /* MHz */
+        .unk2                   = 3460,
+        RADIOREGS(0x71, 0x02, 0x07, 0x0B, 0xB6, 0x01, 0x04, 0x0A,
+                  0x00, 0x8C, 0x88, 0x88, 0xCC, 0x00, 0x0B, 0x0C,
+                  0x89, 0xCC, 0x00, 0x0B, 0x0C, 0x89),
+        PHYREGS(0x2008, 0x1C08, 0x1808, 0xF801, 0xF901, 0xFA01),
+  },
+  {     .channel                = 40,
+        .freq                   = 5200, /* MHz */
+        .unk2                   = 3467,
+        RADIOREGS(0x71, 0x02, 0x08, 0x0B, 0xAF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8B, 0x88, 0x88, 0xBB, 0x00, 0x0A, 0x0B,
+                  0x89, 0xBB, 0x00, 0x0A, 0x0B, 0x89),
+        PHYREGS(0x2408, 0x2008, 0x1C08, 0xF701, 0xF801, 0xF901),
+  },
+  {     .channel                = 42,
+        .freq                   = 5210, /* MHz */
+        .unk2                   = 3473,
+        RADIOREGS(0x71, 0x02, 0x09, 0x0B, 0xAF, 0x01, 0x04, 0x0A,
+                  0x00, 0x8B, 0x88, 0x88, 0xBB, 0x00, 0x0A, 0x0B,
+                  0x89, 0xBB, 0x00, 0x0A, 0x0B, 0x89),
+        PHYREGS(0x2808, 0x2408, 0x2008, 0xF601, 0xF701, 0xF801),
+  },
+  {     .channel                = 44,
+        .freq                   = 5220, /* MHz */
+        .unk2                   = 3480,
+        RADIOREGS(0x71, 0x02, 0x0A, 0x0A, 0xA7, 0x01, 0x04, 0x0A,
+                  0x00, 0x8B, 0x77, 0x77, 0xBB, 0x00, 0x09, 0x0A,
+                  0x88, 0xBB, 0x00, 0x09, 0x0A, 0x88),
+        PHYREGS(0x2C08, 0x2808, 0x2408, 0xF501, 0xF601, 0xF701),
+  },
+  {     .channel                = 46,
+        .freq                   = 5230, /* MHz */
+        .unk2                   = 3487,
+        RADIOREGS(0x71, 0x02, 0x0B, 0x0A, 0xA7, 0x01, 0x04, 0x0A,
+                  0x00, 0x8B, 0x77, 0x77, 0xBB, 0x00, 0x09, 0x0A,
+                  0x88, 0xBB, 0x00, 0x09, 0x0A, 0x88),
+        PHYREGS(0x3008, 0x2C08, 0x2808, 0xF401, 0xF501, 0xF601),
+  },
+  {     .channel                = 48,
+        .freq                   = 5240, /* MHz */
+        .unk2                   = 3493,
+        RADIOREGS(0x71, 0x02, 0x0C, 0x0A, 0xA0, 0x01, 0x04, 0x0A,
+                  0x00, 0x8A, 0x77, 0x77, 0xAA, 0x00, 0x09, 0x0A,
+                  0x87, 0xAA, 0x00, 0x09, 0x0A, 0x87),
+        PHYREGS(0x3408, 0x3008, 0x2C08, 0xF301, 0xF401, 0xF501),
+  },
+  {     .channel                = 50,
+        .freq                   = 5250, /* MHz */
+        .unk2                   = 3500,
+        RADIOREGS(0x71, 0x02, 0x0D, 0x0A, 0xA0, 0x01, 0x04, 0x0A,
+                  0x00, 0x8A, 0x77, 0x77, 0xAA, 0x00, 0x09, 0x0A,
+                  0x87, 0xAA, 0x00, 0x09, 0x0A, 0x87),
+        PHYREGS(0x3808, 0x3408, 0x3008, 0xF201, 0xF301, 0xF401),
+  },
+  {     .channel                = 52,
+        .freq                   = 5260, /* MHz */
+        .unk2                   = 3507,
+        RADIOREGS(0x71, 0x02, 0x0E, 0x0A, 0x98, 0x01, 0x04, 0x0A,
+                  0x00, 0x8A, 0x66, 0x66, 0xAA, 0x00, 0x08, 0x09,
+                  0x87, 0xAA, 0x00, 0x08, 0x09, 0x87),
+        PHYREGS(0x3C08, 0x3808, 0x3408, 0xF101, 0xF201, 0xF301),
+  },
+  {     .channel                = 54,
+        .freq                   = 5270, /* MHz */
+        .unk2                   = 3513,
+        RADIOREGS(0x71, 0x02, 0x0F, 0x0A, 0x98, 0x01, 0x04, 0x0A,
+                  0x00, 0x8A, 0x66, 0x66, 0xAA, 0x00, 0x08, 0x09,
+                  0x87, 0xAA, 0x00, 0x08, 0x09, 0x87),
+        PHYREGS(0x4008, 0x3C08, 0x3808, 0xF001, 0xF101, 0xF201),
+  },
+  {     .channel                = 56,
+        .freq                   = 5280, /* MHz */
+        .unk2                   = 3520,
+        RADIOREGS(0x71, 0x02, 0x10, 0x09, 0x91, 0x01, 0x04, 0x0A,
+                  0x00, 0x89, 0x66, 0x66, 0x99, 0x00, 0x08, 0x08,
+                  0x86, 0x99, 0x00, 0x08, 0x08, 0x86),
+        PHYREGS(0x4408, 0x4008, 0x3C08, 0xF001, 0xF001, 0xF101),
+  },
+  {     .channel                = 58,
+        .freq                   = 5290, /* MHz */
+        .unk2                   = 3527,
+        RADIOREGS(0x71, 0x02, 0x11, 0x09, 0x91, 0x01, 0x04, 0x0A,
+                  0x00, 0x89, 0x66, 0x66, 0x99, 0x00, 0x08, 0x08,
+                  0x86, 0x99, 0x00, 0x08, 0x08, 0x86),
+        PHYREGS(0x4808, 0x4408, 0x4008, 0xEF01, 0xF001, 0xF001),
+  },
+  {     .channel                = 60,
+        .freq                   = 5300, /* MHz */
+        .unk2                   = 3533,
+        RADIOREGS(0x71, 0x02, 0x12, 0x09, 0x8A, 0x01, 0x04, 0x0A,
+                  0x00, 0x89, 0x55, 0x55, 0x99, 0x00, 0x08, 0x07,
+                  0x85, 0x99, 0x00, 0x08, 0x07, 0x85),
+        PHYREGS(0x4C08, 0x4808, 0x4408, 0xEE01, 0xEF01, 0xF001),
+  },
+  {     .channel                = 62,
+        .freq                   = 5310, /* MHz */
+        .unk2                   = 3540,
+        RADIOREGS(0x71, 0x02, 0x13, 0x09, 0x8A, 0x01, 0x04, 0x0A,
+                  0x00, 0x89, 0x55, 0x55, 0x99, 0x00, 0x08, 0x07,
+                  0x85, 0x99, 0x00, 0x08, 0x07, 0x85),
+        PHYREGS(0x5008, 0x4C08, 0x4808, 0xED01, 0xEE01, 0xEF01),
+  },
+  {     .channel                = 64,
+        .freq                   = 5320, /* MHz */
+        .unk2                   = 3547,
+        RADIOREGS(0x71, 0x02, 0x14, 0x09, 0x83, 0x01, 0x04, 0x0A,
+                  0x00, 0x88, 0x55, 0x55, 0x88, 0x00, 0x07, 0x07,
+                  0x84, 0x88, 0x00, 0x07, 0x07, 0x84),
+        PHYREGS(0x5408, 0x5008, 0x4C08, 0xEC01, 0xED01, 0xEE01),
+  },
+  {     .channel                = 66,
+        .freq                   = 5330, /* MHz */
+        .unk2                   = 3553,
+        RADIOREGS(0x71, 0x02, 0x15, 0x09, 0x83, 0x01, 0x04, 0x0A,
+                  0x00, 0x88, 0x55, 0x55, 0x88, 0x00, 0x07, 0x07,
+                  0x84, 0x88, 0x00, 0x07, 0x07, 0x84),
+        PHYREGS(0x5808, 0x5408, 0x5008, 0xEB01, 0xEC01, 0xED01),
+  },
+  {     .channel                = 68,
+        .freq                   = 5340, /* MHz */
+        .unk2                   = 3560,
+        RADIOREGS(0x71, 0x02, 0x16, 0x08, 0x7C, 0x01, 0x04, 0x0A,
+                  0x00, 0x88, 0x44, 0x44, 0x88, 0x00, 0x07, 0x06,
+                  0x84, 0x88, 0x00, 0x07, 0x06, 0x84),
+        PHYREGS(0x5C08, 0x5808, 0x5408, 0xEA01, 0xEB01, 0xEC01),
+  },
+  {     .channel                = 70,
+        .freq                   = 5350, /* MHz */
+        .unk2                   = 3567,
+        RADIOREGS(0x71, 0x02, 0x17, 0x08, 0x7C, 0x01, 0x04, 0x0A,
+                  0x00, 0x88, 0x44, 0x44, 0x88, 0x00, 0x07, 0x06,
+                  0x84, 0x88, 0x00, 0x07, 0x06, 0x84),
+        PHYREGS(0x6008, 0x5C08, 0x5808, 0xE901, 0xEA01, 0xEB01),
+  },
+  {     .channel                = 72,
+        .freq                   = 5360, /* MHz */
+        .unk2                   = 3573,
+        RADIOREGS(0x71, 0x02, 0x18, 0x08, 0x75, 0x01, 0x04, 0x0A,
+                  0x00, 0x87, 0x44, 0x44, 0x77, 0x00, 0x06, 0x05,
+                  0x83, 0x77, 0x00, 0x06, 0x05, 0x83),
+        PHYREGS(0x6408, 0x6008, 0x5C08, 0xE801, 0xE901, 0xEA01),
+  },
+  {     .channel                = 74,
+        .freq                   = 5370, /* MHz */
+        .unk2                   = 3580,
+        RADIOREGS(0x71, 0x02, 0x19, 0x08, 0x75, 0x01, 0x04, 0x0A,
+                  0x00, 0x87, 0x44, 0x44, 0x77, 0x00, 0x06, 0x05,
+                  0x83, 0x77, 0x00, 0x06, 0x05, 0x83),
+        PHYREGS(0x6808, 0x6408, 0x6008, 0xE701, 0xE801, 0xE901),
+  },
+  {     .channel                = 76,
+        .freq                   = 5380, /* MHz */
+        .unk2                   = 3587,
+        RADIOREGS(0x71, 0x02, 0x1A, 0x08, 0x6E, 0x01, 0x04, 0x0A,
+                  0x00, 0x87, 0x33, 0x33, 0x77, 0x00, 0x06, 0x04,
+                  0x82, 0x77, 0x00, 0x06, 0x04, 0x82),
+        PHYREGS(0x6C08, 0x6808, 0x6408, 0xE601, 0xE701, 0xE801),
+  },
+  {     .channel                = 78,
+        .freq                   = 5390, /* MHz */
+        .unk2                   = 3593,
+        RADIOREGS(0x71, 0x02, 0x1B, 0x08, 0x6E, 0x01, 0x04, 0x0A,
+                  0x00, 0x87, 0x33, 0x33, 0x77, 0x00, 0x06, 0x04,
+                  0x82, 0x77, 0x00, 0x06, 0x04, 0x82),
+        PHYREGS(0x7008, 0x6C08, 0x6808, 0xE501, 0xE601, 0xE701),
+  },
+  {     .channel                = 80,
+        .freq                   = 5400, /* MHz */
+        .unk2                   = 3600,
+        RADIOREGS(0x71, 0x02, 0x1C, 0x07, 0x67, 0x01, 0x04, 0x0A,
+                  0x00, 0x86, 0x33, 0x33, 0x66, 0x00, 0x05, 0x04,
+                  0x81, 0x66, 0x00, 0x05, 0x04, 0x81),
+        PHYREGS(0x7408, 0x7008, 0x6C08, 0xE501, 0xE501, 0xE601),
+  },
+  {     .channel                = 82,
+        .freq                   = 5410, /* MHz */
+        .unk2                   = 3607,
+        RADIOREGS(0x71, 0x02, 0x1D, 0x07, 0x67, 0x01, 0x04, 0x0A,
+                  0x00, 0x86, 0x33, 0x33, 0x66, 0x00, 0x05, 0x04,
+                  0x81, 0x66, 0x00, 0x05, 0x04, 0x81),
+        PHYREGS(0x7808, 0x7408, 0x7008, 0xE401, 0xE501, 0xE501),
+  },
+  {     .channel                = 84,
+        .freq                   = 5420, /* MHz */
+        .unk2                   = 3613,
+        RADIOREGS(0x71, 0x02, 0x1E, 0x07, 0x61, 0x01, 0x04, 0x0A,
+                  0x00, 0x86, 0x22, 0x22, 0x66, 0x00, 0x05, 0x03,
+                  0x80, 0x66, 0x00, 0x05, 0x03, 0x80),
+        PHYREGS(0x7C08, 0x7808, 0x7408, 0xE301, 0xE401, 0xE501),
+  },
+  {     .channel                = 86,
+        .freq                   = 5430, /* MHz */
+        .unk2                   = 3620,
+        RADIOREGS(0x71, 0x02, 0x1F, 0x07, 0x61, 0x01, 0x04, 0x0A,
+                  0x00, 0x86, 0x22, 0x22, 0x66, 0x00, 0x05, 0x03,
+                  0x80, 0x66, 0x00, 0x05, 0x03, 0x80),
+        PHYREGS(0x8008, 0x7C08, 0x7808, 0xE201, 0xE301, 0xE401),
+  },
+  {     .channel                = 88,
+        .freq                   = 5440, /* MHz */
+        .unk2                   = 3627,
+        RADIOREGS(0x71, 0x02, 0x20, 0x07, 0x5A, 0x01, 0x04, 0x0A,
+                  0x00, 0x85, 0x22, 0x22, 0x55, 0x00, 0x04, 0x02,
+                  0x80, 0x55, 0x00, 0x04, 0x02, 0x80),
+        PHYREGS(0x8408, 0x8008, 0x7C08, 0xE101, 0xE201, 0xE301),
+  },
+  {     .channel                = 90,
+        .freq                   = 5450, /* MHz */
+        .unk2                   = 3633,
+        RADIOREGS(0x71, 0x02, 0x21, 0x07, 0x5A, 0x01, 0x04, 0x0A,
+                  0x00, 0x85, 0x22, 0x22, 0x55, 0x00, 0x04, 0x02,
+                  0x80, 0x55, 0x00, 0x04, 0x02, 0x80),
+        PHYREGS(0x8808, 0x8408, 0x8008, 0xE001, 0xE101, 0xE201),
+  },
+  {     .channel                = 92,
+        .freq                   = 5460, /* MHz */
+        .unk2                   = 3640,
+        RADIOREGS(0x71, 0x02, 0x22, 0x06, 0x53, 0x01, 0x04, 0x0A,
+                  0x00, 0x85, 0x11, 0x11, 0x55, 0x00, 0x04, 0x01,
+                  0x80, 0x55, 0x00, 0x04, 0x01, 0x80),
+        PHYREGS(0x8C08, 0x8808, 0x8408, 0xDF01, 0xE001, 0xE101),
+  },
+  {     .channel                = 94,
+        .freq                   = 5470, /* MHz */
+        .unk2                   = 3647,
+        RADIOREGS(0x71, 0x02, 0x23, 0x06, 0x53, 0x01, 0x04, 0x0A,
+                  0x00, 0x85, 0x11, 0x11, 0x55, 0x00, 0x04, 0x01,
+                  0x80, 0x55, 0x00, 0x04, 0x01, 0x80),
+        PHYREGS(0x9008, 0x8C08, 0x8808, 0xDE01, 0xDF01, 0xE001),
+  },
+  {     .channel                = 96,
+        .freq                   = 5480, /* MHz */
+        .unk2                   = 3653,
+        RADIOREGS(0x71, 0x02, 0x24, 0x06, 0x4D, 0x01, 0x04, 0x0A,
+                  0x00, 0x84, 0x11, 0x11, 0x44, 0x00, 0x03, 0x00,
+                  0x80, 0x44, 0x00, 0x03, 0x00, 0x80),
+        PHYREGS(0x9408, 0x9008, 0x8C08, 0xDD01, 0xDE01, 0xDF01),
+  },
+  {     .channel                = 98,
+        .freq                   = 5490, /* MHz */
+        .unk2                   = 3660,
+        RADIOREGS(0x71, 0x02, 0x25, 0x06, 0x4D, 0x01, 0x04, 0x0A,
+                  0x00, 0x84, 0x11, 0x11, 0x44, 0x00, 0x03, 0x00,
+                  0x80, 0x44, 0x00, 0x03, 0x00, 0x80),
+        PHYREGS(0x9808, 0x9408, 0x9008, 0xDD01, 0xDD01, 0xDE01),
+  },
+  {     .channel                = 100,
+        .freq                   = 5500, /* MHz */
+        .unk2                   = 3667,
+        RADIOREGS(0x71, 0x02, 0x26, 0x06, 0x47, 0x01, 0x04, 0x0A,
+                  0x00, 0x84, 0x00, 0x00, 0x44, 0x00, 0x03, 0x00,
+                  0x80, 0x44, 0x00, 0x03, 0x00, 0x80),
+        PHYREGS(0x9C08, 0x9808, 0x9408, 0xDC01, 0xDD01, 0xDD01),
+  },
+  {     .channel                = 102,
+        .freq                   = 5510, /* MHz */
+        .unk2                   = 3673,
+        RADIOREGS(0x71, 0x02, 0x27, 0x06, 0x47, 0x01, 0x04, 0x0A,
+                  0x00, 0x84, 0x00, 0x00, 0x44, 0x00, 0x03, 0x00,
+                  0x80, 0x44, 0x00, 0x03, 0x00, 0x80),
+        PHYREGS(0xA008, 0x9C08, 0x9808, 0xDB01, 0xDC01, 0xDD01),
+  },
+  {     .channel                = 104,
+        .freq                   = 5520, /* MHz */
+        .unk2                   = 3680,
+        RADIOREGS(0x71, 0x02, 0x28, 0x05, 0x40, 0x01, 0x04, 0x0A,
+                  0x00, 0x83, 0x00, 0x00, 0x33, 0x00, 0x02, 0x00,
+                  0x80, 0x33, 0x00, 0x02, 0x00, 0x80),
+        PHYREGS(0xA408, 0xA008, 0x9C08, 0xDA01, 0xDB01, 0xDC01),
+  },
+  {     .channel                = 106,
+        .freq                   = 5530, /* MHz */
+        .unk2                   = 3687,
+        RADIOREGS(0x71, 0x02, 0x29, 0x05, 0x40, 0x01, 0x04, 0x0A,
+                  0x00, 0x83, 0x00, 0x00, 0x33, 0x00, 0x02, 0x00,
+                  0x80, 0x33, 0x00, 0x02, 0x00, 0x80),
+        PHYREGS(0xA808, 0xA408, 0xA008, 0xD901, 0xDA01, 0xDB01),
+  },
+  {     .channel                = 108,
+        .freq                   = 5540, /* MHz */
+        .unk2                   = 3693,
+        RADIOREGS(0x71, 0x02, 0x2A, 0x05, 0x3A, 0x01, 0x04, 0x0A,
+                  0x00, 0x83, 0x00, 0x00, 0x33, 0x00, 0x02, 0x00,
+                  0x80, 0x33, 0x00, 0x02, 0x00, 0x80),
+        PHYREGS(0xAC08, 0xA808, 0xA408, 0xD801, 0xD901, 0xDA01),
+  },
+  {     .channel                = 110,
+        .freq                   = 5550, /* MHz */
+        .unk2                   = 3700,
+        RADIOREGS(0x71, 0x02, 0x2B, 0x05, 0x3A, 0x01, 0x04, 0x0A,
+                  0x00, 0x83, 0x00, 0x00, 0x33, 0x00, 0x02, 0x00,
+                  0x80, 0x33, 0x00, 0x02, 0x00, 0x80),
+        PHYREGS(0xB008, 0xAC08, 0xA808, 0xD701, 0xD801, 0xD901),
+  },
+  {     .channel                = 112,
+        .freq                   = 5560, /* MHz */
+        .unk2                   = 3707,
+        RADIOREGS(0x71, 0x02, 0x2C, 0x05, 0x34, 0x01, 0x04, 0x0A,
+                  0x00, 0x82, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00,
+                  0x80, 0x22, 0x00, 0x01, 0x00, 0x80),
+        PHYREGS(0xB408, 0xB008, 0xAC08, 0xD701, 0xD701, 0xD801),
+  },
+  {     .channel                = 114,
+        .freq                   = 5570, /* MHz */
+        .unk2                   = 3713,
+        RADIOREGS(0x71, 0x02, 0x2D, 0x05, 0x34, 0x01, 0x04, 0x0A,
+                  0x00, 0x82, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00,
+                  0x80, 0x22, 0x00, 0x01, 0x00, 0x80),
+        PHYREGS(0xB808, 0xB408, 0xB008, 0xD601, 0xD701, 0xD701),
+  },
+  {     .channel                = 116,
+        .freq                   = 5580, /* MHz */
+        .unk2                   = 3720,
+        RADIOREGS(0x71, 0x02, 0x2E, 0x04, 0x2E, 0x01, 0x04, 0x0A,
+                  0x00, 0x82, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00,
+                  0x80, 0x22, 0x00, 0x01, 0x00, 0x80),
+        PHYREGS(0xBC08, 0xB808, 0xB408, 0xD501, 0xD601, 0xD701),
+  },
+  {     .channel                = 118,
+        .freq                   = 5590, /* MHz */
+        .unk2                   = 3727,
+        RADIOREGS(0x71, 0x02, 0x2F, 0x04, 0x2E, 0x01, 0x04, 0x0A,
+                  0x00, 0x82, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00,
+                  0x80, 0x22, 0x00, 0x01, 0x00, 0x80),
+        PHYREGS(0xC008, 0xBC08, 0xB808, 0xD401, 0xD501, 0xD601),
+  },
+  {     .channel                = 120,
+        .freq                   = 5600, /* MHz */
+        .unk2                   = 3733,
+        RADIOREGS(0x71, 0x02, 0x30, 0x04, 0x28, 0x01, 0x04, 0x0A,
+                  0x00, 0x81, 0x00, 0x00, 0x11, 0x00, 0x01, 0x00,
+                  0x80, 0x11, 0x00, 0x01, 0x00, 0x80),
+        PHYREGS(0xC408, 0xC008, 0xBC08, 0xD301, 0xD401, 0xD501),
+  },
+  {     .channel                = 122,
+        .freq                   = 5610, /* MHz */
+        .unk2                   = 3740,
+        RADIOREGS(0x71, 0x02, 0x31, 0x04, 0x28, 0x01, 0x04, 0x0A,
+                  0x00, 0x81, 0x00, 0x00, 0x11, 0x00, 0x01, 0x00,
+                  0x80, 0x11, 0x00, 0x01, 0x00, 0x80),
+        PHYREGS(0xC808, 0xC408, 0xC008, 0xD201, 0xD301, 0xD401),
+  },
+  {     .channel                = 124,
+        .freq                   = 5620, /* MHz */
+        .unk2                   = 3747,
+        RADIOREGS(0x71, 0x02, 0x32, 0x04, 0x21, 0x01, 0x04, 0x0A,
+                  0x00, 0x81, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00,
+                  0x80, 0x11, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xCC08, 0xC808, 0xC408, 0xD201, 0xD201, 0xD301),
+  },
+  {     .channel                = 126,
+        .freq                   = 5630, /* MHz */
+        .unk2                   = 3753,
+        RADIOREGS(0x71, 0x02, 0x33, 0x04, 0x21, 0x01, 0x04, 0x0A,
+                  0x00, 0x81, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00,
+                  0x80, 0x11, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xD008, 0xCC08, 0xC808, 0xD101, 0xD201, 0xD201),
+  },
+  {     .channel                = 128,
+        .freq                   = 5640, /* MHz */
+        .unk2                   = 3760,
+        RADIOREGS(0x71, 0x02, 0x34, 0x03, 0x1C, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xD408, 0xD008, 0xCC08, 0xD001, 0xD101, 0xD201),
+  },
+  {     .channel                = 130,
+        .freq                   = 5650, /* MHz */
+        .unk2                   = 3767,
+        RADIOREGS(0x71, 0x02, 0x35, 0x03, 0x1C, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xD808, 0xD408, 0xD008, 0xCF01, 0xD001, 0xD101),
+  },
+  {     .channel                = 132,
+        .freq                   = 5660, /* MHz */
+        .unk2                   = 3773,
+        RADIOREGS(0x71, 0x02, 0x36, 0x03, 0x16, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xDC08, 0xD808, 0xD408, 0xCE01, 0xCF01, 0xD001),
+  },
+  {     .channel                = 134,
+        .freq                   = 5670, /* MHz */
+        .unk2                   = 3780,
+        RADIOREGS(0x71, 0x02, 0x37, 0x03, 0x16, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xE008, 0xDC08, 0xD808, 0xCE01, 0xCE01, 0xCF01),
+  },
+  {     .channel                = 136,
+        .freq                   = 5680, /* MHz */
+        .unk2                   = 3787,
+        RADIOREGS(0x71, 0x02, 0x38, 0x03, 0x10, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xE408, 0xE008, 0xDC08, 0xCD01, 0xCE01, 0xCE01),
+  },
+  {     .channel                = 138,
+        .freq                   = 5690, /* MHz */
+        .unk2                   = 3793,
+        RADIOREGS(0x71, 0x02, 0x39, 0x03, 0x10, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xE808, 0xE408, 0xE008, 0xCC01, 0xCD01, 0xCE01),
+  },
+  {     .channel                = 140,
+        .freq                   = 5700, /* MHz */
+        .unk2                   = 3800,
+        RADIOREGS(0x71, 0x02, 0x3A, 0x02, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xEC08, 0xE808, 0xE408, 0xCB01, 0xCC01, 0xCD01),
+  },
+  {     .channel                = 142,
+        .freq                   = 5710, /* MHz */
+        .unk2                   = 3807,
+        RADIOREGS(0x71, 0x02, 0x3B, 0x02, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xF008, 0xEC08, 0xE808, 0xCA01, 0xCB01, 0xCC01),
+  },
+  {     .channel                = 144,
+        .freq                   = 5720, /* MHz */
+        .unk2                   = 3813,
+        RADIOREGS(0x71, 0x02, 0x3C, 0x02, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xF408, 0xF008, 0xEC08, 0xC901, 0xCA01, 0xCB01),
+  },
+  {     .channel                = 145,
+        .freq                   = 5725, /* MHz */
+        .unk2                   = 3817,
+        RADIOREGS(0x72, 0x04, 0x79, 0x02, 0x03, 0x01, 0x03, 0x14,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xF608, 0xF208, 0xEE08, 0xC901, 0xCA01, 0xCB01),
+  },
+  {     .channel                = 146,
+        .freq                   = 5730, /* MHz */
+        .unk2                   = 3820,
+        RADIOREGS(0x71, 0x02, 0x3D, 0x02, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xF808, 0xF408, 0xF008, 0xC901, 0xC901, 0xCA01),
+  },
+  {     .channel                = 147,
+        .freq                   = 5735, /* MHz */
+        .unk2                   = 3823,
+        RADIOREGS(0x72, 0x04, 0x7B, 0x02, 0x03, 0x01, 0x03, 0x14,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xFA08, 0xF608, 0xF208, 0xC801, 0xC901, 0xCA01),
+  },
+  {     .channel                = 148,
+        .freq                   = 5740, /* MHz */
+        .unk2                   = 3827,
+        RADIOREGS(0x71, 0x02, 0x3E, 0x02, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xFC08, 0xF808, 0xF408, 0xC801, 0xC901, 0xC901),
+  },
+  {     .channel                = 149,
+        .freq                   = 5745, /* MHz */
+        .unk2                   = 3830,
+        RADIOREGS(0x72, 0x04, 0x7D, 0x02, 0xFE, 0x00, 0x03, 0x14,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0xFE08, 0xFA08, 0xF608, 0xC801, 0xC801, 0xC901),
+  },
+  {     .channel                = 150,
+        .freq                   = 5750, /* MHz */
+        .unk2                   = 3833,
+        RADIOREGS(0x71, 0x02, 0x3F, 0x02, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x0009, 0xFC08, 0xF808, 0xC701, 0xC801, 0xC901),
+  },
+  {     .channel                = 151,
+        .freq                   = 5755, /* MHz */
+        .unk2                   = 3837,
+        RADIOREGS(0x72, 0x04, 0x7F, 0x02, 0xFE, 0x00, 0x03, 0x14,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x0209, 0xFE08, 0xFA08, 0xC701, 0xC801, 0xC801),
+  },
+  {     .channel                = 152,
+        .freq                   = 5760, /* MHz */
+        .unk2                   = 3840,
+        RADIOREGS(0x71, 0x02, 0x40, 0x02, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x0409, 0x0009, 0xFC08, 0xC601, 0xC701, 0xC801),
+  },
+  {     .channel                = 153,
+        .freq                   = 5765, /* MHz */
+        .unk2                   = 3843,
+        RADIOREGS(0x72, 0x04, 0x81, 0x02, 0xF8, 0x00, 0x03, 0x14,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x0609, 0x0209, 0xFE08, 0xC601, 0xC701, 0xC801),
+  },
+  {     .channel                = 154,
+        .freq                   = 5770, /* MHz */
+        .unk2                   = 3847,
+        RADIOREGS(0x71, 0x02, 0x41, 0x02, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x0809, 0x0409, 0x0009, 0xC601, 0xC601, 0xC701),
+  },
+  {     .channel                = 155,
+        .freq                   = 5775, /* MHz */
+        .unk2                   = 3850,
+        RADIOREGS(0x72, 0x04, 0x83, 0x02, 0xF8, 0x00, 0x03, 0x14,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x0A09, 0x0609, 0x0209, 0xC501, 0xC601, 0xC701),
+  },
+  {     .channel                = 156,
+        .freq                   = 5780, /* MHz */
+        .unk2                   = 3853,
+        RADIOREGS(0x71, 0x02, 0x42, 0x02, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x0C09, 0x0809, 0x0409, 0xC501, 0xC601, 0xC601),
+  },
+  {     .channel                = 157,
+        .freq                   = 5785, /* MHz */
+        .unk2                   = 3857,
+        RADIOREGS(0x72, 0x04, 0x85, 0x02, 0xF2, 0x00, 0x03, 0x14,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x0E09, 0x0A09, 0x0609, 0xC401, 0xC501, 0xC601),
+  },
+  {     .channel                = 158,
+        .freq                   = 5790, /* MHz */
+        .unk2                   = 3860,
+        RADIOREGS(0x71, 0x02, 0x43, 0x02, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x1009, 0x0C09, 0x0809, 0xC401, 0xC501, 0xC601),
+  },
+  {     .channel                = 159,
+        .freq                   = 5795, /* MHz */
+        .unk2                   = 3863,
+        RADIOREGS(0x72, 0x04, 0x87, 0x02, 0xF2, 0x00, 0x03, 0x14,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x1209, 0x0E09, 0x0A09, 0xC401, 0xC401, 0xC501),
+  },
+  {     .channel                = 160,
+        .freq                   = 5800, /* MHz */
+        .unk2                   = 3867,
+        RADIOREGS(0x71, 0x02, 0x44, 0x01, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x1409, 0x1009, 0x0C09, 0xC301, 0xC401, 0xC501),
+  },
+  {     .channel                = 161,
+        .freq                   = 5805, /* MHz */
+        .unk2                   = 3870,
+        RADIOREGS(0x72, 0x04, 0x89, 0x01, 0xED, 0x00, 0x03, 0x14,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x1609, 0x1209, 0x0E09, 0xC301, 0xC401, 0xC401),
+  },
+  {     .channel                = 162,
+        .freq                   = 5810, /* MHz */
+        .unk2                   = 3873,
+        RADIOREGS(0x71, 0x02, 0x45, 0x01, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x1809, 0x1409, 0x1009, 0xC201, 0xC301, 0xC401),
+  },
+  {     .channel                = 163,
+        .freq                   = 5815, /* MHz */
+        .unk2                   = 3877,
+        RADIOREGS(0x72, 0x04, 0x8B, 0x01, 0xED, 0x00, 0x03, 0x14,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x1A09, 0x1609, 0x1209, 0xC201, 0xC301, 0xC401),
+  },
+  {     .channel                = 164,
+        .freq                   = 5820, /* MHz */
+        .unk2                   = 3880,
+        RADIOREGS(0x71, 0x02, 0x46, 0x01, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x1C09, 0x1809, 0x1409, 0xC201, 0xC201, 0xC301),
+  },
+  {     .channel                = 165,
+        .freq                   = 5825, /* MHz */
+        .unk2                   = 3883,
+        RADIOREGS(0x72, 0x04, 0x8D, 0x01, 0xED, 0x00, 0x03, 0x14,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x1E09, 0x1A09, 0x1609, 0xC101, 0xC201, 0xC301),
+  },
+  {     .channel                = 166,
+        .freq                   = 5830, /* MHz */
+        .unk2                   = 3887,
+        RADIOREGS(0x71, 0x02, 0x47, 0x01, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x2009, 0x1C09, 0x1809, 0xC101, 0xC201, 0xC201),
+  },
+  {     .channel                = 168,
+        .freq                   = 5840, /* MHz */
+        .unk2                   = 3893,
+        RADIOREGS(0x71, 0x02, 0x48, 0x01, 0x0A, 0x01, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x2409, 0x2009, 0x1C09, 0xC001, 0xC101, 0xC201),
+  },
+  {     .channel                = 170,
+        .freq                   = 5850, /* MHz */
+        .unk2                   = 3900,
+        RADIOREGS(0x71, 0x02, 0x49, 0x01, 0xE0, 0x00, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x2809, 0x2409, 0x2009, 0xBF01, 0xC001, 0xC101),
+  },
+  {     .channel                = 172,
+        .freq                   = 5860, /* MHz */
+        .unk2                   = 3907,
+        RADIOREGS(0x71, 0x02, 0x4A, 0x01, 0xDE, 0x00, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x2C09, 0x2809, 0x2409, 0xBF01, 0xBF01, 0xC001),
+  },
+  {     .channel                = 174,
+        .freq                   = 5870, /* MHz */
+        .unk2                   = 3913,
+        RADIOREGS(0x71, 0x02, 0x4B, 0x00, 0xDB, 0x00, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x3009, 0x2C09, 0x2809, 0xBE01, 0xBF01, 0xBF01),
+  },
+  {     .channel                = 176,
+        .freq                   = 5880, /* MHz */
+        .unk2                   = 3920,
+        RADIOREGS(0x71, 0x02, 0x4C, 0x00, 0xD8, 0x00, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x3409, 0x3009, 0x2C09, 0xBD01, 0xBE01, 0xBF01),
+  },
+  {     .channel                = 178,
+        .freq                   = 5890, /* MHz */
+        .unk2                   = 3927,
+        RADIOREGS(0x71, 0x02, 0x4D, 0x00, 0xD6, 0x00, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x3809, 0x3409, 0x3009, 0xBC01, 0xBD01, 0xBE01),
+  },
+  {     .channel                = 180,
+        .freq                   = 5900, /* MHz */
+        .unk2                   = 3933,
+        RADIOREGS(0x71, 0x02, 0x4E, 0x00, 0xD3, 0x00, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x3C09, 0x3809, 0x3409, 0xBC01, 0xBC01, 0xBD01),
+  },
+  {     .channel                = 182,
+        .freq                   = 5910, /* MHz */
+        .unk2                   = 3940,
+        RADIOREGS(0x71, 0x02, 0x4F, 0x00, 0xD6, 0x00, 0x04, 0x0A,
+                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
+        PHYREGS(0x4009, 0x3C09, 0x3809, 0xBB01, 0xBC01, 0xBC01),
+  },
+  {     .channel                = 1,
+        .freq                   = 2412, /* MHz */
+        .unk2                   = 3216,
+        RADIOREGS(0x73, 0x09, 0x6C, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0D, 0x0C,
+                  0x80, 0xFF, 0x88, 0x0D, 0x0C, 0x80),
+        PHYREGS(0xC903, 0xC503, 0xC103, 0x3A04, 0x3F04, 0x4304),
+  },
+  {     .channel                = 2,
+        .freq                   = 2417, /* MHz */
+        .unk2                   = 3223,
+        RADIOREGS(0x73, 0x09, 0x71, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0C, 0x0B,
+                  0x80, 0xFF, 0x88, 0x0C, 0x0B, 0x80),
+        PHYREGS(0xCB03, 0xC703, 0xC303, 0x3804, 0x3D04, 0x4104),
+  },
+  {     .channel                = 3,
+        .freq                   = 2422, /* MHz */
+        .unk2                   = 3229,
+        RADIOREGS(0x73, 0x09, 0x76, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0C, 0x0A,
+                  0x80, 0xFF, 0x88, 0x0C, 0x0A, 0x80),
+        PHYREGS(0xCD03, 0xC903, 0xC503, 0x3604, 0x3A04, 0x3F04),
+  },
+  {     .channel                = 4,
+        .freq                   = 2427, /* MHz */
+        .unk2                   = 3236,
+        RADIOREGS(0x73, 0x09, 0x7B, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0C, 0x0A,
+                  0x80, 0xFF, 0x88, 0x0C, 0x0A, 0x80),
+        PHYREGS(0xCF03, 0xCB03, 0xC703, 0x3404, 0x3804, 0x3D04),
+  },
+  {     .channel                = 5,
+        .freq                   = 2432, /* MHz */
+        .unk2                   = 3243,
+        RADIOREGS(0x73, 0x09, 0x80, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0C, 0x09,
+                  0x80, 0xFF, 0x88, 0x0C, 0x09, 0x80),
+        PHYREGS(0xD103, 0xCD03, 0xC903, 0x3104, 0x3604, 0x3A04),
+  },
+  {     .channel                = 6,
+        .freq                   = 2437, /* MHz */
+        .unk2                   = 3249,
+        RADIOREGS(0x73, 0x09, 0x85, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0B, 0x08,
+                  0x80, 0xFF, 0x88, 0x0B, 0x08, 0x80),
+        PHYREGS(0xD303, 0xCF03, 0xCB03, 0x2F04, 0x3404, 0x3804),
+  },
+  {     .channel                = 7,
+        .freq                   = 2442, /* MHz */
+        .unk2                   = 3256,
+        RADIOREGS(0x73, 0x09, 0x8A, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0A, 0x07,
+                  0x80, 0xFF, 0x88, 0x0A, 0x07, 0x80),
+        PHYREGS(0xD503, 0xD103, 0xCD03, 0x2D04, 0x3104, 0x3604),
+  },
+  {     .channel                = 8,
+        .freq                   = 2447, /* MHz */
+        .unk2                   = 3263,
+        RADIOREGS(0x73, 0x09, 0x8F, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0A, 0x06,
+                  0x80, 0xFF, 0x88, 0x0A, 0x06, 0x80),
+        PHYREGS(0xD703, 0xD303, 0xCF03, 0x2B04, 0x2F04, 0x3404),
+  },
+  {     .channel                = 9,
+        .freq                   = 2452, /* MHz */
+        .unk2                   = 3269,
+        RADIOREGS(0x73, 0x09, 0x94, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x09, 0x06,
+                  0x80, 0xFF, 0x88, 0x09, 0x06, 0x80),
+        PHYREGS(0xD903, 0xD503, 0xD103, 0x2904, 0x2D04, 0x3104),
+  },
+  {     .channel                = 10,
+        .freq                   = 2457, /* MHz */
+        .unk2                   = 3276,
+        RADIOREGS(0x73, 0x09, 0x99, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x08, 0x05,
+                  0x80, 0xFF, 0x88, 0x08, 0x05, 0x80),
+        PHYREGS(0xDB03, 0xD703, 0xD303, 0x2704, 0x2B04, 0x2F04),
+  },
+  {     .channel                = 11,
+        .freq                   = 2462, /* MHz */
+        .unk2                   = 3283,
+        RADIOREGS(0x73, 0x09, 0x9E, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x08, 0x04,
+                  0x80, 0xFF, 0x88, 0x08, 0x04, 0x80),
+        PHYREGS(0xDD03, 0xD903, 0xD503, 0x2404, 0x2904, 0x2D04),
+  },
+  {     .channel                = 12,
+        .freq                   = 2467, /* MHz */
+        .unk2                   = 3289,
+        RADIOREGS(0x73, 0x09, 0xA3, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x08, 0x03,
+                  0x80, 0xFF, 0x88, 0x08, 0x03, 0x80),
+        PHYREGS(0xDF03, 0xDB03, 0xD703, 0x2204, 0x2704, 0x2B04),
+  },
+  {     .channel                = 13,
+        .freq                   = 2472, /* MHz */
+        .unk2                   = 3296,
+        RADIOREGS(0x73, 0x09, 0xA8, 0x0F, 0x00, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x07, 0x03,
+                  0x80, 0xFF, 0x88, 0x07, 0x03, 0x80),
+        PHYREGS(0xE103, 0xDD03, 0xD903, 0x2004, 0x2404, 0x2904),
+  },
+  {     .channel                = 14,
+        .freq                   = 2484, /* MHz */
+        .unk2                   = 3312,
+        RADIOREGS(0x73, 0x09, 0xB4, 0x0F, 0xFF, 0x01, 0x07, 0x15,
+                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x07, 0x01,
+                  0x80, 0xFF, 0x88, 0x07, 0x01, 0x80),
+        PHYREGS(0xE603, 0xE203, 0xDE03, 0x1B04, 0x1F04, 0x2404),
+  },
+};
+
+void b2055_upload_inittab(struct b43_wldev *dev,
+                          bool ghz5, bool ignore_uploadflag)
+{
+        const struct b2055_inittab_entry *e;
+        unsigned int i;
+        u16 value;
+
+        for (i = 0; i < ARRAY_SIZE(b2055_inittab); i++) {
+                e = &(b2055_inittab[i]);
+                if (!(e->flags & B2055_INITTAB_ENTRY_OK))
+                        continue;
+                if ((e->flags & B2055_INITTAB_UPLOAD) || ignore_uploadflag) {
+                        if (ghz5)
+                                value = e->ghz5;
+                        else
+                                value = e->ghz2;
+                        b43_radio_write16(dev, i, value);
+                }
+        }
+}
+
+const struct b43_nphy_channeltab_entry_rev2 *
+b43_nphy_get_chantabent_rev2(struct b43_wldev *dev, u8 channel)
+{
+        const struct b43_nphy_channeltab_entry_rev2 *e;
+        unsigned int i;
+
+        for (i = 0; i < ARRAY_SIZE(b43_nphy_channeltab_rev2); i++) {
+                e = &(b43_nphy_channeltab_rev2[i]);
+                if (e->channel == channel)
+                        return e;
+        }
+
+        return NULL;
+}
diff --git a/drivers/net/wireless/b43/radio_2055.h b/drivers/net/wireless/b43/radio_2055.h
new file mode 100644
index 000000000000..d9bfa0f21b72
--- /dev/null
+++ b/drivers/net/wireless/b43/radio_2055.h
@@ -0,0 +1,254 @@
+#ifndef B43_RADIO_2055_H_
+#define B43_RADIO_2055_H_
+
+#include <linux/types.h>
+
+#include "tables_nphy.h"
+
+#define B2055_GEN_SPARE                 0x00 /* GEN spare */
+#define B2055_SP_PINPD                  0x02 /* SP PIN PD */
+#define B2055_C1_SP_RSSI                0x03 /* SP RSSI Core 1 */
+#define B2055_C1_SP_PDMISC              0x04 /* SP PD MISC Core 1 */
+#define B2055_C2_SP_RSSI                0x05 /* SP RSSI Core 2 */
+#define B2055_C2_SP_PDMISC              0x06 /* SP PD MISC Core 2 */
+#define B2055_C1_SP_RXGC1               0x07 /* SP RX GC1 Core 1 */
+#define B2055_C1_SP_RXGC2               0x08 /* SP RX GC2 Core 1 */
+#define B2055_C2_SP_RXGC1               0x09 /* SP RX GC1 Core 2 */
+#define B2055_C2_SP_RXGC2               0x0A /* SP RX GC2 Core 2 */
+#define B2055_C1_SP_LPFBWSEL            0x0B /* SP LPF BW select Core 1 */
+#define B2055_C2_SP_LPFBWSEL            0x0C /* SP LPF BW select Core 2 */
+#define B2055_C1_SP_TXGC1               0x0D /* SP TX GC1 Core 1 */
+#define B2055_C1_SP_TXGC2               0x0E /* SP TX GC2 Core 1 */
+#define B2055_C2_SP_TXGC1               0x0F /* SP TX GC1 Core 2 */
+#define B2055_C2_SP_TXGC2               0x10 /* SP TX GC2 Core 2 */
+#define B2055_MASTER1                   0x11 /* Master control 1 */
+#define B2055_MASTER2                   0x12 /* Master control 2 */
+#define B2055_PD_LGEN                   0x13 /* PD LGEN */
+#define B2055_PD_PLLTS                  0x14 /* PD PLL TS */
+#define B2055_C1_PD_LGBUF               0x15 /* PD Core 1 LGBUF */
+#define B2055_C1_PD_TX                  0x16 /* PD Core 1 TX */
+#define B2055_C1_PD_RXTX                0x17 /* PD Core 1 RXTX */
+#define B2055_C1_PD_RSSIMISC            0x18 /* PD Core 1 RSSI MISC */
+#define B2055_C2_PD_LGBUF               0x19 /* PD Core 2 LGBUF */
+#define B2055_C2_PD_TX                  0x1A /* PD Core 2 TX */
+#define B2055_C2_PD_RXTX                0x1B /* PD Core 2 RXTX */
+#define B2055_C2_PD_RSSIMISC            0x1C /* PD Core 2 RSSI MISC */
+#define B2055_PWRDET_LGEN               0x1D /* PWRDET LGEN */
+#define B2055_C1_PWRDET_LGBUF           0x1E /* PWRDET LGBUF Core 1 */
+#define B2055_C1_PWRDET_RXTX            0x1F /* PWRDET RXTX Core 1 */
+#define B2055_C2_PWRDET_LGBUF           0x20 /* PWRDET LGBUF Core 2 */
+#define B2055_C2_PWRDET_RXTX            0x21 /* PWRDET RXTX Core 2 */
+#define B2055_RRCCAL_CS                 0x22 /* RRCCAL Control spare */
+#define B2055_RRCCAL_NOPTSEL            0x23 /* RRCCAL N OPT SEL */
+#define B2055_CAL_MISC                  0x24 /* CAL MISC */
+#define B2055_CAL_COUT                  0x25 /* CAL Counter out */
+#define B2055_CAL_COUT2                 0x26 /* CAL Counter out 2 */
+#define B2055_CAL_CVARCTL               0x27 /* CAL CVAR Control */
+#define B2055_CAL_RVARCTL               0x28 /* CAL RVAR Control */
+#define B2055_CAL_LPOCTL                0x29 /* CAL LPO Control */
+#define B2055_CAL_TS                    0x2A /* CAL TS */
+#define B2055_CAL_RCCALRTS              0x2B /* CAL RCCAL READ TS */
+#define B2055_CAL_RCALRTS               0x2C /* CAL RCAL READ TS */
+#define B2055_PADDRV                    0x2D /* PAD driver */
+#define B2055_XOCTL1                    0x2E /* XO Control 1 */
+#define B2055_XOCTL2                    0x2F /* XO Control 2 */
+#define B2055_XOREGUL                   0x30 /* XO Regulator */
+#define B2055_XOMISC                    0x31 /* XO misc */
+#define B2055_PLL_LFC1                  0x32 /* PLL LF C1 */
+#define B2055_PLL_CALVTH                0x33 /* PLL CAL VTH */
+#define B2055_PLL_LFC2                  0x34 /* PLL LF C2 */
+#define B2055_PLL_REF                   0x35 /* PLL reference */
+#define B2055_PLL_LFR1                  0x36 /* PLL LF R1 */
+#define B2055_PLL_PFDCP                 0x37 /* PLL PFD CP */
+#define B2055_PLL_IDAC_CPOPAMP          0x38 /* PLL IDAC CPOPAMP */
+#define B2055_PLL_CPREG                 0x39 /* PLL CP Regulator */
+#define B2055_PLL_RCAL                  0x3A /* PLL RCAL */
+#define B2055_RF_PLLMOD0                0x3B /* RF PLL MOD0 */
+#define B2055_RF_PLLMOD1                0x3C /* RF PLL MOD1 */
+#define B2055_RF_MMDIDAC1               0x3D /* RF MMD IDAC 1 */
+#define B2055_RF_MMDIDAC0               0x3E /* RF MMD IDAC 0 */
+#define B2055_RF_MMDSP                  0x3F /* RF MMD spare */
+#define B2055_VCO_CAL1                  0x40 /* VCO cal 1 */
+#define B2055_VCO_CAL2                  0x41 /* VCO cal 2 */
+#define B2055_VCO_CAL3                  0x42 /* VCO cal 3 */
+#define B2055_VCO_CAL4                  0x43 /* VCO cal 4 */
+#define B2055_VCO_CAL5                  0x44 /* VCO cal 5 */
+#define B2055_VCO_CAL6                  0x45 /* VCO cal 6 */
+#define B2055_VCO_CAL7                  0x46 /* VCO cal 7 */
+#define B2055_VCO_CAL8                  0x47 /* VCO cal 8 */
+#define B2055_VCO_CAL9                  0x48 /* VCO cal 9 */
+#define B2055_VCO_CAL10                 0x49 /* VCO cal 10 */
+#define B2055_VCO_CAL11                 0x4A /* VCO cal 11 */
+#define B2055_VCO_CAL12                 0x4B /* VCO cal 12 */
+#define B2055_VCO_CAL13                 0x4C /* VCO cal 13 */
+#define B2055_VCO_CAL14                 0x4D /* VCO cal 14 */
+#define B2055_VCO_CAL15                 0x4E /* VCO cal 15 */
+#define B2055_VCO_CAL16                 0x4F /* VCO cal 16 */
+#define B2055_VCO_KVCO                  0x50 /* VCO KVCO */
+#define B2055_VCO_CAPTAIL               0x51 /* VCO CAP TAIL */
+#define B2055_VCO_IDACVCO               0x52 /* VCO IDAC VCO */
+#define B2055_VCO_REG                   0x53 /* VCO Regulator */
+#define B2055_PLL_RFVTH                 0x54 /* PLL RF VTH */
+#define B2055_LGBUF_CENBUF              0x55 /* LGBUF CEN BUF */
+#define B2055_LGEN_TUNE1                0x56 /* LGEN tune 1 */
+#define B2055_LGEN_TUNE2                0x57 /* LGEN tune 2 */
+#define B2055_LGEN_IDAC1                0x58 /* LGEN IDAC 1 */
+#define B2055_LGEN_IDAC2                0x59 /* LGEN IDAC 2 */
+#define B2055_LGEN_BIASC                0x5A /* LGEN BIAS counter */
+#define B2055_LGEN_BIASIDAC             0x5B /* LGEN BIAS IDAC */
+#define B2055_LGEN_RCAL                 0x5C /* LGEN RCAL */
+#define B2055_LGEN_DIV                  0x5D /* LGEN div */
+#define B2055_LGEN_SPARE2               0x5E /* LGEN spare 2 */
+#define B2055_C1_LGBUF_ATUNE            0x5F /* Core 1 LGBUF A tune */
+#define B2055_C1_LGBUF_GTUNE            0x60 /* Core 1 LGBUF G tune */
+#define B2055_C1_LGBUF_DIV              0x61 /* Core 1 LGBUF div */
+#define B2055_C1_LGBUF_AIDAC            0x62 /* Core 1 LGBUF A IDAC */
+#define B2055_C1_LGBUF_GIDAC            0x63 /* Core 1 LGBUF G IDAC */
+#define B2055_C1_LGBUF_IDACFO           0x64 /* Core 1 LGBUF IDAC filter override */
+#define B2055_C1_LGBUF_SPARE            0x65 /* Core 1 LGBUF spare */
+#define B2055_C1_RX_RFSPC1              0x66 /* Core 1 RX RF SPC1 */
+#define B2055_C1_RX_RFR1                0x67 /* Core 1 RX RF reg 1 */
+#define B2055_C1_RX_RFR2                0x68 /* Core 1 RX RF reg 2 */
+#define B2055_C1_RX_RFRCAL              0x69 /* Core 1 RX RF RCAL */
+#define B2055_C1_RX_BB_BLCMP            0x6A /* Core 1 RX Baseband BUFI LPF CMP */
+#define B2055_C1_RX_BB_LPF              0x6B /* Core 1 RX Baseband LPF */
+#define B2055_C1_RX_BB_MIDACHP          0x6C /* Core 1 RX Baseband MIDAC High-pass */
+#define B2055_C1_RX_BB_VGA1IDAC         0x6D /* Core 1 RX Baseband VGA1 IDAC */
+#define B2055_C1_RX_BB_VGA2IDAC         0x6E /* Core 1 RX Baseband VGA2 IDAC */
+#define B2055_C1_RX_BB_VGA3IDAC         0x6F /* Core 1 RX Baseband VGA3 IDAC */
+#define B2055_C1_RX_BB_BUFOCTL          0x70 /* Core 1 RX Baseband BUFO Control */
+#define B2055_C1_RX_BB_RCCALCTL         0x71 /* Core 1 RX Baseband RCCAL Control */
+#define B2055_C1_RX_BB_RSSICTL1         0x72 /* Core 1 RX Baseband RSSI Control 1 */
+#define B2055_C1_RX_BB_RSSICTL2         0x73 /* Core 1 RX Baseband RSSI Control 2 */
+#define B2055_C1_RX_BB_RSSICTL3         0x74 /* Core 1 RX Baseband RSSI Control 3 */
+#define B2055_C1_RX_BB_RSSICTL4         0x75 /* Core 1 RX Baseband RSSI Control 4 */
+#define B2055_C1_RX_BB_RSSICTL5         0x76 /* Core 1 RX Baseband RSSI Control 5 */
+#define B2055_C1_RX_BB_REG              0x77 /* Core 1 RX Baseband Regulator */
+#define B2055_C1_RX_BB_SPARE1           0x78 /* Core 1 RX Baseband spare 1 */
+#define B2055_C1_RX_TXBBRCAL            0x79 /* Core 1 RX TX BB RCAL */
+#define B2055_C1_TX_RF_SPGA             0x7A /* Core 1 TX RF SGM PGA */
+#define B2055_C1_TX_RF_SPAD             0x7B /* Core 1 TX RF SGM PAD */
+#define B2055_C1_TX_RF_CNTPGA1          0x7C /* Core 1 TX RF counter PGA 1 */
+#define B2055_C1_TX_RF_CNTPAD1          0x7D /* Core 1 TX RF counter PAD 1 */
+#define B2055_C1_TX_RF_PGAIDAC          0x7E /* Core 1 TX RF PGA IDAC */
+#define B2055_C1_TX_PGAPADTN            0x7F /* Core 1 TX PGA PAD TN */
+#define B2055_C1_TX_PADIDAC1            0x80 /* Core 1 TX PAD IDAC 1 */
+#define B2055_C1_TX_PADIDAC2            0x81 /* Core 1 TX PAD IDAC 2 */
+#define B2055_C1_TX_MXBGTRIM            0x82 /* Core 1 TX MX B/G TRIM */
+#define B2055_C1_TX_RF_RCAL             0x83 /* Core 1 TX RF RCAL */
+#define B2055_C1_TX_RF_PADTSSI1         0x84 /* Core 1 TX RF PAD TSSI1 */
+#define B2055_C1_TX_RF_PADTSSI2         0x85 /* Core 1 TX RF PAD TSSI2 */
+#define B2055_C1_TX_RF_SPARE            0x86 /* Core 1 TX RF spare */
+#define B2055_C1_TX_RF_IQCAL1           0x87 /* Core 1 TX RF I/Q CAL 1 */
+#define B2055_C1_TX_RF_IQCAL2           0x88 /* Core 1 TX RF I/Q CAL 2 */
+#define B2055_C1_TXBB_RCCAL             0x89 /* Core 1 TXBB RC CAL Control */
+#define B2055_C1_TXBB_LPF1              0x8A /* Core 1 TXBB LPF 1 */
+#define B2055_C1_TX_VOSCNCL             0x8B /* Core 1 TX VOS CNCL */
+#define B2055_C1_TX_LPF_MXGMIDAC        0x8C /* Core 1 TX LPF MXGM IDAC */
+#define B2055_C1_TX_BB_MXGM             0x8D /* Core 1 TX BB MXGM */
+#define B2055_C2_LGBUF_ATUNE            0x8E /* Core 2 LGBUF A tune */
+#define B2055_C2_LGBUF_GTUNE            0x8F /* Core 2 LGBUF G tune */
+#define B2055_C2_LGBUF_DIV              0x90 /* Core 2 LGBUF div */
+#define B2055_C2_LGBUF_AIDAC            0x91 /* Core 2 LGBUF A IDAC */
+#define B2055_C2_LGBUF_GIDAC            0x92 /* Core 2 LGBUF G IDAC */
+#define B2055_C2_LGBUF_IDACFO           0x93 /* Core 2 LGBUF IDAC filter override */
+#define B2055_C2_LGBUF_SPARE            0x94 /* Core 2 LGBUF spare */
+#define B2055_C2_RX_RFSPC1              0x95 /* Core 2 RX RF SPC1 */
+#define B2055_C2_RX_RFR1                0x96 /* Core 2 RX RF reg 1 */
+#define B2055_C2_RX_RFR2                0x97 /* Core 2 RX RF reg 2 */
+#define B2055_C2_RX_RFRCAL              0x98 /* Core 2 RX RF RCAL */
+#define B2055_C2_RX_BB_BLCMP            0x99 /* Core 2 RX Baseband BUFI LPF CMP */
+#define B2055_C2_RX_BB_LPF              0x9A /* Core 2 RX Baseband LPF */
+#define B2055_C2_RX_BB_MIDACHP          0x9B /* Core 2 RX Baseband MIDAC High-pass */
+#define B2055_C2_RX_BB_VGA1IDAC         0x9C /* Core 2 RX Baseband VGA1 IDAC */
+#define B2055_C2_RX_BB_VGA2IDAC         0x9D /* Core 2 RX Baseband VGA2 IDAC */
+#define B2055_C2_RX_BB_VGA3IDAC         0x9E /* Core 2 RX Baseband VGA3 IDAC */
+#define B2055_C2_RX_BB_BUFOCTL          0x9F /* Core 2 RX Baseband BUFO Control */
+#define B2055_C2_RX_BB_RCCALCTL         0xA0 /* Core 2 RX Baseband RCCAL Control */
+#define B2055_C2_RX_BB_RSSICTL1         0xA1 /* Core 2 RX Baseband RSSI Control 1 */
+#define B2055_C2_RX_BB_RSSICTL2         0xA2 /* Core 2 RX Baseband RSSI Control 2 */
+#define B2055_C2_RX_BB_RSSICTL3         0xA3 /* Core 2 RX Baseband RSSI Control 3 */
+#define B2055_C2_RX_BB_RSSICTL4         0xA4 /* Core 2 RX Baseband RSSI Control 4 */
+#define B2055_C2_RX_BB_RSSICTL5         0xA5 /* Core 2 RX Baseband RSSI Control 5 */
+#define B2055_C2_RX_BB_REG              0xA6 /* Core 2 RX Baseband Regulator */
+#define B2055_C2_RX_BB_SPARE1           0xA7 /* Core 2 RX Baseband spare 1 */
+#define B2055_C2_RX_TXBBRCAL            0xA8 /* Core 2 RX TX BB RCAL */
+#define B2055_C2_TX_RF_SPGA             0xA9 /* Core 2 TX RF SGM PGA */
+#define B2055_C2_TX_RF_SPAD             0xAA /* Core 2 TX RF SGM PAD */
+#define B2055_C2_TX_RF_CNTPGA1          0xAB /* Core 2 TX RF counter PGA 1 */
+#define B2055_C2_TX_RF_CNTPAD1          0xAC /* Core 2 TX RF counter PAD 1 */
+#define B2055_C2_TX_RF_PGAIDAC          0xAD /* Core 2 TX RF PGA IDAC */
+#define B2055_C2_TX_PGAPADTN            0xAE /* Core 2 TX PGA PAD TN */
+#define B2055_C2_TX_PADIDAC1            0xAF /* Core 2 TX PAD IDAC 1 */
+#define B2055_C2_TX_PADIDAC2            0xB0 /* Core 2 TX PAD IDAC 2 */
+#define B2055_C2_TX_MXBGTRIM            0xB1 /* Core 2 TX MX B/G TRIM */
+#define B2055_C2_TX_RF_RCAL             0xB2 /* Core 2 TX RF RCAL */
+#define B2055_C2_TX_RF_PADTSSI1         0xB3 /* Core 2 TX RF PAD TSSI1 */
+#define B2055_C2_TX_RF_PADTSSI2         0xB4 /* Core 2 TX RF PAD TSSI2 */
+#define B2055_C2_TX_RF_SPARE            0xB5 /* Core 2 TX RF spare */
+#define B2055_C2_TX_RF_IQCAL1           0xB6 /* Core 2 TX RF I/Q CAL 1 */
+#define B2055_C2_TX_RF_IQCAL2           0xB7 /* Core 2 TX RF I/Q CAL 2 */
+#define B2055_C2_TXBB_RCCAL             0xB8 /* Core 2 TXBB RC CAL Control */
+#define B2055_C2_TXBB_LPF1              0xB9 /* Core 2 TXBB LPF 1 */
+#define B2055_C2_TX_VOSCNCL             0xBA /* Core 2 TX VOS CNCL */
+#define B2055_C2_TX_LPF_MXGMIDAC        0xBB /* Core 2 TX LPF MXGM IDAC */
+#define B2055_C2_TX_BB_MXGM             0xBC /* Core 2 TX BB MXGM */
+#define B2055_PRG_GCHP21                0xBD /* PRG GC HPVGA23 21 */
+#define B2055_PRG_GCHP22                0xBE /* PRG GC HPVGA23 22 */
+#define B2055_PRG_GCHP23                0xBF /* PRG GC HPVGA23 23 */
+#define B2055_PRG_GCHP24                0xC0 /* PRG GC HPVGA23 24 */
+#define B2055_PRG_GCHP25                0xC1 /* PRG GC HPVGA23 25 */
+#define B2055_PRG_GCHP26                0xC2 /* PRG GC HPVGA23 26 */
+#define B2055_PRG_GCHP27                0xC3 /* PRG GC HPVGA23 27 */
+#define B2055_PRG_GCHP28                0xC4 /* PRG GC HPVGA23 28 */
+#define B2055_PRG_GCHP29                0xC5 /* PRG GC HPVGA23 29 */
+#define B2055_PRG_GCHP30                0xC6 /* PRG GC HPVGA23 30 */
+#define B2055_C1_LNA_GAINBST            0xCD /* Core 1 LNA GAINBST */
+#define B2055_C1_B0NB_RSSIVCM           0xD2 /* Core 1 B0 narrow-band RSSI VCM */
+#define B2055_C1_GENSPARE2              0xD6 /* Core 1 GEN spare 2 */
+#define B2055_C2_LNA_GAINBST            0xD9 /* Core 2 LNA GAINBST */
+#define B2055_C2_B0NB_RSSIVCM           0xDE /* Core 2 B0 narrow-band RSSI VCM */
+#define B2055_C2_GENSPARE2              0xE2 /* Core 2 GEN spare 2 */
+
+struct b43_nphy_channeltab_entry_rev2 {
+        /* The channel number */
+        u8 channel;
+        /* The channel frequency in MHz */
+        u16 freq;
+        /* An unknown value */
+        u16 unk2;
+        /* Radio register values on channelswitch */
+        u8 radio_pll_ref;
+        u8 radio_rf_pllmod0;
+        u8 radio_rf_pllmod1;
+        u8 radio_vco_captail;
+        u8 radio_vco_cal1;
+        u8 radio_vco_cal2;
+        u8 radio_pll_lfc1;
+        u8 radio_pll_lfr1;
+        u8 radio_pll_lfc2;
+        u8 radio_lgbuf_cenbuf;
+        u8 radio_lgen_tune1;
+        u8 radio_lgen_tune2;
+        u8 radio_c1_lgbuf_atune;
+        u8 radio_c1_lgbuf_gtune;
+        u8 radio_c1_rx_rfr1;
+        u8 radio_c1_tx_pgapadtn;
+        u8 radio_c1_tx_mxbgtrim;
+        u8 radio_c2_lgbuf_atune;
+        u8 radio_c2_lgbuf_gtune;
+        u8 radio_c2_rx_rfr1;
+        u8 radio_c2_tx_pgapadtn;
+        u8 radio_c2_tx_mxbgtrim;
+        /* PHY register values on channelswitch */
+        struct b43_phy_n_sfo_cfg phy_regs;
+};
+
+/* Upload the default register value table.
+ * If "ghz5" is true, we upload the 5Ghz table. Otherwise the 2.4Ghz
+ * table is uploaded. If "ignore_uploadflag" is true, we upload any value
+ * and ignore the "UPLOAD" flag. */
+void b2055_upload_inittab(struct b43_wldev *dev,
+                          bool ghz5, bool ignore_uploadflag);
+
+#endif /* B43_RADIO_2055_H_ */
diff --git a/drivers/net/wireless/b43/radio_2056.c b/drivers/net/wireless/b43/radio_2056.c
new file mode 100644
index 000000000000..d8563192ce56
--- /dev/null
+++ b/drivers/net/wireless/b43/radio_2056.c
@@ -0,0 +1,43 @@
+/*
+
+  Broadcom B43 wireless driver
+  IEEE 802.11n 2056 radio device data tables
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; see the file COPYING.  If not, write to
+  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
+  Boston, MA 02110-1301, USA.
+
+*/
+
+#include "b43.h"
+#include "radio_2056.h"
+#include "phy_common.h"
+
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev3[] = {
+};
+
+const struct b43_nphy_channeltab_entry_rev3 *
+b43_nphy_get_chantabent_rev3(struct b43_wldev *dev, u16 freq)
+{
+        const struct b43_nphy_channeltab_entry_rev3 *e;
+        unsigned int i;
+
+        for (i = 0; i < ARRAY_SIZE(b43_nphy_channeltab_rev3); i++) {
+                e = &(b43_nphy_channeltab_rev3[i]);
+                if (e->freq == freq)
+                        return e;
+        }
+
+        return NULL;
+}
diff --git a/drivers/net/wireless/b43/radio_2056.h b/drivers/net/wireless/b43/radio_2056.h
new file mode 100644
index 000000000000..fda6dafecb8c
--- /dev/null
+++ b/drivers/net/wireless/b43/radio_2056.h
@@ -0,0 +1,42 @@
+/*
+
+  Broadcom B43 wireless driver
+
+  Copyright (c) 2010 Rafał Miłecki <zajec5@gmail.com>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; see the file COPYING.  If not, write to
+  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
+  Boston, MA 02110-1301, USA.
+
+*/
+
+#ifndef B43_RADIO_2056_H_
+#define B43_RADIO_2056_H_
+
+#include <linux/types.h>
+
+#include "tables_nphy.h"
+
+struct b43_nphy_channeltab_entry_rev3 {
+        /* The channel number */
+        u8 channel;
+        /* The channel frequency in MHz */
+        u16 freq;
+        /* Radio register values on channelswitch */
+        /* TODO */
+        /* PHY register values on channelswitch */
+        struct b43_phy_n_sfo_cfg phy_regs;
+};
+
+#endif /* B43_RADIO_2056_H_ */
diff --git a/drivers/net/wireless/b43/tables_nphy.c b/drivers/net/wireless/b43/tables_nphy.c
index d96e870ab8fe..d60db078eae2 100644
--- a/drivers/net/wireless/b43/tables_nphy.c
+++ b/drivers/net/wireless/b43/tables_nphy.c
@@ -1,7 +1,7 @@
 /*
 
   Broadcom B43 wireless driver
-  IEEE 802.11n PHY and radio device data tables
+  IEEE 802.11n PHY data tables
 
   Copyright (c) 2008 Michael Buesch <mb@bu3sch.de>
 
@@ -27,1315 +27,6 @@
 #include "phy_common.h"
 #include "phy_n.h"
 
-
-struct b2055_inittab_entry {
-        /* Value to write if we use the 5GHz band. */
-        u16 ghz5;
-        /* Value to write if we use the 2.4GHz band. */
-        u16 ghz2;
-        /* Flags */
-        u8 flags;
-#define B2055_INITTAB_ENTRY_OK  0x01
-#define B2055_INITTAB_UPLOAD    0x02
-};
-#define UPLOAD          .flags = B2055_INITTAB_ENTRY_OK | B2055_INITTAB_UPLOAD
-#define NOUPLOAD        .flags = B2055_INITTAB_ENTRY_OK
-
-static const struct b2055_inittab_entry b2055_inittab [] = {
-  [B2055_SP_PINPD]              = { .ghz5 = 0x0080, .ghz2 = 0x0080, NOUPLOAD, },
-  [B2055_C1_SP_RSSI]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C1_SP_PDMISC]          = { .ghz5 = 0x0027, .ghz2 = 0x0027, NOUPLOAD, },
-  [B2055_C2_SP_RSSI]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C2_SP_PDMISC]          = { .ghz5 = 0x0027, .ghz2 = 0x0027, NOUPLOAD, },
-  [B2055_C1_SP_RXGC1]           = { .ghz5 = 0x007F, .ghz2 = 0x007F, UPLOAD, },
-  [B2055_C1_SP_RXGC2]           = { .ghz5 = 0x0007, .ghz2 = 0x0007, UPLOAD, },
-  [B2055_C2_SP_RXGC1]           = { .ghz5 = 0x007F, .ghz2 = 0x007F, UPLOAD, },
-  [B2055_C2_SP_RXGC2]           = { .ghz5 = 0x0007, .ghz2 = 0x0007, UPLOAD, },
-  [B2055_C1_SP_LPFBWSEL]        = { .ghz5 = 0x0015, .ghz2 = 0x0015, NOUPLOAD, },
-  [B2055_C2_SP_LPFBWSEL]        = { .ghz5 = 0x0015, .ghz2 = 0x0015, NOUPLOAD, },
-  [B2055_C1_SP_TXGC1]           = { .ghz5 = 0x004F, .ghz2 = 0x004F, UPLOAD, },
-  [B2055_C1_SP_TXGC2]           = { .ghz5 = 0x0005, .ghz2 = 0x0005, UPLOAD, },
-  [B2055_C2_SP_TXGC1]           = { .ghz5 = 0x004F, .ghz2 = 0x004F, UPLOAD, },
-  [B2055_C2_SP_TXGC2]           = { .ghz5 = 0x0005, .ghz2 = 0x0005, UPLOAD, },
-  [B2055_MASTER1]               = { .ghz5 = 0x00D0, .ghz2 = 0x00D0, NOUPLOAD, },
-  [B2055_MASTER2]               = { .ghz5 = 0x0002, .ghz2 = 0x0002, NOUPLOAD, },
-  [B2055_PD_LGEN]               = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_PD_PLLTS]              = { .ghz5 = 0x0040, .ghz2 = 0x0040, NOUPLOAD, },
-  [B2055_C1_PD_LGBUF]           = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C1_PD_TX]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C1_PD_RXTX]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C1_PD_RSSIMISC]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C2_PD_LGBUF]           = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C2_PD_TX]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C2_PD_RXTX]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C2_PD_RSSIMISC]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_PWRDET_LGEN]           = { .ghz5 = 0x00C0, .ghz2 = 0x00C0, NOUPLOAD, },
-  [B2055_C1_PWRDET_LGBUF]       = { .ghz5 = 0x00FF, .ghz2 = 0x00FF, NOUPLOAD, },
-  [B2055_C1_PWRDET_RXTX]        = { .ghz5 = 0x00C0, .ghz2 = 0x00C0, NOUPLOAD, },
-  [B2055_C2_PWRDET_LGBUF]       = { .ghz5 = 0x00FF, .ghz2 = 0x00FF, NOUPLOAD, },
-  [B2055_C2_PWRDET_RXTX]        = { .ghz5 = 0x00C0, .ghz2 = 0x00C0, NOUPLOAD, },
-  [B2055_RRCCAL_CS]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_RRCCAL_NOPTSEL]        = { .ghz5 = 0x002C, .ghz2 = 0x002C, NOUPLOAD, },
-  [B2055_CAL_MISC]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_CAL_COUT]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_CAL_COUT2]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_CAL_CVARCTL]           = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_CAL_RVARCTL]           = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_CAL_LPOCTL]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_CAL_TS]                = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_CAL_RCCALRTS]          = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_CAL_RCALRTS]           = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_PADDRV]                = { .ghz5 = 0x00A4, .ghz2 = 0x00A4, NOUPLOAD, },
-  [B2055_XOCTL1]                = { .ghz5 = 0x0038, .ghz2 = 0x0038, NOUPLOAD, },
-  [B2055_XOCTL2]                = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_XOREGUL]               = { .ghz5 = 0x0004, .ghz2 = 0x0004, UPLOAD, },
-  [B2055_XOMISC]                = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_PLL_LFC1]              = { .ghz5 = 0x000A, .ghz2 = 0x000A, NOUPLOAD, },
-  [B2055_PLL_CALVTH]            = { .ghz5 = 0x0087, .ghz2 = 0x0087, NOUPLOAD, },
-  [B2055_PLL_LFC2]              = { .ghz5 = 0x0009, .ghz2 = 0x0009, NOUPLOAD, },
-  [B2055_PLL_REF]               = { .ghz5 = 0x0070, .ghz2 = 0x0070, NOUPLOAD, },
-  [B2055_PLL_LFR1]              = { .ghz5 = 0x0011, .ghz2 = 0x0011, NOUPLOAD, },
-  [B2055_PLL_PFDCP]             = { .ghz5 = 0x0018, .ghz2 = 0x0018, UPLOAD, },
-  [B2055_PLL_IDAC_CPOPAMP]      = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
-  [B2055_PLL_CPREG]             = { .ghz5 = 0x0004, .ghz2 = 0x0004, UPLOAD, },
-  [B2055_PLL_RCAL]              = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
-  [B2055_RF_PLLMOD0]            = { .ghz5 = 0x009E, .ghz2 = 0x009E, NOUPLOAD, },
-  [B2055_RF_PLLMOD1]            = { .ghz5 = 0x0009, .ghz2 = 0x0009, NOUPLOAD, },
-  [B2055_RF_MMDIDAC1]           = { .ghz5 = 0x00C8, .ghz2 = 0x00C8, UPLOAD, },
-  [B2055_RF_MMDIDAC0]           = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [B2055_RF_MMDSP]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_VCO_CAL1]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_VCO_CAL2]              = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_VCO_CAL3]              = { .ghz5 = 0x0001, .ghz2 = 0x0001, NOUPLOAD, },
-  [B2055_VCO_CAL4]              = { .ghz5 = 0x0002, .ghz2 = 0x0002, NOUPLOAD, },
-  [B2055_VCO_CAL5]              = { .ghz5 = 0x0096, .ghz2 = 0x0096, NOUPLOAD, },
-  [B2055_VCO_CAL6]              = { .ghz5 = 0x003E, .ghz2 = 0x003E, NOUPLOAD, },
-  [B2055_VCO_CAL7]              = { .ghz5 = 0x003E, .ghz2 = 0x003E, NOUPLOAD, },
-  [B2055_VCO_CAL8]              = { .ghz5 = 0x0013, .ghz2 = 0x0013, NOUPLOAD, },
-  [B2055_VCO_CAL9]              = { .ghz5 = 0x0002, .ghz2 = 0x0002, NOUPLOAD, },
-  [B2055_VCO_CAL10]             = { .ghz5 = 0x0015, .ghz2 = 0x0015, NOUPLOAD, },
-  [B2055_VCO_CAL11]             = { .ghz5 = 0x0007, .ghz2 = 0x0007, NOUPLOAD, },
-  [B2055_VCO_CAL12]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_VCO_CAL13]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_VCO_CAL14]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_VCO_CAL15]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_VCO_CAL16]             = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_VCO_KVCO]              = { .ghz5 = 0x0008, .ghz2 = 0x0008, NOUPLOAD, },
-  [B2055_VCO_CAPTAIL]           = { .ghz5 = 0x0008, .ghz2 = 0x0008, NOUPLOAD, },
-  [B2055_VCO_IDACVCO]           = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
-  [B2055_VCO_REG]               = { .ghz5 = 0x0084, .ghz2 = 0x0084, UPLOAD, },
-  [B2055_PLL_RFVTH]             = { .ghz5 = 0x00C3, .ghz2 = 0x00C3, NOUPLOAD, },
-  [B2055_LGBUF_CENBUF]          = { .ghz5 = 0x008F, .ghz2 = 0x008F, NOUPLOAD, },
-  [B2055_LGEN_TUNE1]            = { .ghz5 = 0x00FF, .ghz2 = 0x00FF, NOUPLOAD, },
-  [B2055_LGEN_TUNE2]            = { .ghz5 = 0x00FF, .ghz2 = 0x00FF, NOUPLOAD, },
-  [B2055_LGEN_IDAC1]            = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [B2055_LGEN_IDAC2]            = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [B2055_LGEN_BIASC]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_LGEN_BIASIDAC]         = { .ghz5 = 0x00CC, .ghz2 = 0x00CC, NOUPLOAD, },
-  [B2055_LGEN_RCAL]             = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
-  [B2055_LGEN_DIV]              = { .ghz5 = 0x0080, .ghz2 = 0x0080, NOUPLOAD, },
-  [B2055_LGEN_SPARE2]           = { .ghz5 = 0x0080, .ghz2 = 0x0080, NOUPLOAD, },
-  [B2055_C1_LGBUF_ATUNE]        = { .ghz5 = 0x00F8, .ghz2 = 0x00F8, NOUPLOAD, },
-  [B2055_C1_LGBUF_GTUNE]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [B2055_C1_LGBUF_DIV]          = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [B2055_C1_LGBUF_AIDAC]        = { .ghz5 = 0x0088, .ghz2 = 0x0008, UPLOAD, },
-  [B2055_C1_LGBUF_GIDAC]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [B2055_C1_LGBUF_IDACFO]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C1_LGBUF_SPARE]        = { .ghz5 = 0x0001, .ghz2 = 0x0001, UPLOAD, },
-  [B2055_C1_RX_RFSPC1]          = { .ghz5 = 0x008A, .ghz2 = 0x008A, NOUPLOAD, },
-  [B2055_C1_RX_RFR1]            = { .ghz5 = 0x0008, .ghz2 = 0x0008, NOUPLOAD, },
-  [B2055_C1_RX_RFR2]            = { .ghz5 = 0x0083, .ghz2 = 0x0083, NOUPLOAD, },
-  [B2055_C1_RX_RFRCAL]          = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
-  [B2055_C1_RX_BB_BLCMP]        = { .ghz5 = 0x00A0, .ghz2 = 0x00A0, NOUPLOAD, },
-  [B2055_C1_RX_BB_LPF]          = { .ghz5 = 0x000A, .ghz2 = 0x000A, NOUPLOAD, },
-  [B2055_C1_RX_BB_MIDACHP]      = { .ghz5 = 0x0087, .ghz2 = 0x0087, UPLOAD, },
-  [B2055_C1_RX_BB_VGA1IDAC]     = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
-  [B2055_C1_RX_BB_VGA2IDAC]     = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
-  [B2055_C1_RX_BB_VGA3IDAC]     = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
-  [B2055_C1_RX_BB_BUFOCTL]      = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
-  [B2055_C1_RX_BB_RCCALCTL]     = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
-  [B2055_C1_RX_BB_RSSICTL1]     = { .ghz5 = 0x006A, .ghz2 = 0x006A, UPLOAD, },
-  [B2055_C1_RX_BB_RSSICTL2]     = { .ghz5 = 0x00AB, .ghz2 = 0x00AB, UPLOAD, },
-  [B2055_C1_RX_BB_RSSICTL3]     = { .ghz5 = 0x0013, .ghz2 = 0x0013, UPLOAD, },
-  [B2055_C1_RX_BB_RSSICTL4]     = { .ghz5 = 0x00C1, .ghz2 = 0x00C1, UPLOAD, },
-  [B2055_C1_RX_BB_RSSICTL5]     = { .ghz5 = 0x00AA, .ghz2 = 0x00AA, UPLOAD, },
-  [B2055_C1_RX_BB_REG]          = { .ghz5 = 0x0087, .ghz2 = 0x0087, UPLOAD, },
-  [B2055_C1_RX_BB_SPARE1]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C1_RX_TXBBRCAL]        = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
-  [B2055_C1_TX_RF_SPGA]         = { .ghz5 = 0x0007, .ghz2 = 0x0007, NOUPLOAD, },
-  [B2055_C1_TX_RF_SPAD]         = { .ghz5 = 0x0007, .ghz2 = 0x0007, NOUPLOAD, },
-  [B2055_C1_TX_RF_CNTPGA1]      = { .ghz5 = 0x0015, .ghz2 = 0x0015, NOUPLOAD, },
-  [B2055_C1_TX_RF_CNTPAD1]      = { .ghz5 = 0x0055, .ghz2 = 0x0055, NOUPLOAD, },
-  [B2055_C1_TX_RF_PGAIDAC]      = { .ghz5 = 0x0097, .ghz2 = 0x0097, UPLOAD, },
-  [B2055_C1_TX_PGAPADTN]        = { .ghz5 = 0x0008, .ghz2 = 0x0008, NOUPLOAD, },
-  [B2055_C1_TX_PADIDAC1]        = { .ghz5 = 0x0014, .ghz2 = 0x0014, UPLOAD, },
-  [B2055_C1_TX_PADIDAC2]        = { .ghz5 = 0x0033, .ghz2 = 0x0033, NOUPLOAD, },
-  [B2055_C1_TX_MXBGTRIM]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [B2055_C1_TX_RF_RCAL]         = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
-  [B2055_C1_TX_RF_PADTSSI1]     = { .ghz5 = 0x0003, .ghz2 = 0x0003, UPLOAD, },
-  [B2055_C1_TX_RF_PADTSSI2]     = { .ghz5 = 0x000A, .ghz2 = 0x000A, NOUPLOAD, },
-  [B2055_C1_TX_RF_SPARE]        = { .ghz5 = 0x0003, .ghz2 = 0x0003, UPLOAD, },
-  [B2055_C1_TX_RF_IQCAL1]       = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
-  [B2055_C1_TX_RF_IQCAL2]       = { .ghz5 = 0x00A4, .ghz2 = 0x00A4, NOUPLOAD, },
-  [B2055_C1_TXBB_RCCAL]         = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
-  [B2055_C1_TXBB_LPF1]          = { .ghz5 = 0x0028, .ghz2 = 0x0028, NOUPLOAD, },
-  [B2055_C1_TX_VOSCNCL]         = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C1_TX_LPF_MXGMIDAC]    = { .ghz5 = 0x004A, .ghz2 = 0x004A, NOUPLOAD, },
-  [B2055_C1_TX_BB_MXGM]         = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C2_LGBUF_ATUNE]        = { .ghz5 = 0x00F8, .ghz2 = 0x00F8, NOUPLOAD, },
-  [B2055_C2_LGBUF_GTUNE]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [B2055_C2_LGBUF_DIV]          = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [B2055_C2_LGBUF_AIDAC]        = { .ghz5 = 0x0088, .ghz2 = 0x0008, UPLOAD, },
-  [B2055_C2_LGBUF_GIDAC]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [B2055_C2_LGBUF_IDACFO]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C2_LGBUF_SPARE]        = { .ghz5 = 0x0001, .ghz2 = 0x0001, UPLOAD, },
-  [B2055_C2_RX_RFSPC1]          = { .ghz5 = 0x008A, .ghz2 = 0x008A, NOUPLOAD, },
-  [B2055_C2_RX_RFR1]            = { .ghz5 = 0x0008, .ghz2 = 0x0008, NOUPLOAD, },
-  [B2055_C2_RX_RFR2]            = { .ghz5 = 0x0083, .ghz2 = 0x0083, NOUPLOAD, },
-  [B2055_C2_RX_RFRCAL]          = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
-  [B2055_C2_RX_BB_BLCMP]        = { .ghz5 = 0x00A0, .ghz2 = 0x00A0, NOUPLOAD, },
-  [B2055_C2_RX_BB_LPF]          = { .ghz5 = 0x000A, .ghz2 = 0x000A, NOUPLOAD, },
-  [B2055_C2_RX_BB_MIDACHP]      = { .ghz5 = 0x0087, .ghz2 = 0x0087, UPLOAD, },
-  [B2055_C2_RX_BB_VGA1IDAC]     = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
-  [B2055_C2_RX_BB_VGA2IDAC]     = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
-  [B2055_C2_RX_BB_VGA3IDAC]     = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
-  [B2055_C2_RX_BB_BUFOCTL]      = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
-  [B2055_C2_RX_BB_RCCALCTL]     = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
-  [B2055_C2_RX_BB_RSSICTL1]     = { .ghz5 = 0x006A, .ghz2 = 0x006A, UPLOAD, },
-  [B2055_C2_RX_BB_RSSICTL2]     = { .ghz5 = 0x00AB, .ghz2 = 0x00AB, UPLOAD, },
-  [B2055_C2_RX_BB_RSSICTL3]     = { .ghz5 = 0x0013, .ghz2 = 0x0013, UPLOAD, },
-  [B2055_C2_RX_BB_RSSICTL4]     = { .ghz5 = 0x00C1, .ghz2 = 0x00C1, UPLOAD, },
-  [B2055_C2_RX_BB_RSSICTL5]     = { .ghz5 = 0x00AA, .ghz2 = 0x00AA, UPLOAD, },
-  [B2055_C2_RX_BB_REG]          = { .ghz5 = 0x0087, .ghz2 = 0x0087, UPLOAD, },
-  [B2055_C2_RX_BB_SPARE1]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C2_RX_TXBBRCAL]        = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
-  [B2055_C2_TX_RF_SPGA]         = { .ghz5 = 0x0007, .ghz2 = 0x0007, NOUPLOAD, },
-  [B2055_C2_TX_RF_SPAD]         = { .ghz5 = 0x0007, .ghz2 = 0x0007, NOUPLOAD, },
-  [B2055_C2_TX_RF_CNTPGA1]      = { .ghz5 = 0x0015, .ghz2 = 0x0015, NOUPLOAD, },
-  [B2055_C2_TX_RF_CNTPAD1]      = { .ghz5 = 0x0055, .ghz2 = 0x0055, NOUPLOAD, },
-  [B2055_C2_TX_RF_PGAIDAC]      = { .ghz5 = 0x0097, .ghz2 = 0x0097, UPLOAD, },
-  [B2055_C2_TX_PGAPADTN]        = { .ghz5 = 0x0008, .ghz2 = 0x0008, NOUPLOAD, },
-  [B2055_C2_TX_PADIDAC1]        = { .ghz5 = 0x0014, .ghz2 = 0x0014, UPLOAD, },
-  [B2055_C2_TX_PADIDAC2]        = { .ghz5 = 0x0033, .ghz2 = 0x0033, NOUPLOAD, },
-  [B2055_C2_TX_MXBGTRIM]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [B2055_C2_TX_RF_RCAL]         = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
-  [B2055_C2_TX_RF_PADTSSI1]     = { .ghz5 = 0x0003, .ghz2 = 0x0003, UPLOAD, },
-  [B2055_C2_TX_RF_PADTSSI2]     = { .ghz5 = 0x000A, .ghz2 = 0x000A, NOUPLOAD, },
-  [B2055_C2_TX_RF_SPARE]        = { .ghz5 = 0x0003, .ghz2 = 0x0003, UPLOAD, },
-  [B2055_C2_TX_RF_IQCAL1]       = { .ghz5 = 0x002A, .ghz2 = 0x002A, NOUPLOAD, },
-  [B2055_C2_TX_RF_IQCAL2]       = { .ghz5 = 0x00A4, .ghz2 = 0x00A4, NOUPLOAD, },
-  [B2055_C2_TXBB_RCCAL]         = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
-  [B2055_C2_TXBB_LPF1]          = { .ghz5 = 0x0028, .ghz2 = 0x0028, NOUPLOAD, },
-  [B2055_C2_TX_VOSCNCL]         = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C2_TX_LPF_MXGMIDAC]    = { .ghz5 = 0x004A, .ghz2 = 0x004A, NOUPLOAD, },
-  [B2055_C2_TX_BB_MXGM]         = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_PRG_GCHP21]            = { .ghz5 = 0x0071, .ghz2 = 0x0071, NOUPLOAD, },
-  [B2055_PRG_GCHP22]            = { .ghz5 = 0x0072, .ghz2 = 0x0072, NOUPLOAD, },
-  [B2055_PRG_GCHP23]            = { .ghz5 = 0x0073, .ghz2 = 0x0073, NOUPLOAD, },
-  [B2055_PRG_GCHP24]            = { .ghz5 = 0x0074, .ghz2 = 0x0074, NOUPLOAD, },
-  [B2055_PRG_GCHP25]            = { .ghz5 = 0x0075, .ghz2 = 0x0075, NOUPLOAD, },
-  [B2055_PRG_GCHP26]            = { .ghz5 = 0x0076, .ghz2 = 0x0076, NOUPLOAD, },
-  [B2055_PRG_GCHP27]            = { .ghz5 = 0x0077, .ghz2 = 0x0077, NOUPLOAD, },
-  [B2055_PRG_GCHP28]            = { .ghz5 = 0x0078, .ghz2 = 0x0078, NOUPLOAD, },
-  [B2055_PRG_GCHP29]            = { .ghz5 = 0x0079, .ghz2 = 0x0079, NOUPLOAD, },
-  [B2055_PRG_GCHP30]            = { .ghz5 = 0x007A, .ghz2 = 0x007A, NOUPLOAD, },
-  [0xC7]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xC8]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xC9]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xCA]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xCB]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xCC]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C1_LNA_GAINBST]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xCE]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xCF]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xD0]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xD1]                        = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
-  [B2055_C1_B0NB_RSSIVCM]       = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [0xD3]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xD4]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xD5]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C1_GENSPARE2]          = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xD7]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xD8]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C2_LNA_GAINBST]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xDA]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xDB]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xDC]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xDD]                        = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
-  [B2055_C2_B0NB_RSSIVCM]       = { .ghz5 = 0x0088, .ghz2 = 0x0088, NOUPLOAD, },
-  [0xDF]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xE0]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xE1]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [B2055_C2_GENSPARE2]          = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-};
-
-
-void b2055_upload_inittab(struct b43_wldev *dev,
-                          bool ghz5, bool ignore_uploadflag)
-{
-        const struct b2055_inittab_entry *e;
-        unsigned int i;
-        u16 value;
-
-        for (i = 0; i < ARRAY_SIZE(b2055_inittab); i++) {
-                e = &(b2055_inittab[i]);
-                if (!(e->flags & B2055_INITTAB_ENTRY_OK))
-                        continue;
-                if ((e->flags & B2055_INITTAB_UPLOAD) || ignore_uploadflag) {
-                        if (ghz5)
-                                value = e->ghz5;
-                        else
-                                value = e->ghz2;
-                        b43_radio_write16(dev, i, value);
-                }
-        }
-}
-
-
-#define RADIOREGS(r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, \
-                  r12, r13, r14, r15, r16, r17, r18, r19, r20, r21) \
-        .radio_pll_ref          = r0,   \
-        .radio_rf_pllmod0       = r1,   \
-        .radio_rf_pllmod1       = r2,   \
-        .radio_vco_captail      = r3,   \
-        .radio_vco_cal1         = r4,   \
-        .radio_vco_cal2         = r5,   \
-        .radio_pll_lfc1         = r6,   \
-        .radio_pll_lfr1         = r7,   \
-        .radio_pll_lfc2         = r8,   \
-        .radio_lgbuf_cenbuf     = r9,   \
-        .radio_lgen_tune1       = r10,  \
-        .radio_lgen_tune2       = r11,  \
-        .radio_c1_lgbuf_atune   = r12,  \
-        .radio_c1_lgbuf_gtune   = r13,  \
-        .radio_c1_rx_rfr1       = r14,  \
-        .radio_c1_tx_pgapadtn   = r15,  \
-        .radio_c1_tx_mxbgtrim   = r16,  \
-        .radio_c2_lgbuf_atune   = r17,  \
-        .radio_c2_lgbuf_gtune   = r18,  \
-        .radio_c2_rx_rfr1       = r19,  \
-        .radio_c2_tx_pgapadtn   = r20,  \
-        .radio_c2_tx_mxbgtrim   = r21
-
-#define PHYREGS(r0, r1, r2, r3, r4, r5) \
-        .phy_regs.phy_bw1a      = r0,   \
-        .phy_regs.phy_bw2       = r1,   \
-        .phy_regs.phy_bw3       = r2,   \
-        .phy_regs.phy_bw4       = r3,   \
-        .phy_regs.phy_bw5       = r4,   \
-        .phy_regs.phy_bw6       = r5
-
-static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab[] = {
-  {     .channel                = 184,
-        .freq                   = 4920, /* MHz */
-        .unk2                   = 3280,
-        RADIOREGS(0x71, 0x01, 0xEC, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xFF, 0xFF, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xB407, 0xB007, 0xAC07, 0x1402, 0x1502, 0x1602),
-  },
-  {     .channel                = 186,
-        .freq                   = 4930, /* MHz */
-        .unk2                   = 3287,
-        RADIOREGS(0x71, 0x01, 0xED, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xFF, 0xFF, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xB807, 0xB407, 0xB007, 0x1302, 0x1402, 0x1502),
-  },
-  {     .channel                = 188,
-        .freq                   = 4940, /* MHz */
-        .unk2                   = 3293,
-        RADIOREGS(0x71, 0x01, 0xEE, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xEE, 0xEE, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xBC07, 0xB807, 0xB407, 0x1202, 0x1302, 0x1402),
-  },
-  {     .channel                = 190,
-        .freq                   = 4950, /* MHz */
-        .unk2                   = 3300,
-        RADIOREGS(0x71, 0x01, 0xEF, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xEE, 0xEE, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xC007, 0xBC07, 0xB807, 0x1102, 0x1202, 0x1302),
-  },
-  {     .channel                = 192,
-        .freq                   = 4960, /* MHz */
-        .unk2                   = 3307,
-        RADIOREGS(0x71, 0x01, 0xF0, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xEE, 0xEE, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xC407, 0xC007, 0xBC07, 0x0F02, 0x1102, 0x1202),
-  },
-  {     .channel                = 194,
-        .freq                   = 4970, /* MHz */
-        .unk2                   = 3313,
-        RADIOREGS(0x71, 0x01, 0xF1, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xEE, 0xEE, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xC807, 0xC407, 0xC007, 0x0E02, 0x0F02, 0x1102),
-  },
-  {     .channel                = 196,
-        .freq                   = 4980, /* MHz */
-        .unk2                   = 3320,
-        RADIOREGS(0x71, 0x01, 0xF2, 0x0E, 0xFF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xDD, 0xDD, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xCC07, 0xC807, 0xC407, 0x0D02, 0x0E02, 0x0F02),
-  },
-  {     .channel                = 198,
-        .freq                   = 4990, /* MHz */
-        .unk2                   = 3327,
-        RADIOREGS(0x71, 0x01, 0xF3, 0x0E, 0xFF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xDD, 0xDD, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xD007, 0xCC07, 0xC807, 0x0C02, 0x0D02, 0x0E02),
-  },
-  {     .channel                = 200,
-        .freq                   = 5000, /* MHz */
-        .unk2                   = 3333,
-        RADIOREGS(0x71, 0x01, 0xF4, 0x0E, 0xFF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xDD, 0xDD, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xD407, 0xD007, 0xCC07, 0x0B02, 0x0C02, 0x0D02),
-  },
-  {     .channel                = 202,
-        .freq                   = 5010, /* MHz */
-        .unk2                   = 3340,
-        RADIOREGS(0x71, 0x01, 0xF5, 0x0E, 0xFF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xDD, 0xDD, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xD807, 0xD407, 0xD007, 0x0A02, 0x0B02, 0x0C02),
-  },
-  {     .channel                = 204,
-        .freq                   = 5020, /* MHz */
-        .unk2                   = 3347,
-        RADIOREGS(0x71, 0x01, 0xF6, 0x0E, 0xF7, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xCC, 0xCC, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xDC07, 0xD807, 0xD407, 0x0902, 0x0A02, 0x0B02),
-  },
-  {     .channel                = 206,
-        .freq                   = 5030, /* MHz */
-        .unk2                   = 3353,
-        RADIOREGS(0x71, 0x01, 0xF7, 0x0E, 0xF7, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xCC, 0xCC, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xE007, 0xDC07, 0xD807, 0x0802, 0x0902, 0x0A02),
-  },
-  {     .channel                = 208,
-        .freq                   = 5040, /* MHz */
-        .unk2                   = 3360,
-        RADIOREGS(0x71, 0x01, 0xF8, 0x0D, 0xEF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xCC, 0xCC, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xE407, 0xE007, 0xDC07, 0x0702, 0x0802, 0x0902),
-  },
-  {     .channel                = 210,
-        .freq                   = 5050, /* MHz */
-        .unk2                   = 3367,
-        RADIOREGS(0x71, 0x01, 0xF9, 0x0D, 0xEF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xCC, 0xCC, 0xFF, 0x00, 0x0F, 0x0F,
-                  0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xE807, 0xE407, 0xE007, 0x0602, 0x0702, 0x0802),
-  },
-  {     .channel                = 212,
-        .freq                   = 5060, /* MHz */
-        .unk2                   = 3373,
-        RADIOREGS(0x71, 0x01, 0xFA, 0x0D, 0xE6, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xBB, 0xBB, 0xFF, 0x00, 0x0E, 0x0F,
-                  0x8E, 0xFF, 0x00, 0x0E, 0x0F, 0x8E),
-        PHYREGS(0xEC07, 0xE807, 0xE407, 0x0502, 0x0602, 0x0702),
-  },
-  {     .channel                = 214,
-        .freq                   = 5070, /* MHz */
-        .unk2                   = 3380,
-        RADIOREGS(0x71, 0x01, 0xFB, 0x0D, 0xE6, 0x01, 0x04, 0x0A,
-                  0x00, 0x8F, 0xBB, 0xBB, 0xFF, 0x00, 0x0E, 0x0F,
-                  0x8E, 0xFF, 0x00, 0x0E, 0x0F, 0x8E),
-        PHYREGS(0xF007, 0xEC07, 0xE807, 0x0402, 0x0502, 0x0602),
-  },
-  {     .channel                = 216,
-        .freq                   = 5080, /* MHz */
-        .unk2                   = 3387,
-        RADIOREGS(0x71, 0x01, 0xFC, 0x0D, 0xDE, 0x01, 0x04, 0x0A,
-                  0x00, 0x8E, 0xBB, 0xBB, 0xEE, 0x00, 0x0E, 0x0F,
-                  0x8D, 0xEE, 0x00, 0x0E, 0x0F, 0x8D),
-        PHYREGS(0xF407, 0xF007, 0xEC07, 0x0302, 0x0402, 0x0502),
-  },
-  {     .channel                = 218,
-        .freq                   = 5090, /* MHz */
-        .unk2                   = 3393,
-        RADIOREGS(0x71, 0x01, 0xFD, 0x0D, 0xDE, 0x01, 0x04, 0x0A,
-                  0x00, 0x8E, 0xBB, 0xBB, 0xEE, 0x00, 0x0E, 0x0F,
-                  0x8D, 0xEE, 0x00, 0x0E, 0x0F, 0x8D),
-        PHYREGS(0xF807, 0xF407, 0xF007, 0x0202, 0x0302, 0x0402),
-  },
-  {     .channel                = 220,
-        .freq                   = 5100, /* MHz */
-        .unk2                   = 3400,
-        RADIOREGS(0x71, 0x01, 0xFE, 0x0C, 0xD6, 0x01, 0x04, 0x0A,
-                  0x00, 0x8E, 0xAA, 0xAA, 0xEE, 0x00, 0x0D, 0x0F,
-                  0x8D, 0xEE, 0x00, 0x0D, 0x0F, 0x8D),
-        PHYREGS(0xFC07, 0xF807, 0xF407, 0x0102, 0x0202, 0x0302),
-  },
-  {     .channel                = 222,
-        .freq                   = 5110, /* MHz */
-        .unk2                   = 3407,
-        RADIOREGS(0x71, 0x01, 0xFF, 0x0C, 0xD6, 0x01, 0x04, 0x0A,
-                  0x00, 0x8E, 0xAA, 0xAA, 0xEE, 0x00, 0x0D, 0x0F,
-                  0x8D, 0xEE, 0x00, 0x0D, 0x0F, 0x8D),
-        PHYREGS(0x0008, 0xFC07, 0xF807, 0x0002, 0x0102, 0x0202),
-  },
-  {     .channel                = 224,
-        .freq                   = 5120, /* MHz */
-        .unk2                   = 3413,
-        RADIOREGS(0x71, 0x02, 0x00, 0x0C, 0xCE, 0x01, 0x04, 0x0A,
-                  0x00, 0x8D, 0xAA, 0xAA, 0xDD, 0x00, 0x0D, 0x0F,
-                  0x8C, 0xDD, 0x00, 0x0D, 0x0F, 0x8C),
-        PHYREGS(0x0408, 0x0008, 0xFC07, 0xFF01, 0x0002, 0x0102),
-  },
-  {     .channel                = 226,
-        .freq                   = 5130, /* MHz */
-        .unk2                   = 3420,
-        RADIOREGS(0x71, 0x02, 0x01, 0x0C, 0xCE, 0x01, 0x04, 0x0A,
-                  0x00, 0x8D, 0xAA, 0xAA, 0xDD, 0x00, 0x0D, 0x0F,
-                  0x8C, 0xDD, 0x00, 0x0D, 0x0F, 0x8C),
-        PHYREGS(0x0808, 0x0408, 0x0008, 0xFE01, 0xFF01, 0x0002),
-  },
-  {     .channel                = 228,
-        .freq                   = 5140, /* MHz */
-        .unk2                   = 3427,
-        RADIOREGS(0x71, 0x02, 0x02, 0x0C, 0xC6, 0x01, 0x04, 0x0A,
-                  0x00, 0x8D, 0x99, 0x99, 0xDD, 0x00, 0x0C, 0x0E,
-                  0x8B, 0xDD, 0x00, 0x0C, 0x0E, 0x8B),
-        PHYREGS(0x0C08, 0x0808, 0x0408, 0xFD01, 0xFE01, 0xFF01),
-  },
-  {     .channel                = 32,
-        .freq                   = 5160, /* MHz */
-        .unk2                   = 3440,
-        RADIOREGS(0x71, 0x02, 0x04, 0x0B, 0xBE, 0x01, 0x04, 0x0A,
-                  0x00, 0x8C, 0x99, 0x99, 0xCC, 0x00, 0x0B, 0x0D,
-                  0x8A, 0xCC, 0x00, 0x0B, 0x0D, 0x8A),
-        PHYREGS(0x1408, 0x1008, 0x0C08, 0xFB01, 0xFC01, 0xFD01),
-  },
-  {     .channel                = 34,
-        .freq                   = 5170, /* MHz */
-        .unk2                   = 3447,
-        RADIOREGS(0x71, 0x02, 0x05, 0x0B, 0xBE, 0x01, 0x04, 0x0A,
-                  0x00, 0x8C, 0x99, 0x99, 0xCC, 0x00, 0x0B, 0x0D,
-                  0x8A, 0xCC, 0x00, 0x0B, 0x0D, 0x8A),
-        PHYREGS(0x1808, 0x1408, 0x1008, 0xFA01, 0xFB01, 0xFC01),
-  },
-  {     .channel                = 36,
-        .freq                   = 5180, /* MHz */
-        .unk2                   = 3453,
-        RADIOREGS(0x71, 0x02, 0x06, 0x0B, 0xB6, 0x01, 0x04, 0x0A,
-                  0x00, 0x8C, 0x88, 0x88, 0xCC, 0x00, 0x0B, 0x0C,
-                  0x89, 0xCC, 0x00, 0x0B, 0x0C, 0x89),
-        PHYREGS(0x1C08, 0x1808, 0x1408, 0xF901, 0xFA01, 0xFB01),
-  },
-  {     .channel                = 38,
-        .freq                   = 5190, /* MHz */
-        .unk2                   = 3460,
-        RADIOREGS(0x71, 0x02, 0x07, 0x0B, 0xB6, 0x01, 0x04, 0x0A,
-                  0x00, 0x8C, 0x88, 0x88, 0xCC, 0x00, 0x0B, 0x0C,
-                  0x89, 0xCC, 0x00, 0x0B, 0x0C, 0x89),
-        PHYREGS(0x2008, 0x1C08, 0x1808, 0xF801, 0xF901, 0xFA01),
-  },
-  {     .channel                = 40,
-        .freq                   = 5200, /* MHz */
-        .unk2                   = 3467,
-        RADIOREGS(0x71, 0x02, 0x08, 0x0B, 0xAF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8B, 0x88, 0x88, 0xBB, 0x00, 0x0A, 0x0B,
-                  0x89, 0xBB, 0x00, 0x0A, 0x0B, 0x89),
-        PHYREGS(0x2408, 0x2008, 0x1C08, 0xF701, 0xF801, 0xF901),
-  },
-  {     .channel                = 42,
-        .freq                   = 5210, /* MHz */
-        .unk2                   = 3473,
-        RADIOREGS(0x71, 0x02, 0x09, 0x0B, 0xAF, 0x01, 0x04, 0x0A,
-                  0x00, 0x8B, 0x88, 0x88, 0xBB, 0x00, 0x0A, 0x0B,
-                  0x89, 0xBB, 0x00, 0x0A, 0x0B, 0x89),
-        PHYREGS(0x2808, 0x2408, 0x2008, 0xF601, 0xF701, 0xF801),
-  },
-  {     .channel                = 44,
-        .freq                   = 5220, /* MHz */
-        .unk2                   = 3480,
-        RADIOREGS(0x71, 0x02, 0x0A, 0x0A, 0xA7, 0x01, 0x04, 0x0A,
-                  0x00, 0x8B, 0x77, 0x77, 0xBB, 0x00, 0x09, 0x0A,
-                  0x88, 0xBB, 0x00, 0x09, 0x0A, 0x88),
-        PHYREGS(0x2C08, 0x2808, 0x2408, 0xF501, 0xF601, 0xF701),
-  },
-  {     .channel                = 46,
-        .freq                   = 5230, /* MHz */
-        .unk2                   = 3487,
-        RADIOREGS(0x71, 0x02, 0x0B, 0x0A, 0xA7, 0x01, 0x04, 0x0A,
-                  0x00, 0x8B, 0x77, 0x77, 0xBB, 0x00, 0x09, 0x0A,
-                  0x88, 0xBB, 0x00, 0x09, 0x0A, 0x88),
-        PHYREGS(0x3008, 0x2C08, 0x2808, 0xF401, 0xF501, 0xF601),
-  },
-  {     .channel                = 48,
-        .freq                   = 5240, /* MHz */
-        .unk2                   = 3493,
-        RADIOREGS(0x71, 0x02, 0x0C, 0x0A, 0xA0, 0x01, 0x04, 0x0A,
-                  0x00, 0x8A, 0x77, 0x77, 0xAA, 0x00, 0x09, 0x0A,
-                  0x87, 0xAA, 0x00, 0x09, 0x0A, 0x87),
-        PHYREGS(0x3408, 0x3008, 0x2C08, 0xF301, 0xF401, 0xF501),
-  },
-  {     .channel                = 50,
-        .freq                   = 5250, /* MHz */
-        .unk2                   = 3500,
-        RADIOREGS(0x71, 0x02, 0x0D, 0x0A, 0xA0, 0x01, 0x04, 0x0A,
-                  0x00, 0x8A, 0x77, 0x77, 0xAA, 0x00, 0x09, 0x0A,
-                  0x87, 0xAA, 0x00, 0x09, 0x0A, 0x87),
-        PHYREGS(0x3808, 0x3408, 0x3008, 0xF201, 0xF301, 0xF401),
-  },
-  {     .channel                = 52,
-        .freq                   = 5260, /* MHz */
-        .unk2                   = 3507,
-        RADIOREGS(0x71, 0x02, 0x0E, 0x0A, 0x98, 0x01, 0x04, 0x0A,
-                  0x00, 0x8A, 0x66, 0x66, 0xAA, 0x00, 0x08, 0x09,
-                  0x87, 0xAA, 0x00, 0x08, 0x09, 0x87),
-        PHYREGS(0x3C08, 0x3808, 0x3408, 0xF101, 0xF201, 0xF301),
-  },
-  {     .channel                = 54,
-        .freq                   = 5270, /* MHz */
-        .unk2                   = 3513,
-        RADIOREGS(0x71, 0x02, 0x0F, 0x0A, 0x98, 0x01, 0x04, 0x0A,
-                  0x00, 0x8A, 0x66, 0x66, 0xAA, 0x00, 0x08, 0x09,
-                  0x87, 0xAA, 0x00, 0x08, 0x09, 0x87),
-        PHYREGS(0x4008, 0x3C08, 0x3808, 0xF001, 0xF101, 0xF201),
-  },
-  {     .channel                = 56,
-        .freq                   = 5280, /* MHz */
-        .unk2                   = 3520,
-        RADIOREGS(0x71, 0x02, 0x10, 0x09, 0x91, 0x01, 0x04, 0x0A,
-                  0x00, 0x89, 0x66, 0x66, 0x99, 0x00, 0x08, 0x08,
-                  0x86, 0x99, 0x00, 0x08, 0x08, 0x86),
-        PHYREGS(0x4408, 0x4008, 0x3C08, 0xF001, 0xF001, 0xF101),
-  },
-  {     .channel                = 58,
-        .freq                   = 5290, /* MHz */
-        .unk2                   = 3527,
-        RADIOREGS(0x71, 0x02, 0x11, 0x09, 0x91, 0x01, 0x04, 0x0A,
-                  0x00, 0x89, 0x66, 0x66, 0x99, 0x00, 0x08, 0x08,
-                  0x86, 0x99, 0x00, 0x08, 0x08, 0x86),
-        PHYREGS(0x4808, 0x4408, 0x4008, 0xEF01, 0xF001, 0xF001),
-  },
-  {     .channel                = 60,
-        .freq                   = 5300, /* MHz */
-        .unk2                   = 3533,
-        RADIOREGS(0x71, 0x02, 0x12, 0x09, 0x8A, 0x01, 0x04, 0x0A,
-                  0x00, 0x89, 0x55, 0x55, 0x99, 0x00, 0x08, 0x07,
-                  0x85, 0x99, 0x00, 0x08, 0x07, 0x85),
-        PHYREGS(0x4C08, 0x4808, 0x4408, 0xEE01, 0xEF01, 0xF001),
-  },
-  {     .channel                = 62,
-        .freq                   = 5310, /* MHz */
-        .unk2                   = 3540,
-        RADIOREGS(0x71, 0x02, 0x13, 0x09, 0x8A, 0x01, 0x04, 0x0A,
-                  0x00, 0x89, 0x55, 0x55, 0x99, 0x00, 0x08, 0x07,
-                  0x85, 0x99, 0x00, 0x08, 0x07, 0x85),
-        PHYREGS(0x5008, 0x4C08, 0x4808, 0xED01, 0xEE01, 0xEF01),
-  },
-  {     .channel                = 64,
-        .freq                   = 5320, /* MHz */
-        .unk2                   = 3547,
-        RADIOREGS(0x71, 0x02, 0x14, 0x09, 0x83, 0x01, 0x04, 0x0A,
-                  0x00, 0x88, 0x55, 0x55, 0x88, 0x00, 0x07, 0x07,
-                  0x84, 0x88, 0x00, 0x07, 0x07, 0x84),
-        PHYREGS(0x5408, 0x5008, 0x4C08, 0xEC01, 0xED01, 0xEE01),
-  },
-  {     .channel                = 66,
-        .freq                   = 5330, /* MHz */
-        .unk2                   = 3553,
-        RADIOREGS(0x71, 0x02, 0x15, 0x09, 0x83, 0x01, 0x04, 0x0A,
-                  0x00, 0x88, 0x55, 0x55, 0x88, 0x00, 0x07, 0x07,
-                  0x84, 0x88, 0x00, 0x07, 0x07, 0x84),
-        PHYREGS(0x5808, 0x5408, 0x5008, 0xEB01, 0xEC01, 0xED01),
-  },
-  {     .channel                = 68,
-        .freq                   = 5340, /* MHz */
-        .unk2                   = 3560,
-        RADIOREGS(0x71, 0x02, 0x16, 0x08, 0x7C, 0x01, 0x04, 0x0A,
-                  0x00, 0x88, 0x44, 0x44, 0x88, 0x00, 0x07, 0x06,
-                  0x84, 0x88, 0x00, 0x07, 0x06, 0x84),
-        PHYREGS(0x5C08, 0x5808, 0x5408, 0xEA01, 0xEB01, 0xEC01),
-  },
-  {     .channel                = 70,
-        .freq                   = 5350, /* MHz */
-        .unk2                   = 3567,
-        RADIOREGS(0x71, 0x02, 0x17, 0x08, 0x7C, 0x01, 0x04, 0x0A,
-                  0x00, 0x88, 0x44, 0x44, 0x88, 0x00, 0x07, 0x06,
-                  0x84, 0x88, 0x00, 0x07, 0x06, 0x84),
-        PHYREGS(0x6008, 0x5C08, 0x5808, 0xE901, 0xEA01, 0xEB01),
-  },
-  {     .channel                = 72,
-        .freq                   = 5360, /* MHz */
-        .unk2                   = 3573,
-        RADIOREGS(0x71, 0x02, 0x18, 0x08, 0x75, 0x01, 0x04, 0x0A,
-                  0x00, 0x87, 0x44, 0x44, 0x77, 0x00, 0x06, 0x05,
-                  0x83, 0x77, 0x00, 0x06, 0x05, 0x83),
-        PHYREGS(0x6408, 0x6008, 0x5C08, 0xE801, 0xE901, 0xEA01),
-  },
-  {     .channel                = 74,
-        .freq                   = 5370, /* MHz */
-        .unk2                   = 3580,
-        RADIOREGS(0x71, 0x02, 0x19, 0x08, 0x75, 0x01, 0x04, 0x0A,
-                  0x00, 0x87, 0x44, 0x44, 0x77, 0x00, 0x06, 0x05,
-                  0x83, 0x77, 0x00, 0x06, 0x05, 0x83),
-        PHYREGS(0x6808, 0x6408, 0x6008, 0xE701, 0xE801, 0xE901),
-  },
-  {     .channel                = 76,
-        .freq                   = 5380, /* MHz */
-        .unk2                   = 3587,
-        RADIOREGS(0x71, 0x02, 0x1A, 0x08, 0x6E, 0x01, 0x04, 0x0A,
-                  0x00, 0x87, 0x33, 0x33, 0x77, 0x00, 0x06, 0x04,
-                  0x82, 0x77, 0x00, 0x06, 0x04, 0x82),
-        PHYREGS(0x6C08, 0x6808, 0x6408, 0xE601, 0xE701, 0xE801),
-  },
-  {     .channel                = 78,
-        .freq                   = 5390, /* MHz */
-        .unk2                   = 3593,
-        RADIOREGS(0x71, 0x02, 0x1B, 0x08, 0x6E, 0x01, 0x04, 0x0A,
-                  0x00, 0x87, 0x33, 0x33, 0x77, 0x00, 0x06, 0x04,
-                  0x82, 0x77, 0x00, 0x06, 0x04, 0x82),
-        PHYREGS(0x7008, 0x6C08, 0x6808, 0xE501, 0xE601, 0xE701),
-  },
-  {     .channel                = 80,
-        .freq                   = 5400, /* MHz */
-        .unk2                   = 3600,
-        RADIOREGS(0x71, 0x02, 0x1C, 0x07, 0x67, 0x01, 0x04, 0x0A,
-                  0x00, 0x86, 0x33, 0x33, 0x66, 0x00, 0x05, 0x04,
-                  0x81, 0x66, 0x00, 0x05, 0x04, 0x81),
-        PHYREGS(0x7408, 0x7008, 0x6C08, 0xE501, 0xE501, 0xE601),
-  },
-  {     .channel                = 82,
-        .freq                   = 5410, /* MHz */
-        .unk2                   = 3607,
-        RADIOREGS(0x71, 0x02, 0x1D, 0x07, 0x67, 0x01, 0x04, 0x0A,
-                  0x00, 0x86, 0x33, 0x33, 0x66, 0x00, 0x05, 0x04,
-                  0x81, 0x66, 0x00, 0x05, 0x04, 0x81),
-        PHYREGS(0x7808, 0x7408, 0x7008, 0xE401, 0xE501, 0xE501),
-  },
-  {     .channel                = 84,
-        .freq                   = 5420, /* MHz */
-        .unk2                   = 3613,
-        RADIOREGS(0x71, 0x02, 0x1E, 0x07, 0x61, 0x01, 0x04, 0x0A,
-                  0x00, 0x86, 0x22, 0x22, 0x66, 0x00, 0x05, 0x03,
-                  0x80, 0x66, 0x00, 0x05, 0x03, 0x80),
-        PHYREGS(0x7C08, 0x7808, 0x7408, 0xE301, 0xE401, 0xE501),
-  },
-  {     .channel                = 86,
-        .freq                   = 5430, /* MHz */
-        .unk2                   = 3620,
-        RADIOREGS(0x71, 0x02, 0x1F, 0x07, 0x61, 0x01, 0x04, 0x0A,
-                  0x00, 0x86, 0x22, 0x22, 0x66, 0x00, 0x05, 0x03,
-                  0x80, 0x66, 0x00, 0x05, 0x03, 0x80),
-        PHYREGS(0x8008, 0x7C08, 0x7808, 0xE201, 0xE301, 0xE401),
-  },
-  {     .channel                = 88,
-        .freq                   = 5440, /* MHz */
-        .unk2                   = 3627,
-        RADIOREGS(0x71, 0x02, 0x20, 0x07, 0x5A, 0x01, 0x04, 0x0A,
-                  0x00, 0x85, 0x22, 0x22, 0x55, 0x00, 0x04, 0x02,
-                  0x80, 0x55, 0x00, 0x04, 0x02, 0x80),
-        PHYREGS(0x8408, 0x8008, 0x7C08, 0xE101, 0xE201, 0xE301),
-  },
-  {     .channel                = 90,
-        .freq                   = 5450, /* MHz */
-        .unk2                   = 3633,
-        RADIOREGS(0x71, 0x02, 0x21, 0x07, 0x5A, 0x01, 0x04, 0x0A,
-                  0x00, 0x85, 0x22, 0x22, 0x55, 0x00, 0x04, 0x02,
-                  0x80, 0x55, 0x00, 0x04, 0x02, 0x80),
-        PHYREGS(0x8808, 0x8408, 0x8008, 0xE001, 0xE101, 0xE201),
-  },
-  {     .channel                = 92,
-        .freq                   = 5460, /* MHz */
-        .unk2                   = 3640,
-        RADIOREGS(0x71, 0x02, 0x22, 0x06, 0x53, 0x01, 0x04, 0x0A,
-                  0x00, 0x85, 0x11, 0x11, 0x55, 0x00, 0x04, 0x01,
-                  0x80, 0x55, 0x00, 0x04, 0x01, 0x80),
-        PHYREGS(0x8C08, 0x8808, 0x8408, 0xDF01, 0xE001, 0xE101),
-  },
-  {     .channel                = 94,
-        .freq                   = 5470, /* MHz */
-        .unk2                   = 3647,
-        RADIOREGS(0x71, 0x02, 0x23, 0x06, 0x53, 0x01, 0x04, 0x0A,
-                  0x00, 0x85, 0x11, 0x11, 0x55, 0x00, 0x04, 0x01,
-                  0x80, 0x55, 0x00, 0x04, 0x01, 0x80),
-        PHYREGS(0x9008, 0x8C08, 0x8808, 0xDE01, 0xDF01, 0xE001),
-  },
-  {     .channel                = 96,
-        .freq                   = 5480, /* MHz */
-        .unk2                   = 3653,
-        RADIOREGS(0x71, 0x02, 0x24, 0x06, 0x4D, 0x01, 0x04, 0x0A,
-                  0x00, 0x84, 0x11, 0x11, 0x44, 0x00, 0x03, 0x00,
-                  0x80, 0x44, 0x00, 0x03, 0x00, 0x80),
-        PHYREGS(0x9408, 0x9008, 0x8C08, 0xDD01, 0xDE01, 0xDF01),
-  },
-  {     .channel                = 98,
-        .freq                   = 5490, /* MHz */
-        .unk2                   = 3660,
-        RADIOREGS(0x71, 0x02, 0x25, 0x06, 0x4D, 0x01, 0x04, 0x0A,
-                  0x00, 0x84, 0x11, 0x11, 0x44, 0x00, 0x03, 0x00,
-                  0x80, 0x44, 0x00, 0x03, 0x00, 0x80),
-        PHYREGS(0x9808, 0x9408, 0x9008, 0xDD01, 0xDD01, 0xDE01),
-  },
-  {     .channel                = 100,
-        .freq                   = 5500, /* MHz */
-        .unk2                   = 3667,
-        RADIOREGS(0x71, 0x02, 0x26, 0x06, 0x47, 0x01, 0x04, 0x0A,
-                  0x00, 0x84, 0x00, 0x00, 0x44, 0x00, 0x03, 0x00,
-                  0x80, 0x44, 0x00, 0x03, 0x00, 0x80),
-        PHYREGS(0x9C08, 0x9808, 0x9408, 0xDC01, 0xDD01, 0xDD01),
-  },
-  {     .channel                = 102,
-        .freq                   = 5510, /* MHz */
-        .unk2                   = 3673,
-        RADIOREGS(0x71, 0x02, 0x27, 0x06, 0x47, 0x01, 0x04, 0x0A,
-                  0x00, 0x84, 0x00, 0x00, 0x44, 0x00, 0x03, 0x00,
-                  0x80, 0x44, 0x00, 0x03, 0x00, 0x80),
-        PHYREGS(0xA008, 0x9C08, 0x9808, 0xDB01, 0xDC01, 0xDD01),
-  },
-  {     .channel                = 104,
-        .freq                   = 5520, /* MHz */
-        .unk2                   = 3680,
-        RADIOREGS(0x71, 0x02, 0x28, 0x05, 0x40, 0x01, 0x04, 0x0A,
-                  0x00, 0x83, 0x00, 0x00, 0x33, 0x00, 0x02, 0x00,
-                  0x80, 0x33, 0x00, 0x02, 0x00, 0x80),
-        PHYREGS(0xA408, 0xA008, 0x9C08, 0xDA01, 0xDB01, 0xDC01),
-  },
-  {     .channel                = 106,
-        .freq                   = 5530, /* MHz */
-        .unk2                   = 3687,
-        RADIOREGS(0x71, 0x02, 0x29, 0x05, 0x40, 0x01, 0x04, 0x0A,
-                  0x00, 0x83, 0x00, 0x00, 0x33, 0x00, 0x02, 0x00,
-                  0x80, 0x33, 0x00, 0x02, 0x00, 0x80),
-        PHYREGS(0xA808, 0xA408, 0xA008, 0xD901, 0xDA01, 0xDB01),
-  },
-  {     .channel                = 108,
-        .freq                   = 5540, /* MHz */
-        .unk2                   = 3693,
-        RADIOREGS(0x71, 0x02, 0x2A, 0x05, 0x3A, 0x01, 0x04, 0x0A,
-                  0x00, 0x83, 0x00, 0x00, 0x33, 0x00, 0x02, 0x00,
-                  0x80, 0x33, 0x00, 0x02, 0x00, 0x80),
-        PHYREGS(0xAC08, 0xA808, 0xA408, 0xD801, 0xD901, 0xDA01),
-  },
-  {     .channel                = 110,
-        .freq                   = 5550, /* MHz */
-        .unk2                   = 3700,
-        RADIOREGS(0x71, 0x02, 0x2B, 0x05, 0x3A, 0x01, 0x04, 0x0A,
-                  0x00, 0x83, 0x00, 0x00, 0x33, 0x00, 0x02, 0x00,
-                  0x80, 0x33, 0x00, 0x02, 0x00, 0x80),
-        PHYREGS(0xB008, 0xAC08, 0xA808, 0xD701, 0xD801, 0xD901),
-  },
-  {     .channel                = 112,
-        .freq                   = 5560, /* MHz */
-        .unk2                   = 3707,
-        RADIOREGS(0x71, 0x02, 0x2C, 0x05, 0x34, 0x01, 0x04, 0x0A,
-                  0x00, 0x82, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00,
-                  0x80, 0x22, 0x00, 0x01, 0x00, 0x80),
-        PHYREGS(0xB408, 0xB008, 0xAC08, 0xD701, 0xD701, 0xD801),
-  },
-  {     .channel                = 114,
-        .freq                   = 5570, /* MHz */
-        .unk2                   = 3713,
-        RADIOREGS(0x71, 0x02, 0x2D, 0x05, 0x34, 0x01, 0x04, 0x0A,
-                  0x00, 0x82, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00,
-                  0x80, 0x22, 0x00, 0x01, 0x00, 0x80),
-        PHYREGS(0xB808, 0xB408, 0xB008, 0xD601, 0xD701, 0xD701),
-  },
-  {     .channel                = 116,
-        .freq                   = 5580, /* MHz */
-        .unk2                   = 3720,
-        RADIOREGS(0x71, 0x02, 0x2E, 0x04, 0x2E, 0x01, 0x04, 0x0A,
-                  0x00, 0x82, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00,
-                  0x80, 0x22, 0x00, 0x01, 0x00, 0x80),
-        PHYREGS(0xBC08, 0xB808, 0xB408, 0xD501, 0xD601, 0xD701),
-  },
-  {     .channel                = 118,
-        .freq                   = 5590, /* MHz */
-        .unk2                   = 3727,
-        RADIOREGS(0x71, 0x02, 0x2F, 0x04, 0x2E, 0x01, 0x04, 0x0A,
-                  0x00, 0x82, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00,
-                  0x80, 0x22, 0x00, 0x01, 0x00, 0x80),
-        PHYREGS(0xC008, 0xBC08, 0xB808, 0xD401, 0xD501, 0xD601),
-  },
-  {     .channel                = 120,
-        .freq                   = 5600, /* MHz */
-        .unk2                   = 3733,
-        RADIOREGS(0x71, 0x02, 0x30, 0x04, 0x28, 0x01, 0x04, 0x0A,
-                  0x00, 0x81, 0x00, 0x00, 0x11, 0x00, 0x01, 0x00,
-                  0x80, 0x11, 0x00, 0x01, 0x00, 0x80),
-        PHYREGS(0xC408, 0xC008, 0xBC08, 0xD301, 0xD401, 0xD501),
-  },
-  {     .channel                = 122,
-        .freq                   = 5610, /* MHz */
-        .unk2                   = 3740,
-        RADIOREGS(0x71, 0x02, 0x31, 0x04, 0x28, 0x01, 0x04, 0x0A,
-                  0x00, 0x81, 0x00, 0x00, 0x11, 0x00, 0x01, 0x00,
-                  0x80, 0x11, 0x00, 0x01, 0x00, 0x80),
-        PHYREGS(0xC808, 0xC408, 0xC008, 0xD201, 0xD301, 0xD401),
-  },
-  {     .channel                = 124,
-        .freq                   = 5620, /* MHz */
-        .unk2                   = 3747,
-        RADIOREGS(0x71, 0x02, 0x32, 0x04, 0x21, 0x01, 0x04, 0x0A,
-                  0x00, 0x81, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00,
-                  0x80, 0x11, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xCC08, 0xC808, 0xC408, 0xD201, 0xD201, 0xD301),
-  },
-  {     .channel                = 126,
-        .freq                   = 5630, /* MHz */
-        .unk2                   = 3753,
-        RADIOREGS(0x71, 0x02, 0x33, 0x04, 0x21, 0x01, 0x04, 0x0A,
-                  0x00, 0x81, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00,
-                  0x80, 0x11, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xD008, 0xCC08, 0xC808, 0xD101, 0xD201, 0xD201),
-  },
-  {     .channel                = 128,
-        .freq                   = 5640, /* MHz */
-        .unk2                   = 3760,
-        RADIOREGS(0x71, 0x02, 0x34, 0x03, 0x1C, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xD408, 0xD008, 0xCC08, 0xD001, 0xD101, 0xD201),
-  },
-  {     .channel                = 130,
-        .freq                   = 5650, /* MHz */
-        .unk2                   = 3767,
-        RADIOREGS(0x71, 0x02, 0x35, 0x03, 0x1C, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xD808, 0xD408, 0xD008, 0xCF01, 0xD001, 0xD101),
-  },
-  {     .channel                = 132,
-        .freq                   = 5660, /* MHz */
-        .unk2                   = 3773,
-        RADIOREGS(0x71, 0x02, 0x36, 0x03, 0x16, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xDC08, 0xD808, 0xD408, 0xCE01, 0xCF01, 0xD001),
-  },
-  {     .channel                = 134,
-        .freq                   = 5670, /* MHz */
-        .unk2                   = 3780,
-        RADIOREGS(0x71, 0x02, 0x37, 0x03, 0x16, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xE008, 0xDC08, 0xD808, 0xCE01, 0xCE01, 0xCF01),
-  },
-  {     .channel                = 136,
-        .freq                   = 5680, /* MHz */
-        .unk2                   = 3787,
-        RADIOREGS(0x71, 0x02, 0x38, 0x03, 0x10, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xE408, 0xE008, 0xDC08, 0xCD01, 0xCE01, 0xCE01),
-  },
-  {     .channel                = 138,
-        .freq                   = 5690, /* MHz */
-        .unk2                   = 3793,
-        RADIOREGS(0x71, 0x02, 0x39, 0x03, 0x10, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xE808, 0xE408, 0xE008, 0xCC01, 0xCD01, 0xCE01),
-  },
-  {     .channel                = 140,
-        .freq                   = 5700, /* MHz */
-        .unk2                   = 3800,
-        RADIOREGS(0x71, 0x02, 0x3A, 0x02, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xEC08, 0xE808, 0xE408, 0xCB01, 0xCC01, 0xCD01),
-  },
-  {     .channel                = 142,
-        .freq                   = 5710, /* MHz */
-        .unk2                   = 3807,
-        RADIOREGS(0x71, 0x02, 0x3B, 0x02, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xF008, 0xEC08, 0xE808, 0xCA01, 0xCB01, 0xCC01),
-  },
-  {     .channel                = 144,
-        .freq                   = 5720, /* MHz */
-        .unk2                   = 3813,
-        RADIOREGS(0x71, 0x02, 0x3C, 0x02, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xF408, 0xF008, 0xEC08, 0xC901, 0xCA01, 0xCB01),
-  },
-  {     .channel                = 145,
-        .freq                   = 5725, /* MHz */
-        .unk2                   = 3817,
-        RADIOREGS(0x72, 0x04, 0x79, 0x02, 0x03, 0x01, 0x03, 0x14,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xF608, 0xF208, 0xEE08, 0xC901, 0xCA01, 0xCB01),
-  },
-  {     .channel                = 146,
-        .freq                   = 5730, /* MHz */
-        .unk2                   = 3820,
-        RADIOREGS(0x71, 0x02, 0x3D, 0x02, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xF808, 0xF408, 0xF008, 0xC901, 0xC901, 0xCA01),
-  },
-  {     .channel                = 147,
-        .freq                   = 5735, /* MHz */
-        .unk2                   = 3823,
-        RADIOREGS(0x72, 0x04, 0x7B, 0x02, 0x03, 0x01, 0x03, 0x14,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xFA08, 0xF608, 0xF208, 0xC801, 0xC901, 0xCA01),
-  },
-  {     .channel                = 148,
-        .freq                   = 5740, /* MHz */
-        .unk2                   = 3827,
-        RADIOREGS(0x71, 0x02, 0x3E, 0x02, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xFC08, 0xF808, 0xF408, 0xC801, 0xC901, 0xC901),
-  },
-  {     .channel                = 149,
-        .freq                   = 5745, /* MHz */
-        .unk2                   = 3830,
-        RADIOREGS(0x72, 0x04, 0x7D, 0x02, 0xFE, 0x00, 0x03, 0x14,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xFE08, 0xFA08, 0xF608, 0xC801, 0xC801, 0xC901),
-  },
-  {     .channel                = 150,
-        .freq                   = 5750, /* MHz */
-        .unk2                   = 3833,
-        RADIOREGS(0x71, 0x02, 0x3F, 0x02, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0009, 0xFC08, 0xF808, 0xC701, 0xC801, 0xC901),
-  },
-  {     .channel                = 151,
-        .freq                   = 5755, /* MHz */
-        .unk2                   = 3837,
-        RADIOREGS(0x72, 0x04, 0x7F, 0x02, 0xFE, 0x00, 0x03, 0x14,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0209, 0xFE08, 0xFA08, 0xC701, 0xC801, 0xC801),
-  },
-  {     .channel                = 152,
-        .freq                   = 5760, /* MHz */
-        .unk2                   = 3840,
-        RADIOREGS(0x71, 0x02, 0x40, 0x02, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0409, 0x0009, 0xFC08, 0xC601, 0xC701, 0xC801),
-  },
-  {     .channel                = 153,
-        .freq                   = 5765, /* MHz */
-        .unk2                   = 3843,
-        RADIOREGS(0x72, 0x04, 0x81, 0x02, 0xF8, 0x00, 0x03, 0x14,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0609, 0x0209, 0xFE08, 0xC601, 0xC701, 0xC801),
-  },
-  {     .channel                = 154,
-        .freq                   = 5770, /* MHz */
-        .unk2                   = 3847,
-        RADIOREGS(0x71, 0x02, 0x41, 0x02, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0809, 0x0409, 0x0009, 0xC601, 0xC601, 0xC701),
-  },
-  {     .channel                = 155,
-        .freq                   = 5775, /* MHz */
-        .unk2                   = 3850,
-        RADIOREGS(0x72, 0x04, 0x83, 0x02, 0xF8, 0x00, 0x03, 0x14,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0A09, 0x0609, 0x0209, 0xC501, 0xC601, 0xC701),
-  },
-  {     .channel                = 156,
-        .freq                   = 5780, /* MHz */
-        .unk2                   = 3853,
-        RADIOREGS(0x71, 0x02, 0x42, 0x02, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0C09, 0x0809, 0x0409, 0xC501, 0xC601, 0xC601),
-  },
-  {     .channel                = 157,
-        .freq                   = 5785, /* MHz */
-        .unk2                   = 3857,
-        RADIOREGS(0x72, 0x04, 0x85, 0x02, 0xF2, 0x00, 0x03, 0x14,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0E09, 0x0A09, 0x0609, 0xC401, 0xC501, 0xC601),
-  },
-  {     .channel                = 158,
-        .freq                   = 5790, /* MHz */
-        .unk2                   = 3860,
-        RADIOREGS(0x71, 0x02, 0x43, 0x02, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1009, 0x0C09, 0x0809, 0xC401, 0xC501, 0xC601),
-  },
-  {     .channel                = 159,
-        .freq                   = 5795, /* MHz */
-        .unk2                   = 3863,
-        RADIOREGS(0x72, 0x04, 0x87, 0x02, 0xF2, 0x00, 0x03, 0x14,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1209, 0x0E09, 0x0A09, 0xC401, 0xC401, 0xC501),
-  },
-  {     .channel                = 160,
-        .freq                   = 5800, /* MHz */
-        .unk2                   = 3867,
-        RADIOREGS(0x71, 0x02, 0x44, 0x01, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1409, 0x1009, 0x0C09, 0xC301, 0xC401, 0xC501),
-  },
-  {     .channel                = 161,
-        .freq                   = 5805, /* MHz */
-        .unk2                   = 3870,
-        RADIOREGS(0x72, 0x04, 0x89, 0x01, 0xED, 0x00, 0x03, 0x14,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1609, 0x1209, 0x0E09, 0xC301, 0xC401, 0xC401),
-  },
-  {     .channel                = 162,
-        .freq                   = 5810, /* MHz */
-        .unk2                   = 3873,
-        RADIOREGS(0x71, 0x02, 0x45, 0x01, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1809, 0x1409, 0x1009, 0xC201, 0xC301, 0xC401),
-  },
-  {     .channel                = 163,
-        .freq                   = 5815, /* MHz */
-        .unk2                   = 3877,
-        RADIOREGS(0x72, 0x04, 0x8B, 0x01, 0xED, 0x00, 0x03, 0x14,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1A09, 0x1609, 0x1209, 0xC201, 0xC301, 0xC401),
-  },
-  {     .channel                = 164,
-        .freq                   = 5820, /* MHz */
-        .unk2                   = 3880,
-        RADIOREGS(0x71, 0x02, 0x46, 0x01, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1C09, 0x1809, 0x1409, 0xC201, 0xC201, 0xC301),
-  },
-  {     .channel                = 165,
-        .freq                   = 5825, /* MHz */
-        .unk2                   = 3883,
-        RADIOREGS(0x72, 0x04, 0x8D, 0x01, 0xED, 0x00, 0x03, 0x14,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1E09, 0x1A09, 0x1609, 0xC101, 0xC201, 0xC301),
-  },
-  {     .channel                = 166,
-        .freq                   = 5830, /* MHz */
-        .unk2                   = 3887,
-        RADIOREGS(0x71, 0x02, 0x47, 0x01, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x2009, 0x1C09, 0x1809, 0xC101, 0xC201, 0xC201),
-  },
-  {     .channel                = 168,
-        .freq                   = 5840, /* MHz */
-        .unk2                   = 3893,
-        RADIOREGS(0x71, 0x02, 0x48, 0x01, 0x0A, 0x01, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x2409, 0x2009, 0x1C09, 0xC001, 0xC101, 0xC201),
-  },
-  {     .channel                = 170,
-        .freq                   = 5850, /* MHz */
-        .unk2                   = 3900,
-        RADIOREGS(0x71, 0x02, 0x49, 0x01, 0xE0, 0x00, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x2809, 0x2409, 0x2009, 0xBF01, 0xC001, 0xC101),
-  },
-  {     .channel                = 172,
-        .freq                   = 5860, /* MHz */
-        .unk2                   = 3907,
-        RADIOREGS(0x71, 0x02, 0x4A, 0x01, 0xDE, 0x00, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x2C09, 0x2809, 0x2409, 0xBF01, 0xBF01, 0xC001),
-  },
-  {     .channel                = 174,
-        .freq                   = 5870, /* MHz */
-        .unk2                   = 3913,
-        RADIOREGS(0x71, 0x02, 0x4B, 0x00, 0xDB, 0x00, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x3009, 0x2C09, 0x2809, 0xBE01, 0xBF01, 0xBF01),
-  },
-  {     .channel                = 176,
-        .freq                   = 5880, /* MHz */
-        .unk2                   = 3920,
-        RADIOREGS(0x71, 0x02, 0x4C, 0x00, 0xD8, 0x00, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x3409, 0x3009, 0x2C09, 0xBD01, 0xBE01, 0xBF01),
-  },
-  {     .channel                = 178,
-        .freq                   = 5890, /* MHz */
-        .unk2                   = 3927,
-        RADIOREGS(0x71, 0x02, 0x4D, 0x00, 0xD6, 0x00, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x3809, 0x3409, 0x3009, 0xBC01, 0xBD01, 0xBE01),
-  },
-  {     .channel                = 180,
-        .freq                   = 5900, /* MHz */
-        .unk2                   = 3933,
-        RADIOREGS(0x71, 0x02, 0x4E, 0x00, 0xD3, 0x00, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x3C09, 0x3809, 0x3409, 0xBC01, 0xBC01, 0xBD01),
-  },
-  {     .channel                = 182,
-        .freq                   = 5910, /* MHz */
-        .unk2                   = 3940,
-        RADIOREGS(0x71, 0x02, 0x4F, 0x00, 0xD6, 0x00, 0x04, 0x0A,
-                  0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                  0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x4009, 0x3C09, 0x3809, 0xBB01, 0xBC01, 0xBC01),
-  },
-  {     .channel                = 1,
-        .freq                   = 2412, /* MHz */
-        .unk2                   = 3216,
-        RADIOREGS(0x73, 0x09, 0x6C, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0D, 0x0C,
-                  0x80, 0xFF, 0x88, 0x0D, 0x0C, 0x80),
-        PHYREGS(0xC903, 0xC503, 0xC103, 0x3A04, 0x3F04, 0x4304),
-  },
-  {     .channel                = 2,
-        .freq                   = 2417, /* MHz */
-        .unk2                   = 3223,
-        RADIOREGS(0x73, 0x09, 0x71, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0C, 0x0B,
-                  0x80, 0xFF, 0x88, 0x0C, 0x0B, 0x80),
-        PHYREGS(0xCB03, 0xC703, 0xC303, 0x3804, 0x3D04, 0x4104),
-  },
-  {     .channel                = 3,
-        .freq                   = 2422, /* MHz */
-        .unk2                   = 3229,
-        RADIOREGS(0x73, 0x09, 0x76, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0C, 0x0A,
-                  0x80, 0xFF, 0x88, 0x0C, 0x0A, 0x80),
-        PHYREGS(0xCD03, 0xC903, 0xC503, 0x3604, 0x3A04, 0x3F04),
-  },
-  {     .channel                = 4,
-        .freq                   = 2427, /* MHz */
-        .unk2                   = 3236,
-        RADIOREGS(0x73, 0x09, 0x7B, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0C, 0x0A,
-                  0x80, 0xFF, 0x88, 0x0C, 0x0A, 0x80),
-        PHYREGS(0xCF03, 0xCB03, 0xC703, 0x3404, 0x3804, 0x3D04),
-  },
-  {     .channel                = 5,
-        .freq                   = 2432, /* MHz */
-        .unk2                   = 3243,
-        RADIOREGS(0x73, 0x09, 0x80, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0C, 0x09,
-                  0x80, 0xFF, 0x88, 0x0C, 0x09, 0x80),
-        PHYREGS(0xD103, 0xCD03, 0xC903, 0x3104, 0x3604, 0x3A04),
-  },
-  {     .channel                = 6,
-        .freq                   = 2437, /* MHz */
-        .unk2                   = 3249,
-        RADIOREGS(0x73, 0x09, 0x85, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0B, 0x08,
-                  0x80, 0xFF, 0x88, 0x0B, 0x08, 0x80),
-        PHYREGS(0xD303, 0xCF03, 0xCB03, 0x2F04, 0x3404, 0x3804),
-  },
-  {     .channel                = 7,
-        .freq                   = 2442, /* MHz */
-        .unk2                   = 3256,
-        RADIOREGS(0x73, 0x09, 0x8A, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0A, 0x07,
-                  0x80, 0xFF, 0x88, 0x0A, 0x07, 0x80),
-        PHYREGS(0xD503, 0xD103, 0xCD03, 0x2D04, 0x3104, 0x3604),
-  },
-  {     .channel                = 8,
-        .freq                   = 2447, /* MHz */
-        .unk2                   = 3263,
-        RADIOREGS(0x73, 0x09, 0x8F, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0A, 0x06,
-                  0x80, 0xFF, 0x88, 0x0A, 0x06, 0x80),
-        PHYREGS(0xD703, 0xD303, 0xCF03, 0x2B04, 0x2F04, 0x3404),
-  },
-  {     .channel                = 9,
-        .freq                   = 2452, /* MHz */
-        .unk2                   = 3269,
-        RADIOREGS(0x73, 0x09, 0x94, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x09, 0x06,
-                  0x80, 0xFF, 0x88, 0x09, 0x06, 0x80),
-        PHYREGS(0xD903, 0xD503, 0xD103, 0x2904, 0x2D04, 0x3104),
-  },
-  {     .channel                = 10,
-        .freq                   = 2457, /* MHz */
-        .unk2                   = 3276,
-        RADIOREGS(0x73, 0x09, 0x99, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x08, 0x05,
-                  0x80, 0xFF, 0x88, 0x08, 0x05, 0x80),
-        PHYREGS(0xDB03, 0xD703, 0xD303, 0x2704, 0x2B04, 0x2F04),
-  },
-  {     .channel                = 11,
-        .freq                   = 2462, /* MHz */
-        .unk2                   = 3283,
-        RADIOREGS(0x73, 0x09, 0x9E, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x08, 0x04,
-                  0x80, 0xFF, 0x88, 0x08, 0x04, 0x80),
-        PHYREGS(0xDD03, 0xD903, 0xD503, 0x2404, 0x2904, 0x2D04),
-  },
-  {     .channel                = 12,
-        .freq                   = 2467, /* MHz */
-        .unk2                   = 3289,
-        RADIOREGS(0x73, 0x09, 0xA3, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x08, 0x03,
-                  0x80, 0xFF, 0x88, 0x08, 0x03, 0x80),
-        PHYREGS(0xDF03, 0xDB03, 0xD703, 0x2204, 0x2704, 0x2B04),
-  },
-  {     .channel                = 13,
-        .freq                   = 2472, /* MHz */
-        .unk2                   = 3296,
-        RADIOREGS(0x73, 0x09, 0xA8, 0x0F, 0x00, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x07, 0x03,
-                  0x80, 0xFF, 0x88, 0x07, 0x03, 0x80),
-        PHYREGS(0xE103, 0xDD03, 0xD903, 0x2004, 0x2404, 0x2904),
-  },
-  {     .channel                = 14,
-        .freq                   = 2484, /* MHz */
-        .unk2                   = 3312,
-        RADIOREGS(0x73, 0x09, 0xB4, 0x0F, 0xFF, 0x01, 0x07, 0x15,
-                  0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x07, 0x01,
-                  0x80, 0xFF, 0x88, 0x07, 0x01, 0x80),
-        PHYREGS(0xE603, 0xE203, 0xDE03, 0x1B04, 0x1F04, 0x2404),
-  },
-};
-
-const struct b43_nphy_channeltab_entry_rev2 *
-b43_nphy_get_chantabent_rev2(struct b43_wldev *dev, u8 channel)
-{
-        const struct b43_nphy_channeltab_entry_rev2 *e;
-        unsigned int i;
-
-        for (i = 0; i < ARRAY_SIZE(b43_nphy_channeltab); i++) {
-                e = &(b43_nphy_channeltab[i]);
-                if (e->channel == channel)
-                        return e;
-        }
-
-        return NULL;
-}
-
-
 static const u8 b43_ntab_adjustpower0[] = {
         0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01,
         0x02, 0x02, 0x02, 0x02, 0x03, 0x03, 0x03, 0x03,
diff --git a/drivers/net/wireless/b43/tables_nphy.h b/drivers/net/wireless/b43/tables_nphy.h
index 8fc1da9f8fe5..4ec593ba3eef 100644
--- a/drivers/net/wireless/b43/tables_nphy.h
+++ b/drivers/net/wireless/b43/tables_nphy.h
@@ -3,7 +3,6 @@
 
 #include <linux/types.h>
 
-
 struct b43_phy_n_sfo_cfg {
         u16 phy_bw1a;
         u16 phy_bw2;
@@ -13,52 +12,6 @@ struct b43_phy_n_sfo_cfg {
         u16 phy_bw6;
 };
 
-struct b43_nphy_channeltab_entry_rev2 {
-        /* The channel number */
-        u8 channel;
-        /* The channel frequency in MHz */
-        u16 freq;
-        /* An unknown value */
-        u16 unk2;
-        /* Radio register values on channelswitch */
-        u8 radio_pll_ref;
-        u8 radio_rf_pllmod0;
-        u8 radio_rf_pllmod1;
-        u8 radio_vco_captail;
-        u8 radio_vco_cal1;
-        u8 radio_vco_cal2;
-        u8 radio_pll_lfc1;
-        u8 radio_pll_lfr1;
-        u8 radio_pll_lfc2;
-        u8 radio_lgbuf_cenbuf;
-        u8 radio_lgen_tune1;
-        u8 radio_lgen_tune2;
-        u8 radio_c1_lgbuf_atune;
-        u8 radio_c1_lgbuf_gtune;
-        u8 radio_c1_rx_rfr1;
-        u8 radio_c1_tx_pgapadtn;
-        u8 radio_c1_tx_mxbgtrim;
-        u8 radio_c2_lgbuf_atune;
-        u8 radio_c2_lgbuf_gtune;
-        u8 radio_c2_rx_rfr1;
-        u8 radio_c2_tx_pgapadtn;
-        u8 radio_c2_tx_mxbgtrim;
-        /* PHY register values on channelswitch */
-        struct b43_phy_n_sfo_cfg phy_regs;
-};
-
-struct b43_nphy_channeltab_entry_rev3 {
-        /* The channel number */
-        u8 channel;
-        /* The channel frequency in MHz */
-        u16 freq;
-        /* Radio register values on channelswitch */
-        /* TODO */
-        /* PHY register values on channelswitch */
-        struct b43_phy_n_sfo_cfg phy_regs;
-};
-
-
 struct b43_wldev;
 
 struct nphy_txiqcal_ladder {
@@ -82,18 +35,12 @@ struct nphy_rf_control_override_rev3 {
         u8 val_addr1;
 };
 
-/* Upload the default register value table.
- * If "ghz5" is true, we upload the 5Ghz table. Otherwise the 2.4Ghz
- * table is uploaded. If "ignore_uploadflag" is true, we upload any value
- * and ignore the "UPLOAD" flag. */
-void b2055_upload_inittab(struct b43_wldev *dev,
-                          bool ghz5, bool ignore_uploadflag);
-
-
-/* Get the NPHY Channel Switch Table entry for a channel number.
+/* Get the NPHY Channel Switch Table entry for a channel.
  * Returns NULL on failure to find an entry. */
 const struct b43_nphy_channeltab_entry_rev2 *
 b43_nphy_get_chantabent_rev2(struct b43_wldev *dev, u8 channel);
+const struct b43_nphy_channeltab_entry_rev3 *
+b43_nphy_get_chantabent_rev3(struct b43_wldev *dev, u16 freq);
 
 
 /* The N-PHY tables. */
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 0f2508384c75..8d6ed5f6f46f 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -11470,6 +11470,10 @@ static int ipw_net_init(struct net_device *dev)
                 bg_band->channels = kcalloc(geo->bg_channels,
                                             sizeof(struct ieee80211_channel),
                                             GFP_KERNEL);
+                if (!bg_band->channels) {
+                        rc = -ENOMEM;
+                        goto out;
+                }
                 /* translate geo->bg to bg_band.channels */
                 for (i = 0; i < geo->bg_channels; i++) {
                         bg_band->channels[i].band = IEEE80211_BAND_2GHZ;
@@ -11505,6 +11509,10 @@ static int ipw_net_init(struct net_device *dev)
                 a_band->channels = kcalloc(geo->a_channels,
                                            sizeof(struct ieee80211_channel),
                                            GFP_KERNEL);
+                if (!a_band->channels) {
+                        rc = -ENOMEM;
+                        goto out;
+                }
                 /* translate geo->bg to a_band.channels */
                 for (i = 0; i < geo->a_channels; i++) {
                         a_band->channels[i].band = IEEE80211_BAND_2GHZ;
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index 493163925a45..63edbe2e557f 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -12,7 +12,7 @@ obj-$(CONFIG_IWLAGN)	+= iwlagn.o
 iwlagn-objs             := iwl-agn.o iwl-agn-rs.o iwl-agn-led.o iwl-agn-ict.o
 iwlagn-objs             += iwl-agn-ucode.o iwl-agn-hcmd.o iwl-agn-tx.o
 iwlagn-objs             += iwl-agn-lib.o iwl-agn-rx.o iwl-agn-calib.o
-iwlagn-objs             += iwl-agn-tt.o
+iwlagn-objs             += iwl-agn-tt.o iwl-agn-sta.o iwl-agn-eeprom.o
 iwlagn-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-agn-debugfs.o
 
 iwlagn-$(CONFIG_IWL4965) += iwl-4965.o
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 674fb93ae17f..db540910b110 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -50,14 +50,20 @@
 
 /* Highest firmware API version supported */
 #define IWL1000_UCODE_API_MAX 3
+#define IWL100_UCODE_API_MAX 5
 
 /* Lowest firmware API version supported */
 #define IWL1000_UCODE_API_MIN 1
+#define IWL100_UCODE_API_MIN 5
 
 #define IWL1000_FW_PRE "iwlwifi-1000-"
 #define _IWL1000_MODULE_FIRMWARE(api) IWL1000_FW_PRE #api ".ucode"
 #define IWL1000_MODULE_FIRMWARE(api) _IWL1000_MODULE_FIRMWARE(api)
 
+#define IWL100_FW_PRE "iwlwifi-100-"
+#define _IWL100_MODULE_FIRMWARE(api) IWL100_FW_PRE #api ".ucode"
+#define IWL100_MODULE_FIRMWARE(api) _IWL100_MODULE_FIRMWARE(api)
+
 
 /*
  * For 1000, use advance thermal throttling critical temperature threshold,
@@ -120,13 +126,13 @@ static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
 {
         if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
             priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
-                priv->cfg->num_of_queues =
+                priv->cfg->base_params->num_of_queues =
                         priv->cfg->mod_params->num_of_queues;
 
-        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->base_params->num_of_queues;
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
-                        priv->cfg->num_of_queues *
+                        priv->cfg->base_params->num_of_queues *
                         sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWLAGN_STATION_COUNT;
@@ -145,8 +151,7 @@ static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
         priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
 
-        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
-                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
+        iwl1000_set_ct_threshold(priv);
 
         /* Set initial sensitivity parameters */
         /* Set initial calibration set */
@@ -189,9 +194,7 @@ static struct iwl_lib_ops iwl1000_lib = {
         .update_chain_flags = iwl_update_chain_flags,
         .apm_ops = {
                 .init = iwl_apm_init,
-                .stop = iwl_apm_stop,
                 .config = iwl1000_nic_config,
-                .set_pwr_src = iwl_set_pwr_src,
         },
         .eeprom_ops = {
                 .regulatory_bands = {
@@ -203,7 +206,6 @@ static struct iwl_lib_ops iwl1000_lib = {
                         EEPROM_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
-                .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
                 .calib_version  = iwlagn_eeprom_calib_version,
@@ -214,7 +216,6 @@ static struct iwl_lib_ops iwl1000_lib = {
         .config_ap = iwl_config_ap,
         .temp_ops = {
                 .temperature = iwlagn_temperature,
-                .set_ct_kill = iwl1000_set_ct_threshold,
          },
         .manage_ibss_station = iwlagn_manage_ibss_station,
         .update_bcast_stations = iwl_update_bcast_stations,
@@ -223,6 +224,7 @@ static struct iwl_lib_ops iwl1000_lib = {
                 .tx_stats_read = iwl_ucode_tx_stats_read,
                 .general_stats_read = iwl_ucode_general_stats_read,
                 .bt_stats_read = iwl_ucode_bt_stats_read,
+                .reply_tx_error = iwl_reply_tx_error_read,
         },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
@@ -243,29 +245,16 @@ static const struct iwl_ops iwl1000_ops = {
         .led = &iwlagn_led_ops,
 };
 
-struct iwl_cfg iwl1000_bgn_cfg = {
-        .name = "Intel(R) Centrino(R) Wireless-N 1000 BGN",
-        .fw_name_pre = IWL1000_FW_PRE,
-        .ucode_api_max = IWL1000_UCODE_API_MAX,
-        .ucode_api_min = IWL1000_UCODE_API_MIN,
-        .sku = IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl1000_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,
+static struct iwl_base_params iwl1000_base_params = {
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
-        .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_A,
-        .valid_rx_ant = ANT_AB,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
         .set_l0s = true,
         .use_bsm = false,
         .max_ll_items = OTP_MAX_LL_ITEMS_1000,
         .shadow_ram_support = false,
-        .ht_greenfield_support = true,
         .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
@@ -276,6 +265,26 @@ struct iwl_cfg iwl1000_bgn_cfg = {
         .sensitivity_calib_by_driver = true,
         .chain_noise_calib_by_driver = true,
 };
+static struct iwl_ht_params iwl1000_ht_params = {
+        .ht_greenfield_support = true,
+        .use_rts_for_aggregation = true, /* use rts/cts protection */
+};
+
+struct iwl_cfg iwl1000_bgn_cfg = {
+        .name = "Intel(R) Centrino(R) Wireless-N 1000 BGN",
+        .fw_name_pre = IWL1000_FW_PRE,
+        .ucode_api_max = IWL1000_UCODE_API_MAX,
+        .ucode_api_min = IWL1000_UCODE_API_MIN,
+        .sku = IWL_SKU_G|IWL_SKU_N,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_AB,
+        .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,
+        .ops = &iwl1000_ops,
+        .mod_params = &iwlagn_mod_params,
+        .base_params = &iwl1000_base_params,
+        .ht_params = &iwl1000_ht_params,
+};
 
 struct iwl_cfg iwl1000_bg_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 1000 BG",
@@ -283,30 +292,45 @@ struct iwl_cfg iwl1000_bg_cfg = {
         .ucode_api_max = IWL1000_UCODE_API_MAX,
         .ucode_api_min = IWL1000_UCODE_API_MIN,
         .sku = IWL_SKU_G,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_AB,
+        .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,
         .ops = &iwl1000_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .mod_params = &iwlagn_mod_params,
+        .base_params = &iwl1000_base_params,
+};
+
+struct iwl_cfg iwl100_bgn_cfg = {
+        .name = "Intel(R) 100 Series 1x1 BGN",
+        .fw_name_pre = IWL100_FW_PRE,
+        .ucode_api_max = IWL100_UCODE_API_MAX,
+        .ucode_api_min = IWL100_UCODE_API_MIN,
+        .sku = IWL_SKU_G|IWL_SKU_N,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_A,
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl1000_ops,
         .mod_params = &iwlagn_mod_params,
+        .base_params = &iwl1000_base_params,
+        .ht_params = &iwl1000_ht_params,
+};
+
+struct iwl_cfg iwl100_bg_cfg = {
+        .name = "Intel(R) 100 Series 1x1 BG",
+        .fw_name_pre = IWL100_FW_PRE,
+        .ucode_api_max = IWL100_UCODE_API_MAX,
+        .ucode_api_min = IWL100_UCODE_API_MIN,
+        .sku = IWL_SKU_G,
         .valid_tx_ant = ANT_A,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
-        .set_l0s = true,
-        .use_bsm = false,
-        .max_ll_items = OTP_MAX_LL_ITEMS_1000,
-        .shadow_ram_support = false,
-        .led_compensation = 51,
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_DEF_MONITORING_PERIOD,
-        .max_event_log_size = 128,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .valid_rx_ant = ANT_A,
+        .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,
+        .ops = &iwl1000_ops,
+        .mod_params = &iwlagn_mod_params,
+        .base_params = &iwl1000_base_params,
 };
 
 MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL100_MODULE_FIRMWARE(IWL100_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 5d09686c3389..176e52577673 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -87,6 +87,15 @@ const struct iwl3945_rate_info iwl3945_rates[IWL_RATE_COUNT_3945] = {
         IWL_DECLARE_RATE_INFO(54, 48, INV, 48, INV, 48, INV),/* 54mbps */
 };
 
+static inline u8 iwl3945_get_prev_ieee_rate(u8 rate_index)
+{
+        u8 rate = iwl3945_rates[rate_index].prev_ieee;
+
+        if (rate == IWL_RATE_INVALID)
+                rate = rate_index;
+        return rate;
+}
+
 /* 1 = enable the iwl3945_disable_events() function */
 #define IWL_EVT_DISABLE (0)
 #define IWL_EVT_DISABLE_SIZE (1532/32)
@@ -339,7 +348,7 @@ static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
         IWL_DEBUG_TX_REPLY(priv, "Tx queue reclaim %d\n", index);
         iwl3945_tx_queue_reclaim(priv, txq_id, index);
 
-        if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
+        if (status & TX_ABORT_REQUIRED_MSK)
                 IWL_ERR(priv, "TODO:  Implement Tx ABORT REQUIRED!!!\n");
 }
 
@@ -406,7 +415,7 @@ static bool iwl3945_good_plcp_health(struct iwl_priv *priv,
         unsigned int plcp_msec;
         unsigned long plcp_received_jiffies;
 
-        if (priv->cfg->plcp_delta_threshold ==
+        if (priv->cfg->base_params->plcp_delta_threshold ==
             IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE) {
                 IWL_DEBUG_RADIO(priv, "plcp_err check disabled\n");
                 return rc;
@@ -432,7 +441,7 @@ static bool iwl3945_good_plcp_health(struct iwl_priv *priv,
 
                 if ((combined_plcp_delta > 0) &&
                         ((combined_plcp_delta * 100) / plcp_msec) >
-                        priv->cfg->plcp_delta_threshold) {
+                        priv->cfg->base_params->plcp_delta_threshold) {
                         /*
                          * if plcp_err exceed the threshold, the following
                          * data is printed in csv format:
@@ -444,7 +453,7 @@ static bool iwl3945_good_plcp_health(struct iwl_priv *priv,
                          */
                         IWL_DEBUG_RADIO(priv, "plcp_err exceeded %u, "
                                 "%u, %d, %u mSecs\n",
-                                priv->cfg->plcp_delta_threshold,
+                                priv->cfg->base_params->plcp_delta_threshold,
                                 le32_to_cpu(current_stat.rx.ofdm.plcp_err),
                                 combined_plcp_delta, plcp_msec);
                         /*
@@ -807,9 +816,12 @@ static u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id, u16 tx_rate)
         return sta_id;
 }
 
-static int iwl3945_set_pwr_src(struct iwl_priv *priv, enum iwl_pwr_src src)
+static void iwl3945_set_pwr_vmain(struct iwl_priv *priv)
 {
-        if (src == IWL_PWR_SRC_VAUX) {
+/*
+ * (for documentation purposes)
+ * to set power to V_AUX, do
+
                 if (pci_pme_capable(priv->pci_dev, PCI_D3cold)) {
                         iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
                                         APMG_PS_CTRL_VAL_PWR_SRC_VAUX,
@@ -819,16 +831,14 @@ static int iwl3945_set_pwr_src(struct iwl_priv *priv, enum iwl_pwr_src src)
                                      CSR_GPIO_IN_VAL_VAUX_PWR_SRC,
                                      CSR_GPIO_IN_BIT_AUX_POWER, 5000);
                 }
-        } else {
-                iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
-                                APMG_PS_CTRL_VAL_PWR_SRC_VMAIN,
-                                ~APMG_PS_CTRL_MSK_PWR_SRC);
+ */
 
-                iwl_poll_bit(priv, CSR_GPIO_IN, CSR_GPIO_IN_VAL_VMAIN_PWR_SRC,
-                             CSR_GPIO_IN_BIT_AUX_POWER, 5000);  /* uS */
-        }
+        iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
+                        APMG_PS_CTRL_VAL_PWR_SRC_VMAIN,
+                        ~APMG_PS_CTRL_MSK_PWR_SRC);
 
-        return 0;
+        iwl_poll_bit(priv, CSR_GPIO_IN, CSR_GPIO_IN_VAL_VMAIN_PWR_SRC,
+                     CSR_GPIO_IN_BIT_AUX_POWER, 5000);  /* uS */
 }
 
 static int iwl3945_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
@@ -1022,9 +1032,7 @@ int iwl3945_hw_nic_init(struct iwl_priv *priv)
         priv->cfg->ops->lib->apm_ops.init(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        rc = priv->cfg->ops->lib->apm_ops.set_pwr_src(priv, IWL_PWR_SRC_VMAIN);
-        if (rc)
-                return rc;
+        iwl3945_set_pwr_vmain(priv);
 
         priv->cfg->ops->lib->apm_ops.config(priv);
 
@@ -1763,8 +1771,7 @@ static int iwl3945_send_rxon_assoc(struct iwl_priv *priv,
  * function correctly transitions out of the RXON_ASSOC_MSK state if
  * a HW tune is required based on the RXON structure changes.
  */
-static int iwl3945_commit_rxon(struct iwl_priv *priv,
-                               struct iwl_rxon_context *ctx)
+int iwl3945_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 {
         /* cast away the const for active_rxon in this function */
         struct iwl3945_rxon_cmd *active_rxon = (void *)&ctx->active;
@@ -2300,6 +2307,32 @@ static u16 iwl3945_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd, u8 *data)
         return (u16)sizeof(struct iwl3945_addsta_cmd);
 }
 
+static int iwl3945_add_bssid_station(struct iwl_priv *priv,
+                                     const u8 *addr, u8 *sta_id_r)
+{
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+        int ret;
+        u8 sta_id;
+        unsigned long flags;
+
+        if (sta_id_r)
+                *sta_id_r = IWL_INVALID_STATION;
+
+        ret = iwl_add_station_common(priv, ctx, addr, 0, NULL, &sta_id);
+        if (ret) {
+                IWL_ERR(priv, "Unable to add station %pM\n", addr);
+                return ret;
+        }
+
+        if (sta_id_r)
+                *sta_id_r = sta_id;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        priv->stations[sta_id].used |= IWL_STA_LOCAL;
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return 0;
+}
 static int iwl3945_manage_ibss_station(struct iwl_priv *priv,
                                        struct ieee80211_vif *vif, bool add)
 {
@@ -2307,10 +2340,8 @@ static int iwl3945_manage_ibss_station(struct iwl_priv *priv,
         int ret;
 
         if (add) {
-                ret = iwl_add_bssid_station(
-                                priv, &priv->contexts[IWL_RXON_CTX_BSS],
-                                vif->bss_conf.bssid, false,
-                                &vif_priv->ibss_bssid_sta_id);
+                ret = iwl3945_add_bssid_station(priv, vif->bss_conf.bssid,
+                                                &vif_priv->ibss_bssid_sta_id);
                 if (ret)
                         return ret;
 
@@ -2421,7 +2452,7 @@ int iwl3945_hw_set_hw_params(struct iwl_priv *priv)
         }
 
         /* Assign number of Usable TX queues */
-        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->base_params->num_of_queues;
 
         priv->hw_params.tfd_size = sizeof(struct iwl3945_tfd);
         priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_3K);
@@ -2673,9 +2704,7 @@ static struct iwl_lib_ops iwl3945_lib = {
         .dump_nic_error_log = iwl3945_dump_nic_error_log,
         .apm_ops = {
                 .init = iwl3945_apm_init,
-                .stop = iwl_apm_stop,
                 .config = iwl3945_nic_config,
-                .set_pwr_src = iwl3945_set_pwr_src,
         },
         .eeprom_ops = {
                 .regulatory_bands = {
@@ -2687,7 +2716,6 @@ static struct iwl_lib_ops iwl3945_lib = {
                         EEPROM_REGULATORY_BAND_NO_HT40,
                         EEPROM_REGULATORY_BAND_NO_HT40,
                 },
-                .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwl3945_eeprom_acquire_semaphore,
                 .release_semaphore = iwl3945_eeprom_release_semaphore,
                 .query_addr = iwlcore_eeprom_query_addr,
@@ -2713,6 +2741,7 @@ static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
         .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
         .tx_cmd_protection = iwlcore_tx_cmd_protection,
         .request_scan = iwl3945_request_scan,
+        .post_scan = iwl3945_post_scan,
 };
 
 static const struct iwl_ops iwl3945_ops = {
@@ -2722,22 +2751,13 @@ static const struct iwl_ops iwl3945_ops = {
         .led = &iwl3945_led_ops,
 };
 
-static struct iwl_cfg iwl3945_bg_cfg = {
-        .name = "3945BG",
-        .fw_name_pre = IWL3945_FW_PRE,
-        .ucode_api_max = IWL3945_UCODE_API_MAX,
-        .ucode_api_min = IWL3945_UCODE_API_MIN,
-        .sku = IWL_SKU_G,
+static struct iwl_base_params iwl3945_base_params = {
         .eeprom_size = IWL3945_EEPROM_IMG_SIZE,
-        .eeprom_ver = EEPROM_3945_EEPROM_VERSION,
-        .ops = &iwl3945_ops,
         .num_of_queues = IWL39_NUM_QUEUES,
-        .mod_params = &iwl3945_mod_params,
         .pll_cfg_val = CSR39_ANA_PLL_CFG_VAL,
         .set_l0s = false,
         .use_bsm = true,
         .use_isr_legacy = true,
-        .ht_greenfield_support = false,
         .led_compensation = 64,
         .broken_powersave = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
@@ -2746,25 +2766,28 @@ static struct iwl_cfg iwl3945_bg_cfg = {
         .tx_power_by_driver = true,
 };
 
+static struct iwl_cfg iwl3945_bg_cfg = {
+        .name = "3945BG",
+        .fw_name_pre = IWL3945_FW_PRE,
+        .ucode_api_max = IWL3945_UCODE_API_MAX,
+        .ucode_api_min = IWL3945_UCODE_API_MIN,
+        .sku = IWL_SKU_G,
+        .eeprom_ver = EEPROM_3945_EEPROM_VERSION,
+        .ops = &iwl3945_ops,
+        .mod_params = &iwl3945_mod_params,
+        .base_params = &iwl3945_base_params,
+};
+
 static struct iwl_cfg iwl3945_abg_cfg = {
         .name = "3945ABG",
         .fw_name_pre = IWL3945_FW_PRE,
         .ucode_api_max = IWL3945_UCODE_API_MAX,
         .ucode_api_min = IWL3945_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G,
-        .eeprom_size = IWL3945_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_3945_EEPROM_VERSION,
         .ops = &iwl3945_ops,
-        .num_of_queues = IWL39_NUM_QUEUES,
         .mod_params = &iwl3945_mod_params,
-        .use_isr_legacy = true,
-        .ht_greenfield_support = false,
-        .led_compensation = 64,
-        .broken_powersave = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
-        .monitor_recover_period = IWL_DEF_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .tx_power_by_driver = true,
+        .base_params = &iwl3945_base_params,
 };
 
 DEFINE_PCI_DEVICE_TABLE(iwl3945_hw_card_ids) = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index bb2aeebf3652..09391f0ee61f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -138,8 +138,6 @@ enum iwl3945_antenna {
 #define DEFAULT_SHORT_RETRY_LIMIT 7U
 #define DEFAULT_LONG_RETRY_LIMIT  4U
 
-#include "iwl-agn-rs.h"
-
 #define IWL_TX_FIFO_AC0 0
 #define IWL_TX_FIFO_AC1 1
 #define IWL_TX_FIFO_AC2 2
@@ -271,6 +269,9 @@ extern void iwl3945_post_associate(struct iwl_priv *priv,
 extern void iwl3945_config_ap(struct iwl_priv *priv,
                               struct ieee80211_vif *vif);
 
+extern int iwl3945_commit_rxon(struct iwl_priv *priv,
+                               struct iwl_rxon_context *ctx);
+
 /**
  * iwl3945_hw_find_station - Find station id for a given BSSID
  * @bssid: MAC address of station ID to find
@@ -295,7 +296,11 @@ extern const struct iwl_channel_info *iwl3945_get_channel_info(
 extern int iwl3945_rs_next_rate(struct iwl_priv *priv, int rate);
 
 /* scanning */
-void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
+int iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
+void iwl3945_post_scan(struct iwl_priv *priv);
+
+/* rates */
+extern const struct iwl3945_rate_info iwl3945_rates[IWL_RATE_COUNT_3945];
 
 /* Requires full declaration of iwl_priv before including */
 #include "iwl-io.h"
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 1d6a46d4db59..b207e3e9299f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -43,7 +43,7 @@
 #include "iwl-core.h"
 #include "iwl-io.h"
 #include "iwl-helpers.h"
-#include "iwl-calib.h"
+#include "iwl-agn-calib.h"
 #include "iwl-sta.h"
 #include "iwl-agn-led.h"
 #include "iwl-agn.h"
@@ -647,13 +647,13 @@ static int iwl4965_hw_set_hw_params(struct iwl_priv *priv)
 {
         if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
             priv->cfg->mod_params->num_of_queues <= IWL49_NUM_QUEUES)
-                priv->cfg->num_of_queues =
+                priv->cfg->base_params->num_of_queues =
                         priv->cfg->mod_params->num_of_queues;
 
-        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->base_params->num_of_queues;
         priv->hw_params.dma_chnl_num = FH49_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
-                        priv->cfg->num_of_queues *
+                        priv->cfg->base_params->num_of_queues *
                         sizeof(struct iwl4965_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL4965_STATION_COUNT;
@@ -669,8 +669,8 @@ static int iwl4965_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.rx_chains_num = num_of_ant(priv->cfg->valid_rx_ant);
         priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
         priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
-        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
-                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
+
+        iwl4965_set_ct_threshold(priv);
 
         priv->hw_params.sens = &iwl4965_sensitivity;
         priv->hw_params.beacon_time_tsf_bits = IWLAGN_EXT_BEACON_TIME_POS;
@@ -1724,13 +1724,13 @@ static int iwl4965_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                                    u16 ssn_idx, u8 tx_fifo)
 {
         if ((IWL49_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL49_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
-             <= txq_id)) {
+            (IWL49_FIRST_AMPDU_QUEUE +
+                priv->cfg->base_params->num_of_ampdu_queues <= txq_id)) {
                 IWL_WARN(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWL49_FIRST_AMPDU_QUEUE,
                         IWL49_FIRST_AMPDU_QUEUE +
-                        priv->cfg->num_of_ampdu_queues - 1);
+                        priv->cfg->base_params->num_of_ampdu_queues - 1);
                 return -EINVAL;
         }
 
@@ -1792,13 +1792,13 @@ static int iwl4965_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         int ret;
 
         if ((IWL49_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL49_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
-             <= txq_id)) {
+            (IWL49_FIRST_AMPDU_QUEUE +
+                priv->cfg->base_params->num_of_ampdu_queues <= txq_id)) {
                 IWL_WARN(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWL49_FIRST_AMPDU_QUEUE,
                         IWL49_FIRST_AMPDU_QUEUE +
-                        priv->cfg->num_of_ampdu_queues - 1);
+                        priv->cfg->base_params->num_of_ampdu_queues - 1);
                 return -EINVAL;
         }
 
@@ -2216,11 +2216,23 @@ static void iwl4965_cancel_deferred_work(struct iwl_priv *priv)
 
 static struct iwl_hcmd_ops iwl4965_hcmd = {
         .rxon_assoc = iwl4965_send_rxon_assoc,
-        .commit_rxon = iwl_commit_rxon,
-        .set_rxon_chain = iwl_set_rxon_chain,
+        .commit_rxon = iwlagn_commit_rxon,
+        .set_rxon_chain = iwlagn_set_rxon_chain,
         .send_bt_config = iwl_send_bt_config,
 };
 
+static void iwl4965_post_scan(struct iwl_priv *priv)
+{
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+
+        /*
+         * Since setting the RXON may have been deferred while
+         * performing the scan, fire one off if needed
+         */
+        if (memcmp(&ctx->staging, &ctx->active, sizeof(ctx->staging)))
+                iwlcore_commit_rxon(priv, ctx);
+}
+
 static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
         .get_hcmd_size = iwl4965_get_hcmd_size,
         .build_addsta_hcmd = iwl4965_build_addsta_hcmd,
@@ -2229,6 +2241,7 @@ static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
         .tx_cmd_protection = iwlcore_tx_cmd_protection,
         .calc_rssi = iwl4965_calc_rssi,
         .request_scan = iwlagn_request_scan,
+        .post_scan = iwl4965_post_scan,
 };
 
 static struct iwl_lib_ops iwl4965_lib = {
@@ -2253,9 +2266,7 @@ static struct iwl_lib_ops iwl4965_lib = {
         .set_channel_switch = iwl4965_hw_channel_switch,
         .apm_ops = {
                 .init = iwl_apm_init,
-                .stop = iwl_apm_stop,
                 .config = iwl4965_nic_config,
-                .set_pwr_src = iwl_set_pwr_src,
         },
         .eeprom_ops = {
                 .regulatory_bands = {
@@ -2267,7 +2278,6 @@ static struct iwl_lib_ops iwl4965_lib = {
                         EEPROM_4965_REGULATORY_BAND_24_HT40_CHANNELS,
                         EEPROM_4965_REGULATORY_BAND_52_HT40_CHANNELS
                 },
-                .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
                 .calib_version = iwl4965_eeprom_calib_version,
@@ -2280,7 +2290,6 @@ static struct iwl_lib_ops iwl4965_lib = {
         .isr = iwl_isr_legacy,
         .temp_ops = {
                 .temperature = iwl4965_temperature_calib,
-                .set_ct_kill = iwl4965_set_ct_threshold,
         },
         .manage_ibss_station = iwlagn_manage_ibss_station,
         .update_bcast_stations = iwl_update_bcast_stations,
@@ -2289,6 +2298,7 @@ static struct iwl_lib_ops iwl4965_lib = {
                 .tx_stats_read = iwl_ucode_tx_stats_read,
                 .general_stats_read = iwl_ucode_general_stats_read,
                 .bt_stats_read = iwl_ucode_bt_stats_read,
+                .reply_tx_error = iwl_reply_tx_error_read,
         },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
@@ -2301,26 +2311,14 @@ static const struct iwl_ops iwl4965_ops = {
         .led = &iwlagn_led_ops,
 };
 
-struct iwl_cfg iwl4965_agn_cfg = {
-        .name = "Intel(R) Wireless WiFi Link 4965AGN",
-        .fw_name_pre = IWL4965_FW_PRE,
-        .ucode_api_max = IWL4965_UCODE_API_MAX,
-        .ucode_api_min = IWL4965_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
+static struct iwl_base_params iwl4965_base_params = {
         .eeprom_size = IWL4965_EEPROM_IMG_SIZE,
-        .eeprom_ver = EEPROM_4965_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_4965_TX_POWER_VERSION,
-        .ops = &iwl4965_ops,
         .num_of_queues = IWL49_NUM_QUEUES,
         .num_of_ampdu_queues = IWL49_NUM_AMPDU_QUEUES,
-        .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_ABC,
         .pll_cfg_val = 0,
         .set_l0s = true,
         .use_bsm = true,
         .use_isr_legacy = true,
-        .ht_greenfield_support = false,
         .broken_powersave = true,
         .led_compensation = 61,
         .chain_noise_num_beacons = IWL4965_CAL_NUM_BEACONS,
@@ -2332,6 +2330,21 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .ucode_tracing = true,
         .sensitivity_calib_by_driver = true,
         .chain_noise_calib_by_driver = true,
+};
+
+struct iwl_cfg iwl4965_agn_cfg = {
+        .name = "Intel(R) Wireless WiFi Link 4965AGN",
+        .fw_name_pre = IWL4965_FW_PRE,
+        .ucode_api_max = IWL4965_UCODE_API_MAX,
+        .ucode_api_min = IWL4965_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_ABC,
+        .eeprom_ver = EEPROM_4965_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_4965_TX_POWER_VERSION,
+        .ops = &iwl4965_ops,
+        .mod_params = &iwlagn_mod_params,
+        .base_params = &iwl4965_base_params,
         /*
          * Force use of chains B and C for scan RX on 5 GHz band
          * because the device has off-channel reception on chain A.
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 1dbb1246c083..fd9fbc93ea1b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -170,13 +170,13 @@ static int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
 {
         if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
             priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
-                priv->cfg->num_of_queues =
+                priv->cfg->base_params->num_of_queues =
                         priv->cfg->mod_params->num_of_queues;
 
-        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->base_params->num_of_queues;
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
-                        priv->cfg->num_of_queues *
+                        priv->cfg->base_params->num_of_queues *
                         sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWLAGN_STATION_COUNT;
@@ -195,8 +195,7 @@ static int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
         priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
 
-        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
-                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
+        iwl5000_set_ct_threshold(priv);
 
         /* Set initial sensitivity parameters */
         /* Set initial calibration set */
@@ -217,13 +216,13 @@ static int iwl5150_hw_set_hw_params(struct iwl_priv *priv)
 {
         if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
             priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
-                priv->cfg->num_of_queues =
+                priv->cfg->base_params->num_of_queues =
                         priv->cfg->mod_params->num_of_queues;
 
-        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->base_params->num_of_queues;
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
-                        priv->cfg->num_of_queues *
+                        priv->cfg->base_params->num_of_queues *
                         sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWLAGN_STATION_COUNT;
@@ -242,8 +241,7 @@ static int iwl5150_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
         priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
 
-        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
-                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
+        iwl5150_set_ct_threshold(priv);
 
         /* Set initial sensitivity parameters */
         /* Set initial calibration set */
@@ -370,9 +368,7 @@ static struct iwl_lib_ops iwl5000_lib = {
         .set_channel_switch = iwl5000_hw_channel_switch,
         .apm_ops = {
                 .init = iwl_apm_init,
-                .stop = iwl_apm_stop,
                 .config = iwl5000_nic_config,
-                .set_pwr_src = iwl_set_pwr_src,
         },
         .eeprom_ops = {
                 .regulatory_bands = {
@@ -384,7 +380,6 @@ static struct iwl_lib_ops iwl5000_lib = {
                         EEPROM_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
-                .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
                 .calib_version  = iwlagn_eeprom_calib_version,
@@ -395,7 +390,6 @@ static struct iwl_lib_ops iwl5000_lib = {
         .config_ap = iwl_config_ap,
         .temp_ops = {
                 .temperature = iwlagn_temperature,
-                .set_ct_kill = iwl5000_set_ct_threshold,
          },
         .manage_ibss_station = iwlagn_manage_ibss_station,
         .update_bcast_stations = iwl_update_bcast_stations,
@@ -404,6 +398,7 @@ static struct iwl_lib_ops iwl5000_lib = {
                 .tx_stats_read = iwl_ucode_tx_stats_read,
                 .general_stats_read = iwl_ucode_general_stats_read,
                 .bt_stats_read = iwl_ucode_bt_stats_read,
+                .reply_tx_error = iwl_reply_tx_error_read,
         },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
@@ -441,9 +436,7 @@ static struct iwl_lib_ops iwl5150_lib = {
         .set_channel_switch = iwl5000_hw_channel_switch,
         .apm_ops = {
                 .init = iwl_apm_init,
-                .stop = iwl_apm_stop,
                 .config = iwl5000_nic_config,
-                .set_pwr_src = iwl_set_pwr_src,
         },
         .eeprom_ops = {
                 .regulatory_bands = {
@@ -455,7 +448,6 @@ static struct iwl_lib_ops iwl5150_lib = {
                         EEPROM_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
-                .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
                 .calib_version  = iwlagn_eeprom_calib_version,
@@ -466,7 +458,6 @@ static struct iwl_lib_ops iwl5150_lib = {
         .config_ap = iwl_config_ap,
         .temp_ops = {
                 .temperature = iwl5150_temperature,
-                .set_ct_kill = iwl5150_set_ct_threshold,
          },
         .manage_ibss_station = iwlagn_manage_ibss_station,
         .update_bcast_stations = iwl_update_bcast_stations,
@@ -474,6 +465,8 @@ static struct iwl_lib_ops iwl5150_lib = {
                 .rx_stats_read = iwl_ucode_rx_stats_read,
                 .tx_stats_read = iwl_ucode_tx_stats_read,
                 .general_stats_read = iwl_ucode_general_stats_read,
+                .bt_stats_read = iwl_ucode_bt_stats_read,
+                .reply_tx_error = iwl_reply_tx_error_read,
         },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
@@ -501,27 +494,14 @@ static const struct iwl_ops iwl5150_ops = {
         .led = &iwlagn_led_ops,
 };
 
-struct iwl_cfg iwl5300_agn_cfg = {
-        .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
-        .fw_name_pre = IWL5000_FW_PRE,
-        .ucode_api_max = IWL5000_UCODE_API_MAX,
-        .ucode_api_min = IWL5000_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl5000_ops,
+static struct iwl_base_params iwl5000_base_params = {
         .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
-        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
-        .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_ABC,
-        .valid_rx_ant = ANT_ABC,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
         .set_l0s = true,
         .use_bsm = false,
-        .ht_greenfield_support = true,
         .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
@@ -531,6 +511,26 @@ struct iwl_cfg iwl5300_agn_cfg = {
         .sensitivity_calib_by_driver = true,
         .chain_noise_calib_by_driver = true,
 };
+static struct iwl_ht_params iwl5000_ht_params = {
+        .ht_greenfield_support = true,
+        .use_rts_for_aggregation = true, /* use rts/cts protection */
+};
+
+struct iwl_cfg iwl5300_agn_cfg = {
+        .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
+        .fw_name_pre = IWL5000_FW_PRE,
+        .ucode_api_max = IWL5000_UCODE_API_MAX,
+        .ucode_api_min = IWL5000_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
+        .valid_tx_ant = ANT_ABC,
+        .valid_rx_ant = ANT_ABC,
+        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .ops = &iwl5000_ops,
+        .mod_params = &iwlagn_mod_params,
+        .base_params = &iwl5000_base_params,
+        .ht_params = &iwl5000_ht_params,
+};
 
 struct iwl_cfg iwl5100_bgn_cfg = {
         .name = "Intel(R) WiFi Link 5100 BGN",
@@ -538,29 +538,14 @@ struct iwl_cfg iwl5100_bgn_cfg = {
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl5000_ops,
-        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
+        .valid_tx_ant = ANT_B,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl5000_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_B,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
-        .set_l0s = true,
-        .use_bsm = false,
-        .ht_greenfield_support = true,
-        .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl5000_base_params,
+        .ht_params = &iwl5000_ht_params,
 };
 
 struct iwl_cfg iwl5100_abg_cfg = {
@@ -569,27 +554,13 @@ struct iwl_cfg iwl5100_abg_cfg = {
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G,
-        .ops = &iwl5000_ops,
-        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
+        .valid_tx_ant = ANT_B,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl5000_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_B,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
-        .set_l0s = true,
-        .use_bsm = false,
-        .led_compensation = 51,
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl5000_base_params,
 };
 
 struct iwl_cfg iwl5100_agn_cfg = {
@@ -598,29 +569,14 @@ struct iwl_cfg iwl5100_agn_cfg = {
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl5000_ops,
-        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
+        .valid_tx_ant = ANT_B,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl5000_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_B,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
-        .set_l0s = true,
-        .use_bsm = false,
-        .ht_greenfield_support = true,
-        .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl5000_base_params,
+        .ht_params = &iwl5000_ht_params,
 };
 
 struct iwl_cfg iwl5350_agn_cfg = {
@@ -629,29 +585,14 @@ struct iwl_cfg iwl5350_agn_cfg = {
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl5000_ops,
-        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
+        .valid_tx_ant = ANT_ABC,
+        .valid_rx_ant = ANT_ABC,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl5000_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_ABC,
-        .valid_rx_ant = ANT_ABC,
-        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
-        .set_l0s = true,
-        .use_bsm = false,
-        .ht_greenfield_support = true,
-        .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl5000_base_params,
+        .ht_params = &iwl5000_ht_params,
 };
 
 struct iwl_cfg iwl5150_agn_cfg = {
@@ -660,29 +601,14 @@ struct iwl_cfg iwl5150_agn_cfg = {
         .ucode_api_max = IWL5150_UCODE_API_MAX,
         .ucode_api_min = IWL5150_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl5150_ops,
-        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl5150_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_A,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
-        .set_l0s = true,
-        .use_bsm = false,
-        .ht_greenfield_support = true,
-        .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl5000_base_params,
+        .ht_params = &iwl5000_ht_params,
         .need_dc_calib = true,
 };
 
@@ -692,27 +618,13 @@ struct iwl_cfg iwl5150_abg_cfg = {
         .ucode_api_max = IWL5150_UCODE_API_MAX,
         .ucode_api_min = IWL5150_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G,
-        .ops = &iwl5150_ops,
-        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl5150_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_A,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
-        .set_l0s = true,
-        .use_bsm = false,
-        .led_compensation = 51,
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl5000_base_params,
         .need_dc_calib = true,
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 2fdba088bd27..11e6532fc573 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -51,13 +51,15 @@
 
 /* Highest firmware API version supported */
 #define IWL6000_UCODE_API_MAX 4
-#define IWL6050_UCODE_API_MAX 4
+#define IWL6050_UCODE_API_MAX 5
 #define IWL6000G2_UCODE_API_MAX 5
+#define IWL130_UCODE_API_MAX 5
 
 /* Lowest firmware API version supported */
 #define IWL6000_UCODE_API_MIN 4
 #define IWL6050_UCODE_API_MIN 4
 #define IWL6000G2_UCODE_API_MIN 4
+#define IWL130_UCODE_API_MIN 5
 
 #define IWL6000_FW_PRE "iwlwifi-6000-"
 #define _IWL6000_MODULE_FIRMWARE(api) IWL6000_FW_PRE #api ".ucode"
@@ -75,6 +77,9 @@
 #define _IWL6000G2B_MODULE_FIRMWARE(api) IWL6000G2B_FW_PRE #api ".ucode"
 #define IWL6000G2B_MODULE_FIRMWARE(api) _IWL6000G2B_MODULE_FIRMWARE(api)
 
+#define IWL130_FW_PRE "iwlwifi-130-"
+#define _IWL130_MODULE_FIRMWARE(api) IWL130_FW_PRE #api ".ucode"
+#define IWL130_MODULE_FIRMWARE(api) _IWL130_MODULE_FIRMWARE(api)
 
 static void iwl6000_set_ct_threshold(struct iwl_priv *priv)
 {
@@ -83,15 +88,24 @@ static void iwl6000_set_ct_threshold(struct iwl_priv *priv)
         priv->hw_params.ct_kill_exit_threshold = CT_KILL_EXIT_THRESHOLD;
 }
 
-/* Indicate calibration version to uCode. */
-static void iwl6000_set_calib_version(struct iwl_priv *priv)
+static void iwl6050_additional_nic_config(struct iwl_priv *priv)
 {
-        if (priv->cfg->need_dc_calib &&
-            (priv->cfg->ops->lib->eeprom_ops.calib_version(priv) >= 6))
+        /* Indicate calibration version to uCode. */
+        if (priv->cfg->ops->lib->eeprom_ops.calib_version(priv) >= 6)
                 iwl_set_bit(priv, CSR_GP_DRIVER_REG,
                                 CSR_GP_DRIVER_REG_BIT_CALIB_VERSION6);
 }
 
+static void iwl6050g2_additional_nic_config(struct iwl_priv *priv)
+{
+        /* Indicate calibration version to uCode. */
+        if (priv->cfg->ops->lib->eeprom_ops.calib_version(priv) >= 6)
+                iwl_set_bit(priv, CSR_GP_DRIVER_REG,
+                                CSR_GP_DRIVER_REG_BIT_CALIB_VERSION6);
+        iwl_set_bit(priv, CSR_GP_DRIVER_REG,
+                    CSR_GP_DRIVER_REG_BIT_6050_1x2);
+}
+
 /* NIC configuration for 6000 series */
 static void iwl6000_nic_config(struct iwl_priv *priv)
 {
@@ -117,9 +131,11 @@ static void iwl6000_nic_config(struct iwl_priv *priv)
                 iwl_write32(priv, CSR_GP_DRIVER_REG,
                              CSR_GP_DRIVER_REG_BIT_RADIO_SKU_2x2_IPA);
         }
-        /* else do nothing, uCode configured */
-        if (priv->cfg->ops->lib->temp_ops.set_calib_version)
-                priv->cfg->ops->lib->temp_ops.set_calib_version(priv);
+        /* do additional nic configuration if needed */
+        if (priv->cfg->ops->nic &&
+                priv->cfg->ops->nic->additional_nic_config) {
+                        priv->cfg->ops->nic->additional_nic_config(priv);
+        }
 }
 
 static struct iwl_sensitivity_ranges iwl6000_sensitivity = {
@@ -151,13 +167,13 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
 {
         if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
             priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
-                priv->cfg->num_of_queues =
+                priv->cfg->base_params->num_of_queues =
                         priv->cfg->mod_params->num_of_queues;
 
-        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->base_params->num_of_queues;
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
-                        priv->cfg->num_of_queues *
+                        priv->cfg->base_params->num_of_queues *
                         sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWLAGN_STATION_COUNT;
@@ -176,8 +192,7 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
         priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
 
-        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
-                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
+        iwl6000_set_ct_threshold(priv);
 
         /* Set initial sensitivity parameters */
         /* Set initial calibration set */
@@ -188,7 +203,9 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
                 BIT(IWL_CALIB_TX_IQ)            |
                 BIT(IWL_CALIB_BASE_BAND);
         if (priv->cfg->need_dc_calib)
-                priv->hw_params.calib_init_cfg |= BIT(IWL_CALIB_DC);
+                priv->hw_params.calib_rt_cfg |= BIT(IWL_CALIB_CFG_DC_IDX);
+        if (priv->cfg->need_temp_offset_calib)
+                priv->hw_params.calib_init_cfg |= BIT(IWL_CALIB_TEMP_OFFSET);
 
         priv->hw_params.beacon_time_tsf_bits = IWLAGN_EXT_BEACON_TIME_POS;
 
@@ -293,9 +310,7 @@ static struct iwl_lib_ops iwl6000_lib = {
         .set_channel_switch = iwl6000_hw_channel_switch,
         .apm_ops = {
                 .init = iwl_apm_init,
-                .stop = iwl_apm_stop,
                 .config = iwl6000_nic_config,
-                .set_pwr_src = iwl_set_pwr_src,
         },
         .eeprom_ops = {
                 .regulatory_bands = {
@@ -307,7 +322,6 @@ static struct iwl_lib_ops iwl6000_lib = {
                         EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
-                .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
                 .calib_version  = iwlagn_eeprom_calib_version,
@@ -319,8 +333,6 @@ static struct iwl_lib_ops iwl6000_lib = {
         .config_ap = iwl_config_ap,
         .temp_ops = {
                 .temperature = iwlagn_temperature,
-                .set_ct_kill = iwl6000_set_ct_threshold,
-                .set_calib_version = iwl6000_set_calib_version,
          },
         .manage_ibss_station = iwlagn_manage_ibss_station,
         .update_bcast_stations = iwl_update_bcast_stations,
@@ -329,6 +341,7 @@ static struct iwl_lib_ops iwl6000_lib = {
                 .tx_stats_read = iwl_ucode_tx_stats_read,
                 .general_stats_read = iwl_ucode_general_stats_read,
                 .bt_stats_read = iwl_ucode_bt_stats_read,
+                .reply_tx_error = iwl_reply_tx_error_read,
         },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
@@ -368,9 +381,7 @@ static struct iwl_lib_ops iwl6000g2b_lib = {
         .set_channel_switch = iwl6000_hw_channel_switch,
         .apm_ops = {
                 .init = iwl_apm_init,
-                .stop = iwl_apm_stop,
                 .config = iwl6000_nic_config,
-                .set_pwr_src = iwl_set_pwr_src,
         },
         .eeprom_ops = {
                 .regulatory_bands = {
@@ -382,7 +393,6 @@ static struct iwl_lib_ops iwl6000g2b_lib = {
                         EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
-                .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
                 .calib_version  = iwlagn_eeprom_calib_version,
@@ -394,8 +404,6 @@ static struct iwl_lib_ops iwl6000g2b_lib = {
         .config_ap = iwl_config_ap,
         .temp_ops = {
                 .temperature = iwlagn_temperature,
-                .set_ct_kill = iwl6000_set_ct_threshold,
-                .set_calib_version = iwl6000_set_calib_version,
          },
         .manage_ibss_station = iwlagn_manage_ibss_station,
         .update_bcast_stations = iwl_update_bcast_stations,
@@ -404,6 +412,7 @@ static struct iwl_lib_ops iwl6000g2b_lib = {
                 .tx_stats_read = iwl_ucode_tx_stats_read,
                 .general_stats_read = iwl_ucode_general_stats_read,
                 .bt_stats_read = iwl_ucode_bt_stats_read,
+                .reply_tx_error = iwl_reply_tx_error_read,
         },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
@@ -417,6 +426,14 @@ static struct iwl_lib_ops iwl6000g2b_lib = {
         }
 };
 
+static struct iwl_nic_ops iwl6050_nic_ops = {
+        .additional_nic_config = &iwl6050_additional_nic_config,
+};
+
+static struct iwl_nic_ops iwl6050g2_nic_ops = {
+        .additional_nic_config = &iwl6050g2_additional_nic_config,
+};
+
 static const struct iwl_ops iwl6000_ops = {
         .lib = &iwl6000_lib,
         .hcmd = &iwlagn_hcmd,
@@ -424,6 +441,22 @@ static const struct iwl_ops iwl6000_ops = {
         .led = &iwlagn_led_ops,
 };
 
+static const struct iwl_ops iwl6050_ops = {
+        .lib = &iwl6000_lib,
+        .hcmd = &iwlagn_hcmd,
+        .utils = &iwlagn_hcmd_utils,
+        .led = &iwlagn_led_ops,
+        .nic = &iwl6050_nic_ops,
+};
+
+static const struct iwl_ops iwl6050g2_ops = {
+        .lib = &iwl6000_lib,
+        .hcmd = &iwlagn_hcmd,
+        .utils = &iwlagn_hcmd_utils,
+        .led = &iwlagn_led_ops,
+        .nic = &iwl6050g2_nic_ops,
+};
+
 static const struct iwl_ops iwl6000g2b_ops = {
         .lib = &iwl6000g2b_lib,
         .hcmd = &iwlagn_bt_hcmd,
@@ -431,30 +464,16 @@ static const struct iwl_ops iwl6000g2b_ops = {
         .led = &iwlagn_led_ops,
 };
 
-struct iwl_cfg iwl6000g2a_2agn_cfg = {
-        .name = "6000 Series 2x2 AGN Gen2a",
-        .fw_name_pre = IWL6000G2A_FW_PRE,
-        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
-        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000_ops,
+static struct iwl_base_params iwl6000_base_params = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
-        .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_AB,
         .pll_cfg_val = 0,
         .set_l0s = true,
         .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
-        .ht_greenfield_support = true,
         .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
         .adv_thermal_throttle = true,
@@ -466,29 +485,16 @@ struct iwl_cfg iwl6000g2a_2agn_cfg = {
         .ucode_tracing = true,
         .sensitivity_calib_by_driver = true,
         .chain_noise_calib_by_driver = true,
-        .need_dc_calib = true,
 };
 
-struct iwl_cfg iwl6000g2a_2abg_cfg = {
-        .name = "6000 Series 2x2 ABG Gen2a",
-        .fw_name_pre = IWL6000G2A_FW_PRE,
-        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
-        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G,
-        .ops = &iwl6000_ops,
+static struct iwl_base_params iwl6050_base_params = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
-        .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_AB,
         .pll_cfg_val = 0,
         .set_l0s = true,
         .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
         .shadow_ram_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
@@ -496,33 +502,20 @@ struct iwl_cfg iwl6000g2a_2abg_cfg = {
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
+        .chain_noise_scale = 1500,
         .monitor_recover_period = IWL_DEF_MONITORING_PERIOD,
-        .max_event_log_size = 512,
+        .max_event_log_size = 1024,
+        .ucode_tracing = true,
         .sensitivity_calib_by_driver = true,
         .chain_noise_calib_by_driver = true,
-        .need_dc_calib = true,
 };
-
-struct iwl_cfg iwl6000g2a_2bg_cfg = {
-        .name = "6000 Series 2x2 BG Gen2a",
-        .fw_name_pre = IWL6000G2A_FW_PRE,
-        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
-        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
-        .sku = IWL_SKU_G,
-        .ops = &iwl6000_ops,
+static struct iwl_base_params iwl6000_coex_base_params = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
-        .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_AB,
         .pll_cfg_val = 0,
         .set_l0s = true,
         .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
         .led_compensation = 51,
@@ -532,11 +525,76 @@ struct iwl_cfg iwl6000g2a_2bg_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_DEF_MONITORING_PERIOD,
+        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
         .max_event_log_size = 512,
+        .ucode_tracing = true,
         .sensitivity_calib_by_driver = true,
         .chain_noise_calib_by_driver = true,
+};
+
+static struct iwl_ht_params iwl6000_ht_params = {
+        .ht_greenfield_support = true,
+        .use_rts_for_aggregation = true, /* use rts/cts protection */
+};
+
+static struct iwl_bt_params iwl6000_bt_params = {
+        .bt_statistics = true,
+        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
+        .advanced_bt_coexist = true,
+        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
+        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
+};
+
+struct iwl_cfg iwl6000g2a_2agn_cfg = {
+        .name = "6000 Series 2x2 AGN Gen2a",
+        .fw_name_pre = IWL6000G2A_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .ops = &iwl6000_ops,
+        .mod_params = &iwlagn_mod_params,
+        .base_params = &iwl6000_base_params,
+        .ht_params = &iwl6000_ht_params,
+        .need_dc_calib = true,
+        .need_temp_offset_calib = true,
+};
+
+struct iwl_cfg iwl6000g2a_2abg_cfg = {
+        .name = "6000 Series 2x2 ABG Gen2a",
+        .fw_name_pre = IWL6000G2A_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .ops = &iwl6000_ops,
+        .mod_params = &iwlagn_mod_params,
+        .base_params = &iwl6000_base_params,
         .need_dc_calib = true,
+        .need_temp_offset_calib = true,
+};
+
+struct iwl_cfg iwl6000g2a_2bg_cfg = {
+        .name = "6000 Series 2x2 BG Gen2a",
+        .fw_name_pre = IWL6000G2A_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
+        .sku = IWL_SKU_G,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .ops = &iwl6000_ops,
+        .mod_params = &iwlagn_mod_params,
+        .base_params = &iwl6000_base_params,
+        .need_dc_calib = true,
+        .need_temp_offset_calib = true,
 };
 
 struct iwl_cfg iwl6000g2b_2agn_cfg = {
@@ -545,41 +603,19 @@ struct iwl_cfg iwl6000g2b_2agn_cfg = {
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000g2b_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl6000g2b_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
-        .shadow_ram_support = true,
-        .ht_greenfield_support = true,
-        .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl6000_coex_base_params,
+        .bt_params = &iwl6000_bt_params,
+        .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
-        .bt_statistics = true,
+        .need_temp_offset_calib = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
-        .advanced_bt_coexist = true,
-        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
-        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
 };
 
 struct iwl_cfg iwl6000g2b_2abg_cfg = {
@@ -588,39 +624,18 @@ struct iwl_cfg iwl6000g2b_2abg_cfg = {
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G,
-        .ops = &iwl6000g2b_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl6000g2b_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
-        .shadow_ram_support = true,
-        .led_compensation = 51,
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl6000_coex_base_params,
+        .bt_params = &iwl6000_bt_params,
         .need_dc_calib = true,
-        .bt_statistics = true,
+        .need_temp_offset_calib = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
-        .advanced_bt_coexist = true,
-        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
-        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
 };
 
 struct iwl_cfg iwl6000g2b_2bgn_cfg = {
@@ -629,41 +644,19 @@ struct iwl_cfg iwl6000g2b_2bgn_cfg = {
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
         .sku = IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000g2b_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl6000g2b_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
-        .shadow_ram_support = true,
-        .ht_greenfield_support = true,
-        .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl6000_coex_base_params,
+        .bt_params = &iwl6000_bt_params,
+        .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
-        .bt_statistics = true,
+        .need_temp_offset_calib = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
-        .advanced_bt_coexist = true,
-        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
-        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
 };
 
 struct iwl_cfg iwl6000g2b_2bg_cfg = {
@@ -672,39 +665,18 @@ struct iwl_cfg iwl6000g2b_2bg_cfg = {
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
         .sku = IWL_SKU_G,
-        .ops = &iwl6000g2b_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl6000g2b_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
-        .shadow_ram_support = true,
-        .led_compensation = 51,
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl6000_coex_base_params,
+        .bt_params = &iwl6000_bt_params,
         .need_dc_calib = true,
-        .bt_statistics = true,
+        .need_temp_offset_calib = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
-        .advanced_bt_coexist = true,
-        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
-        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
 };
 
 struct iwl_cfg iwl6000g2b_bgn_cfg = {
@@ -713,41 +685,19 @@ struct iwl_cfg iwl6000g2b_bgn_cfg = {
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
         .sku = IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000g2b_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl6000g2b_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_A,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
-        .shadow_ram_support = true,
-        .ht_greenfield_support = true,
-        .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl6000_coex_base_params,
+        .bt_params = &iwl6000_bt_params,
+        .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
-        .bt_statistics = true,
+        .need_temp_offset_calib = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
-        .advanced_bt_coexist = true,
-        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
-        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
 };
 
 struct iwl_cfg iwl6000g2b_bg_cfg = {
@@ -756,39 +706,18 @@ struct iwl_cfg iwl6000g2b_bg_cfg = {
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
         .sku = IWL_SKU_G,
-        .ops = &iwl6000g2b_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl6000g2b_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_A,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
-        .shadow_ram_support = true,
-        .led_compensation = 51,
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
-        .max_event_log_size = 512,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl6000_coex_base_params,
+        .bt_params = &iwl6000_bt_params,
         .need_dc_calib = true,
-        .bt_statistics = true,
+        .need_temp_offset_calib = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
-        .advanced_bt_coexist = true,
-        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
-        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
 };
 
 /*
@@ -800,35 +729,15 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_BC,
+        .valid_rx_ant = ANT_BC,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl6000_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_BC,
-        .valid_rx_ant = ANT_BC,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
+        .base_params = &iwl6000_base_params,
+        .ht_params = &iwl6000_ht_params,
         .pa_type = IWL_PA_INTERNAL,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
-        .shadow_ram_support = true,
-        .ht_greenfield_support = true,
-        .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_DEF_MONITORING_PERIOD,
-        .max_event_log_size = 1024,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl6000i_2abg_cfg = {
@@ -837,33 +746,14 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G,
-        .ops = &iwl6000_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_BC,
+        .valid_rx_ant = ANT_BC,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl6000_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_BC,
-        .valid_rx_ant = ANT_BC,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
+        .base_params = &iwl6000_base_params,
         .pa_type = IWL_PA_INTERNAL,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
-        .shadow_ram_support = true,
-        .led_compensation = 51,
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_DEF_MONITORING_PERIOD,
-        .max_event_log_size = 1024,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl6000i_2bg_cfg = {
@@ -872,33 +762,14 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
         .sku = IWL_SKU_G,
-        .ops = &iwl6000_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_BC,
+        .valid_rx_ant = ANT_BC,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl6000_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_BC,
-        .valid_rx_ant = ANT_BC,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
+        .base_params = &iwl6000_base_params,
         .pa_type = IWL_PA_INTERNAL,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
-        .shadow_ram_support = true,
-        .led_compensation = 51,
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_DEF_MONITORING_PERIOD,
-        .max_event_log_size = 1024,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl6050_2agn_cfg = {
@@ -907,35 +778,14 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .ops = &iwl6050_ops,
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6050_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
-        .shadow_ram_support = true,
-        .ht_greenfield_support = true,
-        .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1500,
-        .monitor_recover_period = IWL_DEF_MONITORING_PERIOD,
-        .max_event_log_size = 1024,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl6050_base_params,
+        .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
 };
 
@@ -945,35 +795,14 @@ struct iwl_cfg iwl6050g2_bgn_cfg = {
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
         .sku = IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6050G2_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6050G2_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl6050g2_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_A,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
-        .shadow_ram_support = true,
-        .ht_greenfield_support = true,
-        .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1500,
-        .monitor_recover_period = IWL_DEF_MONITORING_PERIOD,
-        .max_event_log_size = 1024,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl6050_base_params,
+        .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
 };
 
@@ -983,33 +812,13 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G,
-        .ops = &iwl6000_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6050_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl6050_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_AB,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
-        .shadow_ram_support = true,
-        .led_compensation = 51,
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1500,
-        .monitor_recover_period = IWL_DEF_MONITORING_PERIOD,
-        .max_event_log_size = 1024,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl6050_base_params,
         .need_dc_calib = true,
 };
 
@@ -1019,38 +828,58 @@ struct iwl_cfg iwl6000_3agn_cfg = {
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000_ops,
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .valid_tx_ant = ANT_ABC,
+        .valid_rx_ant = ANT_ABC,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
-        .num_of_queues = IWLAGN_NUM_QUEUES,
-        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .ops = &iwl6000_ops,
         .mod_params = &iwlagn_mod_params,
-        .valid_tx_ant = ANT_ABC,
-        .valid_rx_ant = ANT_ABC,
-        .pll_cfg_val = 0,
-        .set_l0s = true,
-        .use_bsm = false,
-        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
-        .shadow_ram_support = true,
-        .ht_greenfield_support = true,
-        .led_compensation = 51,
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
-        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .supports_idle = true,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
-        .monitor_recover_period = IWL_DEF_MONITORING_PERIOD,
-        .max_event_log_size = 1024,
-        .ucode_tracing = true,
-        .sensitivity_calib_by_driver = true,
-        .chain_noise_calib_by_driver = true,
+        .base_params = &iwl6000_base_params,
+        .ht_params = &iwl6000_ht_params,
+        .need_dc_calib = true,
+};
+
+struct iwl_cfg iwl130_bgn_cfg = {
+        .name = "Intel(R) 130 Series 1x1 BGN",
+        .fw_name_pre = IWL6000G2B_FW_PRE,
+        .ucode_api_max = IWL130_UCODE_API_MAX,
+        .ucode_api_min = IWL130_UCODE_API_MIN,
+        .sku = IWL_SKU_G|IWL_SKU_N,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_A,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .ops = &iwl6000g2b_ops,
+        .mod_params = &iwlagn_mod_params,
+        .base_params = &iwl6000_coex_base_params,
+        .bt_params = &iwl6000_bt_params,
+        .ht_params = &iwl6000_ht_params,
+        .need_dc_calib = true,
+        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
+        .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
+};
+
+struct iwl_cfg iwl130_bg_cfg = {
+        .name = "Intel(R) 130 Series 1x2 BG",
+        .fw_name_pre = IWL6000G2B_FW_PRE,
+        .ucode_api_max = IWL130_UCODE_API_MAX,
+        .ucode_api_min = IWL130_UCODE_API_MIN,
+        .sku = IWL_SKU_G,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_A,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .ops = &iwl6000g2b_ops,
+        .mod_params = &iwlagn_mod_params,
+        .base_params = &iwl6000_coex_base_params,
+        .bt_params = &iwl6000_bt_params,
+        .need_dc_calib = true,
+        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
+        .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
 };
 
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL6000G2A_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL6000G2B_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL130_MODULE_FIRMWARE(IWL130_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-calib.c b/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
index 84ad62958535..e2019e756936 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
@@ -65,7 +65,7 @@
 
 #include "iwl-dev.h"
 #include "iwl-core.h"
-#include "iwl-calib.h"
+#include "iwl-agn-calib.h"
 
 /*****************************************************************************
  * INIT calibrations framework
@@ -631,7 +631,8 @@ void iwl_sensitivity_calibration(struct iwl_priv *priv, void *resp)
         }
 
         spin_lock_irqsave(&priv->lock, flags);
-        if (priv->cfg->bt_statistics) {
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->bt_statistics) {
                 rx_info = &(((struct iwl_bt_notif_statistics *)resp)->
                               rx.general.common);
                 ofdm = &(((struct iwl_bt_notif_statistics *)resp)->rx.ofdm);
@@ -786,7 +787,8 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv, void *stat_resp)
         }
 
         spin_lock_irqsave(&priv->lock, flags);
-        if (priv->cfg->bt_statistics) {
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->bt_statistics) {
                 rx_info = &(((struct iwl_bt_notif_statistics *)stat_resp)->
                               rx.general.common);
         } else {
@@ -801,7 +803,8 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv, void *stat_resp)
 
         rxon_band24 = !!(ctx->staging.flags & RXON_FLG_BAND_24G_MSK);
         rxon_chnum = le16_to_cpu(ctx->staging.channel);
-        if (priv->cfg->bt_statistics) {
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->bt_statistics) {
                 stat_band24 = !!(((struct iwl_bt_notif_statistics *)
                                  stat_resp)->flag &
                                  STATISTICS_REPLY_FLG_BAND_24G_MSK);
@@ -861,16 +864,17 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv, void *stat_resp)
         /* If this is the "chain_noise_num_beacons", determine:
          * 1)  Disconnected antennas (using signal strengths)
          * 2)  Differential gain (using silence noise) to balance receivers */
-        if (data->beacon_count != priv->cfg->chain_noise_num_beacons)
+        if (data->beacon_count !=
+                priv->cfg->base_params->chain_noise_num_beacons)
                 return;
 
         /* Analyze signal for disconnected antenna */
-        average_sig[0] =
-                (data->chain_signal_a) / priv->cfg->chain_noise_num_beacons;
-        average_sig[1] =
-                (data->chain_signal_b) / priv->cfg->chain_noise_num_beacons;
-        average_sig[2] =
-                (data->chain_signal_c) / priv->cfg->chain_noise_num_beacons;
+        average_sig[0] = data->chain_signal_a /
+                         priv->cfg->base_params->chain_noise_num_beacons;
+        average_sig[1] = data->chain_signal_b /
+                         priv->cfg->base_params->chain_noise_num_beacons;
+        average_sig[2] = data->chain_signal_c /
+                         priv->cfg->base_params->chain_noise_num_beacons;
 
         if (average_sig[0] >= average_sig[1]) {
                 max_average_sig = average_sig[0];
@@ -920,7 +924,9 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv, void *stat_resp)
          * To be safe, simply mask out any chains that we know
          * are not on the device.
          */
-        if (priv->cfg->advanced_bt_coexist && priv->bt_full_concurrent) {
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->advanced_bt_coexist &&
+            priv->bt_full_concurrent) {
                 /* operated as 1x1 in full concurrency mode */
                 active_chains &= first_antenna(priv->hw_params.valid_rx_ant);
         } else
@@ -967,12 +973,12 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv, void *stat_resp)
                         active_chains);
 
         /* Analyze noise for rx balance */
-        average_noise[0] =
-                ((data->chain_noise_a) / priv->cfg->chain_noise_num_beacons);
-        average_noise[1] =
-                ((data->chain_noise_b) / priv->cfg->chain_noise_num_beacons);
-        average_noise[2] =
-                ((data->chain_noise_c) / priv->cfg->chain_noise_num_beacons);
+        average_noise[0] = data->chain_noise_a /
+                           priv->cfg->base_params->chain_noise_num_beacons;
+        average_noise[1] = data->chain_noise_b /
+                           priv->cfg->base_params->chain_noise_num_beacons;
+        average_noise[2] = data->chain_noise_c /
+                           priv->cfg->base_params->chain_noise_num_beacons;
 
         for (i = 0; i < NUM_RX_CHAINS; i++) {
                 if (!(data->disconn_array[i]) &&
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.h b/drivers/net/wireless/iwlwifi/iwl-agn-calib.h
index ba9523fbb300..e37ae7261630 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-calib.h
@@ -79,4 +79,8 @@ static inline void iwl_chain_noise_reset(struct iwl_priv *priv)
                 priv->cfg->ops->utils->chain_noise_reset(priv);
 }
 
+int iwl_send_calib_results(struct iwl_priv *priv);
+int iwl_calib_set(struct iwl_calib_result *res, const u8 *buf, int len);
+void iwl_calib_free_results(struct iwl_priv *priv);
+
 #endif /* __iwl_calib_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
index d706b8afbe5a..a358d4334a1a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
@@ -25,15 +25,22 @@
 *  Intel Linux Wireless <ilw@linux.intel.com>
 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
 *****************************************************************************/
-
+#include "iwl-agn.h"
 #include "iwl-agn-debugfs.h"
 
+static const char *fmt_value = "  %-30s %10u\n";
+static const char *fmt_hex   = "  %-30s       0x%02X\n";
+static const char *fmt_table = "  %-30s %10u  %10u  %10u  %10u\n";
+static const char *fmt_header =
+        "%-32s    current  cumulative       delta         max\n";
+
 static int iwl_statistics_flag(struct iwl_priv *priv, char *buf, int bufsz)
 {
         int p = 0;
         u32 flag;
 
-        if (priv->cfg->bt_statistics)
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->bt_statistics)
                 flag = le32_to_cpu(priv->_agn.statistics_bt.flag);
         else
                 flag = le32_to_cpu(priv->_agn.statistics.flag);
@@ -82,7 +89,8 @@ ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
          * the last statistics notification from uCode
          * might not reflect the current uCode activity
          */
-        if (priv->cfg->bt_statistics) {
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->bt_statistics) {
                 ofdm = &priv->_agn.statistics_bt.rx.ofdm;
                 cck = &priv->_agn.statistics_bt.rx.cck;
                 general = &priv->_agn.statistics_bt.rx.general.common;
@@ -121,436 +129,380 @@ ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
         }
 
         pos += iwl_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
-                         "acumulative       delta         max\n",
-                         "Statistics_Rx - OFDM:");
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "ina_cnt:", le32_to_cpu(ofdm->ina_cnt),
+                         fmt_header, "Statistics_Rx - OFDM:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_table, "ina_cnt:",
+                         le32_to_cpu(ofdm->ina_cnt),
                          accum_ofdm->ina_cnt,
                          delta_ofdm->ina_cnt, max_ofdm->ina_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "fina_cnt:",
+                         fmt_table, "fina_cnt:",
                          le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt,
                          delta_ofdm->fina_cnt, max_ofdm->fina_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "plcp_err:",
+                         fmt_table, "plcp_err:",
                          le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err,
                          delta_ofdm->plcp_err, max_ofdm->plcp_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "crc32_err:",
+                         fmt_table, "crc32_err:",
                          le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err,
                          delta_ofdm->crc32_err, max_ofdm->crc32_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "overrun_err:",
+                         fmt_table, "overrun_err:",
                          le32_to_cpu(ofdm->overrun_err),
                          accum_ofdm->overrun_err, delta_ofdm->overrun_err,
                          max_ofdm->overrun_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "early_overrun_err:",
+                         fmt_table, "early_overrun_err:",
                          le32_to_cpu(ofdm->early_overrun_err),
                          accum_ofdm->early_overrun_err,
                          delta_ofdm->early_overrun_err,
                          max_ofdm->early_overrun_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "crc32_good:", le32_to_cpu(ofdm->crc32_good),
+                         fmt_table, "crc32_good:",
+                         le32_to_cpu(ofdm->crc32_good),
                          accum_ofdm->crc32_good, delta_ofdm->crc32_good,
                          max_ofdm->crc32_good);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "false_alarm_cnt:",
+                         fmt_table, "false_alarm_cnt:",
                          le32_to_cpu(ofdm->false_alarm_cnt),
                          accum_ofdm->false_alarm_cnt,
                          delta_ofdm->false_alarm_cnt,
                          max_ofdm->false_alarm_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "fina_sync_err_cnt:",
+                         fmt_table, "fina_sync_err_cnt:",
                          le32_to_cpu(ofdm->fina_sync_err_cnt),
                          accum_ofdm->fina_sync_err_cnt,
                          delta_ofdm->fina_sync_err_cnt,
                          max_ofdm->fina_sync_err_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "sfd_timeout:",
+                         fmt_table, "sfd_timeout:",
                          le32_to_cpu(ofdm->sfd_timeout),
                          accum_ofdm->sfd_timeout, delta_ofdm->sfd_timeout,
                          max_ofdm->sfd_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "fina_timeout:",
+                         fmt_table, "fina_timeout:",
                          le32_to_cpu(ofdm->fina_timeout),
                          accum_ofdm->fina_timeout, delta_ofdm->fina_timeout,
                          max_ofdm->fina_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "unresponded_rts:",
+                         fmt_table, "unresponded_rts:",
                          le32_to_cpu(ofdm->unresponded_rts),
                          accum_ofdm->unresponded_rts,
                          delta_ofdm->unresponded_rts,
                          max_ofdm->unresponded_rts);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "rxe_frame_lmt_ovrun:",
+                         fmt_table, "rxe_frame_lmt_ovrun:",
                          le32_to_cpu(ofdm->rxe_frame_limit_overrun),
                          accum_ofdm->rxe_frame_limit_overrun,
                          delta_ofdm->rxe_frame_limit_overrun,
                          max_ofdm->rxe_frame_limit_overrun);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_ack_cnt:",
+                         fmt_table, "sent_ack_cnt:",
                          le32_to_cpu(ofdm->sent_ack_cnt),
                          accum_ofdm->sent_ack_cnt, delta_ofdm->sent_ack_cnt,
                          max_ofdm->sent_ack_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_cts_cnt:",
+                         fmt_table, "sent_cts_cnt:",
                          le32_to_cpu(ofdm->sent_cts_cnt),
                          accum_ofdm->sent_cts_cnt, delta_ofdm->sent_cts_cnt,
                          max_ofdm->sent_cts_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "sent_ba_rsp_cnt:",
+                         fmt_table, "sent_ba_rsp_cnt:",
                          le32_to_cpu(ofdm->sent_ba_rsp_cnt),
                          accum_ofdm->sent_ba_rsp_cnt,
                          delta_ofdm->sent_ba_rsp_cnt,
                          max_ofdm->sent_ba_rsp_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "dsp_self_kill:",
+                         fmt_table, "dsp_self_kill:",
                          le32_to_cpu(ofdm->dsp_self_kill),
                          accum_ofdm->dsp_self_kill,
                          delta_ofdm->dsp_self_kill,
                          max_ofdm->dsp_self_kill);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "mh_format_err:",
+                         fmt_table, "mh_format_err:",
                          le32_to_cpu(ofdm->mh_format_err),
                          accum_ofdm->mh_format_err,
                          delta_ofdm->mh_format_err,
                          max_ofdm->mh_format_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "re_acq_main_rssi_sum:",
+                         fmt_table, "re_acq_main_rssi_sum:",
                          le32_to_cpu(ofdm->re_acq_main_rssi_sum),
                          accum_ofdm->re_acq_main_rssi_sum,
                          delta_ofdm->re_acq_main_rssi_sum,
                          max_ofdm->re_acq_main_rssi_sum);
 
-        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
-                         "acumulative       delta         max\n",
-                         "Statistics_Rx - CCK:");
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "ina_cnt:",
+                         fmt_header, "Statistics_Rx - CCK:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_table, "ina_cnt:",
                          le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt,
                          delta_cck->ina_cnt, max_cck->ina_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "fina_cnt:",
+                         fmt_table, "fina_cnt:",
                          le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt,
                          delta_cck->fina_cnt, max_cck->fina_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "plcp_err:",
+                         fmt_table, "plcp_err:",
                          le32_to_cpu(cck->plcp_err), accum_cck->plcp_err,
                          delta_cck->plcp_err, max_cck->plcp_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "crc32_err:",
+                         fmt_table, "crc32_err:",
                          le32_to_cpu(cck->crc32_err), accum_cck->crc32_err,
                          delta_cck->crc32_err, max_cck->crc32_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "overrun_err:",
+                         fmt_table, "overrun_err:",
                          le32_to_cpu(cck->overrun_err),
                          accum_cck->overrun_err, delta_cck->overrun_err,
                          max_cck->overrun_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "early_overrun_err:",
+                         fmt_table, "early_overrun_err:",
                          le32_to_cpu(cck->early_overrun_err),
                          accum_cck->early_overrun_err,
                          delta_cck->early_overrun_err,
                          max_cck->early_overrun_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "crc32_good:",
+                         fmt_table, "crc32_good:",
                          le32_to_cpu(cck->crc32_good), accum_cck->crc32_good,
                          delta_cck->crc32_good, max_cck->crc32_good);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "false_alarm_cnt:",
+                         fmt_table, "false_alarm_cnt:",
                          le32_to_cpu(cck->false_alarm_cnt),
                          accum_cck->false_alarm_cnt,
                          delta_cck->false_alarm_cnt, max_cck->false_alarm_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "fina_sync_err_cnt:",
+                         fmt_table, "fina_sync_err_cnt:",
                          le32_to_cpu(cck->fina_sync_err_cnt),
                          accum_cck->fina_sync_err_cnt,
                          delta_cck->fina_sync_err_cnt,
                          max_cck->fina_sync_err_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "sfd_timeout:",
+                         fmt_table, "sfd_timeout:",
                          le32_to_cpu(cck->sfd_timeout),
                          accum_cck->sfd_timeout, delta_cck->sfd_timeout,
                          max_cck->sfd_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "fina_timeout:",
+                         fmt_table, "fina_timeout:",
                          le32_to_cpu(cck->fina_timeout),
                          accum_cck->fina_timeout, delta_cck->fina_timeout,
                          max_cck->fina_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "unresponded_rts:",
+                         fmt_table, "unresponded_rts:",
                          le32_to_cpu(cck->unresponded_rts),
                          accum_cck->unresponded_rts, delta_cck->unresponded_rts,
                          max_cck->unresponded_rts);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "rxe_frame_lmt_ovrun:",
+                         fmt_table, "rxe_frame_lmt_ovrun:",
                          le32_to_cpu(cck->rxe_frame_limit_overrun),
                          accum_cck->rxe_frame_limit_overrun,
                          delta_cck->rxe_frame_limit_overrun,
                          max_cck->rxe_frame_limit_overrun);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_ack_cnt:",
+                         fmt_table, "sent_ack_cnt:",
                          le32_to_cpu(cck->sent_ack_cnt),
                          accum_cck->sent_ack_cnt, delta_cck->sent_ack_cnt,
                          max_cck->sent_ack_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_cts_cnt:",
+                         fmt_table, "sent_cts_cnt:",
                          le32_to_cpu(cck->sent_cts_cnt),
                          accum_cck->sent_cts_cnt, delta_cck->sent_cts_cnt,
                          max_cck->sent_cts_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_ba_rsp_cnt:",
+                         fmt_table, "sent_ba_rsp_cnt:",
                          le32_to_cpu(cck->sent_ba_rsp_cnt),
                          accum_cck->sent_ba_rsp_cnt,
                          delta_cck->sent_ba_rsp_cnt,
                          max_cck->sent_ba_rsp_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "dsp_self_kill:",
+                         fmt_table, "dsp_self_kill:",
                          le32_to_cpu(cck->dsp_self_kill),
                          accum_cck->dsp_self_kill, delta_cck->dsp_self_kill,
                          max_cck->dsp_self_kill);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "mh_format_err:",
+                         fmt_table, "mh_format_err:",
                          le32_to_cpu(cck->mh_format_err),
                          accum_cck->mh_format_err, delta_cck->mh_format_err,
                          max_cck->mh_format_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "re_acq_main_rssi_sum:",
+                         fmt_table, "re_acq_main_rssi_sum:",
                          le32_to_cpu(cck->re_acq_main_rssi_sum),
                          accum_cck->re_acq_main_rssi_sum,
                          delta_cck->re_acq_main_rssi_sum,
                          max_cck->re_acq_main_rssi_sum);
 
-        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
-                         "acumulative       delta         max\n",
-                         "Statistics_Rx - GENERAL:");
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "bogus_cts:",
+                         fmt_header, "Statistics_Rx - GENERAL:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_table, "bogus_cts:",
                          le32_to_cpu(general->bogus_cts),
                          accum_general->bogus_cts, delta_general->bogus_cts,
                          max_general->bogus_cts);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "bogus_ack:",
+                         fmt_table, "bogus_ack:",
                          le32_to_cpu(general->bogus_ack),
                          accum_general->bogus_ack, delta_general->bogus_ack,
                          max_general->bogus_ack);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "non_bssid_frames:",
+                         fmt_table, "non_bssid_frames:",
                          le32_to_cpu(general->non_bssid_frames),
                          accum_general->non_bssid_frames,
                          delta_general->non_bssid_frames,
                          max_general->non_bssid_frames);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "filtered_frames:",
+                         fmt_table, "filtered_frames:",
                          le32_to_cpu(general->filtered_frames),
                          accum_general->filtered_frames,
                          delta_general->filtered_frames,
                          max_general->filtered_frames);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "non_channel_beacons:",
+                         fmt_table, "non_channel_beacons:",
                          le32_to_cpu(general->non_channel_beacons),
                          accum_general->non_channel_beacons,
                          delta_general->non_channel_beacons,
                          max_general->non_channel_beacons);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "channel_beacons:",
+                         fmt_table, "channel_beacons:",
                          le32_to_cpu(general->channel_beacons),
                          accum_general->channel_beacons,
                          delta_general->channel_beacons,
                          max_general->channel_beacons);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "num_missed_bcon:",
+                         fmt_table, "num_missed_bcon:",
                          le32_to_cpu(general->num_missed_bcon),
                          accum_general->num_missed_bcon,
                          delta_general->num_missed_bcon,
                          max_general->num_missed_bcon);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "adc_rx_saturation_time:",
+                         fmt_table, "adc_rx_saturation_time:",
                          le32_to_cpu(general->adc_rx_saturation_time),
                          accum_general->adc_rx_saturation_time,
                          delta_general->adc_rx_saturation_time,
                          max_general->adc_rx_saturation_time);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "ina_detect_search_tm:",
+                         fmt_table, "ina_detect_search_tm:",
                          le32_to_cpu(general->ina_detection_search_time),
                          accum_general->ina_detection_search_time,
                          delta_general->ina_detection_search_time,
                          max_general->ina_detection_search_time);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_silence_rssi_a:",
+                         fmt_table, "beacon_silence_rssi_a:",
                          le32_to_cpu(general->beacon_silence_rssi_a),
                          accum_general->beacon_silence_rssi_a,
                          delta_general->beacon_silence_rssi_a,
                          max_general->beacon_silence_rssi_a);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_silence_rssi_b:",
+                         fmt_table, "beacon_silence_rssi_b:",
                          le32_to_cpu(general->beacon_silence_rssi_b),
                          accum_general->beacon_silence_rssi_b,
                          delta_general->beacon_silence_rssi_b,
                          max_general->beacon_silence_rssi_b);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_silence_rssi_c:",
+                         fmt_table, "beacon_silence_rssi_c:",
                          le32_to_cpu(general->beacon_silence_rssi_c),
                          accum_general->beacon_silence_rssi_c,
                          delta_general->beacon_silence_rssi_c,
                          max_general->beacon_silence_rssi_c);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "interference_data_flag:",
+                         fmt_table, "interference_data_flag:",
                          le32_to_cpu(general->interference_data_flag),
                          accum_general->interference_data_flag,
                          delta_general->interference_data_flag,
                          max_general->interference_data_flag);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "channel_load:",
+                         fmt_table, "channel_load:",
                          le32_to_cpu(general->channel_load),
                          accum_general->channel_load,
                          delta_general->channel_load,
                          max_general->channel_load);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "dsp_false_alarms:",
+                         fmt_table, "dsp_false_alarms:",
                          le32_to_cpu(general->dsp_false_alarms),
                          accum_general->dsp_false_alarms,
                          delta_general->dsp_false_alarms,
                          max_general->dsp_false_alarms);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_rssi_a:",
+                         fmt_table, "beacon_rssi_a:",
                          le32_to_cpu(general->beacon_rssi_a),
                          accum_general->beacon_rssi_a,
                          delta_general->beacon_rssi_a,
                          max_general->beacon_rssi_a);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_rssi_b:",
+                         fmt_table, "beacon_rssi_b:",
                          le32_to_cpu(general->beacon_rssi_b),
                          accum_general->beacon_rssi_b,
                          delta_general->beacon_rssi_b,
                          max_general->beacon_rssi_b);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_rssi_c:",
+                         fmt_table, "beacon_rssi_c:",
                          le32_to_cpu(general->beacon_rssi_c),
                          accum_general->beacon_rssi_c,
                          delta_general->beacon_rssi_c,
                          max_general->beacon_rssi_c);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_energy_a:",
+                         fmt_table, "beacon_energy_a:",
                          le32_to_cpu(general->beacon_energy_a),
                          accum_general->beacon_energy_a,
                          delta_general->beacon_energy_a,
                          max_general->beacon_energy_a);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_energy_b:",
+                         fmt_table, "beacon_energy_b:",
                          le32_to_cpu(general->beacon_energy_b),
                          accum_general->beacon_energy_b,
                          delta_general->beacon_energy_b,
                          max_general->beacon_energy_b);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_energy_c:",
+                         fmt_table, "beacon_energy_c:",
                          le32_to_cpu(general->beacon_energy_c),
                          accum_general->beacon_energy_c,
                          delta_general->beacon_energy_c,
                          max_general->beacon_energy_c);
 
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM_HT:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
-                         "acumulative       delta         max\n",
-                         "Statistics_Rx - OFDM_HT:");
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "plcp_err:",
+                         fmt_header, "Statistics_Rx - OFDM_HT:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_table, "plcp_err:",
                          le32_to_cpu(ht->plcp_err), accum_ht->plcp_err,
                          delta_ht->plcp_err, max_ht->plcp_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "overrun_err:",
+                         fmt_table, "overrun_err:",
                          le32_to_cpu(ht->overrun_err), accum_ht->overrun_err,
                          delta_ht->overrun_err, max_ht->overrun_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "early_overrun_err:",
+                         fmt_table, "early_overrun_err:",
                          le32_to_cpu(ht->early_overrun_err),
                          accum_ht->early_overrun_err,
                          delta_ht->early_overrun_err,
                          max_ht->early_overrun_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "crc32_good:",
+                         fmt_table, "crc32_good:",
                          le32_to_cpu(ht->crc32_good), accum_ht->crc32_good,
                          delta_ht->crc32_good, max_ht->crc32_good);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "crc32_err:",
+                         fmt_table, "crc32_err:",
                          le32_to_cpu(ht->crc32_err), accum_ht->crc32_err,
                          delta_ht->crc32_err, max_ht->crc32_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "mh_format_err:",
+                         fmt_table, "mh_format_err:",
                          le32_to_cpu(ht->mh_format_err),
                          accum_ht->mh_format_err,
                          delta_ht->mh_format_err, max_ht->mh_format_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg_crc32_good:",
+                         fmt_table, "agg_crc32_good:",
                          le32_to_cpu(ht->agg_crc32_good),
                          accum_ht->agg_crc32_good,
                          delta_ht->agg_crc32_good, max_ht->agg_crc32_good);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg_mpdu_cnt:",
+                         fmt_table, "agg_mpdu_cnt:",
                          le32_to_cpu(ht->agg_mpdu_cnt),
                          accum_ht->agg_mpdu_cnt,
                          delta_ht->agg_mpdu_cnt, max_ht->agg_mpdu_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg_cnt:",
+                         fmt_table, "agg_cnt:",
                          le32_to_cpu(ht->agg_cnt), accum_ht->agg_cnt,
                          delta_ht->agg_cnt, max_ht->agg_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "unsupport_mcs:",
+                         fmt_table, "unsupport_mcs:",
                          le32_to_cpu(ht->unsupport_mcs),
                          accum_ht->unsupport_mcs,
                          delta_ht->unsupport_mcs, max_ht->unsupport_mcs);
@@ -584,7 +536,8 @@ ssize_t iwl_ucode_tx_stats_read(struct file *file,
           * the last statistics notification from uCode
           * might not reflect the current uCode activity
           */
-        if (priv->cfg->bt_statistics) {
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->bt_statistics) {
                 tx = &priv->_agn.statistics_bt.tx;
                 accum_tx = &priv->_agn.accum_statistics_bt.tx;
                 delta_tx = &priv->_agn.delta_statistics_bt.tx;
@@ -597,166 +550,141 @@ ssize_t iwl_ucode_tx_stats_read(struct file *file,
         }
 
         pos += iwl_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos,  "%-32s     current"
-                         "acumulative       delta         max\n",
-                         "Statistics_Tx:");
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "preamble:",
+                         fmt_header, "Statistics_Tx:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_table, "preamble:",
                          le32_to_cpu(tx->preamble_cnt),
                          accum_tx->preamble_cnt,
                          delta_tx->preamble_cnt, max_tx->preamble_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "rx_detected_cnt:",
+                         fmt_table, "rx_detected_cnt:",
                          le32_to_cpu(tx->rx_detected_cnt),
                          accum_tx->rx_detected_cnt,
                          delta_tx->rx_detected_cnt, max_tx->rx_detected_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "bt_prio_defer_cnt:",
+                         fmt_table, "bt_prio_defer_cnt:",
                          le32_to_cpu(tx->bt_prio_defer_cnt),
                          accum_tx->bt_prio_defer_cnt,
                          delta_tx->bt_prio_defer_cnt,
                          max_tx->bt_prio_defer_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "bt_prio_kill_cnt:",
+                         fmt_table, "bt_prio_kill_cnt:",
                          le32_to_cpu(tx->bt_prio_kill_cnt),
                          accum_tx->bt_prio_kill_cnt,
                          delta_tx->bt_prio_kill_cnt,
                          max_tx->bt_prio_kill_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "few_bytes_cnt:",
+                         fmt_table, "few_bytes_cnt:",
                          le32_to_cpu(tx->few_bytes_cnt),
                          accum_tx->few_bytes_cnt,
                          delta_tx->few_bytes_cnt, max_tx->few_bytes_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "cts_timeout:",
+                         fmt_table, "cts_timeout:",
                          le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout,
                          delta_tx->cts_timeout, max_tx->cts_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "ack_timeout:",
+                         fmt_table, "ack_timeout:",
                          le32_to_cpu(tx->ack_timeout),
                          accum_tx->ack_timeout,
                          delta_tx->ack_timeout, max_tx->ack_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "expected_ack_cnt:",
+                         fmt_table, "expected_ack_cnt:",
                          le32_to_cpu(tx->expected_ack_cnt),
                          accum_tx->expected_ack_cnt,
                          delta_tx->expected_ack_cnt,
                          max_tx->expected_ack_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "actual_ack_cnt:",
+                         fmt_table, "actual_ack_cnt:",
                          le32_to_cpu(tx->actual_ack_cnt),
                          accum_tx->actual_ack_cnt,
                          delta_tx->actual_ack_cnt,
                          max_tx->actual_ack_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "dump_msdu_cnt:",
+                         fmt_table, "dump_msdu_cnt:",
                          le32_to_cpu(tx->dump_msdu_cnt),
                          accum_tx->dump_msdu_cnt,
                          delta_tx->dump_msdu_cnt,
                          max_tx->dump_msdu_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "abort_nxt_frame_mismatch:",
+                         fmt_table, "abort_nxt_frame_mismatch:",
                          le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt),
                          accum_tx->burst_abort_next_frame_mismatch_cnt,
                          delta_tx->burst_abort_next_frame_mismatch_cnt,
                          max_tx->burst_abort_next_frame_mismatch_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "abort_missing_nxt_frame:",
+                         fmt_table, "abort_missing_nxt_frame:",
                          le32_to_cpu(tx->burst_abort_missing_next_frame_cnt),
                          accum_tx->burst_abort_missing_next_frame_cnt,
                          delta_tx->burst_abort_missing_next_frame_cnt,
                          max_tx->burst_abort_missing_next_frame_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "cts_timeout_collision:",
+                         fmt_table, "cts_timeout_collision:",
                          le32_to_cpu(tx->cts_timeout_collision),
                          accum_tx->cts_timeout_collision,
                          delta_tx->cts_timeout_collision,
                          max_tx->cts_timeout_collision);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "ack_ba_timeout_collision:",
+                         fmt_table, "ack_ba_timeout_collision:",
                          le32_to_cpu(tx->ack_or_ba_timeout_collision),
                          accum_tx->ack_or_ba_timeout_collision,
                          delta_tx->ack_or_ba_timeout_collision,
                          max_tx->ack_or_ba_timeout_collision);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg ba_timeout:",
+                         fmt_table, "agg ba_timeout:",
                          le32_to_cpu(tx->agg.ba_timeout),
                          accum_tx->agg.ba_timeout,
                          delta_tx->agg.ba_timeout,
                          max_tx->agg.ba_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg ba_resched_frames:",
+                         fmt_table, "agg ba_resched_frames:",
                          le32_to_cpu(tx->agg.ba_reschedule_frames),
                          accum_tx->agg.ba_reschedule_frames,
                          delta_tx->agg.ba_reschedule_frames,
                          max_tx->agg.ba_reschedule_frames);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg scd_query_agg_frame:",
+                         fmt_table, "agg scd_query_agg_frame:",
                          le32_to_cpu(tx->agg.scd_query_agg_frame_cnt),
                          accum_tx->agg.scd_query_agg_frame_cnt,
                          delta_tx->agg.scd_query_agg_frame_cnt,
                          max_tx->agg.scd_query_agg_frame_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg scd_query_no_agg:",
+                         fmt_table, "agg scd_query_no_agg:",
                          le32_to_cpu(tx->agg.scd_query_no_agg),
                          accum_tx->agg.scd_query_no_agg,
                          delta_tx->agg.scd_query_no_agg,
                          max_tx->agg.scd_query_no_agg);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg scd_query_agg:",
+                         fmt_table, "agg scd_query_agg:",
                          le32_to_cpu(tx->agg.scd_query_agg),
                          accum_tx->agg.scd_query_agg,
                          delta_tx->agg.scd_query_agg,
                          max_tx->agg.scd_query_agg);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg scd_query_mismatch:",
+                         fmt_table, "agg scd_query_mismatch:",
                          le32_to_cpu(tx->agg.scd_query_mismatch),
                          accum_tx->agg.scd_query_mismatch,
                          delta_tx->agg.scd_query_mismatch,
                          max_tx->agg.scd_query_mismatch);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg frame_not_ready:",
+                         fmt_table, "agg frame_not_ready:",
                          le32_to_cpu(tx->agg.frame_not_ready),
                          accum_tx->agg.frame_not_ready,
                          delta_tx->agg.frame_not_ready,
                          max_tx->agg.frame_not_ready);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg underrun:",
+                         fmt_table, "agg underrun:",
                          le32_to_cpu(tx->agg.underrun),
                          accum_tx->agg.underrun,
                          delta_tx->agg.underrun, max_tx->agg.underrun);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg bt_prio_kill:",
+                         fmt_table, "agg bt_prio_kill:",
                          le32_to_cpu(tx->agg.bt_prio_kill),
                          accum_tx->agg.bt_prio_kill,
                          delta_tx->agg.bt_prio_kill,
                          max_tx->agg.bt_prio_kill);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg rx_ba_rsp_cnt:",
+                         fmt_table, "agg rx_ba_rsp_cnt:",
                          le32_to_cpu(tx->agg.rx_ba_rsp_cnt),
                          accum_tx->agg.rx_ba_rsp_cnt,
                          delta_tx->agg.rx_ba_rsp_cnt,
@@ -767,15 +695,15 @@ ssize_t iwl_ucode_tx_stats_read(struct file *file,
                         "tx power: (1/2 dB step)\n");
                 if ((priv->cfg->valid_tx_ant & ANT_A) && tx->tx_power.ant_a)
                         pos += scnprintf(buf + pos, bufsz - pos,
-                                        "\tantenna A: 0x%X\n",
+                                        fmt_hex, "antenna A:",
                                         tx->tx_power.ant_a);
                 if ((priv->cfg->valid_tx_ant & ANT_B) && tx->tx_power.ant_b)
                         pos += scnprintf(buf + pos, bufsz - pos,
-                                        "\tantenna B: 0x%X\n",
+                                        fmt_hex, "antenna B:",
                                         tx->tx_power.ant_b);
                 if ((priv->cfg->valid_tx_ant & ANT_C) && tx->tx_power.ant_c)
                         pos += scnprintf(buf + pos, bufsz - pos,
-                                        "\tantenna C: 0x%X\n",
+                                        fmt_hex, "antenna C:",
                                         tx->tx_power.ant_c);
         }
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
@@ -809,7 +737,8 @@ ssize_t iwl_ucode_general_stats_read(struct file *file, char __user *user_buf,
           * the last statistics notification from uCode
           * might not reflect the current uCode activity
           */
-        if (priv->cfg->bt_statistics) {
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->bt_statistics) {
                 general = &priv->_agn.statistics_bt.general.common;
                 dbg = &priv->_agn.statistics_bt.general.common.dbg;
                 div = &priv->_agn.statistics_bt.general.common.div;
@@ -838,84 +767,72 @@ ssize_t iwl_ucode_general_stats_read(struct file *file, char __user *user_buf,
         }
 
         pos += iwl_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
-                         "acumulative       delta         max\n",
-                         "Statistics_General:");
-        pos += scnprintf(buf + pos, bufsz - pos, "  %-30s %10u\n",
-                         "temperature:",
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_header, "Statistics_General:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_value, "temperature:",
                          le32_to_cpu(general->temperature));
-        pos += scnprintf(buf + pos, bufsz - pos, "  %-30s %10u\n",
-                         "temperature_m:",
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_value, "temperature_m:",
                          le32_to_cpu(general->temperature_m));
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "burst_check:",
+                         fmt_value, "ttl_timestamp:",
+                         le32_to_cpu(general->ttl_timestamp));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_table, "burst_check:",
                          le32_to_cpu(dbg->burst_check),
                          accum_dbg->burst_check,
                          delta_dbg->burst_check, max_dbg->burst_check);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "burst_count:",
+                         fmt_table, "burst_count:",
                          le32_to_cpu(dbg->burst_count),
                          accum_dbg->burst_count,
                          delta_dbg->burst_count, max_dbg->burst_count);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "wait_for_silence_timeout_count:",
+                         fmt_table, "wait_for_silence_timeout_count:",
                          le32_to_cpu(dbg->wait_for_silence_timeout_cnt),
                          accum_dbg->wait_for_silence_timeout_cnt,
                          delta_dbg->wait_for_silence_timeout_cnt,
                          max_dbg->wait_for_silence_timeout_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "sleep_time:",
+                         fmt_table, "sleep_time:",
                          le32_to_cpu(general->sleep_time),
                          accum_general->sleep_time,
                          delta_general->sleep_time, max_general->sleep_time);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "slots_out:",
+                         fmt_table, "slots_out:",
                          le32_to_cpu(general->slots_out),
                          accum_general->slots_out,
                          delta_general->slots_out, max_general->slots_out);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "slots_idle:",
+                         fmt_table, "slots_idle:",
                          le32_to_cpu(general->slots_idle),
                          accum_general->slots_idle,
                          delta_general->slots_idle, max_general->slots_idle);
-        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp:\t\t\t%u\n",
-                         le32_to_cpu(general->ttl_timestamp));
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "tx_on_a:",
+                         fmt_table, "tx_on_a:",
                          le32_to_cpu(div->tx_on_a), accum_div->tx_on_a,
                          delta_div->tx_on_a, max_div->tx_on_a);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "tx_on_b:",
+                         fmt_table, "tx_on_b:",
                          le32_to_cpu(div->tx_on_b), accum_div->tx_on_b,
                          delta_div->tx_on_b, max_div->tx_on_b);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "exec_time:",
+                         fmt_table, "exec_time:",
                          le32_to_cpu(div->exec_time), accum_div->exec_time,
                          delta_div->exec_time, max_div->exec_time);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "probe_time:",
+                         fmt_table, "probe_time:",
                          le32_to_cpu(div->probe_time), accum_div->probe_time,
                          delta_div->probe_time, max_div->probe_time);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "rx_enable_counter:",
+                         fmt_table, "rx_enable_counter:",
                          le32_to_cpu(general->rx_enable_counter),
                          accum_general->rx_enable_counter,
                          delta_general->rx_enable_counter,
                          max_general->rx_enable_counter);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "num_of_sos_states:",
+                         fmt_table, "num_of_sos_states:",
                          le32_to_cpu(general->num_of_sos_states),
                          accum_general->num_of_sos_states,
                          delta_general->num_of_sos_states,
@@ -1011,3 +928,147 @@ ssize_t iwl_ucode_bt_stats_read(struct file *file,
         kfree(buf);
         return ret;
 }
+
+ssize_t iwl_reply_tx_error_read(struct file *file,
+                                char __user *user_buf,
+                                size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = (sizeof(struct reply_tx_error_statistics) * 24) +
+                (sizeof(struct reply_agg_tx_error_statistics) * 24) + 200;
+        ssize_t ret;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_TX_Error:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_POSTPONE_DELAY),
+                         priv->_agn.reply_tx_stats.pp_delay);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_POSTPONE_FEW_BYTES),
+                         priv->_agn.reply_tx_stats.pp_few_bytes);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_POSTPONE_BT_PRIO),
+                         priv->_agn.reply_tx_stats.pp_bt_prio);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_POSTPONE_QUIET_PERIOD),
+                         priv->_agn.reply_tx_stats.pp_quiet_period);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_POSTPONE_CALC_TTAK),
+                         priv->_agn.reply_tx_stats.pp_calc_ttak);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_tx_fail_reason(
+                                TX_STATUS_FAIL_INTERNAL_CROSSED_RETRY),
+                         priv->_agn.reply_tx_stats.int_crossed_retry);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_SHORT_LIMIT),
+                         priv->_agn.reply_tx_stats.short_limit);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_LONG_LIMIT),
+                         priv->_agn.reply_tx_stats.long_limit);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_FIFO_UNDERRUN),
+                         priv->_agn.reply_tx_stats.fifo_underrun);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_DRAIN_FLOW),
+                         priv->_agn.reply_tx_stats.drain_flow);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_RFKILL_FLUSH),
+                         priv->_agn.reply_tx_stats.rfkill_flush);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_LIFE_EXPIRE),
+                         priv->_agn.reply_tx_stats.life_expire);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_DEST_PS),
+                         priv->_agn.reply_tx_stats.dest_ps);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_HOST_ABORTED),
+                         priv->_agn.reply_tx_stats.host_abort);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_BT_RETRY),
+                         priv->_agn.reply_tx_stats.pp_delay);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_STA_INVALID),
+                         priv->_agn.reply_tx_stats.sta_invalid);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_FRAG_DROPPED),
+                         priv->_agn.reply_tx_stats.frag_drop);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_TID_DISABLE),
+                         priv->_agn.reply_tx_stats.tid_disable);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_FIFO_FLUSHED),
+                         priv->_agn.reply_tx_stats.fifo_flush);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_tx_fail_reason(
+                                TX_STATUS_FAIL_INSUFFICIENT_CF_POLL),
+                         priv->_agn.reply_tx_stats.insuff_cf_poll);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_PASSIVE_NO_RX),
+                         priv->_agn.reply_tx_stats.fail_hw_drop);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_tx_fail_reason(
+                                TX_STATUS_FAIL_NO_BEACON_ON_RADAR),
+                         priv->_agn.reply_tx_stats.sta_color_mismatch);
+        pos += scnprintf(buf + pos, bufsz - pos, "UNKNOWN:\t\t\t%u\n",
+                         priv->_agn.reply_tx_stats.unknown);
+
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "\nStatistics_Agg_TX_Error:\n");
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_UNDERRUN_MSK),
+                         priv->_agn.reply_agg_tx_stats.underrun);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_BT_PRIO_MSK),
+                         priv->_agn.reply_agg_tx_stats.bt_prio);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_FEW_BYTES_MSK),
+                         priv->_agn.reply_agg_tx_stats.few_bytes);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_ABORT_MSK),
+                         priv->_agn.reply_agg_tx_stats.abort);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(
+                                AGG_TX_STATE_LAST_SENT_TTL_MSK),
+                         priv->_agn.reply_agg_tx_stats.last_sent_ttl);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(
+                                AGG_TX_STATE_LAST_SENT_TRY_CNT_MSK),
+                         priv->_agn.reply_agg_tx_stats.last_sent_try);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(
+                                AGG_TX_STATE_LAST_SENT_BT_KILL_MSK),
+                         priv->_agn.reply_agg_tx_stats.last_sent_bt_kill);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_SCD_QUERY_MSK),
+                         priv->_agn.reply_agg_tx_stats.scd_query);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(
+                                AGG_TX_STATE_TEST_BAD_CRC32_MSK),
+                         priv->_agn.reply_agg_tx_stats.bad_crc32);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_RESPONSE_MSK),
+                         priv->_agn.reply_agg_tx_stats.response);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_DUMP_TX_MSK),
+                         priv->_agn.reply_agg_tx_stats.dump_tx);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_DELAY_TX_MSK),
+                         priv->_agn.reply_agg_tx_stats.delay_tx);
+        pos += scnprintf(buf + pos, bufsz - pos, "UNKNOWN:\t\t\t%u\n",
+                         priv->_agn.reply_agg_tx_stats.unknown);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h
index bbdce5913ac7..f2573b5486cd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h
@@ -39,6 +39,8 @@ ssize_t iwl_ucode_general_stats_read(struct file *file, char __user *user_buf,
                                      size_t count, loff_t *ppos);
 ssize_t iwl_ucode_bt_stats_read(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos);
+ssize_t iwl_reply_tx_error_read(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos);
 #else
 static ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
                                        size_t count, loff_t *ppos)
@@ -60,4 +62,9 @@ static ssize_t iwl_ucode_bt_stats_read(struct file *file, char __user *user_buf,
 {
         return 0;
 }
+static ssize_t iwl_reply_tx_error_read(struct file *file, char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        return 0;
+}
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
new file mode 100644
index 000000000000..a650baba0809
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
@@ -0,0 +1,454 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+
+#include <net/mac80211.h>
+
+#include "iwl-commands.h"
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-debug.h"
+#include "iwl-agn.h"
+#include "iwl-io.h"
+
+/************************** EEPROM BANDS ****************************
+ *
+ * The iwl_eeprom_band definitions below provide the mapping from the
+ * EEPROM contents to the specific channel number supported for each
+ * band.
+ *
+ * For example, iwl_priv->eeprom.band_3_channels[4] from the band_3
+ * definition below maps to physical channel 42 in the 5.2GHz spectrum.
+ * The specific geography and calibration information for that channel
+ * is contained in the eeprom map itself.
+ *
+ * During init, we copy the eeprom information and channel map
+ * information into priv->channel_info_24/52 and priv->channel_map_24/52
+ *
+ * channel_map_24/52 provides the index in the channel_info array for a
+ * given channel.  We have to have two separate maps as there is channel
+ * overlap with the 2.4GHz and 5.2GHz spectrum as seen in band_1 and
+ * band_2
+ *
+ * A value of 0xff stored in the channel_map indicates that the channel
+ * is not supported by the hardware at all.
+ *
+ * A value of 0xfe in the channel_map indicates that the channel is not
+ * valid for Tx with the current hardware.  This means that
+ * while the system can tune and receive on a given channel, it may not
+ * be able to associate or transmit any frames on that
+ * channel.  There is no corresponding channel information for that
+ * entry.
+ *
+ *********************************************************************/
+
+/**
+ * struct iwl_txpwr_section: eeprom section information
+ * @offset: indirect address into eeprom image
+ * @count: number of "struct iwl_eeprom_enhanced_txpwr" in this section
+ * @band: band type for the section
+ * @is_common - true: common section, false: channel section
+ * @is_cck - true: cck section, false: not cck section
+ * @is_ht_40 - true: all channel in the section are HT40 channel,
+ *             false: legacy or HT 20 MHz
+ *             ignore if it is common section
+ * @iwl_eeprom_section_channel: channel array in the section,
+ *             ignore if common section
+ */
+struct iwl_txpwr_section {
+        u32 offset;
+        u8 count;
+        enum ieee80211_band band;
+        bool is_common;
+        bool is_cck;
+        bool is_ht40;
+        u8 iwl_eeprom_section_channel[EEPROM_MAX_TXPOWER_SECTION_ELEMENTS];
+};
+
+/**
+ * section 1 - 3 are regulatory tx power apply to all channels based on
+ *    modulation: CCK, OFDM
+ *    Band: 2.4GHz, 5.2GHz
+ * section 4 - 10 are regulatory tx power apply to specified channels
+ *    For example:
+ *      1L - Channel 1 Legacy
+ *      1HT - Channel 1 HT
+ *      (1,+1) - Channel 1 HT40 "_above_"
+ *
+ * Section 1: all CCK channels
+ * Section 2: all 2.4 GHz OFDM (Legacy, HT and HT40) channels
+ * Section 3: all 5.2 GHz OFDM (Legacy, HT and HT40) channels
+ * Section 4: 2.4 GHz 20MHz channels: 1L, 1HT, 2L, 2HT, 10L, 10HT, 11L, 11HT
+ * Section 5: 2.4 GHz 40MHz channels: (1,+1) (2,+1) (6,+1) (7,+1) (9,+1)
+ * Section 6: 5.2 GHz 20MHz channels: 36L, 64L, 100L, 36HT, 64HT, 100HT
+ * Section 7: 5.2 GHz 40MHz channels: (36,+1) (60,+1) (100,+1)
+ * Section 8: 2.4 GHz channel: 13L, 13HT
+ * Section 9: 2.4 GHz channel: 140L, 140HT
+ * Section 10: 2.4 GHz 40MHz channels: (132,+1)  (44,+1)
+ *
+ */
+static const struct iwl_txpwr_section enhinfo[] = {
+        { EEPROM_LB_CCK_20_COMMON, 1, IEEE80211_BAND_2GHZ, true, true, false },
+        { EEPROM_LB_OFDM_COMMON, 3, IEEE80211_BAND_2GHZ, true, false, false },
+        { EEPROM_HB_OFDM_COMMON, 3, IEEE80211_BAND_5GHZ, true, false, false },
+        { EEPROM_LB_OFDM_20_BAND, 8, IEEE80211_BAND_2GHZ,
+                false, false, false,
+                {1, 1, 2, 2, 10, 10, 11, 11 } },
+        { EEPROM_LB_OFDM_HT40_BAND, 5, IEEE80211_BAND_2GHZ,
+                false, false, true,
+                { 1, 2, 6, 7, 9 } },
+        { EEPROM_HB_OFDM_20_BAND, 6, IEEE80211_BAND_5GHZ,
+                false, false, false,
+                { 36, 64, 100, 36, 64, 100 } },
+        { EEPROM_HB_OFDM_HT40_BAND, 3, IEEE80211_BAND_5GHZ,
+                false, false, true,
+                { 36, 60, 100 } },
+        { EEPROM_LB_OFDM_20_CHANNEL_13, 2, IEEE80211_BAND_2GHZ,
+                false, false, false,
+                { 13, 13 } },
+        { EEPROM_HB_OFDM_20_CHANNEL_140, 2, IEEE80211_BAND_5GHZ,
+                false, false, false,
+                { 140, 140 } },
+        { EEPROM_HB_OFDM_HT40_BAND_1, 2, IEEE80211_BAND_5GHZ,
+                false, false, true,
+                { 132, 44 } },
+};
+
+/******************************************************************************
+ *
+ * EEPROM related functions
+ *
+******************************************************************************/
+
+/*
+ * The device's EEPROM semaphore prevents conflicts between driver and uCode
+ * when accessing the EEPROM; each access is a series of pulses to/from the
+ * EEPROM chip, not a single event, so even reads could conflict if they
+ * weren't arbitrated by the semaphore.
+ */
+int iwlcore_eeprom_acquire_semaphore(struct iwl_priv *priv)
+{
+        u16 count;
+        int ret;
+
+        for (count = 0; count < EEPROM_SEM_RETRY_LIMIT; count++) {
+                /* Request semaphore */
+                iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
+                            CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM);
+
+                /* See if we got it */
+                ret = iwl_poll_bit(priv, CSR_HW_IF_CONFIG_REG,
+                                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM,
+                                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM,
+                                EEPROM_SEM_TIMEOUT);
+                if (ret >= 0) {
+                        IWL_DEBUG_IO(priv,
+                                "Acquired semaphore after %d tries.\n",
+                                count+1);
+                        return ret;
+                }
+        }
+
+        return ret;
+}
+
+void iwlcore_eeprom_release_semaphore(struct iwl_priv *priv)
+{
+        iwl_clear_bit(priv, CSR_HW_IF_CONFIG_REG,
+                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM);
+
+}
+
+int iwl_eeprom_check_version(struct iwl_priv *priv)
+{
+        u16 eeprom_ver;
+        u16 calib_ver;
+
+        eeprom_ver = iwl_eeprom_query16(priv, EEPROM_VERSION);
+        calib_ver = priv->cfg->ops->lib->eeprom_ops.calib_version(priv);
+
+        if (eeprom_ver < priv->cfg->eeprom_ver ||
+            calib_ver < priv->cfg->eeprom_calib_ver)
+                goto err;
+
+        IWL_INFO(priv, "device EEPROM VER=0x%x, CALIB=0x%x\n",
+                 eeprom_ver, calib_ver);
+
+        return 0;
+err:
+        IWL_ERR(priv, "Unsupported (too old) EEPROM VER=0x%x < 0x%x "
+                  "CALIB=0x%x < 0x%x\n",
+                  eeprom_ver, priv->cfg->eeprom_ver,
+                  calib_ver,  priv->cfg->eeprom_calib_ver);
+        return -EINVAL;
+
+}
+
+void iwl_eeprom_get_mac(const struct iwl_priv *priv, u8 *mac)
+{
+        const u8 *addr = priv->cfg->ops->lib->eeprom_ops.query_addr(priv,
+                                        EEPROM_MAC_ADDRESS);
+        memcpy(mac, addr, ETH_ALEN);
+}
+
+/**
+ * iwl_get_max_txpower_avg - get the highest tx power from all chains.
+ *     find the highest tx power from all chains for the channel
+ */
+static s8 iwl_get_max_txpower_avg(struct iwl_priv *priv,
+                struct iwl_eeprom_enhanced_txpwr *enhanced_txpower,
+                int element, s8 *max_txpower_in_half_dbm)
+{
+        s8 max_txpower_avg = 0; /* (dBm) */
+
+        IWL_DEBUG_INFO(priv, "%d - "
+                        "chain_a: %d dB chain_b: %d dB "
+                        "chain_c: %d dB mimo2: %d dB mimo3: %d dB\n",
+                        element,
+                        enhanced_txpower[element].chain_a_max >> 1,
+                        enhanced_txpower[element].chain_b_max >> 1,
+                        enhanced_txpower[element].chain_c_max >> 1,
+                        enhanced_txpower[element].mimo2_max >> 1,
+                        enhanced_txpower[element].mimo3_max >> 1);
+        /* Take the highest tx power from any valid chains */
+        if ((priv->cfg->valid_tx_ant & ANT_A) &&
+            (enhanced_txpower[element].chain_a_max > max_txpower_avg))
+                max_txpower_avg = enhanced_txpower[element].chain_a_max;
+        if ((priv->cfg->valid_tx_ant & ANT_B) &&
+            (enhanced_txpower[element].chain_b_max > max_txpower_avg))
+                max_txpower_avg = enhanced_txpower[element].chain_b_max;
+        if ((priv->cfg->valid_tx_ant & ANT_C) &&
+            (enhanced_txpower[element].chain_c_max > max_txpower_avg))
+                max_txpower_avg = enhanced_txpower[element].chain_c_max;
+        if (((priv->cfg->valid_tx_ant == ANT_AB) |
+            (priv->cfg->valid_tx_ant == ANT_BC) |
+            (priv->cfg->valid_tx_ant == ANT_AC)) &&
+            (enhanced_txpower[element].mimo2_max > max_txpower_avg))
+                max_txpower_avg =  enhanced_txpower[element].mimo2_max;
+        if ((priv->cfg->valid_tx_ant == ANT_ABC) &&
+            (enhanced_txpower[element].mimo3_max > max_txpower_avg))
+                max_txpower_avg = enhanced_txpower[element].mimo3_max;
+
+        /*
+         * max. tx power in EEPROM is in 1/2 dBm format
+         * convert from 1/2 dBm to dBm (round-up convert)
+         * but we also do not want to loss 1/2 dBm resolution which
+         * will impact performance
+         */
+        *max_txpower_in_half_dbm = max_txpower_avg;
+        return (max_txpower_avg & 0x01) + (max_txpower_avg >> 1);
+}
+
+/**
+ * iwl_update_common_txpower: update channel tx power
+ *     update tx power per band based on EEPROM enhanced tx power info.
+ */
+static s8 iwl_update_common_txpower(struct iwl_priv *priv,
+                struct iwl_eeprom_enhanced_txpwr *enhanced_txpower,
+                int section, int element, s8 *max_txpower_in_half_dbm)
+{
+        struct iwl_channel_info *ch_info;
+        int ch;
+        bool is_ht40 = false;
+        s8 max_txpower_avg; /* (dBm) */
+
+        /* it is common section, contain all type (Legacy, HT and HT40)
+         * based on the element in the section to determine
+         * is it HT 40 or not
+         */
+        if (element == EEPROM_TXPOWER_COMMON_HT40_INDEX)
+                is_ht40 = true;
+        max_txpower_avg =
+                iwl_get_max_txpower_avg(priv, enhanced_txpower,
+                                        element, max_txpower_in_half_dbm);
+
+        ch_info = priv->channel_info;
+
+        for (ch = 0; ch < priv->channel_count; ch++) {
+                /* find matching band and update tx power if needed */
+                if ((ch_info->band == enhinfo[section].band) &&
+                    (ch_info->max_power_avg < max_txpower_avg) &&
+                    (!is_ht40)) {
+                        /* Update regulatory-based run-time data */
+                        ch_info->max_power_avg = ch_info->curr_txpow =
+                                max_txpower_avg;
+                        ch_info->scan_power = max_txpower_avg;
+                }
+                if ((ch_info->band == enhinfo[section].band) && is_ht40 &&
+                    (ch_info->ht40_max_power_avg < max_txpower_avg)) {
+                        /* Update regulatory-based run-time data */
+                        ch_info->ht40_max_power_avg = max_txpower_avg;
+                }
+                ch_info++;
+        }
+        return max_txpower_avg;
+}
+
+/**
+ * iwl_update_channel_txpower: update channel tx power
+ *      update channel tx power based on EEPROM enhanced tx power info.
+ */
+static s8 iwl_update_channel_txpower(struct iwl_priv *priv,
+                struct iwl_eeprom_enhanced_txpwr *enhanced_txpower,
+                int section, int element, s8 *max_txpower_in_half_dbm)
+{
+        struct iwl_channel_info *ch_info;
+        int ch;
+        u8 channel;
+        s8 max_txpower_avg; /* (dBm) */
+
+        channel = enhinfo[section].iwl_eeprom_section_channel[element];
+        max_txpower_avg =
+                iwl_get_max_txpower_avg(priv, enhanced_txpower,
+                                        element, max_txpower_in_half_dbm);
+
+        ch_info = priv->channel_info;
+        for (ch = 0; ch < priv->channel_count; ch++) {
+                /* find matching channel and update tx power if needed */
+                if (ch_info->channel == channel) {
+                        if ((ch_info->max_power_avg < max_txpower_avg) &&
+                            (!enhinfo[section].is_ht40)) {
+                                /* Update regulatory-based run-time data */
+                                ch_info->max_power_avg = max_txpower_avg;
+                                ch_info->curr_txpow = max_txpower_avg;
+                                ch_info->scan_power = max_txpower_avg;
+                        }
+                        if ((enhinfo[section].is_ht40) &&
+                            (ch_info->ht40_max_power_avg < max_txpower_avg)) {
+                                /* Update regulatory-based run-time data */
+                                ch_info->ht40_max_power_avg = max_txpower_avg;
+                        }
+                        break;
+                }
+                ch_info++;
+        }
+        return max_txpower_avg;
+}
+
+/**
+ * iwlcore_eeprom_enhanced_txpower: process enhanced tx power info
+ */
+void iwlcore_eeprom_enhanced_txpower(struct iwl_priv *priv)
+{
+        int eeprom_section_count = 0;
+        int section, element;
+        struct iwl_eeprom_enhanced_txpwr *enhanced_txpower;
+        u32 offset;
+        s8 max_txpower_avg; /* (dBm) */
+        s8 max_txpower_in_half_dbm; /* (half-dBm) */
+
+        /* Loop through all the sections
+         * adjust bands and channel's max tx power
+         * Set the tx_power_user_lmt to the highest power
+         * supported by any channels and chains
+         */
+        for (section = 0; section < ARRAY_SIZE(enhinfo); section++) {
+                eeprom_section_count = enhinfo[section].count;
+                offset = enhinfo[section].offset;
+                enhanced_txpower = (struct iwl_eeprom_enhanced_txpwr *)
+                                iwl_eeprom_query_addr(priv, offset);
+
+                /*
+                 * check for valid entry -
+                 * different version of EEPROM might contain different set
+                 * of enhanced tx power table
+                 * always check for valid entry before process
+                 * the information
+                 */
+                if (!enhanced_txpower->common || enhanced_txpower->reserved)
+                        continue;
+
+                for (element = 0; element < eeprom_section_count; element++) {
+                        if (enhinfo[section].is_common)
+                                max_txpower_avg =
+                                        iwl_update_common_txpower(priv,
+                                                enhanced_txpower, section,
+                                                element,
+                                                &max_txpower_in_half_dbm);
+                        else
+                                max_txpower_avg =
+                                        iwl_update_channel_txpower(priv,
+                                                enhanced_txpower, section,
+                                                element,
+                                                &max_txpower_in_half_dbm);
+
+                        /* Update the tx_power_user_lmt to the highest power
+                         * supported by any channel */
+                        if (max_txpower_avg > priv->tx_power_user_lmt)
+                                priv->tx_power_user_lmt = max_txpower_avg;
+
+                        /*
+                         * Update the tx_power_lmt_in_half_dbm to
+                         * the highest power supported by any channel
+                         */
+                        if (max_txpower_in_half_dbm >
+                            priv->tx_power_lmt_in_half_dbm)
+                                priv->tx_power_lmt_in_half_dbm =
+                                        max_txpower_in_half_dbm;
+                }
+        }
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
index 6fb52abafc8d..ffb2f4111ad0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
@@ -137,7 +137,7 @@ static void iwlagn_gain_computation(struct iwl_priv *priv,
                         continue;
                 }
 
-                delta_g = (priv->cfg->chain_noise_scale *
+                delta_g = (priv->cfg->base_params->chain_noise_scale *
                         ((s32)average_noise[default_chain] -
                         (s32)average_noise[i])) / 1500;
 
@@ -222,7 +222,8 @@ static void iwlagn_tx_cmd_protection(struct iwl_priv *priv,
                 return;
         }
 
-        if (priv->cfg->use_rts_for_aggregation &&
+        if (priv->cfg->ht_params &&
+            priv->cfg->ht_params->use_rts_for_aggregation &&
             info->flags & IEEE80211_TX_CTL_AMPDU) {
                 *tx_flags |= TX_CMD_FLG_PROT_REQUIRE_MSK;
                 return;
@@ -287,6 +288,15 @@ static int iwlagn_set_pan_params(struct iwl_priv *priv)
         ctx_bss = &priv->contexts[IWL_RXON_CTX_BSS];
         ctx_pan = &priv->contexts[IWL_RXON_CTX_PAN];
 
+        /*
+         * If the PAN context is inactive, then we don't need
+         * to update the PAN parameters, the last thing we'll
+         * have done before it goes inactive is making the PAN
+         * parameters be WLAN-only.
+         */
+        if (!ctx_pan->is_active)
+                return 0;
+
         memset(&cmd, 0, sizeof(cmd));
 
         /* only 2 slots are currently allowed */
@@ -312,7 +322,7 @@ static int iwlagn_set_pan_params(struct iwl_priv *priv)
                         bcnint = max_t(int, bcnint,
                                        ctx_bss->vif->bss_conf.beacon_int);
                 if (!bcnint)
-                        bcnint = 100;
+                        bcnint = DEFAULT_BEACON_INTERVAL;
                 slot0 = bcnint / 2;
                 slot1 = bcnint - slot0;
 
@@ -330,7 +340,12 @@ static int iwlagn_set_pan_params(struct iwl_priv *priv)
                 slot0 = 0;
                 slot1 = max_t(int, 1, ctx_pan->vif->bss_conf.dtim_period) *
                                         ctx_pan->vif->bss_conf.beacon_int;
-                slot1 = max_t(int, 100, slot1);
+                slot1 = max_t(int, DEFAULT_BEACON_INTERVAL, slot1);
+
+                if (test_bit(STATUS_SCAN_HW, &priv->status)) {
+                        slot0 = slot1 * 3 - 20;
+                        slot1 = 20;
+                }
         }
 
         cmd.slots[0].width = cpu_to_le16(slot0);
@@ -345,8 +360,8 @@ static int iwlagn_set_pan_params(struct iwl_priv *priv)
 
 struct iwl_hcmd_ops iwlagn_hcmd = {
         .rxon_assoc = iwlagn_send_rxon_assoc,
-        .commit_rxon = iwl_commit_rxon,
-        .set_rxon_chain = iwl_set_rxon_chain,
+        .commit_rxon = iwlagn_commit_rxon,
+        .set_rxon_chain = iwlagn_set_rxon_chain,
         .set_tx_ant = iwlagn_send_tx_ant_config,
         .send_bt_config = iwl_send_bt_config,
         .set_pan_params = iwlagn_set_pan_params,
@@ -354,8 +369,8 @@ struct iwl_hcmd_ops iwlagn_hcmd = {
 
 struct iwl_hcmd_ops iwlagn_bt_hcmd = {
         .rxon_assoc = iwlagn_send_rxon_assoc,
-        .commit_rxon = iwl_commit_rxon,
-        .set_rxon_chain = iwl_set_rxon_chain,
+        .commit_rxon = iwlagn_commit_rxon,
+        .set_rxon_chain = iwlagn_set_rxon_chain,
         .set_tx_ant = iwlagn_send_tx_ant_config,
         .send_bt_config = iwlagn_send_advance_bt_config,
         .set_pan_params = iwlagn_set_pan_params,
@@ -369,4 +384,5 @@ struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
         .tx_cmd_protection = iwlagn_tx_cmd_protection,
         .calc_rssi = iwlagn_calc_rssi,
         .request_scan = iwlagn_request_scan,
+        .post_scan = iwlagn_post_scan,
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ict.c b/drivers/net/wireless/iwlwifi/iwl-agn-ict.c
index c92b2c0cbd91..a5dbfea1bfad 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-ict.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ict.c
@@ -59,7 +59,7 @@ void iwl_free_isr_ict(struct iwl_priv *priv)
 int iwl_alloc_isr_ict(struct iwl_priv *priv)
 {
 
-        if (priv->cfg->use_isr_legacy)
+        if (priv->cfg->base_params->use_isr_legacy)
                 return 0;
         /* allocate shrared data table */
         priv->_agn.ict_tbl_vir =
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index a8f2adfd799e..b555edd53354 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -40,22 +40,195 @@
 #include "iwl-agn.h"
 #include "iwl-sta.h"
 
-static inline u32 iwlagn_get_scd_ssn(struct iwl5000_tx_resp *tx_resp)
+static inline u32 iwlagn_get_scd_ssn(struct iwlagn_tx_resp *tx_resp)
 {
         return le32_to_cpup((__le32 *)&tx_resp->status +
                             tx_resp->frame_count) & MAX_SN;
 }
 
+static void iwlagn_count_tx_err_status(struct iwl_priv *priv, u16 status)
+{
+        status &= TX_STATUS_MSK;
+
+        switch (status) {
+        case TX_STATUS_POSTPONE_DELAY:
+                priv->_agn.reply_tx_stats.pp_delay++;
+                break;
+        case TX_STATUS_POSTPONE_FEW_BYTES:
+                priv->_agn.reply_tx_stats.pp_few_bytes++;
+                break;
+        case TX_STATUS_POSTPONE_BT_PRIO:
+                priv->_agn.reply_tx_stats.pp_bt_prio++;
+                break;
+        case TX_STATUS_POSTPONE_QUIET_PERIOD:
+                priv->_agn.reply_tx_stats.pp_quiet_period++;
+                break;
+        case TX_STATUS_POSTPONE_CALC_TTAK:
+                priv->_agn.reply_tx_stats.pp_calc_ttak++;
+                break;
+        case TX_STATUS_FAIL_INTERNAL_CROSSED_RETRY:
+                priv->_agn.reply_tx_stats.int_crossed_retry++;
+                break;
+        case TX_STATUS_FAIL_SHORT_LIMIT:
+                priv->_agn.reply_tx_stats.short_limit++;
+                break;
+        case TX_STATUS_FAIL_LONG_LIMIT:
+                priv->_agn.reply_tx_stats.long_limit++;
+                break;
+        case TX_STATUS_FAIL_FIFO_UNDERRUN:
+                priv->_agn.reply_tx_stats.fifo_underrun++;
+                break;
+        case TX_STATUS_FAIL_DRAIN_FLOW:
+                priv->_agn.reply_tx_stats.drain_flow++;
+                break;
+        case TX_STATUS_FAIL_RFKILL_FLUSH:
+                priv->_agn.reply_tx_stats.rfkill_flush++;
+                break;
+        case TX_STATUS_FAIL_LIFE_EXPIRE:
+                priv->_agn.reply_tx_stats.life_expire++;
+                break;
+        case TX_STATUS_FAIL_DEST_PS:
+                priv->_agn.reply_tx_stats.dest_ps++;
+                break;
+        case TX_STATUS_FAIL_HOST_ABORTED:
+                priv->_agn.reply_tx_stats.host_abort++;
+                break;
+        case TX_STATUS_FAIL_BT_RETRY:
+                priv->_agn.reply_tx_stats.bt_retry++;
+                break;
+        case TX_STATUS_FAIL_STA_INVALID:
+                priv->_agn.reply_tx_stats.sta_invalid++;
+                break;
+        case TX_STATUS_FAIL_FRAG_DROPPED:
+                priv->_agn.reply_tx_stats.frag_drop++;
+                break;
+        case TX_STATUS_FAIL_TID_DISABLE:
+                priv->_agn.reply_tx_stats.tid_disable++;
+                break;
+        case TX_STATUS_FAIL_FIFO_FLUSHED:
+                priv->_agn.reply_tx_stats.fifo_flush++;
+                break;
+        case TX_STATUS_FAIL_INSUFFICIENT_CF_POLL:
+                priv->_agn.reply_tx_stats.insuff_cf_poll++;
+                break;
+        case TX_STATUS_FAIL_PASSIVE_NO_RX:
+                priv->_agn.reply_tx_stats.fail_hw_drop++;
+                break;
+        case TX_STATUS_FAIL_NO_BEACON_ON_RADAR:
+                priv->_agn.reply_tx_stats.sta_color_mismatch++;
+                break;
+        default:
+                priv->_agn.reply_tx_stats.unknown++;
+                break;
+        }
+}
+
+static void iwlagn_count_agg_tx_err_status(struct iwl_priv *priv, u16 status)
+{
+        status &= AGG_TX_STATUS_MSK;
+
+        switch (status) {
+        case AGG_TX_STATE_UNDERRUN_MSK:
+                priv->_agn.reply_agg_tx_stats.underrun++;
+                break;
+        case AGG_TX_STATE_BT_PRIO_MSK:
+                priv->_agn.reply_agg_tx_stats.bt_prio++;
+                break;
+        case AGG_TX_STATE_FEW_BYTES_MSK:
+                priv->_agn.reply_agg_tx_stats.few_bytes++;
+                break;
+        case AGG_TX_STATE_ABORT_MSK:
+                priv->_agn.reply_agg_tx_stats.abort++;
+                break;
+        case AGG_TX_STATE_LAST_SENT_TTL_MSK:
+                priv->_agn.reply_agg_tx_stats.last_sent_ttl++;
+                break;
+        case AGG_TX_STATE_LAST_SENT_TRY_CNT_MSK:
+                priv->_agn.reply_agg_tx_stats.last_sent_try++;
+                break;
+        case AGG_TX_STATE_LAST_SENT_BT_KILL_MSK:
+                priv->_agn.reply_agg_tx_stats.last_sent_bt_kill++;
+                break;
+        case AGG_TX_STATE_SCD_QUERY_MSK:
+                priv->_agn.reply_agg_tx_stats.scd_query++;
+                break;
+        case AGG_TX_STATE_TEST_BAD_CRC32_MSK:
+                priv->_agn.reply_agg_tx_stats.bad_crc32++;
+                break;
+        case AGG_TX_STATE_RESPONSE_MSK:
+                priv->_agn.reply_agg_tx_stats.response++;
+                break;
+        case AGG_TX_STATE_DUMP_TX_MSK:
+                priv->_agn.reply_agg_tx_stats.dump_tx++;
+                break;
+        case AGG_TX_STATE_DELAY_TX_MSK:
+                priv->_agn.reply_agg_tx_stats.delay_tx++;
+                break;
+        default:
+                priv->_agn.reply_agg_tx_stats.unknown++;
+                break;
+        }
+}
+
+static void iwlagn_set_tx_status(struct iwl_priv *priv,
+                                 struct ieee80211_tx_info *info,
+                                 struct iwlagn_tx_resp *tx_resp,
+                                 int txq_id, bool is_agg)
+{
+        u16  status = le16_to_cpu(tx_resp->status.status);
+
+        info->status.rates[0].count = tx_resp->failure_frame + 1;
+        if (is_agg)
+                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+        info->flags |= iwl_tx_status_to_mac80211(status);
+        iwlagn_hwrate_to_tx_control(priv, le32_to_cpu(tx_resp->rate_n_flags),
+                                    info);
+        if (!iwl_is_tx_success(status))
+                iwlagn_count_tx_err_status(priv, status);
+
+        IWL_DEBUG_TX_REPLY(priv, "TXQ %d status %s (0x%08x) rate_n_flags "
+                           "0x%x retries %d\n",
+                           txq_id,
+                           iwl_get_tx_fail_reason(status), status,
+                           le32_to_cpu(tx_resp->rate_n_flags),
+                           tx_resp->failure_frame);
+}
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+#define AGG_TX_STATE_FAIL(x) case AGG_TX_STATE_ ## x: return #x
+
+const char *iwl_get_agg_tx_fail_reason(u16 status)
+{
+        status &= AGG_TX_STATUS_MSK;
+        switch (status) {
+        case AGG_TX_STATE_TRANSMITTED:
+                return "SUCCESS";
+                AGG_TX_STATE_FAIL(UNDERRUN_MSK);
+                AGG_TX_STATE_FAIL(BT_PRIO_MSK);
+                AGG_TX_STATE_FAIL(FEW_BYTES_MSK);
+                AGG_TX_STATE_FAIL(ABORT_MSK);
+                AGG_TX_STATE_FAIL(LAST_SENT_TTL_MSK);
+                AGG_TX_STATE_FAIL(LAST_SENT_TRY_CNT_MSK);
+                AGG_TX_STATE_FAIL(LAST_SENT_BT_KILL_MSK);
+                AGG_TX_STATE_FAIL(SCD_QUERY_MSK);
+                AGG_TX_STATE_FAIL(TEST_BAD_CRC32_MSK);
+                AGG_TX_STATE_FAIL(RESPONSE_MSK);
+                AGG_TX_STATE_FAIL(DUMP_TX_MSK);
+                AGG_TX_STATE_FAIL(DELAY_TX_MSK);
+        }
+
+        return "UNKNOWN";
+}
+#endif /* CONFIG_IWLWIFI_DEBUG */
+
 static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
                                       struct iwl_ht_agg *agg,
-                                      struct iwl5000_tx_resp *tx_resp,
+                                      struct iwlagn_tx_resp *tx_resp,
                                       int txq_id, u16 start_idx)
 {
         u16 status;
         struct agg_tx_status *frame_status = &tx_resp->status;
-        struct ieee80211_tx_info *info = NULL;
         struct ieee80211_hdr *hdr = NULL;
-        u32 rate_n_flags = le32_to_cpu(tx_resp->rate_n_flags);
         int i, sh, idx;
         u16 seq;
 
@@ -64,31 +237,20 @@ static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
 
         agg->frame_count = tx_resp->frame_count;
         agg->start_idx = start_idx;
-        agg->rate_n_flags = rate_n_flags;
+        agg->rate_n_flags = le32_to_cpu(tx_resp->rate_n_flags);
         agg->bitmap = 0;
 
         /* # frames attempted by Tx command */
         if (agg->frame_count == 1) {
                 /* Only one frame was attempted; no block-ack will arrive */
-                status = le16_to_cpu(frame_status[0].status);
                 idx = start_idx;
 
-                /* FIXME: code repetition */
                 IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, StartIdx=%d idx=%d\n",
                                    agg->frame_count, agg->start_idx, idx);
-
-                info = IEEE80211_SKB_CB(priv->txq[txq_id].txb[idx].skb);
-                info->status.rates[0].count = tx_resp->failure_frame + 1;
-                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-                info->flags |= iwl_tx_status_to_mac80211(status);
-                iwlagn_hwrate_to_tx_control(priv, rate_n_flags, info);
-
-                /* FIXME: code repetition end */
-
-                IWL_DEBUG_TX_REPLY(priv, "1 Frame 0x%x failure :%d\n",
-                                    status & 0xff, tx_resp->failure_frame);
-                IWL_DEBUG_TX_REPLY(priv, "Rate Info rate_n_flags=%x\n", rate_n_flags);
-
+                iwlagn_set_tx_status(priv,
+                                     IEEE80211_SKB_CB(
+                                        priv->txq[txq_id].txb[idx].skb),
+                                     tx_resp, txq_id, true);
                 agg->wait_for_ba = 0;
         } else {
                 /* Two or more frames were attempted; expect block-ack */
@@ -109,12 +271,20 @@ static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
                         idx = SEQ_TO_INDEX(seq);
                         txq_id = SEQ_TO_QUEUE(seq);
 
+                        if (status & AGG_TX_STATUS_MSK)
+                                iwlagn_count_agg_tx_err_status(priv, status);
+
                         if (status & (AGG_TX_STATE_FEW_BYTES_MSK |
                                       AGG_TX_STATE_ABORT_MSK))
                                 continue;
 
                         IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, txq_id=%d idx=%d\n",
                                            agg->frame_count, txq_id, idx);
+                        IWL_DEBUG_TX_REPLY(priv, "status %s (0x%08x), "
+                                           "try-count (0x%08x)\n",
+                                           iwl_get_agg_tx_fail_reason(status),
+                                           status & AGG_TX_STATUS_MSK,
+                                           status & AGG_TX_TRY_MSK);
 
                         hdr = iwl_tx_queue_get_hdr(priv, txq_id, idx);
                         if (!hdr) {
@@ -220,7 +390,7 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
         int index = SEQ_TO_INDEX(sequence);
         struct iwl_tx_queue *txq = &priv->txq[txq_id];
         struct ieee80211_tx_info *info;
-        struct iwl5000_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
+        struct iwlagn_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
         u32  status = le16_to_cpu(tx_resp->status.status);
         int tid;
         int sta_id;
@@ -238,8 +408,10 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
         info = IEEE80211_SKB_CB(txq->txb[txq->q.read_ptr].skb);
         memset(&info->status, 0, sizeof(info->status));
 
-        tid = (tx_resp->ra_tid & IWL50_TX_RES_TID_MSK) >> IWL50_TX_RES_TID_POS;
-        sta_id = (tx_resp->ra_tid & IWL50_TX_RES_RA_MSK) >> IWL50_TX_RES_RA_POS;
+        tid = (tx_resp->ra_tid & IWLAGN_TX_RES_TID_MSK) >>
+                IWLAGN_TX_RES_TID_POS;
+        sta_id = (tx_resp->ra_tid & IWLAGN_TX_RES_RA_MSK) >>
+                IWLAGN_TX_RES_RA_POS;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
         if (txq->sched_retry) {
@@ -252,7 +424,8 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
                  * notification again.
                  */
                 if (tx_resp->bt_kill_count && tx_resp->frame_count == 1 &&
-                    priv->cfg->advanced_bt_coexist) {
+                    priv->cfg->bt_params &&
+                    priv->cfg->bt_params->advanced_bt_coexist) {
                         IWL_WARN(priv, "receive reply tx with bt_kill\n");
                 }
                 iwlagn_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);
@@ -281,20 +454,7 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
                 }
         } else {
                 BUG_ON(txq_id != txq->swq_id);
-
-                info->status.rates[0].count = tx_resp->failure_frame + 1;
-                info->flags |= iwl_tx_status_to_mac80211(status);
-                iwlagn_hwrate_to_tx_control(priv,
-                                        le32_to_cpu(tx_resp->rate_n_flags),
-                                        info);
-
-                IWL_DEBUG_TX_REPLY(priv, "TXQ %d status %s (0x%08x) rate_n_flags "
-                                   "0x%x retries %d\n",
-                                   txq_id,
-                                   iwl_get_tx_fail_reason(status), status,
-                                   le32_to_cpu(tx_resp->rate_n_flags),
-                                   tx_resp->failure_frame);
-
+                iwlagn_set_tx_status(priv, info, tx_resp, txq_id, false);
                 freed = iwlagn_tx_queue_reclaim(priv, txq_id, index);
                 iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
@@ -333,7 +493,7 @@ int iwlagn_hw_valid_rtc_data_addr(u32 addr)
 
 int iwlagn_send_tx_power(struct iwl_priv *priv)
 {
-        struct iwl5000_tx_power_dbm_cmd tx_power_cmd;
+        struct iwlagn_tx_power_dbm_cmd tx_power_cmd;
         u8 tx_ant_cfg_cmd;
 
         /* half dBm need to multiply */
@@ -354,8 +514,8 @@ int iwlagn_send_tx_power(struct iwl_priv *priv)
                  */
                 tx_power_cmd.global_lmt = priv->tx_power_lmt_in_half_dbm;
         }
-        tx_power_cmd.flags = IWL50_TX_POWER_NO_CLOSED;
-        tx_power_cmd.srv_chan_lmt = IWL50_TX_POWER_AUTO;
+        tx_power_cmd.flags = IWLAGN_TX_POWER_NO_CLOSED;
+        tx_power_cmd.srv_chan_lmt = IWLAGN_TX_POWER_AUTO;
 
         if (IWL_UCODE_API(priv->ucode_ver) == 1)
                 tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD_V1;
@@ -432,7 +592,7 @@ const u8 *iwlagn_eeprom_query_addr(const struct iwl_priv *priv,
                                            size_t offset)
 {
         u32 address = eeprom_indirect_address(priv, offset);
-        BUG_ON(address >= priv->cfg->eeprom_size);
+        BUG_ON(address >= priv->cfg->base_params->eeprom_size);
         return &priv->eeprom[address];
 }
 
@@ -480,7 +640,7 @@ int iwlagn_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         const u32 rfdnlog = RX_QUEUE_SIZE_LOG; /* 256 RBDs */
         u32 rb_timeout = 0; /* FIXME: RX_RB_TIMEOUT for all devices? */
 
-        if (!priv->cfg->use_isr_legacy)
+        if (!priv->cfg->base_params->use_isr_legacy)
                 rb_timeout = RX_RB_TIMEOUT;
 
         if (priv->cfg->mod_params->amsdu_size_8K)
@@ -525,6 +685,23 @@ int iwlagn_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         return 0;
 }
 
+static void iwlagn_set_pwr_vmain(struct iwl_priv *priv)
+{
+/*
+ * (for documentation purposes)
+ * to set power to V_AUX, do:
+
+                if (pci_pme_capable(priv->pci_dev, PCI_D3cold))
+                        iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
+                                               APMG_PS_CTRL_VAL_PWR_SRC_VAUX,
+                                               ~APMG_PS_CTRL_MSK_PWR_SRC);
+ */
+
+        iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
+                               APMG_PS_CTRL_VAL_PWR_SRC_VMAIN,
+                               ~APMG_PS_CTRL_MSK_PWR_SRC);
+}
+
 int iwlagn_hw_nic_init(struct iwl_priv *priv)
 {
         unsigned long flags;
@@ -540,7 +717,7 @@ int iwlagn_hw_nic_init(struct iwl_priv *priv)
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        ret = priv->cfg->ops->lib->apm_ops.set_pwr_src(priv, IWL_PWR_SRC_VMAIN);
+        iwlagn_set_pwr_vmain(priv);
 
         priv->cfg->ops->lib->apm_ops.config(priv);
 
@@ -1154,7 +1331,7 @@ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
         return added;
 }
 
-void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
+int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SCAN_CMD,
@@ -1162,7 +1339,6 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                 .flags = CMD_SIZE_HUGE,
         };
         struct iwl_scan_cmd *scan;
-        struct ieee80211_conf *conf = NULL;
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         u32 rate_flags = 0;
         u16 cmd_len;
@@ -1175,59 +1351,20 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         int  chan_mod;
         u8 active_chains;
         u8 scan_tx_antennas = priv->hw_params.valid_tx_ant;
+        int ret;
+
+        lockdep_assert_held(&priv->mutex);
 
         if (vif)
                 ctx = iwl_rxon_ctx_from_vif(vif);
 
-        conf = ieee80211_get_hw_conf(priv->hw);
-
-        cancel_delayed_work(&priv->scan_check);
-
-        if (!iwl_is_ready(priv)) {
-                IWL_WARN(priv, "request scan called when driver not ready.\n");
-                goto done;
-        }
-
-        /* Make sure the scan wasn't canceled before this queued work
-         * was given the chance to run... */
-        if (!test_bit(STATUS_SCANNING, &priv->status))
-                goto done;
-
-        /* This should never be called or scheduled if there is currently
-         * a scan active in the hardware. */
-        if (test_bit(STATUS_SCAN_HW, &priv->status)) {
-                IWL_DEBUG_INFO(priv, "Multiple concurrent scan requests in parallel. "
-                               "Ignoring second request.\n");
-                goto done;
-        }
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Aborting scan due to device shutdown\n");
-                goto done;
-        }
-
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_HC(priv, "Scan request while abort pending.  Queuing.\n");
-                goto done;
-        }
-
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_HC(priv, "Aborting scan due to RF Kill activation\n");
-                goto done;
-        }
-
-        if (!test_bit(STATUS_READY, &priv->status)) {
-                IWL_DEBUG_HC(priv, "Scan request while uninitialized.  Queuing.\n");
-                goto done;
-        }
-
         if (!priv->scan_cmd) {
                 priv->scan_cmd = kmalloc(sizeof(struct iwl_scan_cmd) +
                                          IWL_MAX_SCAN_SIZE, GFP_KERNEL);
                 if (!priv->scan_cmd) {
                         IWL_DEBUG_SCAN(priv,
                                        "fail to allocate memory for scan\n");
-                        goto done;
+                        return -ENOMEM;
                 }
         }
         scan = priv->scan_cmd;
@@ -1307,37 +1444,38 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                  * Internal scans are passive, so we can indiscriminately set
                  * the BT ignore flag on 2.4 GHz since it applies to TX only.
                  */
-                if (priv->cfg->advanced_bt_coexist)
+                if (priv->cfg->bt_params &&
+                    priv->cfg->bt_params->advanced_bt_coexist)
                         scan->tx_cmd.tx_flags |= TX_CMD_FLG_IGNORE_BT;
-                scan->good_CRC_th = IWL_GOOD_CRC_TH_DISABLED;
                 break;
         case IEEE80211_BAND_5GHZ:
                 rate = IWL_RATE_6M_PLCP;
-                /*
-                 * If active scanning is requested but a certain channel is
-                 * marked passive, we can do active scanning if we detect
-                 * transmissions.
-                 *
-                 * There is an issue with some firmware versions that triggers
-                 * a sysassert on a "good CRC threshold" of zero (== disabled),
-                 * on a radar channel even though this means that we should NOT
-                 * send probes.
-                 *
-                 * The "good CRC threshold" is the number of frames that we
-                 * need to receive during our dwell time on a channel before
-                 * sending out probes -- setting this to a huge value will
-                 * mean we never reach it, but at the same time work around
-                 * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
-                 * here instead of IWL_GOOD_CRC_TH_DISABLED.
-                 */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
-                                                IWL_GOOD_CRC_TH_NEVER;
                 break;
         default:
-                IWL_WARN(priv, "Invalid scan band count\n");
-                goto done;
+                IWL_WARN(priv, "Invalid scan band\n");
+                return -EIO;
         }
 
+        /*
+         * If active scanning is requested but a certain channel is
+         * marked passive, we can do active scanning if we detect
+         * transmissions.
+         *
+         * There is an issue with some firmware versions that triggers
+         * a sysassert on a "good CRC threshold" of zero (== disabled),
+         * on a radar channel even though this means that we should NOT
+         * send probes.
+         *
+         * The "good CRC threshold" is the number of frames that we
+         * need to receive during our dwell time on a channel before
+         * sending out probes -- setting this to a huge value will
+         * mean we never reach it, but at the same time work around
+         * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
+         * here instead of IWL_GOOD_CRC_TH_DISABLED.
+         */
+        scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                        IWL_GOOD_CRC_TH_NEVER;
+
         band = priv->scan_band;
 
         if (priv->cfg->scan_rx_antennas[band])
@@ -1346,10 +1484,12 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         if (priv->cfg->scan_tx_antennas[band])
                 scan_tx_antennas = priv->cfg->scan_tx_antennas[band];
 
-        if (priv->cfg->advanced_bt_coexist && priv->bt_full_concurrent) {
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->advanced_bt_coexist &&
+            priv->bt_full_concurrent) {
                 /* operated as 1x1 in full concurrency mode */
-                scan_tx_antennas =
-                        first_antenna(priv->cfg->scan_tx_antennas[band]);
+                scan_tx_antennas = first_antenna(
+                        priv->cfg->scan_tx_antennas[band]);
         }
 
         priv->scan_tx_ant[band] = iwl_toggle_tx_ant(priv, priv->scan_tx_ant[band],
@@ -1370,7 +1510,9 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
                 rx_ant = first_antenna(active_chains);
         }
-        if (priv->cfg->advanced_bt_coexist && priv->bt_full_concurrent) {
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->advanced_bt_coexist &&
+            priv->bt_full_concurrent) {
                 /* operated as 1x1 in full concurrency mode */
                 rx_ant = first_antenna(rx_ant);
         }
@@ -1415,7 +1557,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         }
         if (scan->channel_count == 0) {
                 IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
-                goto done;
+                return -EIO;
         }
 
         cmd.len += le16_to_cpu(scan->tx_cmd.len) +
@@ -1423,30 +1565,39 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         cmd.data = scan;
         scan->len = cpu_to_le16(cmd.len);
 
+        /* set scan bit here for PAN params */
         set_bit(STATUS_SCAN_HW, &priv->status);
 
-        if (priv->cfg->ops->hcmd->set_pan_params &&
-            priv->cfg->ops->hcmd->set_pan_params(priv))
-                goto done;
+        if (priv->cfg->ops->hcmd->set_pan_params) {
+                ret = priv->cfg->ops->hcmd->set_pan_params(priv);
+                if (ret)
+                        return ret;
+        }
 
-        if (iwl_send_cmd_sync(priv, &cmd))
-                goto done;
+        ret = iwl_send_cmd_sync(priv, &cmd);
+        if (ret) {
+                clear_bit(STATUS_SCAN_HW, &priv->status);
+                if (priv->cfg->ops->hcmd->set_pan_params)
+                        priv->cfg->ops->hcmd->set_pan_params(priv);
+        }
+
+        return ret;
+}
+
+void iwlagn_post_scan(struct iwl_priv *priv)
+{
+        struct iwl_rxon_context *ctx;
+
+        /*
+         * Since setting the RXON may have been deferred while
+         * performing the scan, fire one off if needed
+         */
+        for_each_context(priv, ctx)
+                if (memcmp(&ctx->staging, &ctx->active, sizeof(ctx->staging)))
+                        iwlagn_commit_rxon(priv, ctx);
 
-        queue_delayed_work(priv->workqueue, &priv->scan_check,
-                           IWL_SCAN_CHECK_WATCHDOG);
-
-        return;
-
- done:
-        /* Cannot perform scan. Make sure we clear scanning
-        * bits from status so next scan request can be performed.
-        * If we don't clear scanning status bit here all next scan
-        * will fail
-        */
-        clear_bit(STATUS_SCAN_HW, &priv->status);
-        clear_bit(STATUS_SCANNING, &priv->status);
-        /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
+        if (priv->cfg->ops->hcmd->set_pan_params)
+                priv->cfg->ops->hcmd->set_pan_params(priv);
 }
 
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
@@ -1455,9 +1606,9 @@ int iwlagn_manage_ibss_station(struct iwl_priv *priv,
         struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
 
         if (add)
-                return iwl_add_bssid_station(priv, vif_priv->ctx,
-                                             vif->bss_conf.bssid, true,
-                                             &vif_priv->ibss_bssid_sta_id);
+                return iwlagn_add_bssid_station(priv, vif_priv->ctx,
+                                                vif->bss_conf.bssid,
+                                                &vif_priv->ibss_bssid_sta_id);
         return iwl_remove_station(priv, vif_priv->ibss_bssid_sta_id,
                                   vif->bss_conf.bssid);
 }
@@ -1669,10 +1820,15 @@ void iwlagn_send_advance_bt_config(struct iwl_priv *priv)
         BUILD_BUG_ON(sizeof(iwlagn_def_3w_lookup) !=
                         sizeof(bt_cmd.bt3_lookup_table));
 
-        bt_cmd.prio_boost = priv->cfg->bt_prio_boost;
+        if (priv->cfg->bt_params)
+                bt_cmd.prio_boost = priv->cfg->bt_params->bt_prio_boost;
+        else
+                bt_cmd.prio_boost = 0;
         bt_cmd.kill_ack_mask = priv->kill_ack_mask;
         bt_cmd.kill_cts_mask = priv->kill_cts_mask;
         bt_cmd.valid = priv->bt_valid;
+        bt_cmd.tx_prio_boost = 0;
+        bt_cmd.rx_prio_boost = 0;
 
         /*
          * Configure BT coex mode to "no coexistence" when the
@@ -1928,3 +2084,290 @@ void iwlagn_bt_cancel_deferred_work(struct iwl_priv *priv)
 {
         cancel_work_sync(&priv->bt_traffic_change_work);
 }
+
+static bool is_single_rx_stream(struct iwl_priv *priv)
+{
+        return priv->current_ht_config.smps == IEEE80211_SMPS_STATIC ||
+               priv->current_ht_config.single_chain_sufficient;
+}
+
+#define IWL_NUM_RX_CHAINS_MULTIPLE      3
+#define IWL_NUM_RX_CHAINS_SINGLE        2
+#define IWL_NUM_IDLE_CHAINS_DUAL        2
+#define IWL_NUM_IDLE_CHAINS_SINGLE      1
+
+/*
+ * Determine how many receiver/antenna chains to use.
+ *
+ * More provides better reception via diversity.  Fewer saves power
+ * at the expense of throughput, but only when not in powersave to
+ * start with.
+ *
+ * MIMO (dual stream) requires at least 2, but works better with 3.
+ * This does not determine *which* chains to use, just how many.
+ */
+static int iwl_get_active_rx_chain_count(struct iwl_priv *priv)
+{
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->advanced_bt_coexist &&
+            (priv->bt_full_concurrent ||
+             priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)) {
+                /*
+                 * only use chain 'A' in bt high traffic load or
+                 * full concurrency mode
+                 */
+                return IWL_NUM_RX_CHAINS_SINGLE;
+        }
+        /* # of Rx chains to use when expecting MIMO. */
+        if (is_single_rx_stream(priv))
+                return IWL_NUM_RX_CHAINS_SINGLE;
+        else
+                return IWL_NUM_RX_CHAINS_MULTIPLE;
+}
+
+/*
+ * When we are in power saving mode, unless device support spatial
+ * multiplexing power save, use the active count for rx chain count.
+ */
+static int iwl_get_idle_rx_chain_count(struct iwl_priv *priv, int active_cnt)
+{
+        /* # Rx chains when idling, depending on SMPS mode */
+        switch (priv->current_ht_config.smps) {
+        case IEEE80211_SMPS_STATIC:
+        case IEEE80211_SMPS_DYNAMIC:
+                return IWL_NUM_IDLE_CHAINS_SINGLE;
+        case IEEE80211_SMPS_OFF:
+                return active_cnt;
+        default:
+                WARN(1, "invalid SMPS mode %d",
+                     priv->current_ht_config.smps);
+                return active_cnt;
+        }
+}
+
+/* up to 4 chains */
+static u8 iwl_count_chain_bitmap(u32 chain_bitmap)
+{
+        u8 res;
+        res = (chain_bitmap & BIT(0)) >> 0;
+        res += (chain_bitmap & BIT(1)) >> 1;
+        res += (chain_bitmap & BIT(2)) >> 2;
+        res += (chain_bitmap & BIT(3)) >> 3;
+        return res;
+}
+
+/**
+ * iwlagn_set_rxon_chain - Set up Rx chain usage in "staging" RXON image
+ *
+ * Selects how many and which Rx receivers/antennas/chains to use.
+ * This should not be used for scan command ... it puts data in wrong place.
+ */
+void iwlagn_set_rxon_chain(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+{
+        bool is_single = is_single_rx_stream(priv);
+        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
+        u8 idle_rx_cnt, active_rx_cnt, valid_rx_cnt;
+        u32 active_chains;
+        u16 rx_chain;
+
+        /* Tell uCode which antennas are actually connected.
+         * Before first association, we assume all antennas are connected.
+         * Just after first association, iwl_chain_noise_calibration()
+         *    checks which antennas actually *are* connected. */
+        if (priv->chain_noise_data.active_chains)
+                active_chains = priv->chain_noise_data.active_chains;
+        else
+                active_chains = priv->hw_params.valid_rx_ant;
+
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->advanced_bt_coexist &&
+            (priv->bt_full_concurrent ||
+             priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)) {
+                /*
+                 * only use chain 'A' in bt high traffic load or
+                 * full concurrency mode
+                 */
+                active_chains = first_antenna(active_chains);
+        }
+
+        rx_chain = active_chains << RXON_RX_CHAIN_VALID_POS;
+
+        /* How many receivers should we use? */
+        active_rx_cnt = iwl_get_active_rx_chain_count(priv);
+        idle_rx_cnt = iwl_get_idle_rx_chain_count(priv, active_rx_cnt);
+
+
+        /* correct rx chain count according hw settings
+         * and chain noise calibration
+         */
+        valid_rx_cnt = iwl_count_chain_bitmap(active_chains);
+        if (valid_rx_cnt < active_rx_cnt)
+                active_rx_cnt = valid_rx_cnt;
+
+        if (valid_rx_cnt < idle_rx_cnt)
+                idle_rx_cnt = valid_rx_cnt;
+
+        rx_chain |= active_rx_cnt << RXON_RX_CHAIN_MIMO_CNT_POS;
+        rx_chain |= idle_rx_cnt  << RXON_RX_CHAIN_CNT_POS;
+
+        ctx->staging.rx_chain = cpu_to_le16(rx_chain);
+
+        if (!is_single && (active_rx_cnt >= IWL_NUM_RX_CHAINS_SINGLE) && is_cam)
+                ctx->staging.rx_chain |= RXON_RX_CHAIN_MIMO_FORCE_MSK;
+        else
+                ctx->staging.rx_chain &= ~RXON_RX_CHAIN_MIMO_FORCE_MSK;
+
+        IWL_DEBUG_ASSOC(priv, "rx_chain=0x%X active=%d idle=%d\n",
+                        ctx->staging.rx_chain,
+                        active_rx_cnt, idle_rx_cnt);
+
+        WARN_ON(active_rx_cnt == 0 || idle_rx_cnt == 0 ||
+                active_rx_cnt < idle_rx_cnt);
+}
+
+u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant, u8 valid)
+{
+        int i;
+        u8 ind = ant;
+
+        if (priv->band == IEEE80211_BAND_2GHZ &&
+            priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)
+                return 0;
+
+        for (i = 0; i < RATE_ANT_NUM - 1; i++) {
+                ind = (ind + 1) < RATE_ANT_NUM ?  ind + 1 : 0;
+                if (valid & BIT(ind))
+                        return ind;
+        }
+        return ant;
+}
+
+static const char *get_csr_string(int cmd)
+{
+        switch (cmd) {
+        IWL_CMD(CSR_HW_IF_CONFIG_REG);
+        IWL_CMD(CSR_INT_COALESCING);
+        IWL_CMD(CSR_INT);
+        IWL_CMD(CSR_INT_MASK);
+        IWL_CMD(CSR_FH_INT_STATUS);
+        IWL_CMD(CSR_GPIO_IN);
+        IWL_CMD(CSR_RESET);
+        IWL_CMD(CSR_GP_CNTRL);
+        IWL_CMD(CSR_HW_REV);
+        IWL_CMD(CSR_EEPROM_REG);
+        IWL_CMD(CSR_EEPROM_GP);
+        IWL_CMD(CSR_OTP_GP_REG);
+        IWL_CMD(CSR_GIO_REG);
+        IWL_CMD(CSR_GP_UCODE_REG);
+        IWL_CMD(CSR_GP_DRIVER_REG);
+        IWL_CMD(CSR_UCODE_DRV_GP1);
+        IWL_CMD(CSR_UCODE_DRV_GP2);
+        IWL_CMD(CSR_LED_REG);
+        IWL_CMD(CSR_DRAM_INT_TBL_REG);
+        IWL_CMD(CSR_GIO_CHICKEN_BITS);
+        IWL_CMD(CSR_ANA_PLL_CFG);
+        IWL_CMD(CSR_HW_REV_WA_REG);
+        IWL_CMD(CSR_DBG_HPET_MEM_REG);
+        default:
+                return "UNKNOWN";
+        }
+}
+
+void iwl_dump_csr(struct iwl_priv *priv)
+{
+        int i;
+        u32 csr_tbl[] = {
+                CSR_HW_IF_CONFIG_REG,
+                CSR_INT_COALESCING,
+                CSR_INT,
+                CSR_INT_MASK,
+                CSR_FH_INT_STATUS,
+                CSR_GPIO_IN,
+                CSR_RESET,
+                CSR_GP_CNTRL,
+                CSR_HW_REV,
+                CSR_EEPROM_REG,
+                CSR_EEPROM_GP,
+                CSR_OTP_GP_REG,
+                CSR_GIO_REG,
+                CSR_GP_UCODE_REG,
+                CSR_GP_DRIVER_REG,
+                CSR_UCODE_DRV_GP1,
+                CSR_UCODE_DRV_GP2,
+                CSR_LED_REG,
+                CSR_DRAM_INT_TBL_REG,
+                CSR_GIO_CHICKEN_BITS,
+                CSR_ANA_PLL_CFG,
+                CSR_HW_REV_WA_REG,
+                CSR_DBG_HPET_MEM_REG
+        };
+        IWL_ERR(priv, "CSR values:\n");
+        IWL_ERR(priv, "(2nd byte of CSR_INT_COALESCING is "
+                "CSR_INT_PERIODIC_REG)\n");
+        for (i = 0; i <  ARRAY_SIZE(csr_tbl); i++) {
+                IWL_ERR(priv, "  %25s: 0X%08x\n",
+                        get_csr_string(csr_tbl[i]),
+                        iwl_read32(priv, csr_tbl[i]));
+        }
+}
+
+static const char *get_fh_string(int cmd)
+{
+        switch (cmd) {
+        IWL_CMD(FH_RSCSR_CHNL0_STTS_WPTR_REG);
+        IWL_CMD(FH_RSCSR_CHNL0_RBDCB_BASE_REG);
+        IWL_CMD(FH_RSCSR_CHNL0_WPTR);
+        IWL_CMD(FH_MEM_RCSR_CHNL0_CONFIG_REG);
+        IWL_CMD(FH_MEM_RSSR_SHARED_CTRL_REG);
+        IWL_CMD(FH_MEM_RSSR_RX_STATUS_REG);
+        IWL_CMD(FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV);
+        IWL_CMD(FH_TSSR_TX_STATUS_REG);
+        IWL_CMD(FH_TSSR_TX_ERROR_REG);
+        default:
+                return "UNKNOWN";
+        }
+}
+
+int iwl_dump_fh(struct iwl_priv *priv, char **buf, bool display)
+{
+        int i;
+#ifdef CONFIG_IWLWIFI_DEBUG
+        int pos = 0;
+        size_t bufsz = 0;
+#endif
+        u32 fh_tbl[] = {
+                FH_RSCSR_CHNL0_STTS_WPTR_REG,
+                FH_RSCSR_CHNL0_RBDCB_BASE_REG,
+                FH_RSCSR_CHNL0_WPTR,
+                FH_MEM_RCSR_CHNL0_CONFIG_REG,
+                FH_MEM_RSSR_SHARED_CTRL_REG,
+                FH_MEM_RSSR_RX_STATUS_REG,
+                FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV,
+                FH_TSSR_TX_STATUS_REG,
+                FH_TSSR_TX_ERROR_REG
+        };
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (display) {
+                bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
+                *buf = kmalloc(bufsz, GFP_KERNEL);
+                if (!*buf)
+                        return -ENOMEM;
+                pos += scnprintf(*buf + pos, bufsz - pos,
+                                "FH register values:\n");
+                for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
+                        pos += scnprintf(*buf + pos, bufsz - pos,
+                                "  %34s: 0X%08x\n",
+                                get_fh_string(fh_tbl[i]),
+                                iwl_read_direct32(priv, fh_tbl[i]));
+                }
+                return pos;
+        }
+#endif
+        IWL_ERR(priv, "FH register values:\n");
+        for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++) {
+                IWL_ERR(priv, "  %34s: 0X%08x\n",
+                        get_fh_string(fh_tbl[i]),
+                        iwl_read_direct32(priv, fh_tbl[i]));
+        }
+        return 0;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 57629fba3a7d..5abe2e9ff0d2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -39,6 +39,7 @@
 #include "iwl-dev.h"
 #include "iwl-sta.h"
 #include "iwl-core.h"
+#include "iwl-agn.h"
 
 #define RS_NAME "iwl-agn-rs"
 
@@ -76,6 +77,74 @@ static const u8 ant_toggle_lookup[] = {
         /*ANT_ABC  -> */ ANT_ABC,
 };
 
+#define IWL_DECLARE_RATE_INFO(r, s, ip, in, rp, rn, pp, np)    \
+        [IWL_RATE_##r##M_INDEX] = { IWL_RATE_##r##M_PLCP,      \
+                                    IWL_RATE_SISO_##s##M_PLCP, \
+                                    IWL_RATE_MIMO2_##s##M_PLCP,\
+                                    IWL_RATE_MIMO3_##s##M_PLCP,\
+                                    IWL_RATE_##r##M_IEEE,      \
+                                    IWL_RATE_##ip##M_INDEX,    \
+                                    IWL_RATE_##in##M_INDEX,    \
+                                    IWL_RATE_##rp##M_INDEX,    \
+                                    IWL_RATE_##rn##M_INDEX,    \
+                                    IWL_RATE_##pp##M_INDEX,    \
+                                    IWL_RATE_##np##M_INDEX }
+
+/*
+ * Parameter order:
+ *   rate, ht rate, prev rate, next rate, prev tgg rate, next tgg rate
+ *
+ * If there isn't a valid next or previous rate then INV is used which
+ * maps to IWL_RATE_INVALID
+ *
+ */
+const struct iwl_rate_info iwl_rates[IWL_RATE_COUNT] = {
+        IWL_DECLARE_RATE_INFO(1, INV, INV, 2, INV, 2, INV, 2),    /*  1mbps */
+        IWL_DECLARE_RATE_INFO(2, INV, 1, 5, 1, 5, 1, 5),          /*  2mbps */
+        IWL_DECLARE_RATE_INFO(5, INV, 2, 6, 2, 11, 2, 11),        /*5.5mbps */
+        IWL_DECLARE_RATE_INFO(11, INV, 9, 12, 9, 12, 5, 18),      /* 11mbps */
+        IWL_DECLARE_RATE_INFO(6, 6, 5, 9, 5, 11, 5, 11),        /*  6mbps */
+        IWL_DECLARE_RATE_INFO(9, 6, 6, 11, 6, 11, 5, 11),       /*  9mbps */
+        IWL_DECLARE_RATE_INFO(12, 12, 11, 18, 11, 18, 11, 18),   /* 12mbps */
+        IWL_DECLARE_RATE_INFO(18, 18, 12, 24, 12, 24, 11, 24),   /* 18mbps */
+        IWL_DECLARE_RATE_INFO(24, 24, 18, 36, 18, 36, 18, 36),   /* 24mbps */
+        IWL_DECLARE_RATE_INFO(36, 36, 24, 48, 24, 48, 24, 48),   /* 36mbps */
+        IWL_DECLARE_RATE_INFO(48, 48, 36, 54, 36, 54, 36, 54),   /* 48mbps */
+        IWL_DECLARE_RATE_INFO(54, 54, 48, INV, 48, INV, 48, INV),/* 54mbps */
+        IWL_DECLARE_RATE_INFO(60, 60, 48, INV, 48, INV, 48, INV),/* 60mbps */
+        /* FIXME:RS:          ^^    should be INV (legacy) */
+};
+
+static int iwl_hwrate_to_plcp_idx(u32 rate_n_flags)
+{
+        int idx = 0;
+
+        /* HT rate format */
+        if (rate_n_flags & RATE_MCS_HT_MSK) {
+                idx = (rate_n_flags & 0xff);
+
+                if (idx >= IWL_RATE_MIMO3_6M_PLCP)
+                        idx = idx - IWL_RATE_MIMO3_6M_PLCP;
+                else if (idx >= IWL_RATE_MIMO2_6M_PLCP)
+                        idx = idx - IWL_RATE_MIMO2_6M_PLCP;
+
+                idx += IWL_FIRST_OFDM_RATE;
+                /* skip 9M not supported in ht*/
+                if (idx >= IWL_RATE_9M_INDEX)
+                        idx += 1;
+                if ((idx >= IWL_FIRST_OFDM_RATE) && (idx <= IWL_LAST_OFDM_RATE))
+                        return idx;
+
+        /* legacy rate format, search for match in table */
+        } else {
+                for (idx = 0; idx < ARRAY_SIZE(iwl_rates); idx++)
+                        if (iwl_rates[idx].plcp == (rate_n_flags & 0xFF))
+                                return idx;
+        }
+
+        return -1;
+}
+
 static void rs_rate_scale_perform(struct iwl_priv *priv,
                                    struct sk_buff *skb,
                                    struct ieee80211_sta *sta,
@@ -2939,11 +3008,14 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
          * overwrite if needed, pass aggregation time limit
          * to uCode in uSec
          */
-        if (priv && priv->cfg->agg_time_limit &&
-            priv->cfg->agg_time_limit >= LINK_QUAL_AGG_TIME_LIMIT_MIN &&
-            priv->cfg->agg_time_limit <= LINK_QUAL_AGG_TIME_LIMIT_MAX)
+        if (priv && priv->cfg->bt_params &&
+            priv->cfg->bt_params->agg_time_limit &&
+            priv->cfg->bt_params->agg_time_limit >=
+                LINK_QUAL_AGG_TIME_LIMIT_MIN &&
+            priv->cfg->bt_params->agg_time_limit <=
+                 LINK_QUAL_AGG_TIME_LIMIT_MAX)
                 lq_cmd->agg_params.agg_time_limit =
-                        cpu_to_le16(priv->cfg->agg_time_limit);
+                        cpu_to_le16(priv->cfg->bt_params->agg_time_limit);
 }
 
 static void *rs_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
index 3970ab1deaf9..75e50d33ecb3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
@@ -299,7 +299,6 @@ enum {
 #define TIME_WRAP_AROUND(x, y) (((y) > (x)) ? (y) - (x) : (0-(x)) + (y))
 
 extern const struct iwl_rate_info iwl_rates[IWL_RATE_COUNT];
-extern const struct iwl3945_rate_info iwl3945_rates[IWL_RATE_COUNT_3945];
 
 enum iwl_table_type {
         LQ_NONE,
@@ -453,24 +452,6 @@ static inline u8 first_antenna(u8 mask)
 }
 
 
-static inline u8 iwl_get_prev_ieee_rate(u8 rate_index)
-{
-        u8 rate = iwl_rates[rate_index].prev_ieee;
-
-        if (rate == IWL_RATE_INVALID)
-                rate = rate_index;
-        return rate;
-}
-
-static inline u8 iwl3945_get_prev_ieee_rate(u8 rate_index)
-{
-        u8 rate = iwl3945_rates[rate_index].prev_ieee;
-
-        if (rate == IWL_RATE_INVALID)
-                rate = rate_index;
-        return rate;
-}
-
 /**
  * iwl3945_rate_scale_init - Initialize the rate scale table based on assoc info
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
index 9490eced1198..bbd40b7dd597 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
@@ -34,7 +34,7 @@
 
 #include "iwl-dev.h"
 #include "iwl-core.h"
-#include "iwl-calib.h"
+#include "iwl-agn-calib.h"
 #include "iwl-sta.h"
 #include "iwl-io.h"
 #include "iwl-helpers.h"
@@ -73,7 +73,8 @@ static void iwl_rx_calc_noise(struct iwl_priv *priv)
         int bcn_silence_a, bcn_silence_b, bcn_silence_c;
         int last_rx_noise;
 
-        if (priv->cfg->bt_statistics)
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->bt_statistics)
                 rx_info = &(priv->_agn.statistics_bt.rx.general.common);
         else
                 rx_info = &(priv->_agn.statistics.rx.general);
@@ -124,7 +125,8 @@ static void iwl_accumulative_statistics(struct iwl_priv *priv,
         struct statistics_general_common *general, *accum_general;
         struct statistics_tx *tx, *accum_tx;
 
-        if (priv->cfg->bt_statistics) {
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->bt_statistics) {
                 prev_stats = (__le32 *)&priv->_agn.statistics_bt;
                 accum_stats = (u32 *)&priv->_agn.accum_statistics_bt;
                 size = sizeof(struct iwl_bt_notif_statistics);
@@ -183,7 +185,7 @@ bool iwl_good_plcp_health(struct iwl_priv *priv,
         unsigned int plcp_msec;
         unsigned long plcp_received_jiffies;
 
-        if (priv->cfg->plcp_delta_threshold ==
+        if (priv->cfg->base_params->plcp_delta_threshold ==
             IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE) {
                 IWL_DEBUG_RADIO(priv, "plcp_err check disabled\n");
                 return rc;
@@ -205,7 +207,8 @@ bool iwl_good_plcp_health(struct iwl_priv *priv,
                 struct statistics_rx_phy *ofdm;
                 struct statistics_rx_ht_phy *ofdm_ht;
 
-                if (priv->cfg->bt_statistics) {
+                if (priv->cfg->bt_params &&
+                    priv->cfg->bt_params->bt_statistics) {
                         ofdm = &pkt->u.stats_bt.rx.ofdm;
                         ofdm_ht = &pkt->u.stats_bt.rx.ofdm_ht;
                         combined_plcp_delta =
@@ -229,7 +232,7 @@ bool iwl_good_plcp_health(struct iwl_priv *priv,
 
                 if ((combined_plcp_delta > 0) &&
                     ((combined_plcp_delta * 100) / plcp_msec) >
-                        priv->cfg->plcp_delta_threshold) {
+                        priv->cfg->base_params->plcp_delta_threshold) {
                         /*
                          * if plcp_err exceed the threshold,
                          * the following data is printed in csv format:
@@ -242,13 +245,13 @@ bool iwl_good_plcp_health(struct iwl_priv *priv,
                          *    plcp_msec
                          */
                         IWL_DEBUG_RADIO(priv, "plcp_err exceeded %u, "
-                                    "%u, %u, %u, %u, %d, %u mSecs\n",
-                                    priv->cfg->plcp_delta_threshold,
-                                    le32_to_cpu(ofdm->plcp_err),
-                                    le32_to_cpu(ofdm->plcp_err),
-                                    le32_to_cpu(ofdm_ht->plcp_err),
-                                    le32_to_cpu(ofdm_ht->plcp_err),
-                                    combined_plcp_delta, plcp_msec);
+                                "%u, %u, %u, %u, %d, %u mSecs\n",
+                                priv->cfg->base_params->plcp_delta_threshold,
+                                le32_to_cpu(ofdm->plcp_err),
+                                le32_to_cpu(ofdm->plcp_err),
+                                le32_to_cpu(ofdm_ht->plcp_err),
+                                le32_to_cpu(ofdm_ht->plcp_err),
+                                combined_plcp_delta, plcp_msec);
 
                         rc = false;
                 }
@@ -262,7 +265,8 @@ void iwl_rx_statistics(struct iwl_priv *priv,
         int change;
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 
-        if (priv->cfg->bt_statistics) {
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->bt_statistics) {
                 IWL_DEBUG_RX(priv,
                              "Statistics notification received (%d vs %d).\n",
                              (int)sizeof(struct iwl_bt_notif_statistics),
@@ -300,7 +304,8 @@ void iwl_rx_statistics(struct iwl_priv *priv,
 
         iwl_recover_from_statistics(priv, pkt);
 
-        if (priv->cfg->bt_statistics)
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->bt_statistics)
                 memcpy(&priv->_agn.statistics_bt, &pkt->u.stats_bt,
                         sizeof(priv->_agn.statistics_bt));
         else
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
new file mode 100644
index 000000000000..35a30d2e0734
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -0,0 +1,716 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
+ *
+ * Portions of this file are derived from the ipw3945 project, as well
+ * as portions of the ieee80211 subsystem header files.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#include <net/mac80211.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-sta.h"
+#include "iwl-agn.h"
+
+static struct iwl_link_quality_cmd *
+iwl_sta_alloc_lq(struct iwl_priv *priv, u8 sta_id)
+{
+        int i, r;
+        struct iwl_link_quality_cmd *link_cmd;
+        u32 rate_flags = 0;
+        __le32 rate_n_flags;
+
+        link_cmd = kzalloc(sizeof(struct iwl_link_quality_cmd), GFP_KERNEL);
+        if (!link_cmd) {
+                IWL_ERR(priv, "Unable to allocate memory for LQ cmd.\n");
+                return NULL;
+        }
+        /* Set up the rate scaling to start at selected rate, fall back
+         * all the way down to 1M in IEEE order, and then spin on 1M */
+        if (priv->band == IEEE80211_BAND_5GHZ)
+                r = IWL_RATE_6M_INDEX;
+        else
+                r = IWL_RATE_1M_INDEX;
+
+        if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
+                rate_flags |= RATE_MCS_CCK_MSK;
+
+        rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
+                                RATE_MCS_ANT_POS;
+        rate_n_flags = iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
+        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
+                link_cmd->rs_table[i].rate_n_flags = rate_n_flags;
+
+        link_cmd->general_params.single_stream_ant_msk =
+                                first_antenna(priv->hw_params.valid_tx_ant);
+
+        link_cmd->general_params.dual_stream_ant_msk =
+                priv->hw_params.valid_tx_ant &
+                ~first_antenna(priv->hw_params.valid_tx_ant);
+        if (!link_cmd->general_params.dual_stream_ant_msk) {
+                link_cmd->general_params.dual_stream_ant_msk = ANT_AB;
+        } else if (num_of_ant(priv->hw_params.valid_tx_ant) == 2) {
+                link_cmd->general_params.dual_stream_ant_msk =
+                        priv->hw_params.valid_tx_ant;
+        }
+
+        link_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+        link_cmd->agg_params.agg_time_limit =
+                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
+
+        link_cmd->sta_id = sta_id;
+
+        return link_cmd;
+}
+
+/*
+ * iwlagn_add_bssid_station - Add the special IBSS BSSID station
+ *
+ * Function sleeps.
+ */
+int iwlagn_add_bssid_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                             const u8 *addr, u8 *sta_id_r)
+{
+        int ret;
+        u8 sta_id;
+        struct iwl_link_quality_cmd *link_cmd;
+        unsigned long flags;
+
+        if (sta_id_r)
+                *sta_id_r = IWL_INVALID_STATION;
+
+        ret = iwl_add_station_common(priv, ctx, addr, 0, NULL, &sta_id);
+        if (ret) {
+                IWL_ERR(priv, "Unable to add station %pM\n", addr);
+                return ret;
+        }
+
+        if (sta_id_r)
+                *sta_id_r = sta_id;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        priv->stations[sta_id].used |= IWL_STA_LOCAL;
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        /* Set up default rate scaling table in device's station table */
+        link_cmd = iwl_sta_alloc_lq(priv, sta_id);
+        if (!link_cmd) {
+                IWL_ERR(priv, "Unable to initialize rate scaling for station %pM.\n",
+                        addr);
+                return -ENOMEM;
+        }
+
+        ret = iwl_send_lq_cmd(priv, ctx, link_cmd, CMD_SYNC, true);
+        if (ret)
+                IWL_ERR(priv, "Link quality command failed (%d)\n", ret);
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        priv->stations[sta_id].lq = link_cmd;
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return 0;
+}
+
+static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv,
+                                      struct iwl_rxon_context *ctx,
+                                      bool send_if_empty)
+{
+        int i, not_empty = 0;
+        u8 buff[sizeof(struct iwl_wep_cmd) +
+                sizeof(struct iwl_wep_key) * WEP_KEYS_MAX];
+        struct iwl_wep_cmd *wep_cmd = (struct iwl_wep_cmd *)buff;
+        size_t cmd_size  = sizeof(struct iwl_wep_cmd);
+        struct iwl_host_cmd cmd = {
+                .id = ctx->wep_key_cmd,
+                .data = wep_cmd,
+                .flags = CMD_SYNC,
+        };
+
+        might_sleep();
+
+        memset(wep_cmd, 0, cmd_size +
+                        (sizeof(struct iwl_wep_key) * WEP_KEYS_MAX));
+
+        for (i = 0; i < WEP_KEYS_MAX ; i++) {
+                wep_cmd->key[i].key_index = i;
+                if (ctx->wep_keys[i].key_size) {
+                        wep_cmd->key[i].key_offset = i;
+                        not_empty = 1;
+                } else {
+                        wep_cmd->key[i].key_offset = WEP_INVALID_OFFSET;
+                }
+
+                wep_cmd->key[i].key_size = ctx->wep_keys[i].key_size;
+                memcpy(&wep_cmd->key[i].key[3], ctx->wep_keys[i].key,
+                                ctx->wep_keys[i].key_size);
+        }
+
+        wep_cmd->global_key_type = WEP_KEY_WEP_TYPE;
+        wep_cmd->num_keys = WEP_KEYS_MAX;
+
+        cmd_size += sizeof(struct iwl_wep_key) * WEP_KEYS_MAX;
+
+        cmd.len = cmd_size;
+
+        if (not_empty || send_if_empty)
+                return iwl_send_cmd(priv, &cmd);
+        else
+                return 0;
+}
+
+int iwl_restore_default_wep_keys(struct iwl_priv *priv,
+                                 struct iwl_rxon_context *ctx)
+{
+        lockdep_assert_held(&priv->mutex);
+
+        return iwl_send_static_wepkey_cmd(priv, ctx, false);
+}
+
+int iwl_remove_default_wep_key(struct iwl_priv *priv,
+                               struct iwl_rxon_context *ctx,
+                               struct ieee80211_key_conf *keyconf)
+{
+        int ret;
+
+        lockdep_assert_held(&priv->mutex);
+
+        IWL_DEBUG_WEP(priv, "Removing default WEP key: idx=%d\n",
+                      keyconf->keyidx);
+
+        memset(&ctx->wep_keys[keyconf->keyidx], 0, sizeof(ctx->wep_keys[0]));
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_WEP(priv, "Not sending REPLY_WEPKEY command due to RFKILL.\n");
+                /* but keys in device are clear anyway so return success */
+                return 0;
+        }
+        ret = iwl_send_static_wepkey_cmd(priv, ctx, 1);
+        IWL_DEBUG_WEP(priv, "Remove default WEP key: idx=%d ret=%d\n",
+                      keyconf->keyidx, ret);
+
+        return ret;
+}
+
+int iwl_set_default_wep_key(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx,
+                            struct ieee80211_key_conf *keyconf)
+{
+        int ret;
+
+        lockdep_assert_held(&priv->mutex);
+
+        if (keyconf->keylen != WEP_KEY_LEN_128 &&
+            keyconf->keylen != WEP_KEY_LEN_64) {
+                IWL_DEBUG_WEP(priv, "Bad WEP key length %d\n", keyconf->keylen);
+                return -EINVAL;
+        }
+
+        keyconf->flags &= ~IEEE80211_KEY_FLAG_GENERATE_IV;
+        keyconf->hw_key_idx = HW_KEY_DEFAULT;
+        priv->stations[ctx->ap_sta_id].keyinfo.cipher = keyconf->cipher;
+
+        ctx->wep_keys[keyconf->keyidx].key_size = keyconf->keylen;
+        memcpy(&ctx->wep_keys[keyconf->keyidx].key, &keyconf->key,
+                                                        keyconf->keylen);
+
+        ret = iwl_send_static_wepkey_cmd(priv, ctx, false);
+        IWL_DEBUG_WEP(priv, "Set default WEP key: len=%d idx=%d ret=%d\n",
+                keyconf->keylen, keyconf->keyidx, ret);
+
+        return ret;
+}
+
+static int iwl_set_wep_dynamic_key_info(struct iwl_priv *priv,
+                                        struct iwl_rxon_context *ctx,
+                                        struct ieee80211_key_conf *keyconf,
+                                        u8 sta_id)
+{
+        unsigned long flags;
+        __le16 key_flags = 0;
+        struct iwl_addsta_cmd sta_cmd;
+
+        lockdep_assert_held(&priv->mutex);
+
+        keyconf->flags &= ~IEEE80211_KEY_FLAG_GENERATE_IV;
+
+        key_flags |= (STA_KEY_FLG_WEP | STA_KEY_FLG_MAP_KEY_MSK);
+        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags &= ~STA_KEY_FLG_INVALID;
+
+        if (keyconf->keylen == WEP_KEY_LEN_128)
+                key_flags |= STA_KEY_FLG_KEY_SIZE_MSK;
+
+        if (sta_id == ctx->bcast_sta_id)
+                key_flags |= STA_KEY_MULTICAST_MSK;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+
+        priv->stations[sta_id].keyinfo.cipher = keyconf->cipher;
+        priv->stations[sta_id].keyinfo.keylen = keyconf->keylen;
+        priv->stations[sta_id].keyinfo.keyidx = keyconf->keyidx;
+
+        memcpy(priv->stations[sta_id].keyinfo.key,
+                                keyconf->key, keyconf->keylen);
+
+        memcpy(&priv->stations[sta_id].sta.key.key[3],
+                                keyconf->key, keyconf->keylen);
+
+        if ((priv->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
+                        == STA_KEY_FLG_NO_ENC)
+                priv->stations[sta_id].sta.key.key_offset =
+                                 iwl_get_free_ucode_key_index(priv);
+        /* else, we are overriding an existing key => no need to allocated room
+         * in uCode. */
+
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for a new key");
+
+        priv->stations[sta_id].sta.key.key_flags = key_flags;
+        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+}
+
+static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
+                                         struct iwl_rxon_context *ctx,
+                                         struct ieee80211_key_conf *keyconf,
+                                         u8 sta_id)
+{
+        unsigned long flags;
+        __le16 key_flags = 0;
+        struct iwl_addsta_cmd sta_cmd;
+
+        lockdep_assert_held(&priv->mutex);
+
+        key_flags |= (STA_KEY_FLG_CCMP | STA_KEY_FLG_MAP_KEY_MSK);
+        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags &= ~STA_KEY_FLG_INVALID;
+
+        if (sta_id == ctx->bcast_sta_id)
+                key_flags |= STA_KEY_MULTICAST_MSK;
+
+        keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        priv->stations[sta_id].keyinfo.cipher = keyconf->cipher;
+        priv->stations[sta_id].keyinfo.keylen = keyconf->keylen;
+
+        memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key,
+               keyconf->keylen);
+
+        memcpy(priv->stations[sta_id].sta.key.key, keyconf->key,
+               keyconf->keylen);
+
+        if ((priv->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
+                        == STA_KEY_FLG_NO_ENC)
+                priv->stations[sta_id].sta.key.key_offset =
+                                 iwl_get_free_ucode_key_index(priv);
+        /* else, we are overriding an existing key => no need to allocated room
+         * in uCode. */
+
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for a new key");
+
+        priv->stations[sta_id].sta.key.key_flags = key_flags;
+        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+}
+
+static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
+                                         struct iwl_rxon_context *ctx,
+                                         struct ieee80211_key_conf *keyconf,
+                                         u8 sta_id)
+{
+        unsigned long flags;
+        int ret = 0;
+        __le16 key_flags = 0;
+
+        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
+        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags &= ~STA_KEY_FLG_INVALID;
+
+        if (sta_id == ctx->bcast_sta_id)
+                key_flags |= STA_KEY_MULTICAST_MSK;
+
+        keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+        keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+
+        priv->stations[sta_id].keyinfo.cipher = keyconf->cipher;
+        priv->stations[sta_id].keyinfo.keylen = 16;
+
+        if ((priv->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
+                        == STA_KEY_FLG_NO_ENC)
+                priv->stations[sta_id].sta.key.key_offset =
+                                 iwl_get_free_ucode_key_index(priv);
+        /* else, we are overriding an existing key => no need to allocated room
+         * in uCode. */
+
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for a new key");
+
+        priv->stations[sta_id].sta.key.key_flags = key_flags;
+
+
+        /* This copy is acutally not needed: we get the key with each TX */
+        memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
+
+        memcpy(priv->stations[sta_id].sta.key.key, keyconf->key, 16);
+
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return ret;
+}
+
+void iwl_update_tkip_key(struct iwl_priv *priv,
+                         struct iwl_rxon_context *ctx,
+                         struct ieee80211_key_conf *keyconf,
+                         struct ieee80211_sta *sta, u32 iv32, u16 *phase1key)
+{
+        u8 sta_id;
+        unsigned long flags;
+        int i;
+
+        if (iwl_scan_cancel(priv)) {
+                /* cancel scan failed, just live w/ bad key and rely
+                   briefly on SW decryption */
+                return;
+        }
+
+        sta_id = iwl_sta_id_or_broadcast(priv, ctx, sta);
+        if (sta_id == IWL_INVALID_STATION)
+                return;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+
+        priv->stations[sta_id].sta.key.tkip_rx_tsc_byte2 = (u8) iv32;
+
+        for (i = 0; i < 5; i++)
+                priv->stations[sta_id].sta.key.tkip_rx_ttak[i] =
+                        cpu_to_le16(phase1key[i]);
+
+        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+
+        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
+
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+}
+
+int iwl_remove_dynamic_key(struct iwl_priv *priv,
+                           struct iwl_rxon_context *ctx,
+                           struct ieee80211_key_conf *keyconf,
+                           u8 sta_id)
+{
+        unsigned long flags;
+        u16 key_flags;
+        u8 keyidx;
+        struct iwl_addsta_cmd sta_cmd;
+
+        lockdep_assert_held(&priv->mutex);
+
+        ctx->key_mapping_keys--;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        key_flags = le16_to_cpu(priv->stations[sta_id].sta.key.key_flags);
+        keyidx = (key_flags >> STA_KEY_FLG_KEYID_POS) & 0x3;
+
+        IWL_DEBUG_WEP(priv, "Remove dynamic key: idx=%d sta=%d\n",
+                      keyconf->keyidx, sta_id);
+
+        if (keyconf->keyidx != keyidx) {
+                /* We need to remove a key with index different that the one
+                 * in the uCode. This means that the key we need to remove has
+                 * been replaced by another one with different index.
+                 * Don't do anything and return ok
+                 */
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
+
+        if (priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET) {
+                IWL_WARN(priv, "Removing wrong key %d 0x%x\n",
+                            keyconf->keyidx, key_flags);
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
+
+        if (!test_and_clear_bit(priv->stations[sta_id].sta.key.key_offset,
+                &priv->ucode_key_table))
+                IWL_ERR(priv, "index %d not used in uCode key table.\n",
+                        priv->stations[sta_id].sta.key.key_offset);
+        memset(&priv->stations[sta_id].keyinfo, 0,
+                                        sizeof(struct iwl_hw_key));
+        memset(&priv->stations[sta_id].sta.key, 0,
+                                        sizeof(struct iwl4965_keyinfo));
+        priv->stations[sta_id].sta.key.key_flags =
+                        STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
+        priv->stations[sta_id].sta.key.key_offset = WEP_INVALID_OFFSET;
+        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_WEP(priv, "Not sending REPLY_ADD_STA command because RFKILL enabled.\n");
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+}
+
+int iwl_set_dynamic_key(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                        struct ieee80211_key_conf *keyconf, u8 sta_id)
+{
+        int ret;
+
+        lockdep_assert_held(&priv->mutex);
+
+        ctx->key_mapping_keys++;
+        keyconf->hw_key_idx = HW_KEY_DYNAMIC;
+
+        switch (keyconf->cipher) {
+        case WLAN_CIPHER_SUITE_CCMP:
+                ret = iwl_set_ccmp_dynamic_key_info(priv, ctx, keyconf, sta_id);
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                ret = iwl_set_tkip_dynamic_key_info(priv, ctx, keyconf, sta_id);
+                break;
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
+                ret = iwl_set_wep_dynamic_key_info(priv, ctx, keyconf, sta_id);
+                break;
+        default:
+                IWL_ERR(priv,
+                        "Unknown alg: %s cipher = %x\n", __func__,
+                        keyconf->cipher);
+                ret = -EINVAL;
+        }
+
+        IWL_DEBUG_WEP(priv, "Set dynamic key: cipher=%x len=%d idx=%d sta=%d ret=%d\n",
+                      keyconf->cipher, keyconf->keylen, keyconf->keyidx,
+                      sta_id, ret);
+
+        return ret;
+}
+
+/**
+ * iwlagn_alloc_bcast_station - add broadcast station into driver's station table.
+ *
+ * This adds the broadcast station into the driver's station table
+ * and marks it driver active, so that it will be restored to the
+ * device at the next best time.
+ */
+int iwlagn_alloc_bcast_station(struct iwl_priv *priv,
+                               struct iwl_rxon_context *ctx)
+{
+        struct iwl_link_quality_cmd *link_cmd;
+        unsigned long flags;
+        u8 sta_id;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        sta_id = iwl_prep_station(priv, ctx, iwl_bcast_addr, false, NULL);
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Unable to prepare broadcast station\n");
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+                return -EINVAL;
+        }
+
+        priv->stations[sta_id].used |= IWL_STA_DRIVER_ACTIVE;
+        priv->stations[sta_id].used |= IWL_STA_BCAST;
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        link_cmd = iwl_sta_alloc_lq(priv, sta_id);
+        if (!link_cmd) {
+                IWL_ERR(priv,
+                        "Unable to initialize rate scaling for bcast station.\n");
+                return -ENOMEM;
+        }
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        priv->stations[sta_id].lq = link_cmd;
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return 0;
+}
+
+/**
+ * iwl_update_bcast_station - update broadcast station's LQ command
+ *
+ * Only used by iwlagn. Placed here to have all bcast station management
+ * code together.
+ */
+static int iwl_update_bcast_station(struct iwl_priv *priv,
+                                    struct iwl_rxon_context *ctx)
+{
+        unsigned long flags;
+        struct iwl_link_quality_cmd *link_cmd;
+        u8 sta_id = ctx->bcast_sta_id;
+
+        link_cmd = iwl_sta_alloc_lq(priv, sta_id);
+        if (!link_cmd) {
+                IWL_ERR(priv, "Unable to initialize rate scaling for bcast station.\n");
+                return -ENOMEM;
+        }
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        if (priv->stations[sta_id].lq)
+                kfree(priv->stations[sta_id].lq);
+        else
+                IWL_DEBUG_INFO(priv, "Bcast station rate scaling has not been initialized yet.\n");
+        priv->stations[sta_id].lq = link_cmd;
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return 0;
+}
+
+int iwl_update_bcast_stations(struct iwl_priv *priv)
+{
+        struct iwl_rxon_context *ctx;
+        int ret = 0;
+
+        for_each_context(priv, ctx) {
+                ret = iwl_update_bcast_station(priv, ctx);
+                if (ret)
+                        break;
+        }
+
+        return ret;
+}
+
+/**
+ * iwl_sta_tx_modify_enable_tid - Enable Tx for this TID in station table
+ */
+int iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid)
+{
+        unsigned long flags;
+        struct iwl_addsta_cmd sta_cmd;
+
+        lockdep_assert_held(&priv->mutex);
+
+        /* Remove "disable" flag, to enable Tx for this TID */
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_TID_DISABLE_TX;
+        priv->stations[sta_id].sta.tid_disable_tx &= cpu_to_le16(~(1 << tid));
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+}
+
+int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
+                         int tid, u16 ssn)
+{
+        unsigned long flags;
+        int sta_id;
+        struct iwl_addsta_cmd sta_cmd;
+
+        lockdep_assert_held(&priv->mutex);
+
+        sta_id = iwl_sta_id(sta);
+        if (sta_id == IWL_INVALID_STATION)
+                return -ENXIO;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        priv->stations[sta_id].sta.station_flags_msk = 0;
+        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_ADDBA_TID_MSK;
+        priv->stations[sta_id].sta.add_immediate_ba_tid = (u8)tid;
+        priv->stations[sta_id].sta.add_immediate_ba_ssn = cpu_to_le16(ssn);
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+}
+
+int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
+                        int tid)
+{
+        unsigned long flags;
+        int sta_id;
+        struct iwl_addsta_cmd sta_cmd;
+
+        lockdep_assert_held(&priv->mutex);
+
+        sta_id = iwl_sta_id(sta);
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Invalid station for AGG tid %d\n", tid);
+                return -ENXIO;
+        }
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        priv->stations[sta_id].sta.station_flags_msk = 0;
+        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_DELBA_TID_MSK;
+        priv->stations[sta_id].sta.remove_immediate_ba_tid = (u8)tid;
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+}
+
+void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        priv->stations[sta_id].sta.station_flags &= ~STA_FLG_PWR_SAVE_MSK;
+        priv->stations[sta_id].sta.station_flags_msk = STA_FLG_PWR_SAVE_MSK;
+        priv->stations[sta_id].sta.sta.modify_mask = 0;
+        priv->stations[sta_id].sta.sleep_tx_count = 0;
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+}
+
+void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        priv->stations[sta_id].sta.station_flags |= STA_FLG_PWR_SAVE_MSK;
+        priv->stations[sta_id].sta.station_flags_msk = STA_FLG_PWR_SAVE_MSK;
+        priv->stations[sta_id].sta.sta.modify_mask =
+                                        STA_MODIFY_SLEEP_TX_COUNT_MSK;
+        priv->stations[sta_id].sta.sleep_tx_count = cpu_to_le16(cnt);
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tt.c b/drivers/net/wireless/iwlwifi/iwl-agn-tt.c
index 07b2c6cadf51..e3a8216a033c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tt.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tt.c
@@ -114,7 +114,7 @@ static bool iwl_within_ct_kill_margin(struct iwl_priv *priv)
         s32 temp = priv->temperature; /* degrees CELSIUS except specified */
         bool within_margin = false;
 
-        if (priv->cfg->temperature_kelvin)
+        if (priv->cfg->base_params->temperature_kelvin)
                 temp = KELVIN_TO_CELSIUS(priv->temperature);
 
         if (!priv->thermal_throttle.advanced_tt)
@@ -571,7 +571,6 @@ void iwl_tt_enter_ct_kill(struct iwl_priv *priv)
         IWL_DEBUG_POWER(priv, "Queueing critical temperature enter.\n");
         queue_work(priv->workqueue, &priv->ct_enter);
 }
-EXPORT_SYMBOL(iwl_tt_enter_ct_kill);
 
 void iwl_tt_exit_ct_kill(struct iwl_priv *priv)
 {
@@ -581,7 +580,6 @@ void iwl_tt_exit_ct_kill(struct iwl_priv *priv)
         IWL_DEBUG_POWER(priv, "Queueing critical temperature exit.\n");
         queue_work(priv->workqueue, &priv->ct_exit);
 }
-EXPORT_SYMBOL(iwl_tt_exit_ct_kill);
 
 static void iwl_bg_tt_work(struct work_struct *work)
 {
@@ -591,7 +589,7 @@ static void iwl_bg_tt_work(struct work_struct *work)
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        if (priv->cfg->temperature_kelvin)
+        if (priv->cfg->base_params->temperature_kelvin)
                 temp = KELVIN_TO_CELSIUS(priv->temperature);
 
         if (!priv->thermal_throttle.advanced_tt)
@@ -608,7 +606,6 @@ void iwl_tt_handler(struct iwl_priv *priv)
         IWL_DEBUG_POWER(priv, "Queueing thermal throttling work.\n");
         queue_work(priv->workqueue, &priv->tt_work);
 }
-EXPORT_SYMBOL(iwl_tt_handler);
 
 /* Thermal throttling initialization
  * For advance thermal throttling:
@@ -640,7 +637,7 @@ void iwl_tt_initialize(struct iwl_priv *priv)
         INIT_WORK(&priv->ct_enter, iwl_bg_ct_enter);
         INIT_WORK(&priv->ct_exit, iwl_bg_ct_exit);
 
-        if (priv->cfg->adv_thermal_throttle) {
+        if (priv->cfg->base_params->adv_thermal_throttle) {
                 IWL_DEBUG_POWER(priv, "Advanced Thermal Throttling\n");
                 tt->restriction = kzalloc(sizeof(struct iwl_tt_restriction) *
                                          IWL_TI_STATE_MAX, GFP_KERNEL);
@@ -678,7 +675,6 @@ void iwl_tt_initialize(struct iwl_priv *priv)
                 priv->thermal_throttle.advanced_tt = false;
         }
 }
-EXPORT_SYMBOL(iwl_tt_initialize);
 
 /* cleanup thermal throttling management related memory and timer */
 void iwl_tt_exit(struct iwl_priv *priv)
@@ -701,4 +697,3 @@ void iwl_tt_exit(struct iwl_priv *priv)
                 tt->transaction = NULL;
         }
 }
-EXPORT_SYMBOL(iwl_tt_exit);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index 5950184d9860..db57aea629d9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -224,13 +224,13 @@ int iwlagn_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         int ret;
 
         if ((IWLAGN_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWLAGN_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
-             <= txq_id)) {
+            (IWLAGN_FIRST_AMPDU_QUEUE +
+                priv->cfg->base_params->num_of_ampdu_queues <= txq_id)) {
                 IWL_WARN(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWLAGN_FIRST_AMPDU_QUEUE,
                         IWLAGN_FIRST_AMPDU_QUEUE +
-                        priv->cfg->num_of_ampdu_queues - 1);
+                        priv->cfg->base_params->num_of_ampdu_queues - 1);
                 return -EINVAL;
         }
 
@@ -286,13 +286,13 @@ int iwlagn_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                            u16 ssn_idx, u8 tx_fifo)
 {
         if ((IWLAGN_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWLAGN_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
-             <= txq_id)) {
+            (IWLAGN_FIRST_AMPDU_QUEUE +
+                priv->cfg->base_params->num_of_ampdu_queues <= txq_id)) {
                 IWL_ERR(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWLAGN_FIRST_AMPDU_QUEUE,
                         IWLAGN_FIRST_AMPDU_QUEUE +
-                        priv->cfg->num_of_ampdu_queues - 1);
+                        priv->cfg->base_params->num_of_ampdu_queues - 1);
                 return -EINVAL;
         }
 
@@ -350,7 +350,8 @@ static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
         if (ieee80211_is_back_req(fc))
                 tx_flags |= TX_CMD_FLG_ACK_MSK | TX_CMD_FLG_IMM_BA_RSP_MASK;
         else if (info->band == IEEE80211_BAND_2GHZ &&
-                 priv->cfg->advanced_bt_coexist &&
+                 priv->cfg->bt_params &&
+                 priv->cfg->bt_params->advanced_bt_coexist &&
                  (ieee80211_is_auth(fc) || ieee80211_is_assoc_req(fc) ||
                  ieee80211_is_reassoc_req(fc) ||
                  skb->protocol == cpu_to_be16(ETH_P_PAE)))
@@ -444,7 +445,9 @@ static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
                 rate_flags |= RATE_MCS_CCK_MSK;
 
         /* Set up antennas */
-         if (priv->cfg->advanced_bt_coexist && priv->bt_full_concurrent) {
+         if (priv->cfg->bt_params &&
+             priv->cfg->bt_params->advanced_bt_coexist &&
+             priv->bt_full_concurrent) {
                 /* operated as 1x1 in full concurrency mode */
                 priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
                                 first_antenna(priv->hw_params.valid_tx_ant));
@@ -1388,3 +1391,43 @@ void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
 
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+const char *iwl_get_tx_fail_reason(u32 status)
+{
+#define TX_STATUS_FAIL(x) case TX_STATUS_FAIL_ ## x: return #x
+#define TX_STATUS_POSTPONE(x) case TX_STATUS_POSTPONE_ ## x: return #x
+
+        switch (status & TX_STATUS_MSK) {
+        case TX_STATUS_SUCCESS:
+                return "SUCCESS";
+        TX_STATUS_POSTPONE(DELAY);
+        TX_STATUS_POSTPONE(FEW_BYTES);
+        TX_STATUS_POSTPONE(BT_PRIO);
+        TX_STATUS_POSTPONE(QUIET_PERIOD);
+        TX_STATUS_POSTPONE(CALC_TTAK);
+        TX_STATUS_FAIL(INTERNAL_CROSSED_RETRY);
+        TX_STATUS_FAIL(SHORT_LIMIT);
+        TX_STATUS_FAIL(LONG_LIMIT);
+        TX_STATUS_FAIL(FIFO_UNDERRUN);
+        TX_STATUS_FAIL(DRAIN_FLOW);
+        TX_STATUS_FAIL(RFKILL_FLUSH);
+        TX_STATUS_FAIL(LIFE_EXPIRE);
+        TX_STATUS_FAIL(DEST_PS);
+        TX_STATUS_FAIL(HOST_ABORTED);
+        TX_STATUS_FAIL(BT_RETRY);
+        TX_STATUS_FAIL(STA_INVALID);
+        TX_STATUS_FAIL(FRAG_DROPPED);
+        TX_STATUS_FAIL(TID_DISABLE);
+        TX_STATUS_FAIL(FIFO_FLUSHED);
+        TX_STATUS_FAIL(INSUFFICIENT_CF_POLL);
+        TX_STATUS_FAIL(PASSIVE_NO_RX);
+        TX_STATUS_FAIL(NO_BEACON_ON_RADAR);
+        }
+
+        return "UNKNOWN";
+
+#undef TX_STATUS_FAIL
+#undef TX_STATUS_POSTPONE
+}
+#endif /* CONFIG_IWLWIFI_DEBUG */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
index a7961bf395fc..703621107dac 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
@@ -38,6 +38,7 @@
 #include "iwl-helpers.h"
 #include "iwl-agn-hw.h"
 #include "iwl-agn.h"
+#include "iwl-agn-calib.h"
 
 static const s8 iwlagn_default_queue_to_tx_fifo[] = {
         IWL_TX_FIFO_VO,
@@ -214,6 +215,25 @@ static int iwlagn_set_Xtal_calib(struct iwl_priv *priv)
                              (u8 *)&cmd, sizeof(cmd));
 }
 
+static int iwlagn_set_temperature_offset_calib(struct iwl_priv *priv)
+{
+        struct iwl_calib_temperature_offset_cmd cmd;
+        __le16 *offset_calib =
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_TEMPERATURE);
+        cmd.hdr.op_code = IWL_PHY_CALIBRATE_TEMP_OFFSET_CMD;
+        cmd.hdr.first_group = 0;
+        cmd.hdr.groups_num = 1;
+        cmd.hdr.data_valid = 1;
+        cmd.radio_sensor_offset = le16_to_cpu(offset_calib[1]);
+        if (!(cmd.radio_sensor_offset))
+                cmd.radio_sensor_offset = DEFAULT_RADIO_SENSOR_OFFSET;
+        cmd.reserved = 0;
+        IWL_DEBUG_CALIB(priv, "Radio sensor offset: %d\n",
+                        cmd.radio_sensor_offset);
+        return iwl_calib_set(&priv->calib_results[IWL_CALIB_TEMP_OFFSET],
+                             (u8 *)&cmd, sizeof(cmd));
+}
+
 static int iwlagn_send_calib_cfg(struct iwl_priv *priv)
 {
         struct iwl_calib_cfg_cmd calib_cfg_cmd;
@@ -307,7 +327,27 @@ void iwlagn_init_alive_start(struct iwl_priv *priv)
                 goto restart;
         }
 
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->advanced_bt_coexist) {
+                /*
+                 * Tell uCode we are ready to perform calibration
+                 * need to perform this before any calibration
+                 * no need to close the envlope since we are going
+                 * to load the runtime uCode later.
+                 */
+                iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_OPEN,
+                        BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+
+        }
         iwlagn_send_calib_cfg(priv);
+
+        /**
+         * temperature offset calibration is only needed for runtime ucode,
+         * so prepare the value now.
+         */
+        if (priv->cfg->need_temp_offset_calib)
+                iwlagn_set_temperature_offset_calib(priv);
+
         return;
 
 restart:
@@ -319,7 +359,7 @@ static int iwlagn_send_wimax_coex(struct iwl_priv *priv)
 {
         struct iwl_wimax_coex_cmd coex_cmd;
 
-        if (priv->cfg->support_wimax_coexist) {
+        if (priv->cfg->base_params->support_wimax_coexist) {
                 /* UnMask wake up src at associated sleep */
                 coex_cmd.flags = COEX_FLAGS_ASSOC_WA_UNMASK_MSK;
 
@@ -364,7 +404,7 @@ static const u8 iwlagn_bt_prio_tbl[BT_COEX_PRIO_TBL_EVT_MAX] = {
         0, 0, 0, 0, 0, 0, 0
 };
 
-static void iwlagn_send_prio_tbl(struct iwl_priv *priv)
+void iwlagn_send_prio_tbl(struct iwl_priv *priv)
 {
         struct iwl_bt_coex_prio_table_cmd prio_tbl_cmd;
 
@@ -375,7 +415,7 @@ static void iwlagn_send_prio_tbl(struct iwl_priv *priv)
                 IWL_ERR(priv, "failed to send BT prio tbl command\n");
 }
 
-static void iwlagn_send_bt_env(struct iwl_priv *priv, u8 action, u8 type)
+void iwlagn_send_bt_env(struct iwl_priv *priv, u8 action, u8 type)
 {
         struct iwl_bt_coex_prot_env_cmd env_cmd;
 
@@ -482,25 +522,6 @@ int iwlagn_alive_notify(struct iwl_priv *priv)
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        if (priv->cfg->advanced_bt_coexist) {
-                /* Configure Bluetooth device coexistence support */
-                /* need to perform this before any calibration */
-                priv->bt_valid = IWLAGN_BT_ALL_VALID_MSK;
-                priv->kill_ack_mask = IWLAGN_BT_KILL_ACK_MASK_DEFAULT;
-                priv->kill_cts_mask = IWLAGN_BT_KILL_CTS_MASK_DEFAULT;
-                priv->cfg->ops->hcmd->send_bt_config(priv);
-                priv->bt_valid = IWLAGN_BT_VALID_ENABLE_FLAGS;
-
-                if (bt_coex_active && priv->iw_mode != NL80211_IFTYPE_ADHOC) {
-                        iwlagn_send_prio_tbl(priv);
-                        iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_OPEN,
-                                BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
-                        iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_CLOSE,
-                                BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
-                }
-
-        }
-
         iwlagn_send_wimax_coex(priv);
 
         iwlagn_set_Xtal_calib(priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index ad0e67f5c0d4..c2636a7ab9ee 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -57,7 +57,7 @@
 #include "iwl-io.h"
 #include "iwl-helpers.h"
 #include "iwl-sta.h"
-#include "iwl-calib.h"
+#include "iwl-agn-calib.h"
 #include "iwl-agn.h"
 
 
@@ -91,14 +91,14 @@ static int iwlagn_ant_coupling;
 static bool iwlagn_bt_ch_announce = 1;
 
 /**
- * iwl_commit_rxon - commit staging_rxon to hardware
+ * iwlagn_commit_rxon - commit staging_rxon to hardware
  *
  * The RXON command in staging_rxon is committed to the hardware and
  * the active_rxon structure is updated with the new data.  This
  * function correctly transitions out of the RXON_ASSOC_MSK state if
  * a HW tune is required based on the RXON structure changes.
  */
-int iwl_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 {
         /* cast away the const for active_rxon in this function */
         struct iwl_rxon_cmd *active_rxon = (void *)&ctx->active;
@@ -110,6 +110,9 @@ int iwl_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
         if (!iwl_is_alive(priv))
                 return -EBUSY;
 
+        if (!ctx->is_active)
+                return 0;
+
         /* always get timestamp with Rx frame */
         ctx->staging.flags |= RXON_FLG_TSF2HOST_MSK;
 
@@ -223,9 +226,8 @@ int iwl_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
                         return ret;
                 }
         }
-
-        priv->start_calib = 0;
         if (new_assoc) {
+                priv->start_calib = 0;
                 /* Apply the new configuration
                  * RXON assoc doesn't clear the station table in uCode,
                  */
@@ -312,24 +314,26 @@ static void iwl_free_frame(struct iwl_priv *priv, struct iwl_frame *frame)
 }
 
 static u32 iwl_fill_beacon_frame(struct iwl_priv *priv,
-                                          struct ieee80211_hdr *hdr,
-                                          int left)
+                                 struct ieee80211_hdr *hdr,
+                                 int left)
 {
-        if (!priv->ibss_beacon)
+        lockdep_assert_held(&priv->mutex);
+
+        if (!priv->beacon_skb)
                 return 0;
 
-        if (priv->ibss_beacon->len > left)
+        if (priv->beacon_skb->len > left)
                 return 0;
 
-        memcpy(hdr, priv->ibss_beacon->data, priv->ibss_beacon->len);
+        memcpy(hdr, priv->beacon_skb->data, priv->beacon_skb->len);
 
-        return priv->ibss_beacon->len;
+        return priv->beacon_skb->len;
 }
 
 /* Parse the beacon frame to find the TIM element and set tim_idx & tim_size */
 static void iwl_set_beacon_tim(struct iwl_priv *priv,
-                struct iwl_tx_beacon_cmd *tx_beacon_cmd,
-                u8 *beacon, u32 frame_size)
+                               struct iwl_tx_beacon_cmd *tx_beacon_cmd,
+                               u8 *beacon, u32 frame_size)
 {
         u16 tim_idx;
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)beacon;
@@ -369,7 +373,7 @@ static unsigned int iwl_hw_get_beacon_cmd(struct iwl_priv *priv,
 
         if (!priv->beacon_ctx) {
                 IWL_ERR(priv, "trying to build beacon w/o beacon context!\n");
-                return -EINVAL;
+                return 0;
         }
 
         /* Initialize memory */
@@ -381,6 +385,8 @@ static unsigned int iwl_hw_get_beacon_cmd(struct iwl_priv *priv,
                                 sizeof(frame->u) - sizeof(*tx_beacon_cmd));
         if (WARN_ON_ONCE(frame_size > MAX_MPDU_SIZE))
                 return 0;
+        if (!frame_size)
+                return 0;
 
         /* Set up TX command fields */
         tx_beacon_cmd->tx.len = cpu_to_le16((u16)frame_size);
@@ -391,7 +397,7 @@ static unsigned int iwl_hw_get_beacon_cmd(struct iwl_priv *priv,
 
         /* Set up TX beacon command fields */
         iwl_set_beacon_tim(priv, tx_beacon_cmd, (u8 *)tx_beacon_cmd->frame,
-                        frame_size);
+                           frame_size);
 
         /* Set up packet rate and flags */
         rate = iwl_rate_get_lowest_plcp(priv, priv->beacon_ctx);
@@ -646,15 +652,14 @@ static void iwl_bg_beacon_update(struct work_struct *work)
         /* Pull updated AP beacon from mac80211. will fail if not in AP mode */
         beacon = ieee80211_beacon_get(priv->hw, priv->beacon_ctx->vif);
         if (!beacon) {
-                IWL_ERR(priv, "update beacon failed\n");
+                IWL_ERR(priv, "update beacon failed -- keeping old\n");
                 goto out;
         }
 
         /* new beacon skb is allocated every time; dispose previous.*/
-        if (priv->ibss_beacon)
-                dev_kfree_skb(priv->ibss_beacon);
+        dev_kfree_skb(priv->beacon_skb);
 
-        priv->ibss_beacon = beacon;
+        priv->beacon_skb = beacon;
 
         iwl_send_beacon_cmd(priv);
  out:
@@ -933,22 +938,6 @@ static void iwl_rx_card_state_notif(struct iwl_priv *priv,
                 wake_up_interruptible(&priv->wait_command_queue);
 }
 
-int iwl_set_pwr_src(struct iwl_priv *priv, enum iwl_pwr_src src)
-{
-        if (src == IWL_PWR_SRC_VAUX) {
-                if (pci_pme_capable(priv->pci_dev, PCI_D3cold))
-                        iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
-                                               APMG_PS_CTRL_VAL_PWR_SRC_VAUX,
-                                               ~APMG_PS_CTRL_MSK_PWR_SRC);
-        } else {
-                iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
-                                       APMG_PS_CTRL_VAL_PWR_SRC_VMAIN,
-                                       ~APMG_PS_CTRL_MSK_PWR_SRC);
-        }
-
-        return 0;
-}
-
 static void iwl_bg_tx_flush(struct work_struct *work)
 {
         struct iwl_priv *priv =
@@ -1278,7 +1267,6 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
                 IWL_ERR(priv, "Microcode SW error detected. "
                         " Restarting 0x%X.\n", inta);
                 priv->isr_stats.sw++;
-                priv->isr_stats.sw_err = inta;
                 iwl_irq_handle_error(priv);
                 handled |= CSR_INT_BIT_SW_ERR;
         }
@@ -1459,7 +1447,6 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                 IWL_ERR(priv, "Microcode SW error detected. "
                         " Restarting 0x%X.\n", inta);
                 priv->isr_stats.sw++;
-                priv->isr_stats.sw_err = inta;
                 iwl_irq_handle_error(priv);
                 handled |= CSR_INT_BIT_SW_ERR;
         }
@@ -2078,7 +2065,7 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         struct iwlagn_ucode_capabilities ucode_capa = {
                 .max_probe_length = 200,
                 .standard_phy_calibration_size =
-                        IWL_MAX_STANDARD_PHY_CALIBRATE_TBL_SIZE,
+                        IWL_DEFAULT_STANDARD_PHY_CALIBRATE_TBL_SIZE,
         };
 
         memset(&pieces, 0, sizeof(pieces));
@@ -2120,18 +2107,23 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
          * firmware filename ... but we don't check for that and only rely
          * on the API version read from firmware header from here on forward
          */
-        if (api_ver < api_min || api_ver > api_max) {
-                IWL_ERR(priv, "Driver unable to support your firmware API. "
-                          "Driver supports v%u, firmware is v%u.\n",
-                          api_max, api_ver);
-                goto try_again;
-        }
+        /* no api version check required for experimental uCode */
+        if (priv->fw_index != UCODE_EXPERIMENTAL_INDEX) {
+                if (api_ver < api_min || api_ver > api_max) {
+                        IWL_ERR(priv,
+                                "Driver unable to support your firmware API. "
+                                "Driver supports v%u, firmware is v%u.\n",
+                                api_max, api_ver);
+                        goto try_again;
+                }
 
-        if (api_ver != api_max)
-                IWL_ERR(priv, "Firmware has old API version. Expected v%u, "
-                          "got v%u. New firmware can be obtained "
-                          "from http://www.intellinuxwireless.org.\n",
-                          api_max, api_ver);
+                if (api_ver != api_max)
+                        IWL_ERR(priv,
+                                "Firmware has old API version. Expected v%u, "
+                                "got v%u. New firmware can be obtained "
+                                "from http://www.intellinuxwireless.org.\n",
+                                api_max, api_ver);
+        }
 
         if (build)
                 sprintf(buildstr, " build %u%s", build,
@@ -2256,13 +2248,15 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         if (pieces.init_evtlog_size)
                 priv->_agn.init_evtlog_size = (pieces.init_evtlog_size - 16)/12;
         else
-                priv->_agn.init_evtlog_size = priv->cfg->max_event_log_size;
+                priv->_agn.init_evtlog_size =
+                        priv->cfg->base_params->max_event_log_size;
         priv->_agn.init_errlog_ptr = pieces.init_errlog_ptr;
         priv->_agn.inst_evtlog_ptr = pieces.inst_evtlog_ptr;
         if (pieces.inst_evtlog_size)
                 priv->_agn.inst_evtlog_size = (pieces.inst_evtlog_size - 16)/12;
         else
-                priv->_agn.inst_evtlog_size = priv->cfg->max_event_log_size;
+                priv->_agn.inst_evtlog_size =
+                        priv->cfg->base_params->max_event_log_size;
         priv->_agn.inst_errlog_ptr = pieces.inst_errlog_ptr;
 
         if (ucode_capa.pan) {
@@ -2467,6 +2461,7 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
         }
 
         desc = iwl_read_targ_mem(priv, base + 1 * sizeof(u32));
+        priv->isr_stats.err_code = desc;
         pc = iwl_read_targ_mem(priv, base + 2 * sizeof(u32));
         blink1 = iwl_read_targ_mem(priv, base + 3 * sizeof(u32));
         blink2 = iwl_read_targ_mem(priv, base + 4 * sizeof(u32));
@@ -2731,7 +2726,7 @@ static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
         spin_unlock_irqrestore(&priv->lock, flags);
         priv->thermal_throttle.ct_kill_toggle = false;
 
-        if (priv->cfg->support_ct_kill_exit) {
+        if (priv->cfg->base_params->support_ct_kill_exit) {
                 adv_cmd.critical_temperature_enter =
                         cpu_to_le32(priv->hw_params.ct_kill_threshold);
                 adv_cmd.critical_temperature_exit =
@@ -2764,6 +2759,23 @@ static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
         }
 }
 
+static int iwlagn_send_calib_cfg_rt(struct iwl_priv *priv, u32 cfg)
+{
+        struct iwl_calib_cfg_cmd calib_cfg_cmd;
+        struct iwl_host_cmd cmd = {
+                .id = CALIBRATION_CFG_CMD,
+                .len = sizeof(struct iwl_calib_cfg_cmd),
+                .data = &calib_cfg_cmd,
+        };
+
+        memset(&calib_cfg_cmd, 0, sizeof(calib_cfg_cmd));
+        calib_cfg_cmd.ucd_calib_cfg.once.is_enable = IWL_CALIB_INIT_CFG_ALL;
+        calib_cfg_cmd.ucd_calib_cfg.once.start = cpu_to_le32(cfg);
+
+        return iwl_send_cmd(priv, &cmd);
+}
+
+
 /**
  * iwl_alive_start - called after REPLY_ALIVE notification received
  *                   from protocol/runtime uCode (initialization uCode's
@@ -2800,6 +2812,7 @@ static void iwl_alive_start(struct iwl_priv *priv)
                 goto restart;
         }
 
+
         /* After the ALIVE response, we can send host commands to the uCode */
         set_bit(STATUS_ALIVE, &priv->status);
 
@@ -2807,12 +2820,33 @@ static void iwl_alive_start(struct iwl_priv *priv)
                 /* Enable timer to monitor the driver queues */
                 mod_timer(&priv->monitor_recover,
                         jiffies +
-                        msecs_to_jiffies(priv->cfg->monitor_recover_period));
+                        msecs_to_jiffies(
+                          priv->cfg->base_params->monitor_recover_period));
         }
 
         if (iwl_is_rfkill(priv))
                 return;
 
+        /* download priority table before any calibration request */
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->advanced_bt_coexist) {
+                /* Configure Bluetooth device coexistence support */
+                priv->bt_valid = IWLAGN_BT_ALL_VALID_MSK;
+                priv->kill_ack_mask = IWLAGN_BT_KILL_ACK_MASK_DEFAULT;
+                priv->kill_cts_mask = IWLAGN_BT_KILL_CTS_MASK_DEFAULT;
+                priv->cfg->ops->hcmd->send_bt_config(priv);
+                priv->bt_valid = IWLAGN_BT_VALID_ENABLE_FLAGS;
+                iwlagn_send_prio_tbl(priv);
+
+                /* FIXME: w/a to force change uCode BT state machine */
+                iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_OPEN,
+                        BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+                iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_CLOSE,
+                        BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+        }
+        if (priv->hw_params.calib_rt_cfg)
+                iwlagn_send_calib_cfg_rt(priv, priv->hw_params.calib_rt_cfg);
+
         ieee80211_wake_queues(priv->hw);
 
         priv->active_rate = IWL_RATES_MASK;
@@ -2837,7 +2871,8 @@ static void iwl_alive_start(struct iwl_priv *priv)
                         priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
         }
 
-        if (!priv->cfg->advanced_bt_coexist) {
+        if (priv->cfg->bt_params &&
+            !priv->cfg->bt_params->advanced_bt_coexist) {
                 /* Configure Bluetooth device coexistence support */
                 priv->cfg->ops->hcmd->send_bt_config(priv);
         }
@@ -2875,8 +2910,9 @@ static void __iwl_down(struct iwl_priv *priv)
 
         IWL_DEBUG_INFO(priv, DRV_NAME " is going down\n");
 
-        if (!exit_pending)
-                set_bit(STATUS_EXIT_PENDING, &priv->status);
+        iwl_scan_cancel_timeout(priv, 200);
+
+        exit_pending = test_and_set_bit(STATUS_EXIT_PENDING, &priv->status);
 
         /* Stop TX queues watchdog. We need to have STATUS_EXIT_PENDING bit set
          * to prevent rearm timer */
@@ -2889,7 +2925,11 @@ static void __iwl_down(struct iwl_priv *priv)
 
         /* reset BT coex data */
         priv->bt_status = 0;
-        priv->bt_traffic_load = priv->cfg->bt_init_traffic_load;
+        if (priv->cfg->bt_params)
+                priv->bt_traffic_load =
+                         priv->cfg->bt_params->bt_init_traffic_load;
+        else
+                priv->bt_traffic_load = 0;
         priv->bt_sco_active = false;
         priv->bt_full_concurrent = false;
         priv->bt_ci_compliance = 0;
@@ -2951,14 +2991,13 @@ static void __iwl_down(struct iwl_priv *priv)
         iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
 
         /* Stop the device, and put it in low power state */
-        priv->cfg->ops->lib->apm_ops.stop(priv);
+        iwl_apm_stop(priv);
 
  exit:
         memset(&priv->card_alive, 0, sizeof(struct iwl_alive_resp));
 
-        if (priv->ibss_beacon)
-                dev_kfree_skb(priv->ibss_beacon);
-        priv->ibss_beacon = NULL;
+        dev_kfree_skb(priv->beacon_skb);
+        priv->beacon_skb = NULL;
 
         /* clear out any free frames */
         iwl_clear_free_frames(priv);
@@ -3041,7 +3080,7 @@ static int __iwl_up(struct iwl_priv *priv)
         }
 
         for_each_context(priv, ctx) {
-                ret = iwl_alloc_bcast_station(priv, ctx, true);
+                ret = iwlagn_alloc_bcast_station(priv, ctx);
                 if (ret) {
                         iwl_dealloc_bcast_stations(priv);
                         return ret;
@@ -3183,7 +3222,8 @@ static void iwl_bg_run_time_calib_work(struct work_struct *work)
         }
 
         if (priv->start_calib) {
-                if (priv->cfg->bt_statistics) {
+                if (priv->cfg->bt_params &&
+                    priv->cfg->bt_params->bt_statistics) {
                         iwl_chain_noise_calibration(priv,
                                         (void *)&priv->_agn.statistics_bt);
                         iwl_sensitivity_calibration(priv,
@@ -3382,7 +3422,7 @@ static int iwl_mac_setup_register(struct iwl_priv *priv,
                     IEEE80211_HW_NEED_DTIM_PERIOD |
                     IEEE80211_HW_SPECTRUM_MGMT;
 
-        if (!priv->cfg->broken_powersave)
+        if (!priv->cfg->base_params->broken_powersave)
                 hw->flags |= IEEE80211_HW_SUPPORTS_PS |
                              IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
 
@@ -3486,15 +3526,6 @@ static void iwl_mac_stop(struct ieee80211_hw *hw)
 
         priv->is_open = 0;
 
-        if (iwl_is_ready_rf(priv) || test_bit(STATUS_SCAN_HW, &priv->status)) {
-                /* stop mac, cancel any scan request and clear
-                 * RXON_FILTER_ASSOC_MSK BIT
-                 */
-                mutex_lock(&priv->mutex);
-                iwl_scan_cancel_timeout(priv, 100);
-                mutex_unlock(&priv->mutex);
-        }
-
         iwl_down(priv);
 
         flush_workqueue(priv->workqueue);
@@ -3716,7 +3747,8 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
                 }
                 if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                         ret = 0;
-                if (priv->cfg->use_rts_for_aggregation) {
+                if (priv->cfg->ht_params &&
+                    priv->cfg->ht_params->use_rts_for_aggregation) {
                         struct iwl_station_priv *sta_priv =
                                 (void *) sta->drv_priv;
                         /*
@@ -3730,7 +3762,8 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
                 }
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
-                if (priv->cfg->use_rts_for_aggregation) {
+                if (priv->cfg->ht_params &&
+                    priv->cfg->ht_params->use_rts_for_aggregation) {
                         struct iwl_station_priv *sta_priv =
                                 (void *) sta->drv_priv;
 
@@ -4048,7 +4081,7 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
                         priv->cfg->ops->lib->recover_from_tx_stall;
         }
 
-        if (!priv->cfg->use_isr_legacy)
+        if (!priv->cfg->base_params->use_isr_legacy)
                 tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
                         iwl_irq_tasklet, (unsigned long)priv);
         else
@@ -4062,13 +4095,15 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
                 priv->cfg->ops->lib->cancel_deferred_work(priv);
 
         cancel_delayed_work_sync(&priv->init_alive_start);
-        cancel_delayed_work(&priv->scan_check);
-        cancel_work_sync(&priv->start_internal_scan);
         cancel_delayed_work(&priv->alive_start);
         cancel_work_sync(&priv->run_time_calib_work);
         cancel_work_sync(&priv->beacon_update);
+
+        iwl_cancel_scan_deferred_work(priv);
+
         cancel_work_sync(&priv->bt_full_concurrency);
         cancel_work_sync(&priv->bt_runtime_config);
+
         del_timer_sync(&priv->statistics_periodic);
         del_timer_sync(&priv->ucode_trace);
 }
@@ -4098,8 +4133,6 @@ static int iwl_init_drv(struct iwl_priv *priv)
 {
         int ret;
 
-        priv->ibss_beacon = NULL;
-
         spin_lock_init(&priv->sta_lock);
         spin_lock_init(&priv->hcmd_lock);
 
@@ -4131,7 +4164,8 @@ static int iwl_init_drv(struct iwl_priv *priv)
         iwl_init_scan_params(priv);
 
         /* init bt coex */
-        if (priv->cfg->advanced_bt_coexist) {
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->advanced_bt_coexist) {
                 priv->kill_ack_mask = IWLAGN_BT_KILL_ACK_MASK_DEFAULT;
                 priv->kill_cts_mask = IWLAGN_BT_KILL_CTS_MASK_DEFAULT;
                 priv->bt_valid = IWLAGN_BT_ALL_VALID_MSK;
@@ -4262,9 +4296,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         /* Disabling hardware scan means that mac80211 will perform scans
          * "the hard way", rather than using device's scan. */
         if (cfg->mod_params->disable_hw_scan) {
-                if (iwl_debug_level & IWL_DL_INFO)
-                        dev_printk(KERN_DEBUG, &(pdev->dev),
-                                   "Disabling hw_scan\n");
+                dev_printk(KERN_DEBUG, &(pdev->dev),
+                        "sw scan support is deprecated\n");
                 iwl_hw_ops.hw_scan = NULL;
         }
 
@@ -4286,6 +4319,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         for (i = 0; i < NUM_IWL_RXON_CTX; i++)
                 priv->contexts[i].ctxid = i;
 
+        priv->contexts[IWL_RXON_CTX_BSS].always_active = true;
+        priv->contexts[IWL_RXON_CTX_BSS].is_active = true;
         priv->contexts[IWL_RXON_CTX_BSS].rxon_cmd = REPLY_RXON;
         priv->contexts[IWL_RXON_CTX_BSS].rxon_timing_cmd = REPLY_RXON_TIMING;
         priv->contexts[IWL_RXON_CTX_BSS].rxon_assoc_cmd = REPLY_RXON_ASSOC;
@@ -4567,7 +4602,7 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
          * paths to avoid running iwl_down() at all before leaving driver.
          * This (inexpensive) call *makes sure* device is reset.
          */
-        priv->cfg->ops->lib->apm_ops.stop(priv);
+        iwl_apm_stop(priv);
 
         iwl_tt_exit(priv);
 
@@ -4610,8 +4645,7 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
 
         iwl_free_isr_ict(priv);
 
-        if (priv->ibss_beacon)
-                dev_kfree_skb(priv->ibss_beacon);
+        dev_kfree_skb(priv->beacon_skb);
 
         ieee80211_free_hw(priv->hw);
 }
@@ -4775,6 +4809,22 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x0083, 0x1326, iwl1000_bg_cfg)},
         {IWL_PCI_DEVICE(0x0084, 0x1216, iwl1000_bg_cfg)},
         {IWL_PCI_DEVICE(0x0084, 0x1316, iwl1000_bg_cfg)},
+
+/* 100 Series WiFi */
+        {IWL_PCI_DEVICE(0x08AE, 0x1005, iwl100_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x08AF, 0x1015, iwl100_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x08AE, 0x1025, iwl100_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x08AE, 0x1007, iwl100_bg_cfg)},
+        {IWL_PCI_DEVICE(0x08AE, 0x1017, iwl100_bg_cfg)},
+
+/* 130 Series WiFi */
+        {IWL_PCI_DEVICE(0x0896, 0x5005, iwl130_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0896, 0x5007, iwl130_bg_cfg)},
+        {IWL_PCI_DEVICE(0x0897, 0x5015, iwl130_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0897, 0x5017, iwl130_bg_cfg)},
+        {IWL_PCI_DEVICE(0x0896, 0x5025, iwl130_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0896, 0x5027, iwl130_bg_cfg)},
+
 #endif /* CONFIG_IWL5000 */
 
         {0}
@@ -4863,7 +4913,8 @@ module_param_named(fw_restart, iwlagn_mod_params.restart_fw, int, S_IRUGO);
 MODULE_PARM_DESC(fw_restart, "restart firmware in case of error");
 module_param_named(
         disable_hw_scan, iwlagn_mod_params.disable_hw_scan, int, S_IRUGO);
-MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 0)");
+MODULE_PARM_DESC(disable_hw_scan,
+                 "disable hardware scanning (default 0) (deprecated)");
 
 module_param_named(ucode_alternative, iwlagn_wanted_ucode_alternative, int,
                    S_IRUGO);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
index 7c542a8c8f81..f525d55f2c0f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -92,6 +92,10 @@ extern struct iwl_cfg iwl6050_2abg_cfg;
 extern struct iwl_cfg iwl6050g2_bgn_cfg;
 extern struct iwl_cfg iwl1000_bgn_cfg;
 extern struct iwl_cfg iwl1000_bg_cfg;
+extern struct iwl_cfg iwl100_bgn_cfg;
+extern struct iwl_cfg iwl100_bg_cfg;
+extern struct iwl_cfg iwl130_bgn_cfg;
+extern struct iwl_cfg iwl130_bg_cfg;
 
 extern struct iwl_mod_params iwlagn_mod_params;
 extern struct iwl_hcmd_ops iwlagn_hcmd;
@@ -125,6 +129,10 @@ void iwlagn_txq_set_sched(struct iwl_priv *priv, u32 mask);
 void iwl_free_tfds_in_queue(struct iwl_priv *priv,
                             int sta_id, int tid, int freed);
 
+/* RXON */
+int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+void iwlagn_set_rxon_chain(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+
 /* uCode */
 int iwlagn_load_ucode(struct iwl_priv *priv);
 void iwlagn_rx_calib_result(struct iwl_priv *priv,
@@ -134,6 +142,8 @@ void iwlagn_rx_calib_complete(struct iwl_priv *priv,
 void iwlagn_init_alive_start(struct iwl_priv *priv);
 int iwlagn_alive_notify(struct iwl_priv *priv);
 int iwl_verify_ucode(struct iwl_priv *priv);
+void iwlagn_send_bt_env(struct iwl_priv *priv, u8 action, u8 type);
+void iwlagn_send_prio_tbl(struct iwl_priv *priv);
 
 /* lib */
 void iwl_check_abort_status(struct iwl_priv *priv,
@@ -152,6 +162,8 @@ int iwlagn_hw_nic_init(struct iwl_priv *priv);
 int iwlagn_wait_tx_queue_empty(struct iwl_priv *priv);
 int iwlagn_txfifo_flush(struct iwl_priv *priv, u16 flush_control);
 void iwlagn_dev_txfifo_flush(struct iwl_priv *priv, u16 flush_control);
+void iwl_dump_csr(struct iwl_priv *priv);
+int iwl_dump_fh(struct iwl_priv *priv, char **buf, bool display);
 
 /* rx */
 void iwlagn_rx_queue_restock(struct iwl_priv *priv);
@@ -165,8 +177,15 @@ void iwlagn_rx_reply_rx(struct iwl_priv *priv,
                      struct iwl_rx_mem_buffer *rxb);
 void iwlagn_rx_reply_rx_phy(struct iwl_priv *priv,
                          struct iwl_rx_mem_buffer *rxb);
+void iwl_rx_handle(struct iwl_priv *priv);
 
 /* tx */
+void iwl_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq);
+int iwl_hw_txq_attach_buf_to_tfd(struct iwl_priv *priv,
+                                 struct iwl_tx_queue *txq,
+                                 dma_addr_t addr, u16 len, u8 reset, u8 pad);
+int iwl_hw_tx_queue_init(struct iwl_priv *priv,
+                         struct iwl_tx_queue *txq);
 void iwlagn_hwrate_to_tx_control(struct iwl_priv *priv, u32 rate_n_flags,
                               struct ieee80211_tx_info *info);
 int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb);
@@ -206,6 +225,8 @@ static inline bool iwl_is_tx_success(u32 status)
                (status == TX_STATUS_DIRECT_DONE);
 }
 
+u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant_idx, u8 valid);
+
 /* rx */
 void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb);
@@ -217,7 +238,8 @@ void iwl_reply_statistics(struct iwl_priv *priv,
                           struct iwl_rx_mem_buffer *rxb);
 
 /* scan */
-void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
+int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
+void iwlagn_post_scan(struct iwl_priv *priv);
 
 /* station mgmt */
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
@@ -236,4 +258,64 @@ void iwlagn_bt_rx_handler_setup(struct iwl_priv *priv);
 void iwlagn_bt_setup_deferred_work(struct iwl_priv *priv);
 void iwlagn_bt_cancel_deferred_work(struct iwl_priv *priv);
 
+#ifdef CONFIG_IWLWIFI_DEBUG
+const char *iwl_get_tx_fail_reason(u32 status);
+const char *iwl_get_agg_tx_fail_reason(u16 status);
+#else
+static inline const char *iwl_get_tx_fail_reason(u32 status) { return ""; }
+static inline const char *iwl_get_agg_tx_fail_reason(u16 status) { return ""; }
+#endif
+
+/* station management */
+int iwlagn_alloc_bcast_station(struct iwl_priv *priv,
+                               struct iwl_rxon_context *ctx);
+int iwlagn_add_bssid_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                             const u8 *addr, u8 *sta_id_r);
+int iwl_remove_default_wep_key(struct iwl_priv *priv,
+                               struct iwl_rxon_context *ctx,
+                               struct ieee80211_key_conf *key);
+int iwl_set_default_wep_key(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx,
+                            struct ieee80211_key_conf *key);
+int iwl_restore_default_wep_keys(struct iwl_priv *priv,
+                                 struct iwl_rxon_context *ctx);
+int iwl_set_dynamic_key(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                        struct ieee80211_key_conf *key, u8 sta_id);
+int iwl_remove_dynamic_key(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                           struct ieee80211_key_conf *key, u8 sta_id);
+void iwl_update_tkip_key(struct iwl_priv *priv,
+                         struct iwl_rxon_context *ctx,
+                         struct ieee80211_key_conf *keyconf,
+                         struct ieee80211_sta *sta, u32 iv32, u16 *phase1key);
+int iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid);
+int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
+                         int tid, u16 ssn);
+int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
+                        int tid);
+void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id);
+void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt);
+int iwl_update_bcast_stations(struct iwl_priv *priv);
+
+/* rate */
+static inline u32 iwl_ant_idx_to_flags(u8 ant_idx)
+{
+        return BIT(ant_idx) << RATE_MCS_ANT_POS;
+}
+
+static inline u8 iwl_hw_get_rate(__le32 rate_n_flags)
+{
+        return le32_to_cpu(rate_n_flags) & 0xFF;
+}
+
+static inline __le32 iwl_hw_set_rate_n_flags(u8 rate, u32 flags)
+{
+        return cpu_to_le32(flags|(u32)rate);
+}
+
+/* eeprom */
+void iwlcore_eeprom_enhanced_txpower(struct iwl_priv *priv);
+void iwl_eeprom_get_mac(const struct iwl_priv *priv, u8 *mac);
+int iwlcore_eeprom_acquire_semaphore(struct iwl_priv *priv);
+void iwlcore_eeprom_release_semaphore(struct iwl_priv *priv);
+
 #endif /* __iwl_agn_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 3e4ba31b5d59..424801abc80e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -420,12 +420,12 @@ struct iwl4965_tx_power_db {
 
 /**
  * Command REPLY_TX_POWER_DBM_CMD = 0x98
- * struct iwl5000_tx_power_dbm_cmd
+ * struct iwlagn_tx_power_dbm_cmd
  */
-#define IWL50_TX_POWER_AUTO 0x7f
-#define IWL50_TX_POWER_NO_CLOSED (0x1 << 6)
+#define IWLAGN_TX_POWER_AUTO 0x7f
+#define IWLAGN_TX_POWER_NO_CLOSED (0x1 << 6)
 
-struct iwl5000_tx_power_dbm_cmd {
+struct iwlagn_tx_power_dbm_cmd {
         s8 global_lmt; /*in half-dBm (e.g. 30 = 15 dBm) */
         u8 flags;
         s8 srv_chan_lmt; /*in half-dBm (e.g. 30 = 15 dBm) */
@@ -1042,7 +1042,7 @@ struct iwl4965_keyinfo {
         u8 key[16];             /* 16-byte unicast decryption key */
 } __packed;
 
-/* 5000 */
+/* agn */
 struct iwl_keyinfo {
         __le16 key_flags;
         u8 tkip_rx_tsc_byte2;   /* TSC[2] for key mix ph1 detection */
@@ -1168,7 +1168,7 @@ struct iwl4965_addsta_cmd {
         __le16 reserved2;
 } __packed;
 
-/* 5000 */
+/* agn */
 struct iwl_addsta_cmd {
         u8 mode;                /* 1: modify existing, 0: add new station */
         u8 reserved[3];
@@ -1820,13 +1820,8 @@ enum {
         TX_STATUS_FAIL_TID_DISABLE = 0x8d,
         TX_STATUS_FAIL_FIFO_FLUSHED = 0x8e,
         TX_STATUS_FAIL_INSUFFICIENT_CF_POLL = 0x8f,
-        /* uCode drop due to FW drop request */
-        TX_STATUS_FAIL_FW_DROP = 0x90,
-        /*
-         * uCode drop due to station color mismatch
-         * between tx command and station table
-         */
-        TX_STATUS_FAIL_STA_COLOR_MISMATCH_DROP = 0x91,
+        TX_STATUS_FAIL_PASSIVE_NO_RX = 0x90,
+        TX_STATUS_FAIL_NO_BEACON_ON_RADAR = 0x91,
 };
 
 #define TX_PACKET_MODE_REGULAR          0x0000
@@ -1868,6 +1863,9 @@ enum {
         AGG_TX_STATE_DELAY_TX_MSK = 0x400
 };
 
+#define AGG_TX_STATUS_MSK       0x00000fff      /* bits 0:11 */
+#define AGG_TX_TRY_MSK          0x0000f000      /* bits 12:15 */
+
 #define AGG_TX_STATE_LAST_SENT_MSK  (AGG_TX_STATE_LAST_SENT_TTL_MSK | \
                                      AGG_TX_STATE_LAST_SENT_TRY_CNT_MSK | \
                                      AGG_TX_STATE_LAST_SENT_BT_KILL_MSK)
@@ -1961,12 +1959,12 @@ struct iwl4965_tx_resp {
 #define IWL50_TX_RES_INV_RATE_INDEX_MSK 0x80
 
 /* refer to ra_tid */
-#define IWL50_TX_RES_TID_POS    0
-#define IWL50_TX_RES_TID_MSK    0x0f
-#define IWL50_TX_RES_RA_POS     4
-#define IWL50_TX_RES_RA_MSK     0xf0
+#define IWLAGN_TX_RES_TID_POS   0
+#define IWLAGN_TX_RES_TID_MSK   0x0f
+#define IWLAGN_TX_RES_RA_POS    4
+#define IWLAGN_TX_RES_RA_MSK    0xf0
 
-struct iwl5000_tx_resp {
+struct iwlagn_tx_resp {
         u8 frame_count;         /* 1 no aggregation, >1 aggregation */
         u8 bt_kill_count;       /* # blocked by bluetooth (unused for agg) */
         u8 failure_rts;         /* # failures due to unsuccessful RTS */
@@ -2488,7 +2486,12 @@ struct iwlagn_bt_cmd {
         __le16 bt4_decision_time; /* unused */
         __le16 valid;
         u8 prio_boost;
-        u8 reserved[3];
+        /*
+         * set IWLAGN_BT_VALID_BOOST to "1" in "valid" bitmask
+         * if configure the following patterns
+         */
+        u8 tx_prio_boost;       /* SW boost of WiFi tx priority */
+        __le16 rx_prio_boost;   /* SW boost of WiFi rx priority */
 };
 
 #define IWLAGN_BT_SCO_ACTIVE    cpu_to_le32(BIT(0))
@@ -3781,7 +3784,8 @@ struct iwl_enhance_sensitivity_cmd {
  */
 
 /* Phy calibration command for series */
-
+/* The default calibrate table size if not specified by firmware */
+#define IWL_DEFAULT_STANDARD_PHY_CALIBRATE_TBL_SIZE     18
 enum {
         IWL_PHY_CALIBRATE_DIFF_GAIN_CMD         = 7,
         IWL_PHY_CALIBRATE_DC_CMD                = 8,
@@ -3790,13 +3794,29 @@ enum {
         IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD       = 15,
         IWL_PHY_CALIBRATE_BASE_BAND_CMD         = 16,
         IWL_PHY_CALIBRATE_TX_IQ_PERD_CMD        = 17,
-        IWL_MAX_STANDARD_PHY_CALIBRATE_TBL_SIZE = 18,
+        IWL_PHY_CALIBRATE_TEMP_OFFSET_CMD       = 18,
+        IWL_MAX_STANDARD_PHY_CALIBRATE_TBL_SIZE = 19,
 };
 
 #define IWL_MAX_PHY_CALIBRATE_TBL_SIZE          (253)
 
 #define IWL_CALIB_INIT_CFG_ALL  cpu_to_le32(0xffffffff)
 
+/* This enum defines the bitmap of various calibrations to enable in both
+ * init ucode and runtime ucode through CALIBRATION_CFG_CMD.
+ */
+enum iwl_ucode_calib_cfg {
+        IWL_CALIB_CFG_RX_BB_IDX,
+        IWL_CALIB_CFG_DC_IDX,
+        IWL_CALIB_CFG_TX_IQ_IDX,
+        IWL_CALIB_CFG_RX_IQ_IDX,
+        IWL_CALIB_CFG_NOISE_IDX,
+        IWL_CALIB_CFG_CRYSTAL_IDX,
+        IWL_CALIB_CFG_TEMPERATURE_IDX,
+        IWL_CALIB_CFG_PAPD_IDX,
+};
+
+
 struct iwl_calib_cfg_elmnt_s {
         __le32 is_enable;
         __le32 start;
@@ -3845,6 +3865,13 @@ struct iwl_calib_xtal_freq_cmd {
         u8 pad[2];
 } __packed;
 
+#define DEFAULT_RADIO_SENSOR_OFFSET    2700
+struct iwl_calib_temperature_offset_cmd {
+        struct iwl_calib_hdr hdr;
+        s16 radio_sensor_offset;
+        s16 reserved;
+} __packed;
+
 /* IWL_PHY_CALIBRATE_CHAIN_NOISE_RESET_CMD */
 struct iwl_calib_chain_noise_reset_cmd {
         struct iwl_calib_hdr hdr;
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 87a2e40972ba..25fb3912342c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -69,97 +69,9 @@ EXPORT_SYMBOL_GPL(bt_coex_active);
 module_param(bt_coex_active, bool, S_IRUGO);
 MODULE_PARM_DESC(bt_coex_active, "enable wifi/bluetooth co-exist");
 
-#define IWL_DECLARE_RATE_INFO(r, s, ip, in, rp, rn, pp, np)    \
-        [IWL_RATE_##r##M_INDEX] = { IWL_RATE_##r##M_PLCP,      \
-                                    IWL_RATE_SISO_##s##M_PLCP, \
-                                    IWL_RATE_MIMO2_##s##M_PLCP,\
-                                    IWL_RATE_MIMO3_##s##M_PLCP,\
-                                    IWL_RATE_##r##M_IEEE,      \
-                                    IWL_RATE_##ip##M_INDEX,    \
-                                    IWL_RATE_##in##M_INDEX,    \
-                                    IWL_RATE_##rp##M_INDEX,    \
-                                    IWL_RATE_##rn##M_INDEX,    \
-                                    IWL_RATE_##pp##M_INDEX,    \
-                                    IWL_RATE_##np##M_INDEX }
-
 u32 iwl_debug_level;
 EXPORT_SYMBOL(iwl_debug_level);
 
-/*
- * Parameter order:
- *   rate, ht rate, prev rate, next rate, prev tgg rate, next tgg rate
- *
- * If there isn't a valid next or previous rate then INV is used which
- * maps to IWL_RATE_INVALID
- *
- */
-const struct iwl_rate_info iwl_rates[IWL_RATE_COUNT] = {
-        IWL_DECLARE_RATE_INFO(1, INV, INV, 2, INV, 2, INV, 2),    /*  1mbps */
-        IWL_DECLARE_RATE_INFO(2, INV, 1, 5, 1, 5, 1, 5),          /*  2mbps */
-        IWL_DECLARE_RATE_INFO(5, INV, 2, 6, 2, 11, 2, 11),        /*5.5mbps */
-        IWL_DECLARE_RATE_INFO(11, INV, 9, 12, 9, 12, 5, 18),      /* 11mbps */
-        IWL_DECLARE_RATE_INFO(6, 6, 5, 9, 5, 11, 5, 11),        /*  6mbps */
-        IWL_DECLARE_RATE_INFO(9, 6, 6, 11, 6, 11, 5, 11),       /*  9mbps */
-        IWL_DECLARE_RATE_INFO(12, 12, 11, 18, 11, 18, 11, 18),   /* 12mbps */
-        IWL_DECLARE_RATE_INFO(18, 18, 12, 24, 12, 24, 11, 24),   /* 18mbps */
-        IWL_DECLARE_RATE_INFO(24, 24, 18, 36, 18, 36, 18, 36),   /* 24mbps */
-        IWL_DECLARE_RATE_INFO(36, 36, 24, 48, 24, 48, 24, 48),   /* 36mbps */
-        IWL_DECLARE_RATE_INFO(48, 48, 36, 54, 36, 54, 36, 54),   /* 48mbps */
-        IWL_DECLARE_RATE_INFO(54, 54, 48, INV, 48, INV, 48, INV),/* 54mbps */
-        IWL_DECLARE_RATE_INFO(60, 60, 48, INV, 48, INV, 48, INV),/* 60mbps */
-        /* FIXME:RS:          ^^    should be INV (legacy) */
-};
-EXPORT_SYMBOL(iwl_rates);
-
-int iwl_hwrate_to_plcp_idx(u32 rate_n_flags)
-{
-        int idx = 0;
-
-        /* HT rate format */
-        if (rate_n_flags & RATE_MCS_HT_MSK) {
-                idx = (rate_n_flags & 0xff);
-
-                if (idx >= IWL_RATE_MIMO3_6M_PLCP)
-                        idx = idx - IWL_RATE_MIMO3_6M_PLCP;
-                else if (idx >= IWL_RATE_MIMO2_6M_PLCP)
-                        idx = idx - IWL_RATE_MIMO2_6M_PLCP;
-
-                idx += IWL_FIRST_OFDM_RATE;
-                /* skip 9M not supported in ht*/
-                if (idx >= IWL_RATE_9M_INDEX)
-                        idx += 1;
-                if ((idx >= IWL_FIRST_OFDM_RATE) && (idx <= IWL_LAST_OFDM_RATE))
-                        return idx;
-
-        /* legacy rate format, search for match in table */
-        } else {
-                for (idx = 0; idx < ARRAY_SIZE(iwl_rates); idx++)
-                        if (iwl_rates[idx].plcp == (rate_n_flags & 0xFF))
-                                return idx;
-        }
-
-        return -1;
-}
-EXPORT_SYMBOL(iwl_hwrate_to_plcp_idx);
-
-u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant, u8 valid)
-{
-        int i;
-        u8 ind = ant;
-
-        if (priv->band == IEEE80211_BAND_2GHZ &&
-            priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)
-                return 0;
-
-        for (i = 0; i < RATE_ANT_NUM - 1; i++) {
-                ind = (ind + 1) < RATE_ANT_NUM ?  ind + 1 : 0;
-                if (valid & BIT(ind))
-                        return ind;
-        }
-        return ant;
-}
-EXPORT_SYMBOL(iwl_toggle_tx_ant);
-
 const u8 iwl_bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 EXPORT_SYMBOL(iwl_bcast_addr);
 
@@ -196,6 +108,9 @@ static void iwl_update_qos(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
+        if (!ctx->is_active)
+                return;
+
         ctx->qos_data.def_qos_parm.qos_flags = 0;
 
         if (ctx->qos_data.qos_active)
@@ -229,7 +144,8 @@ static void iwlcore_init_ht_hw_capab(const struct iwl_priv *priv,
 
         ht_info->ht_supported = true;
 
-        if (priv->cfg->ht_greenfield_support)
+        if (priv->cfg->ht_params &&
+            priv->cfg->ht_params->ht_greenfield_support)
                 ht_info->cap |= IEEE80211_HT_CAP_GRN_FLD;
         ht_info->cap |= IEEE80211_HT_CAP_SGI_20;
         max_bit_rate = MAX_BIT_RATE_20_MHZ;
@@ -244,11 +160,11 @@ static void iwlcore_init_ht_hw_capab(const struct iwl_priv *priv,
                 ht_info->cap |= IEEE80211_HT_CAP_MAX_AMSDU;
 
         ht_info->ampdu_factor = CFG_HT_RX_AMPDU_FACTOR_DEF;
-        if (priv->cfg->ampdu_factor)
-                ht_info->ampdu_factor = priv->cfg->ampdu_factor;
+        if (priv->cfg->bt_params && priv->cfg->bt_params->ampdu_factor)
+                ht_info->ampdu_factor = priv->cfg->bt_params->ampdu_factor;
         ht_info->ampdu_density = CFG_HT_MPDU_DENSITY_DEF;
-        if (priv->cfg->ampdu_density)
-                ht_info->ampdu_density = priv->cfg->ampdu_density;
+        if (priv->cfg->bt_params && priv->cfg->bt_params->ampdu_density)
+                ht_info->ampdu_density = priv->cfg->bt_params->ampdu_density;
 
         ht_info->mcs.rx_mask[0] = 0xFF;
         if (rx_chains_num >= 2)
@@ -435,12 +351,6 @@ void iwlcore_tx_cmd_protection(struct iwl_priv *priv,
 EXPORT_SYMBOL(iwlcore_tx_cmd_protection);
 
 
-static bool is_single_rx_stream(struct iwl_priv *priv)
-{
-        return priv->current_ht_config.smps == IEEE80211_SMPS_STATIC ||
-               priv->current_ht_config.single_chain_sufficient;
-}
-
 static bool iwl_is_channel_extension(struct iwl_priv *priv,
                                      enum ieee80211_band band,
                                      u16 channel, u8 extension_chan_offset)
@@ -488,8 +398,29 @@ EXPORT_SYMBOL(iwl_is_ht40_tx_allowed);
 
 static u16 iwl_adjust_beacon_interval(u16 beacon_val, u16 max_beacon_val)
 {
-        u16 new_val = 0;
-        u16 beacon_factor = 0;
+        u16 new_val;
+        u16 beacon_factor;
+
+        /*
+         * If mac80211 hasn't given us a beacon interval, program
+         * the default into the device (not checking this here
+         * would cause the adjustment below to return the maximum
+         * value, which may break PAN.)
+         */
+        if (!beacon_val)
+                return DEFAULT_BEACON_INTERVAL;
+
+        /*
+         * If the beacon interval we obtained from the peer
+         * is too large, we'll have to wake up more often
+         * (and in IBSS case, we'll beacon too much)
+         *
+         * For example, if max_beacon_val is 4096, and the
+         * requested beacon interval is 7000, we'll have to
+         * use 3500 to be able to wake up on the beacons.
+         *
+         * This could badly influence beacon detection stats.
+         */
 
         beacon_factor = (beacon_val + max_beacon_val) / max_beacon_val;
         new_val = beacon_val / beacon_factor;
@@ -526,10 +457,22 @@ int iwl_send_rxon_timing(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
         ctx->timing.atim_window = 0;
 
         if (ctx->ctxid == IWL_RXON_CTX_PAN &&
-            (!ctx->vif || ctx->vif->type != NL80211_IFTYPE_STATION)) {
+            (!ctx->vif || ctx->vif->type != NL80211_IFTYPE_STATION) &&
+            iwl_is_associated(priv, IWL_RXON_CTX_BSS) &&
+            priv->contexts[IWL_RXON_CTX_BSS].vif &&
+            priv->contexts[IWL_RXON_CTX_BSS].vif->bss_conf.beacon_int) {
                 ctx->timing.beacon_interval =
                         priv->contexts[IWL_RXON_CTX_BSS].timing.beacon_interval;
                 beacon_int = le16_to_cpu(ctx->timing.beacon_interval);
+        } else if (ctx->ctxid == IWL_RXON_CTX_BSS &&
+                   iwl_is_associated(priv, IWL_RXON_CTX_PAN) &&
+                   priv->contexts[IWL_RXON_CTX_PAN].vif &&
+                   priv->contexts[IWL_RXON_CTX_PAN].vif->bss_conf.beacon_int &&
+                   (!iwl_is_associated_ctx(ctx) || !ctx->vif ||
+                    !ctx->vif->bss_conf.beacon_int)) {
+                ctx->timing.beacon_interval =
+                        priv->contexts[IWL_RXON_CTX_PAN].timing.beacon_interval;
+                beacon_int = le16_to_cpu(ctx->timing.beacon_interval);
         } else {
                 beacon_int = iwl_adjust_beacon_interval(beacon_int,
                                 priv->hw_params.max_beacon_itrvl * TIME_UNIT);
@@ -567,76 +510,74 @@ void iwl_set_rxon_hwcrypto(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
 }
 EXPORT_SYMBOL(iwl_set_rxon_hwcrypto);
 
-/**
- * iwl_check_rxon_cmd - validate RXON structure is valid
- *
- * NOTE:  This is really only useful during development and can eventually
- * be #ifdef'd out once the driver is stable and folks aren't actively
- * making changes
- */
+/* validate RXON structure is valid */
 int iwl_check_rxon_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 {
-        int error = 0;
-        int counter = 1;
         struct iwl_rxon_cmd *rxon = &ctx->staging;
+        bool error = false;
 
         if (rxon->flags & RXON_FLG_BAND_24G_MSK) {
-                error |= le32_to_cpu(rxon->flags &
-                                (RXON_FLG_TGJ_NARROW_BAND_MSK |
-                                 RXON_FLG_RADAR_DETECT_MSK));
-                if (error)
-                        IWL_WARN(priv, "check 24G fields %d | %d\n",
-                                    counter++, error);
+                if (rxon->flags & RXON_FLG_TGJ_NARROW_BAND_MSK) {
+                        IWL_WARN(priv, "check 2.4G: wrong narrow\n");
+                        error = true;
+                }
+                if (rxon->flags & RXON_FLG_RADAR_DETECT_MSK) {
+                        IWL_WARN(priv, "check 2.4G: wrong radar\n");
+                        error = true;
+                }
         } else {
-                error |= (rxon->flags & RXON_FLG_SHORT_SLOT_MSK) ?
-                                0 : le32_to_cpu(RXON_FLG_SHORT_SLOT_MSK);
-                if (error)
-                        IWL_WARN(priv, "check 52 fields %d | %d\n",
-                                    counter++, error);
-                error |= le32_to_cpu(rxon->flags & RXON_FLG_CCK_MSK);
-                if (error)
-                        IWL_WARN(priv, "check 52 CCK %d | %d\n",
-                                    counter++, error);
-        }
-        error |= (rxon->node_addr[0] | rxon->bssid_addr[0]) & 0x1;
-        if (error)
-                IWL_WARN(priv, "check mac addr %d | %d\n", counter++, error);
+                if (!(rxon->flags & RXON_FLG_SHORT_SLOT_MSK)) {
+                        IWL_WARN(priv, "check 5.2G: not short slot!\n");
+                        error = true;
+                }
+                if (rxon->flags & RXON_FLG_CCK_MSK) {
+                        IWL_WARN(priv, "check 5.2G: CCK!\n");
+                        error = true;
+                }
+        }
+        if ((rxon->node_addr[0] | rxon->bssid_addr[0]) & 0x1) {
+                IWL_WARN(priv, "mac/bssid mcast!\n");
+                error = true;
+        }
 
         /* make sure basic rates 6Mbps and 1Mbps are supported */
-        error |= (((rxon->ofdm_basic_rates & IWL_RATE_6M_MASK) == 0) &&
-                  ((rxon->cck_basic_rates & IWL_RATE_1M_MASK) == 0));
-        if (error)
-                IWL_WARN(priv, "check basic rate %d | %d\n", counter++, error);
+        if ((rxon->ofdm_basic_rates & IWL_RATE_6M_MASK) == 0 &&
+            (rxon->cck_basic_rates & IWL_RATE_1M_MASK) == 0) {
+                IWL_WARN(priv, "neither 1 nor 6 are basic\n");
+                error = true;
+        }
 
-        error |= (le16_to_cpu(rxon->assoc_id) > 2007);
-        if (error)
-                IWL_WARN(priv, "check assoc id %d | %d\n", counter++, error);
+        if (le16_to_cpu(rxon->assoc_id) > 2007) {
+                IWL_WARN(priv, "aid > 2007\n");
+                error = true;
+        }
 
-        error |= ((rxon->flags & (RXON_FLG_CCK_MSK | RXON_FLG_SHORT_SLOT_MSK))
-                        == (RXON_FLG_CCK_MSK | RXON_FLG_SHORT_SLOT_MSK));
-        if (error)
-                IWL_WARN(priv, "check CCK and short slot %d | %d\n",
-                            counter++, error);
+        if ((rxon->flags & (RXON_FLG_CCK_MSK | RXON_FLG_SHORT_SLOT_MSK))
+                        == (RXON_FLG_CCK_MSK | RXON_FLG_SHORT_SLOT_MSK)) {
+                IWL_WARN(priv, "CCK and short slot\n");
+                error = true;
+        }
 
-        error |= ((rxon->flags & (RXON_FLG_CCK_MSK | RXON_FLG_AUTO_DETECT_MSK))
-                        == (RXON_FLG_CCK_MSK | RXON_FLG_AUTO_DETECT_MSK));
-        if (error)
-                IWL_WARN(priv, "check CCK & auto detect %d | %d\n",
-                            counter++, error);
+        if ((rxon->flags & (RXON_FLG_CCK_MSK | RXON_FLG_AUTO_DETECT_MSK))
+                        == (RXON_FLG_CCK_MSK | RXON_FLG_AUTO_DETECT_MSK)) {
+                IWL_WARN(priv, "CCK and auto detect");
+                error = true;
+        }
 
-        error |= ((rxon->flags & (RXON_FLG_AUTO_DETECT_MSK |
-                        RXON_FLG_TGG_PROTECT_MSK)) == RXON_FLG_TGG_PROTECT_MSK);
-        if (error)
-                IWL_WARN(priv, "check TGG and auto detect %d | %d\n",
-                            counter++, error);
+        if ((rxon->flags & (RXON_FLG_AUTO_DETECT_MSK |
+                            RXON_FLG_TGG_PROTECT_MSK)) ==
+                            RXON_FLG_TGG_PROTECT_MSK) {
+                IWL_WARN(priv, "TGg but no auto-detect\n");
+                error = true;
+        }
 
         if (error)
                 IWL_WARN(priv, "Tuning to channel %d\n",
                             le16_to_cpu(rxon->channel));
 
         if (error) {
-                IWL_ERR(priv, "Not a valid iwl_rxon_assoc_cmd field values\n");
-                return -1;
+                IWL_ERR(priv, "Invalid RXON\n");
+                return -EINVAL;
         }
         return 0;
 }
@@ -797,137 +738,6 @@ void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf)
 }
 EXPORT_SYMBOL(iwl_set_rxon_ht);
 
-#define IWL_NUM_RX_CHAINS_MULTIPLE      3
-#define IWL_NUM_RX_CHAINS_SINGLE        2
-#define IWL_NUM_IDLE_CHAINS_DUAL        2
-#define IWL_NUM_IDLE_CHAINS_SINGLE      1
-
-/*
- * Determine how many receiver/antenna chains to use.
- *
- * More provides better reception via diversity.  Fewer saves power
- * at the expense of throughput, but only when not in powersave to
- * start with.
- *
- * MIMO (dual stream) requires at least 2, but works better with 3.
- * This does not determine *which* chains to use, just how many.
- */
-static int iwl_get_active_rx_chain_count(struct iwl_priv *priv)
-{
-        if (priv->cfg->advanced_bt_coexist && (priv->bt_full_concurrent ||
-            priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)) {
-                /*
-                 * only use chain 'A' in bt high traffic load or
-                 * full concurrency mode
-                 */
-                return IWL_NUM_RX_CHAINS_SINGLE;
-        }
-        /* # of Rx chains to use when expecting MIMO. */
-        if (is_single_rx_stream(priv))
-                return IWL_NUM_RX_CHAINS_SINGLE;
-        else
-                return IWL_NUM_RX_CHAINS_MULTIPLE;
-}
-
-/*
- * When we are in power saving mode, unless device support spatial
- * multiplexing power save, use the active count for rx chain count.
- */
-static int iwl_get_idle_rx_chain_count(struct iwl_priv *priv, int active_cnt)
-{
-        /* # Rx chains when idling, depending on SMPS mode */
-        switch (priv->current_ht_config.smps) {
-        case IEEE80211_SMPS_STATIC:
-        case IEEE80211_SMPS_DYNAMIC:
-                return IWL_NUM_IDLE_CHAINS_SINGLE;
-        case IEEE80211_SMPS_OFF:
-                return active_cnt;
-        default:
-                WARN(1, "invalid SMPS mode %d",
-                     priv->current_ht_config.smps);
-                return active_cnt;
-        }
-}
-
-/* up to 4 chains */
-static u8 iwl_count_chain_bitmap(u32 chain_bitmap)
-{
-        u8 res;
-        res = (chain_bitmap & BIT(0)) >> 0;
-        res += (chain_bitmap & BIT(1)) >> 1;
-        res += (chain_bitmap & BIT(2)) >> 2;
-        res += (chain_bitmap & BIT(3)) >> 3;
-        return res;
-}
-
-/**
- * iwl_set_rxon_chain - Set up Rx chain usage in "staging" RXON image
- *
- * Selects how many and which Rx receivers/antennas/chains to use.
- * This should not be used for scan command ... it puts data in wrong place.
- */
-void iwl_set_rxon_chain(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
-{
-        bool is_single = is_single_rx_stream(priv);
-        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
-        u8 idle_rx_cnt, active_rx_cnt, valid_rx_cnt;
-        u32 active_chains;
-        u16 rx_chain;
-
-        /* Tell uCode which antennas are actually connected.
-         * Before first association, we assume all antennas are connected.
-         * Just after first association, iwl_chain_noise_calibration()
-         *    checks which antennas actually *are* connected. */
-        if (priv->chain_noise_data.active_chains)
-                active_chains = priv->chain_noise_data.active_chains;
-        else
-                active_chains = priv->hw_params.valid_rx_ant;
-
-        if (priv->cfg->advanced_bt_coexist && (priv->bt_full_concurrent ||
-            priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)) {
-                /*
-                 * only use chain 'A' in bt high traffic load or
-                 * full concurrency mode
-                 */
-                active_chains = first_antenna(active_chains);
-        }
-
-        rx_chain = active_chains << RXON_RX_CHAIN_VALID_POS;
-
-        /* How many receivers should we use? */
-        active_rx_cnt = iwl_get_active_rx_chain_count(priv);
-        idle_rx_cnt = iwl_get_idle_rx_chain_count(priv, active_rx_cnt);
-
-
-        /* correct rx chain count according hw settings
-         * and chain noise calibration
-         */
-        valid_rx_cnt = iwl_count_chain_bitmap(active_chains);
-        if (valid_rx_cnt < active_rx_cnt)
-                active_rx_cnt = valid_rx_cnt;
-
-        if (valid_rx_cnt < idle_rx_cnt)
-                idle_rx_cnt = valid_rx_cnt;
-
-        rx_chain |= active_rx_cnt << RXON_RX_CHAIN_MIMO_CNT_POS;
-        rx_chain |= idle_rx_cnt  << RXON_RX_CHAIN_CNT_POS;
-
-        ctx->staging.rx_chain = cpu_to_le16(rx_chain);
-
-        if (!is_single && (active_rx_cnt >= IWL_NUM_RX_CHAINS_SINGLE) && is_cam)
-                ctx->staging.rx_chain |= RXON_RX_CHAIN_MIMO_FORCE_MSK;
-        else
-                ctx->staging.rx_chain &= ~RXON_RX_CHAIN_MIMO_FORCE_MSK;
-
-        IWL_DEBUG_ASSOC(priv, "rx_chain=0x%X active=%d idle=%d\n",
-                        ctx->staging.rx_chain,
-                        active_rx_cnt, idle_rx_cnt);
-
-        WARN_ON(active_rx_cnt == 0 || idle_rx_cnt == 0 ||
-                active_rx_cnt < idle_rx_cnt);
-}
-EXPORT_SYMBOL(iwl_set_rxon_chain);
-
 /* Return valid, unused, channel for a passive scan to reset the RF */
 u8 iwl_get_single_channel_number(struct iwl_priv *priv,
                                  enum ieee80211_band band)
@@ -1326,7 +1136,7 @@ int iwl_apm_init(struct iwl_priv *priv)
          * If not (unlikely), enable L0S, so there is at least some
          *    power savings, even without L1.
          */
-        if (priv->cfg->set_l0s) {
+        if (priv->cfg->base_params->set_l0s) {
                 lctl = iwl_pcie_link_ctl(priv);
                 if ((lctl & PCI_CFG_LINK_CTRL_VAL_L1_EN) ==
                                         PCI_CFG_LINK_CTRL_VAL_L1_EN) {
@@ -1343,8 +1153,9 @@ int iwl_apm_init(struct iwl_priv *priv)
         }
 
         /* Configure analog phase-lock-loop before activating to D0A */
-        if (priv->cfg->pll_cfg_val)
-                iwl_set_bit(priv, CSR_ANA_PLL_CFG, priv->cfg->pll_cfg_val);
+        if (priv->cfg->base_params->pll_cfg_val)
+                iwl_set_bit(priv, CSR_ANA_PLL_CFG,
+                            priv->cfg->base_params->pll_cfg_val);
 
         /*
          * Set "initialization complete" bit to move adapter from
@@ -1375,7 +1186,7 @@ int iwl_apm_init(struct iwl_priv *priv)
          * do not disable clocks.  This preserves any hardware bits already
          * set by default in "CLK_CTRL_REG" after reset.
          */
-        if (priv->cfg->use_bsm)
+        if (priv->cfg->base_params->use_bsm)
                 iwl_write_prph(priv, APMG_CLK_EN_REG,
                         APMG_CLK_VAL_DMA_CLK_RQT | APMG_CLK_VAL_BSM_CLK_RQT);
         else
@@ -1716,43 +1527,47 @@ static inline void iwl_set_no_assoc(struct iwl_priv *priv,
         iwlcore_commit_rxon(priv, ctx);
 }
 
-static int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void iwlcore_beacon_update(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif)
 {
         struct iwl_priv *priv = hw->priv;
         unsigned long flags;
         __le64 timestamp;
+        struct sk_buff *skb = ieee80211_beacon_get(hw, vif);
 
-        IWL_DEBUG_MAC80211(priv, "enter\n");
+        if (!skb)
+                return;
+
+        IWL_DEBUG_ASSOC(priv, "enter\n");
 
         lockdep_assert_held(&priv->mutex);
 
         if (!priv->beacon_ctx) {
                 IWL_ERR(priv, "update beacon but no beacon context!\n");
                 dev_kfree_skb(skb);
-                return -EINVAL;
-        }
-
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
-                return -EIO;
+                return;
         }
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        if (priv->ibss_beacon)
-                dev_kfree_skb(priv->ibss_beacon);
+        if (priv->beacon_skb)
+                dev_kfree_skb(priv->beacon_skb);
 
-        priv->ibss_beacon = skb;
+        priv->beacon_skb = skb;
 
         timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
         priv->timestamp = le64_to_cpu(timestamp);
 
-        IWL_DEBUG_MAC80211(priv, "leave\n");
+        IWL_DEBUG_ASSOC(priv, "leave\n");
+
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        priv->cfg->ops->lib->post_associate(priv, priv->beacon_ctx->vif);
+        if (!iwl_is_ready_rf(priv)) {
+                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
+                return;
+        }
 
-        return 0;
+        priv->cfg->ops->lib->post_associate(priv, priv->beacon_ctx->vif);
 }
 
 void iwl_bss_info_changed(struct ieee80211_hw *hw,
@@ -1793,13 +1608,12 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (changes & BSS_CHANGED_BEACON && vif->type == NL80211_IFTYPE_AP) {
-                dev_kfree_skb(priv->ibss_beacon);
-                priv->ibss_beacon = ieee80211_beacon_get(hw, vif);
+                dev_kfree_skb(priv->beacon_skb);
+                priv->beacon_skb = ieee80211_beacon_get(hw, vif);
         }
 
-        if (changes & BSS_CHANGED_BEACON_INT) {
-                /* TODO: in AP mode, do something to make this take effect */
-        }
+        if (changes & BSS_CHANGED_BEACON_INT && vif->type == NL80211_IFTYPE_AP)
+                iwl_send_rxon_timing(priv, ctx);
 
         if (changes & BSS_CHANGED_BSSID) {
                 IWL_DEBUG_MAC80211(priv, "BSSID %pM\n", bss_conf->bssid);
@@ -1835,13 +1649,8 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
          * mac80211 decides to do both changes at once because
          * it will invoke post_associate.
          */
-        if (vif->type == NL80211_IFTYPE_ADHOC &&
-            changes & BSS_CHANGED_BEACON) {
-                struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
-
-                if (beacon)
-                        iwl_mac_beacon_update(hw, beacon);
-        }
+        if (vif->type == NL80211_IFTYPE_ADHOC && changes & BSS_CHANGED_BEACON)
+                iwlcore_beacon_update(hw, vif);
 
         if (changes & BSS_CHANGED_ERP_PREAMBLE) {
                 IWL_DEBUG_MAC80211(priv, "ERP_PREAMBLE %d\n",
@@ -1918,6 +1727,7 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                         memcpy(ctx->staging.bssid_addr,
                                bss_conf->bssid, ETH_ALEN);
                         memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
+                        iwl_led_associate(priv);
                         iwlcore_config_ap(priv, vif);
                 } else
                         iwl_set_no_assoc(priv, vif);
@@ -1968,7 +1778,8 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 
         mutex_lock(&priv->mutex);
 
-        if (WARN_ON(!iwl_is_ready_rf(priv))) {
+        if (!iwl_is_ready_rf(priv)) {
+                IWL_WARN(priv, "Try to add interface when device not ready\n");
                 err = -EINVAL;
                 goto out;
         }
@@ -2009,11 +1820,17 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
          */
         priv->iw_mode = vif->type;
 
+        ctx->is_active = true;
+
         err = iwl_set_mode(priv, vif);
-        if (err)
+        if (err) {
+                if (!ctx->always_active)
+                        ctx->is_active = false;
                 goto out_err;
+        }
 
-        if (priv->cfg->advanced_bt_coexist &&
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->advanced_bt_coexist &&
             vif->type == NL80211_IFTYPE_ADHOC) {
                 /*
                  * pretend to have high BT traffic as long as we
@@ -2041,7 +1858,6 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
 {
         struct iwl_priv *priv = hw->priv;
         struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
-        bool scan_completed = false;
 
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
@@ -2050,14 +1866,14 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
         WARN_ON(ctx->vif != vif);
         ctx->vif = NULL;
 
-        iwl_scan_cancel_timeout(priv, 100);
-        iwl_set_mode(priv, vif);
-
         if (priv->scan_vif == vif) {
-                scan_completed = true;
-                priv->scan_vif = NULL;
-                priv->scan_request = NULL;
+                iwl_scan_cancel_timeout(priv, 200);
+                iwl_force_scan_end(priv);
         }
+        iwl_set_mode(priv, vif);
+
+        if (!ctx->always_active)
+                ctx->is_active = false;
 
         /*
          * When removing the IBSS interface, overwrite the
@@ -2072,9 +1888,6 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
         memset(priv->bssid, 0, ETH_ALEN);
         mutex_unlock(&priv->mutex);
 
-        if (scan_completed)
-                ieee80211_scan_completed(priv->hw, true);
-
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
 }
@@ -2246,15 +2059,16 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
         spin_lock_irqsave(&priv->lock, flags);
 
         /* new association get rid of ibss beacon skb */
-        if (priv->ibss_beacon)
-                dev_kfree_skb(priv->ibss_beacon);
+        if (priv->beacon_skb)
+                dev_kfree_skb(priv->beacon_skb);
 
-        priv->ibss_beacon = NULL;
+        priv->beacon_skb = NULL;
 
         priv->timestamp = 0;
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
+        iwl_scan_cancel_timeout(priv, 100);
         if (!iwl_is_ready_rf(priv)) {
                 IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
                 mutex_unlock(&priv->mutex);
@@ -2264,7 +2078,6 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
         /* we are restarting association process
          * clear RXON_FILTER_ASSOC_MSK bit
          */
-        iwl_scan_cancel_timeout(priv, 100);
         ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
         iwlcore_commit_rxon(priv, ctx);
 
@@ -2280,7 +2093,8 @@ int iwl_alloc_txq_mem(struct iwl_priv *priv)
 {
         if (!priv->txq)
                 priv->txq = kzalloc(
-                        sizeof(struct iwl_tx_queue) * priv->cfg->num_of_queues,
+                        sizeof(struct iwl_tx_queue) *
+                                priv->cfg->base_params->num_of_queues,
                         GFP_KERNEL);
         if (!priv->txq) {
                 IWL_ERR(priv, "Not enough memory for txq\n");
@@ -2536,140 +2350,6 @@ void iwl_update_stats(struct iwl_priv *priv, bool is_tx, __le16 fc, u16 len)
 EXPORT_SYMBOL(iwl_update_stats);
 #endif
 
-static const char *get_csr_string(int cmd)
-{
-        switch (cmd) {
-                IWL_CMD(CSR_HW_IF_CONFIG_REG);
-                IWL_CMD(CSR_INT_COALESCING);
-                IWL_CMD(CSR_INT);
-                IWL_CMD(CSR_INT_MASK);
-                IWL_CMD(CSR_FH_INT_STATUS);
-                IWL_CMD(CSR_GPIO_IN);
-                IWL_CMD(CSR_RESET);
-                IWL_CMD(CSR_GP_CNTRL);
-                IWL_CMD(CSR_HW_REV);
-                IWL_CMD(CSR_EEPROM_REG);
-                IWL_CMD(CSR_EEPROM_GP);
-                IWL_CMD(CSR_OTP_GP_REG);
-                IWL_CMD(CSR_GIO_REG);
-                IWL_CMD(CSR_GP_UCODE_REG);
-                IWL_CMD(CSR_GP_DRIVER_REG);
-                IWL_CMD(CSR_UCODE_DRV_GP1);
-                IWL_CMD(CSR_UCODE_DRV_GP2);
-                IWL_CMD(CSR_LED_REG);
-                IWL_CMD(CSR_DRAM_INT_TBL_REG);
-                IWL_CMD(CSR_GIO_CHICKEN_BITS);
-                IWL_CMD(CSR_ANA_PLL_CFG);
-                IWL_CMD(CSR_HW_REV_WA_REG);
-                IWL_CMD(CSR_DBG_HPET_MEM_REG);
-        default:
-                return "UNKNOWN";
-
-        }
-}
-
-void iwl_dump_csr(struct iwl_priv *priv)
-{
-        int i;
-        u32 csr_tbl[] = {
-                CSR_HW_IF_CONFIG_REG,
-                CSR_INT_COALESCING,
-                CSR_INT,
-                CSR_INT_MASK,
-                CSR_FH_INT_STATUS,
-                CSR_GPIO_IN,
-                CSR_RESET,
-                CSR_GP_CNTRL,
-                CSR_HW_REV,
-                CSR_EEPROM_REG,
-                CSR_EEPROM_GP,
-                CSR_OTP_GP_REG,
-                CSR_GIO_REG,
-                CSR_GP_UCODE_REG,
-                CSR_GP_DRIVER_REG,
-                CSR_UCODE_DRV_GP1,
-                CSR_UCODE_DRV_GP2,
-                CSR_LED_REG,
-                CSR_DRAM_INT_TBL_REG,
-                CSR_GIO_CHICKEN_BITS,
-                CSR_ANA_PLL_CFG,
-                CSR_HW_REV_WA_REG,
-                CSR_DBG_HPET_MEM_REG
-        };
-        IWL_ERR(priv, "CSR values:\n");
-        IWL_ERR(priv, "(2nd byte of CSR_INT_COALESCING is "
-                "CSR_INT_PERIODIC_REG)\n");
-        for (i = 0; i <  ARRAY_SIZE(csr_tbl); i++) {
-                IWL_ERR(priv, "  %25s: 0X%08x\n",
-                        get_csr_string(csr_tbl[i]),
-                        iwl_read32(priv, csr_tbl[i]));
-        }
-}
-EXPORT_SYMBOL(iwl_dump_csr);
-
-static const char *get_fh_string(int cmd)
-{
-        switch (cmd) {
-                IWL_CMD(FH_RSCSR_CHNL0_STTS_WPTR_REG);
-                IWL_CMD(FH_RSCSR_CHNL0_RBDCB_BASE_REG);
-                IWL_CMD(FH_RSCSR_CHNL0_WPTR);
-                IWL_CMD(FH_MEM_RCSR_CHNL0_CONFIG_REG);
-                IWL_CMD(FH_MEM_RSSR_SHARED_CTRL_REG);
-                IWL_CMD(FH_MEM_RSSR_RX_STATUS_REG);
-                IWL_CMD(FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV);
-                IWL_CMD(FH_TSSR_TX_STATUS_REG);
-                IWL_CMD(FH_TSSR_TX_ERROR_REG);
-        default:
-                return "UNKNOWN";
-
-        }
-}
-
-int iwl_dump_fh(struct iwl_priv *priv, char **buf, bool display)
-{
-        int i;
-#ifdef CONFIG_IWLWIFI_DEBUG
-        int pos = 0;
-        size_t bufsz = 0;
-#endif
-        u32 fh_tbl[] = {
-                FH_RSCSR_CHNL0_STTS_WPTR_REG,
-                FH_RSCSR_CHNL0_RBDCB_BASE_REG,
-                FH_RSCSR_CHNL0_WPTR,
-                FH_MEM_RCSR_CHNL0_CONFIG_REG,
-                FH_MEM_RSSR_SHARED_CTRL_REG,
-                FH_MEM_RSSR_RX_STATUS_REG,
-                FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV,
-                FH_TSSR_TX_STATUS_REG,
-                FH_TSSR_TX_ERROR_REG
-        };
-#ifdef CONFIG_IWLWIFI_DEBUG
-        if (display) {
-                bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
-                *buf = kmalloc(bufsz, GFP_KERNEL);
-                if (!*buf)
-                        return -ENOMEM;
-                pos += scnprintf(*buf + pos, bufsz - pos,
-                                "FH register values:\n");
-                for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
-                        pos += scnprintf(*buf + pos, bufsz - pos,
-                                "  %34s: 0X%08x\n",
-                                get_fh_string(fh_tbl[i]),
-                                iwl_read_direct32(priv, fh_tbl[i]));
-                }
-                return pos;
-        }
-#endif
-        IWL_ERR(priv, "FH register values:\n");
-        for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++) {
-                IWL_ERR(priv, "  %34s: 0X%08x\n",
-                        get_fh_string(fh_tbl[i]),
-                        iwl_read_direct32(priv, fh_tbl[i]));
-        }
-        return 0;
-}
-EXPORT_SYMBOL(iwl_dump_fh);
-
 static void iwl_force_rf_reset(struct iwl_priv *priv)
 {
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
@@ -2750,7 +2430,6 @@ int iwl_force_reset(struct iwl_priv *priv, int mode, bool external)
         }
         return 0;
 }
-EXPORT_SYMBOL(iwl_force_reset);
 
 /**
  * iwl_bg_monitor_recover - Timer callback to check for stuck queue and recover
@@ -2786,33 +2465,31 @@ static int iwl_check_stuck_queue(struct iwl_priv *priv, int cnt)
         txq = &priv->txq[cnt];
         q = &txq->q;
         /* queue is empty, skip */
-        if (q->read_ptr != q->write_ptr) {
-                if (q->read_ptr == q->last_read_ptr) {
-                        /* a queue has not been read from last time */
-                        if (q->repeat_same_read_ptr > MAX_REPEAT) {
-                                IWL_ERR(priv,
-                                        "queue %d stuck %d time. Fw reload.\n",
-                                        q->id, q->repeat_same_read_ptr);
-                                q->repeat_same_read_ptr = 0;
-                                iwl_force_reset(priv, IWL_FW_RESET, false);
-                        } else {
-                                q->repeat_same_read_ptr++;
-                                IWL_DEBUG_RADIO(priv,
-                                                "queue %d, not read %d time\n",
-                                                q->id,
-                                                q->repeat_same_read_ptr);
-                                if (!priv->cfg->advanced_bt_coexist) {
-                                        mod_timer(&priv->monitor_recover,
-                                                jiffies + msecs_to_jiffies(
-                                                IWL_ONE_HUNDRED_MSECS));
-                                        return 1;
-                                }
-                        }
-                        return 0;
-                } else {
-                        q->last_read_ptr = q->read_ptr;
+        if (q->read_ptr == q->write_ptr)
+                return 0;
+
+        if (q->read_ptr == q->last_read_ptr) {
+                /* a queue has not been read from last time */
+                if (q->repeat_same_read_ptr > MAX_REPEAT) {
+                        IWL_ERR(priv,
+                                "queue %d stuck %d time. Fw reload.\n",
+                                q->id, q->repeat_same_read_ptr);
                         q->repeat_same_read_ptr = 0;
+                        iwl_force_reset(priv, IWL_FW_RESET, false);
+                } else {
+                        q->repeat_same_read_ptr++;
+                        IWL_DEBUG_RADIO(priv,
+                                        "queue %d, not read %d time\n",
+                                        q->id,
+                                        q->repeat_same_read_ptr);
+                        mod_timer(&priv->monitor_recover,
+                                jiffies + msecs_to_jiffies(
+                                IWL_ONE_HUNDRED_MSECS));
+                        return 1;
                 }
+        } else {
+                q->last_read_ptr = q->read_ptr;
+                q->repeat_same_read_ptr = 0;
         }
         return 0;
 }
@@ -2839,13 +2516,13 @@ void iwl_bg_monitor_recover(unsigned long data)
                                 return;
                 }
         }
-        if (priv->cfg->monitor_recover_period) {
+        if (priv->cfg->base_params->monitor_recover_period) {
                 /*
                  * Reschedule the timer to occur in
-                 * priv->cfg->monitor_recover_period
+                 * priv->cfg->base_params->monitor_recover_period
                  */
                 mod_timer(&priv->monitor_recover, jiffies + msecs_to_jiffies(
-                          priv->cfg->monitor_recover_period));
+                          priv->cfg->base_params->monitor_recover_period));
         }
 }
 EXPORT_SYMBOL(iwl_bg_monitor_recover);
@@ -2918,7 +2595,7 @@ int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
          * it will not call apm_ops.stop() to stop the DMA operation.
          * Calling apm_ops.stop here to make sure we stop the DMA.
          */
-        priv->cfg->ops->lib->apm_ops.stop(priv);
+        iwl_apm_stop(priv);
 
         pci_save_state(pdev);
         pci_disable_device(pdev);
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index f7b57ed84f66..64527def059f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -111,14 +111,13 @@ struct iwl_hcmd_utils_ops {
                                   __le16 fc, __le32 *tx_flags);
         int  (*calc_rssi)(struct iwl_priv *priv,
                           struct iwl_rx_phy_res *rx_resp);
-        void (*request_scan)(struct iwl_priv *priv, struct ieee80211_vif *vif);
+        int (*request_scan)(struct iwl_priv *priv, struct ieee80211_vif *vif);
+        void (*post_scan)(struct iwl_priv *priv);
 };
 
 struct iwl_apm_ops {
         int (*init)(struct iwl_priv *priv);
-        void (*stop)(struct iwl_priv *priv);
         void (*config)(struct iwl_priv *priv);
-        int (*set_pwr_src)(struct iwl_priv *priv, enum iwl_pwr_src src);
 };
 
 struct iwl_debugfs_ops {
@@ -130,12 +129,12 @@ struct iwl_debugfs_ops {
                                       size_t count, loff_t *ppos);
         ssize_t (*bt_stats_read)(struct file *file, char __user *user_buf,
                                  size_t count, loff_t *ppos);
+        ssize_t (*reply_tx_error)(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos);
 };
 
 struct iwl_temp_ops {
         void (*temperature)(struct iwl_priv *priv);
-        void (*set_ct_kill)(struct iwl_priv *priv);
-        void (*set_calib_version)(struct iwl_priv *priv);
 };
 
 struct iwl_tt_ops {
@@ -231,11 +230,17 @@ struct iwl_led_ops {
         int (*off)(struct iwl_priv *priv);
 };
 
+/* NIC specific ops */
+struct iwl_nic_ops {
+        void (*additional_nic_config)(struct iwl_priv *priv);
+};
+
 struct iwl_ops {
         const struct iwl_lib_ops *lib;
         const struct iwl_hcmd_ops *hcmd;
         const struct iwl_hcmd_utils_ops *utils;
         const struct iwl_led_ops *led;
+        const struct iwl_nic_ops *nic;
 };
 
 struct iwl_mod_params {
@@ -248,20 +253,12 @@ struct iwl_mod_params {
         int restart_fw;         /* def: 1 = restart firmware */
 };
 
-/**
- * struct iwl_cfg
- * @fw_name_pre: Firmware filename prefix. The api version and extension
- *      (.ucode) will be added to filename before loading from disk. The
- *      filename is constructed as fw_name_pre<api>.ucode.
- * @ucode_api_max: Highest version of uCode API supported by driver.
- * @ucode_api_min: Lowest version of uCode API supported by driver.
- * @pa_type: used by 6000 series only to identify the type of Power Amplifier
+/*
  * @max_ll_items: max number of OTP blocks
  * @shadow_ram_support: shadow support for OTP memory
  * @led_compensation: compensate on the led on/off time per HW according
  *      to the deviation to achieve the desired led frequency.
  *      The detail algorithm is described in iwl-led.c
- * @use_rts_for_aggregation: use rts/cts protection for HT traffic
  * @chain_noise_num_beacons: number of beacons used to compute chain noise
  * @adv_thermal_throttle: support advance thermal throttle
  * @support_ct_kill_exit: support ct kill exit condition
@@ -279,15 +276,74 @@ struct iwl_mod_params {
  *      sensitivity calibration operation
  * @chain_noise_calib_by_driver: driver has the capability to perform
  *      chain noise calibration operation
- * @scan_antennas: available antenna for scan operation
+*/
+struct iwl_base_params {
+        int eeprom_size;
+        int num_of_queues;      /* def: HW dependent */
+        int num_of_ampdu_queues;/* def: HW dependent */
+        /* for iwl_apm_init() */
+        u32 pll_cfg_val;
+        bool set_l0s;
+        bool use_bsm;
+
+        bool use_isr_legacy;
+        const u16 max_ll_items;
+        const bool shadow_ram_support;
+        u16 led_compensation;
+        const bool broken_powersave;
+        int chain_noise_num_beacons;
+        const bool supports_idle;
+        bool adv_thermal_throttle;
+        bool support_ct_kill_exit;
+        const bool support_wimax_coexist;
+        u8 plcp_delta_threshold;
+        s32 chain_noise_scale;
+        /* timer period for monitor the driver queues */
+        u32 monitor_recover_period;
+        bool temperature_kelvin;
+        u32 max_event_log_size;
+        const bool tx_power_by_driver;
+        const bool ucode_tracing;
+        const bool sensitivity_calib_by_driver;
+        const bool chain_noise_calib_by_driver;
+};
+/*
  * @advanced_bt_coexist: support advanced bt coexist
  * @bt_init_traffic_load: specify initial bt traffic load
  * @bt_prio_boost: default bt priority boost value
- * @need_dc_calib: need to perform init dc calibration
  * @bt_statistics: use BT version of statistics notification
  * @agg_time_limit: maximum number of uSec in aggregation
  * @ampdu_factor: Maximum A-MPDU length factor
  * @ampdu_density: Minimum A-MPDU spacing
+*/
+struct iwl_bt_params {
+        bool advanced_bt_coexist;
+        u8 bt_init_traffic_load;
+        u8 bt_prio_boost;
+        const bool bt_statistics;
+        u16 agg_time_limit;
+        u8 ampdu_factor;
+        u8 ampdu_density;
+};
+/*
+ * @use_rts_for_aggregation: use rts/cts protection for HT traffic
+*/
+struct iwl_ht_params {
+        const bool ht_greenfield_support; /* if used set to true */
+        bool use_rts_for_aggregation;
+};
+
+/**
+ * struct iwl_cfg
+ * @fw_name_pre: Firmware filename prefix. The api version and extension
+ *      (.ucode) will be added to filename before loading from disk. The
+ *      filename is constructed as fw_name_pre<api>.ucode.
+ * @ucode_api_max: Highest version of uCode API supported by driver.
+ * @ucode_api_min: Lowest version of uCode API supported by driver.
+ * @pa_type: used by 6000 series only to identify the type of Power Amplifier
+ * @need_dc_calib: need to perform init dc calibration
+ * @need_temp_offset_calib: need to perform temperature offset calibration
+ * @scan_antennas: available antenna for scan operation
  *
  * We enable the driver to be backward compatible wrt API version. The
  * driver specifies which APIs it supports (with @ucode_api_max being the
@@ -298,9 +354,9 @@ struct iwl_mod_params {
  *
  * For example,
  * if (IWL_UCODE_API(priv->ucode_ver) >= 2) {
- *      Driver interacts with Firmware API version >= 2.
+ *      Driver interacts with Firmware API version >= 2.
  * } else {
- *      Driver interacts with Firmware API version 1.
+ *      Driver interacts with Firmware API version 1.
  * }
  *
  * The ideal usage of this infrastructure is to treat a new ucode API
@@ -311,59 +367,29 @@ struct iwl_mod_params {
  *
  */
 struct iwl_cfg {
+        /* params specific to an individual device within a device family */
         const char *name;
         const char *fw_name_pre;
         const unsigned int ucode_api_max;
         const unsigned int ucode_api_min;
+        u8   valid_tx_ant;
+        u8   valid_rx_ant;
         unsigned int sku;
-        int eeprom_size;
         u16  eeprom_ver;
         u16  eeprom_calib_ver;
-        int num_of_queues;      /* def: HW dependent */
-        int num_of_ampdu_queues;/* def: HW dependent */
         const struct iwl_ops *ops;
+        /* module based parameters which can be set from modprobe cmd */
         const struct iwl_mod_params *mod_params;
-        u8   valid_tx_ant;
-        u8   valid_rx_ant;
-
-        /* for iwl_apm_init() */
-        u32 pll_cfg_val;
-        bool set_l0s;
-        bool use_bsm;
-
-        bool use_isr_legacy;
-        enum iwl_pa_type pa_type;
-        const u16 max_ll_items;
-        const bool shadow_ram_support;
-        const bool ht_greenfield_support;
-        u16 led_compensation;
-        const bool broken_powersave;
-        bool use_rts_for_aggregation;
-        int chain_noise_num_beacons;
-        const bool supports_idle;
-        bool adv_thermal_throttle;
-        bool support_ct_kill_exit;
-        const bool support_wimax_coexist;
-        u8 plcp_delta_threshold;
-        s32 chain_noise_scale;
-        /* timer period for monitor the driver queues */
-        u32 monitor_recover_period;
-        bool temperature_kelvin;
-        u32 max_event_log_size;
-        const bool tx_power_by_driver;
-        const bool ucode_tracing;
-        const bool sensitivity_calib_by_driver;
-        const bool chain_noise_calib_by_driver;
+        /* params not likely to change within a device family */
+        struct iwl_base_params *base_params;
+        /* params likely to change within a device family */
+        struct iwl_ht_params *ht_params;
+        struct iwl_bt_params *bt_params;
+        enum iwl_pa_type pa_type;         /* if used set to IWL_PA_SYSTEM */
+        const bool need_dc_calib;         /* if used set to true */
+        const bool need_temp_offset_calib; /* if used set to true */
         u8 scan_rx_antennas[IEEE80211_NUM_BANDS];
         u8 scan_tx_antennas[IEEE80211_NUM_BANDS];
-        bool advanced_bt_coexist;
-        u8 bt_init_traffic_load;
-        u8 bt_prio_boost;
-        const bool need_dc_calib;
-        const bool bt_statistics;
-        u16 agg_time_limit;
-        u8 ampdu_factor;
-        u8 ampdu_density;
 };
 
 /***************************
@@ -372,7 +398,6 @@ struct iwl_cfg {
 
 struct ieee80211_hw *iwl_alloc_all(struct iwl_cfg *cfg,
                 struct ieee80211_ops *hw_ops);
-void iwl_activate_qos(struct iwl_priv *priv);
 int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
                     const struct ieee80211_tx_queue_params *params);
 int iwl_mac_tx_last_beacon(struct ieee80211_hw *hw);
@@ -380,7 +405,6 @@ void iwl_set_rxon_hwcrypto(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
                            int hw_decrypt);
 int iwl_check_rxon_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
 int iwl_full_rxon_required(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
-void iwl_set_rxon_chain(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
 int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch,
                          struct iwl_rxon_context *ctx);
 void iwl_set_flags_for_band(struct iwl_priv *priv,
@@ -406,7 +430,6 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif,
                                      struct ieee80211_bss_conf *bss_conf,
                                      u32 changes);
-int iwl_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
 int iwl_mac_add_interface(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif);
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
@@ -483,7 +506,6 @@ void iwl_rx_reply_error(struct iwl_priv *priv,
 ******************************************************/
 void iwl_cmd_queue_free(struct iwl_priv *priv);
 int iwl_rx_queue_alloc(struct iwl_priv *priv);
-void iwl_rx_handle(struct iwl_priv *priv);
 void iwl_rx_queue_update_write_ptr(struct iwl_priv *priv,
                                   struct iwl_rx_queue *q);
 int iwl_rx_queue_space(const struct iwl_rx_queue *q);
@@ -501,12 +523,6 @@ void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
 /*****************************************************
 * TX
 ******************************************************/
-void iwl_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq);
-int iwl_hw_txq_attach_buf_to_tfd(struct iwl_priv *priv,
-                                 struct iwl_tx_queue *txq,
-                                 dma_addr_t addr, u16 len, u8 reset, u8 pad);
-int iwl_hw_tx_queue_init(struct iwl_priv *priv,
-                         struct iwl_tx_queue *txq);
 void iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq);
 int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
                       int slots_num, u32 txq_id);
@@ -522,37 +538,16 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force);
  * Rate
  ******************************************************************************/
 
-int iwl_hwrate_to_plcp_idx(u32 rate_n_flags);
-
 u8 iwl_rate_get_lowest_plcp(struct iwl_priv *priv,
                             struct iwl_rxon_context *ctx);
 
-u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant_idx, u8 valid);
-
-static inline u32 iwl_ant_idx_to_flags(u8 ant_idx)
-{
-        return BIT(ant_idx) << RATE_MCS_ANT_POS;
-}
-
-static inline u8 iwl_hw_get_rate(__le32 rate_n_flags)
-{
-        return le32_to_cpu(rate_n_flags) & 0xFF;
-}
-static inline u32 iwl_hw_get_rate_n_flags(__le32 rate_n_flags)
-{
-        return le32_to_cpu(rate_n_flags) & 0x1FFFF;
-}
-static inline __le32 iwl_hw_set_rate_n_flags(u8 rate, u32 flags)
-{
-        return cpu_to_le32(flags|(u32)rate);
-}
-
 /*******************************************************************************
  * Scanning
  ******************************************************************************/
 void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
+void iwl_force_scan_end(struct iwl_priv *priv);
 int iwl_mac_hw_scan(struct ieee80211_hw *hw,
                     struct ieee80211_vif *vif,
                     struct cfg80211_scan_request *req);
@@ -568,6 +563,7 @@ u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
                                enum ieee80211_band band,
                                struct ieee80211_vif *vif);
 void iwl_setup_scan_deferred_work(struct iwl_priv *priv);
+void iwl_cancel_scan_deferred_work(struct iwl_priv *priv);
 
 /* For faster active scanning, scan will move to the next channel if fewer than
  * PLCP_QUIET_THRESH packets are heard on this channel within
@@ -580,13 +576,6 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv);
 
 #define IWL_SCAN_CHECK_WATCHDOG         (HZ * 7)
 
-/*******************************************************************************
- * Calibrations - implemented in iwl-calib.c
- ******************************************************************************/
-int iwl_send_calib_results(struct iwl_priv *priv);
-int iwl_calib_set(struct iwl_calib_result *res, const u8 *buf, int len);
-void iwl_calib_free_results(struct iwl_priv *priv);
-
 /*****************************************************
  *   S e n d i n g     H o s t     C o m m a n d s   *
  *****************************************************/
@@ -636,8 +625,6 @@ int iwl_pci_resume(struct pci_dev *pdev);
 void iwl_dump_nic_error_log(struct iwl_priv *priv);
 int iwl_dump_nic_event_log(struct iwl_priv *priv,
                            bool full_log, char **buf, bool display);
-void iwl_dump_csr(struct iwl_priv *priv);
-int iwl_dump_fh(struct iwl_priv *priv, char **buf, bool display);
 #ifdef CONFIG_IWLWIFI_DEBUG
 void iwl_print_rx_config_cmd(struct iwl_priv *priv,
                              struct iwl_rxon_context *ctx);
@@ -723,8 +710,6 @@ static inline int iwl_is_ready_rf(struct iwl_priv *priv)
 extern void iwl_send_bt_config(struct iwl_priv *priv);
 extern int iwl_send_statistics_request(struct iwl_priv *priv,
                                        u8 flags, bool clear);
-extern int iwl_send_lq_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
-                struct iwl_link_quality_cmd *lq, u8 flags, bool init);
 void iwl_apm_stop(struct iwl_priv *priv);
 int iwl_apm_init(struct iwl_priv *priv);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index ecf98e7ac4ed..2aa15ab13892 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -371,7 +371,8 @@
 #define CSR_GP_DRIVER_REG_BIT_RADIO_SKU_3x3_HYB     (0x00000000)
 #define CSR_GP_DRIVER_REG_BIT_RADIO_SKU_2x2_HYB     (0x00000001)
 #define CSR_GP_DRIVER_REG_BIT_RADIO_SKU_2x2_IPA     (0x00000002)
-#define CSR_GP_DRIVER_REG_BIT_CALIB_VERSION6    (0x00000004)
+#define CSR_GP_DRIVER_REG_BIT_CALIB_VERSION6        (0x00000004)
+#define CSR_GP_DRIVER_REG_BIT_6050_1x2              (0x00000008)
 
 /* GIO Chicken Bits (PCI Express bus link power management) */
 #define CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX  (0x00800000)
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 0ee8f516c4ab..96d9085639e3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -39,7 +39,6 @@
 #include "iwl-debug.h"
 #include "iwl-core.h"
 #include "iwl-io.h"
-#include "iwl-calib.h"
 
 /* create and remove of files */
 #define DEBUGFS_ADD_FILE(name, parent, mode) do {                       \
@@ -356,7 +355,7 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
         const u8 *ptr;
         char *buf;
         u16 eeprom_ver;
-        size_t eeprom_len = priv->cfg->eeprom_size;
+        size_t eeprom_len = priv->cfg->base_params->eeprom_size;
         buf_size = 4 * eeprom_len + 256;
 
         if (eeprom_len % 16) {
@@ -575,10 +574,10 @@ static ssize_t iwl_dbgfs_interrupt_read(struct file *file,
                 priv->isr_stats.hw);
         pos += scnprintf(buf + pos, bufsz - pos, "SW Error:\t\t\t %u\n",
                 priv->isr_stats.sw);
-        if (priv->isr_stats.sw > 0) {
+        if (priv->isr_stats.sw || priv->isr_stats.hw) {
                 pos += scnprintf(buf + pos, bufsz - pos,
                         "\tLast Restarting Code:  0x%X\n",
-                        priv->isr_stats.sw_err);
+                        priv->isr_stats.err_code);
         }
 #ifdef CONFIG_IWLWIFI_DEBUG
         pos += scnprintf(buf + pos, bufsz - pos, "Frame transmitted:\t\t %u\n",
@@ -872,7 +871,7 @@ static ssize_t iwl_dbgfs_traffic_log_read(struct file *file,
         struct iwl_rx_queue *rxq = &priv->rxq;
         char *buf;
         int bufsz = ((IWL_TRAFFIC_ENTRIES * IWL_TRAFFIC_ENTRY_SIZE * 64) * 2) +
-                (priv->cfg->num_of_queues * 32 * 8) + 400;
+                (priv->cfg->base_params->num_of_queues * 32 * 8) + 400;
         const u8 *ptr;
         ssize_t ret;
 
@@ -971,7 +970,8 @@ static ssize_t iwl_dbgfs_tx_queue_read(struct file *file,
         int pos = 0;
         int cnt;
         int ret;
-        const size_t bufsz = sizeof(char) * 64 * priv->cfg->num_of_queues;
+        const size_t bufsz = sizeof(char) * 64 *
+                                priv->cfg->base_params->num_of_queues;
 
         if (!priv->txq) {
                 IWL_ERR(priv, "txq not ready\n");
@@ -1415,7 +1415,7 @@ static ssize_t iwl_dbgfs_plcp_delta_read(struct file *file,
         const size_t bufsz = sizeof(buf);
 
         pos += scnprintf(buf + pos, bufsz - pos, "%u\n",
-                        priv->cfg->plcp_delta_threshold);
+                        priv->cfg->base_params->plcp_delta_threshold);
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
@@ -1437,10 +1437,10 @@ static ssize_t iwl_dbgfs_plcp_delta_write(struct file *file,
                 return -EINVAL;
         if ((plcp < IWL_MAX_PLCP_ERR_THRESHOLD_MIN) ||
                 (plcp > IWL_MAX_PLCP_ERR_THRESHOLD_MAX))
-                priv->cfg->plcp_delta_threshold =
+                priv->cfg->base_params->plcp_delta_threshold =
                         IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE;
         else
-                priv->cfg->plcp_delta_threshold = plcp;
+                priv->cfg->base_params->plcp_delta_threshold = plcp;
         return count;
 }
 
@@ -1550,13 +1550,14 @@ static ssize_t iwl_dbgfs_monitor_period_write(struct file *file,
         if (sscanf(buf, "%d", &period) != 1)
                 return -EINVAL;
         if (period < 0 || period > IWL_MAX_MONITORING_PERIOD)
-                priv->cfg->monitor_recover_period = IWL_DEF_MONITORING_PERIOD;
+                priv->cfg->base_params->monitor_recover_period =
+                        IWL_DEF_MONITORING_PERIOD;
         else
-                priv->cfg->monitor_recover_period = period;
+                priv->cfg->base_params->monitor_recover_period = period;
 
-        if (priv->cfg->monitor_recover_period)
+        if (priv->cfg->base_params->monitor_recover_period)
                 mod_timer(&priv->monitor_recover, jiffies + msecs_to_jiffies(
-                          priv->cfg->monitor_recover_period));
+                          priv->cfg->base_params->monitor_recover_period));
         else
                 del_timer_sync(&priv->monitor_recover);
         return count;
@@ -1604,6 +1605,64 @@ static ssize_t iwl_dbgfs_bt_traffic_read(struct file *file,
         return ret;
 }
 
+static ssize_t iwl_dbgfs_protection_mode_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+
+        int pos = 0;
+        char buf[40];
+        const size_t bufsz = sizeof(buf);
+
+        if (priv->cfg->ht_params)
+                pos += scnprintf(buf + pos, bufsz - pos,
+                         "use %s for aggregation\n",
+                         (priv->cfg->ht_params->use_rts_for_aggregation) ?
+                                "rts/cts" : "cts-to-self");
+        else
+                pos += scnprintf(buf + pos, bufsz - pos, "N/A");
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+static ssize_t iwl_dbgfs_protection_mode_write(struct file *file,
+                                        const char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int rts;
+
+        if (!priv->cfg->ht_params)
+                return -EINVAL;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &rts) != 1)
+                return -EINVAL;
+        if (rts)
+                priv->cfg->ht_params->use_rts_for_aggregation = true;
+        else
+                priv->cfg->ht_params->use_rts_for_aggregation = false;
+        return count;
+}
+
+static ssize_t iwl_dbgfs_reply_tx_error_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+
+        if (priv->cfg->ops->lib->debugfs_ops.reply_tx_error)
+                return priv->cfg->ops->lib->debugfs_ops.reply_tx_error(
+                        file, user_buf, count, ppos);
+        else
+                return -ENODATA;
+}
 DEBUGFS_READ_FILE_OPS(rx_statistics);
 DEBUGFS_READ_FILE_OPS(tx_statistics);
 DEBUGFS_READ_WRITE_FILE_OPS(traffic_log);
@@ -1629,6 +1688,8 @@ DEBUGFS_WRITE_FILE_OPS(txfifo_flush);
 DEBUGFS_READ_FILE_OPS(ucode_bt_stats);
 DEBUGFS_WRITE_FILE_OPS(monitor_period);
 DEBUGFS_READ_FILE_OPS(bt_traffic);
+DEBUGFS_READ_WRITE_FILE_OPS(protection_mode);
+DEBUGFS_READ_FILE_OPS(reply_tx_error);
 
 /*
  * Create the debugfs files and directories
@@ -1664,7 +1725,7 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(interrupt, dir_data, S_IWUSR | S_IRUSR);
         DEBUGFS_ADD_FILE(qos, dir_data, S_IRUSR);
         DEBUGFS_ADD_FILE(led, dir_data, S_IRUSR);
-        if (!priv->cfg->broken_powersave) {
+        if (!priv->cfg->base_params->broken_powersave) {
                 DEBUGFS_ADD_FILE(sleep_level_override, dir_data,
                                  S_IWUSR | S_IRUSR);
                 DEBUGFS_ADD_FILE(current_sleep_command, dir_data, S_IRUSR);
@@ -1689,27 +1750,29 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(ucode_general_stats, dir_debug, S_IRUSR);
         if (priv->cfg->ops->lib->dev_txfifo_flush)
                 DEBUGFS_ADD_FILE(txfifo_flush, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(protection_mode, dir_debug, S_IWUSR | S_IRUSR);
 
-        if (priv->cfg->sensitivity_calib_by_driver)
+        if (priv->cfg->base_params->sensitivity_calib_by_driver)
                 DEBUGFS_ADD_FILE(sensitivity, dir_debug, S_IRUSR);
-        if (priv->cfg->chain_noise_calib_by_driver)
+        if (priv->cfg->base_params->chain_noise_calib_by_driver)
                 DEBUGFS_ADD_FILE(chain_noise, dir_debug, S_IRUSR);
-        if (priv->cfg->ucode_tracing)
+        if (priv->cfg->base_params->ucode_tracing)
                 DEBUGFS_ADD_FILE(ucode_tracing, dir_debug, S_IWUSR | S_IRUSR);
-        if (priv->cfg->bt_statistics)
+        if (priv->cfg->bt_params && priv->cfg->bt_params->bt_statistics)
                 DEBUGFS_ADD_FILE(ucode_bt_stats, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(reply_tx_error, dir_debug, S_IRUSR);
         DEBUGFS_ADD_FILE(rxon_flags, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(rxon_filter_flags, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(monitor_period, dir_debug, S_IWUSR);
-        if (priv->cfg->advanced_bt_coexist)
+        if (priv->cfg->bt_params && priv->cfg->bt_params->advanced_bt_coexist)
                 DEBUGFS_ADD_FILE(bt_traffic, dir_debug, S_IRUSR);
-        if (priv->cfg->sensitivity_calib_by_driver)
+        if (priv->cfg->base_params->sensitivity_calib_by_driver)
                 DEBUGFS_ADD_BOOL(disable_sensitivity, dir_rf,
                                  &priv->disable_sens_cal);
-        if (priv->cfg->chain_noise_calib_by_driver)
+        if (priv->cfg->base_params->chain_noise_calib_by_driver)
                 DEBUGFS_ADD_BOOL(disable_chain_noise, dir_rf,
                                  &priv->disable_chain_noise_cal);
-        if (priv->cfg->tx_power_by_driver)
+        if (priv->cfg->base_params->tx_power_by_driver)
                 DEBUGFS_ADD_BOOL(disable_tx_power, dir_rf,
                                 &priv->disable_tx_power_cal);
         return 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 4dd38b7b8b74..70e07fa48405 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -282,13 +282,6 @@ struct iwl_channel_info {
  */
 #define IWL_IPAN_MCAST_QUEUE            8
 
-/* Power management (not Tx power) structures */
-
-enum iwl_pwr_src {
-        IWL_PWR_SRC_VMAIN,
-        IWL_PWR_SRC_VAUX,
-};
-
 #define IEEE80211_DATA_LEN              2304
 #define IEEE80211_4ADDR_LEN             30
 #define IEEE80211_HLEN                  (IEEE80211_4ADDR_LEN)
@@ -684,6 +677,7 @@ struct iwl_sensitivity_ranges {
  * @ct_kill_threshold: temperature threshold
  * @beacon_time_tsf_bits: number of valid tsf bits for beacon time
  * @calib_init_cfg: setup initial calibrations for the hw
+ * @calib_rt_cfg: setup runtime calibrations for the hw
  * @struct iwl_sensitivity_ranges: range of sensitivity values
  */
 struct iwl_hw_params {
@@ -710,6 +704,7 @@ struct iwl_hw_params {
                                     /* for 1000, 6000 series and up */
         u16 beacon_time_tsf_bits;
         u32 calib_init_cfg;
+        u32 calib_rt_cfg;
         const struct iwl_sensitivity_ranges *sens;
 };
 
@@ -730,7 +725,6 @@ struct iwl_hw_params {
  *
  ****************************************************************************/
 extern void iwl_update_chain_flags(struct iwl_priv *priv);
-extern int iwl_set_pwr_src(struct iwl_priv *priv, enum iwl_pwr_src src);
 extern const u8 iwl_bcast_addr[ETH_ALEN];
 extern int iwl_rxq_stop(struct iwl_priv *priv);
 extern void iwl_txq_ctx_stop(struct iwl_priv *priv);
@@ -841,6 +835,7 @@ enum iwl_calib {
         IWL_CALIB_TX_IQ,
         IWL_CALIB_TX_IQ_PERD,
         IWL_CALIB_BASE_BAND,
+        IWL_CALIB_TEMP_OFFSET,
         IWL_CALIB_MAX
 };
 
@@ -945,7 +940,7 @@ enum iwl_pa_type {
 struct isr_statistics {
         u32 hw;
         u32 sw;
-        u32 sw_err;
+        u32 err_code;
         u32 sch;
         u32 alive;
         u32 rfkill;
@@ -957,6 +952,50 @@ struct isr_statistics {
         u32 unhandled;
 };
 
+/* reply_tx_statistics (for _agn devices) */
+struct reply_tx_error_statistics {
+        u32 pp_delay;
+        u32 pp_few_bytes;
+        u32 pp_bt_prio;
+        u32 pp_quiet_period;
+        u32 pp_calc_ttak;
+        u32 int_crossed_retry;
+        u32 short_limit;
+        u32 long_limit;
+        u32 fifo_underrun;
+        u32 drain_flow;
+        u32 rfkill_flush;
+        u32 life_expire;
+        u32 dest_ps;
+        u32 host_abort;
+        u32 bt_retry;
+        u32 sta_invalid;
+        u32 frag_drop;
+        u32 tid_disable;
+        u32 fifo_flush;
+        u32 insuff_cf_poll;
+        u32 fail_hw_drop;
+        u32 sta_color_mismatch;
+        u32 unknown;
+};
+
+/* reply_agg_tx_statistics (for _agn devices) */
+struct reply_agg_tx_error_statistics {
+        u32 underrun;
+        u32 bt_prio;
+        u32 few_bytes;
+        u32 abort;
+        u32 last_sent_ttl;
+        u32 last_sent_try;
+        u32 last_sent_bt_kill;
+        u32 scd_query;
+        u32 bad_crc32;
+        u32 response;
+        u32 dump_tx;
+        u32 delay_tx;
+        u32 unknown;
+};
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 /* management statistics */
 enum iwl_mgmt_stats {
@@ -1116,6 +1155,13 @@ struct iwl_rxon_context {
         const u8 *ac_to_queue;
         u8 mcast_queue;
 
+        /*
+         * We could use the vif to indicate active, but we
+         * also need it to be active during disabling when
+         * we already removed the vif for type setting.
+         */
+        bool always_active, is_active;
+
         enum iwl_rxon_context_id ctxid;
 
         u32 interface_modes, exclusive_interface_modes;
@@ -1337,8 +1383,6 @@ struct iwl_priv {
 
         enum nl80211_iftype iw_mode;
 
-        struct sk_buff *ibss_beacon;
-
         /* Last Rx'd beacon timestamp */
         u64 timestamp;
 
@@ -1408,6 +1452,9 @@ struct iwl_priv {
 
                         struct iwl_notif_statistics statistics;
                         struct iwl_bt_notif_statistics statistics_bt;
+                        /* counts reply_tx error */
+                        struct reply_tx_error_statistics reply_tx_stats;
+                        struct reply_agg_tx_error_statistics reply_agg_tx_stats;
 #ifdef CONFIG_IWLWIFI_DEBUGFS
                         struct iwl_notif_statistics accum_statistics;
                         struct iwl_notif_statistics delta_statistics;
@@ -1447,8 +1494,10 @@ struct iwl_priv {
         struct work_struct scan_completed;
         struct work_struct rx_replenish;
         struct work_struct abort_scan;
+
         struct work_struct beacon_update;
         struct iwl_rxon_context *beacon_ctx;
+        struct sk_buff *beacon_skb;
 
         struct work_struct tt_work;
         struct work_struct ct_enter;
@@ -1510,7 +1559,6 @@ static inline void iwl_txq_ctx_deactivate(struct iwl_priv *priv, int txq_id)
 }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-const char *iwl_get_tx_fail_reason(u32 status);
 /*
  * iwl_get_debug_level: Return active debug level for device
  *
@@ -1526,8 +1574,6 @@ static inline u32 iwl_get_debug_level(struct iwl_priv *priv)
                 return iwl_debug_level;
 }
 #else
-static inline const char *iwl_get_tx_fail_reason(u32 status) { return ""; }
-
 static inline u32 iwl_get_debug_level(struct iwl_priv *priv)
 {
         return iwl_debug_level;
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index a45d02e555cf..87cd10ff285d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -136,85 +136,13 @@ static const u8 iwl_eeprom_band_7[] = {       /* 5.2 ht40 channel */
         36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157
 };
 
-/**
- * struct iwl_txpwr_section: eeprom section information
- * @offset: indirect address into eeprom image
- * @count: number of "struct iwl_eeprom_enhanced_txpwr" in this section
- * @band: band type for the section
- * @is_common - true: common section, false: channel section
- * @is_cck - true: cck section, false: not cck section
- * @is_ht_40 - true: all channel in the section are HT40 channel,
- *             false: legacy or HT 20 MHz
- *             ignore if it is common section
- * @iwl_eeprom_section_channel: channel array in the section,
- *             ignore if common section
- */
-struct iwl_txpwr_section {
-        u32 offset;
-        u8 count;
-        enum ieee80211_band band;
-        bool is_common;
-        bool is_cck;
-        bool is_ht40;
-        u8 iwl_eeprom_section_channel[EEPROM_MAX_TXPOWER_SECTION_ELEMENTS];
-};
-
-/**
- * section 1 - 3 are regulatory tx power apply to all channels based on
- *    modulation: CCK, OFDM
- *    Band: 2.4GHz, 5.2GHz
- * section 4 - 10 are regulatory tx power apply to specified channels
- *    For example:
- *      1L - Channel 1 Legacy
- *      1HT - Channel 1 HT
- *      (1,+1) - Channel 1 HT40 "_above_"
- *
- * Section 1: all CCK channels
- * Section 2: all 2.4 GHz OFDM (Legacy, HT and HT40) channels
- * Section 3: all 5.2 GHz OFDM (Legacy, HT and HT40) channels
- * Section 4: 2.4 GHz 20MHz channels: 1L, 1HT, 2L, 2HT, 10L, 10HT, 11L, 11HT
- * Section 5: 2.4 GHz 40MHz channels: (1,+1) (2,+1) (6,+1) (7,+1) (9,+1)
- * Section 6: 5.2 GHz 20MHz channels: 36L, 64L, 100L, 36HT, 64HT, 100HT
- * Section 7: 5.2 GHz 40MHz channels: (36,+1) (60,+1) (100,+1)
- * Section 8: 2.4 GHz channel: 13L, 13HT
- * Section 9: 2.4 GHz channel: 140L, 140HT
- * Section 10: 2.4 GHz 40MHz channels: (132,+1)  (44,+1)
- *
- */
-static const struct iwl_txpwr_section enhinfo[] = {
-        { EEPROM_LB_CCK_20_COMMON, 1, IEEE80211_BAND_2GHZ, true, true, false },
-        { EEPROM_LB_OFDM_COMMON, 3, IEEE80211_BAND_2GHZ, true, false, false },
-        { EEPROM_HB_OFDM_COMMON, 3, IEEE80211_BAND_5GHZ, true, false, false },
-        { EEPROM_LB_OFDM_20_BAND, 8, IEEE80211_BAND_2GHZ,
-                false, false, false,
-                {1, 1, 2, 2, 10, 10, 11, 11 } },
-        { EEPROM_LB_OFDM_HT40_BAND, 5, IEEE80211_BAND_2GHZ,
-                false, false, true,
-                { 1, 2, 6, 7, 9 } },
-        { EEPROM_HB_OFDM_20_BAND, 6, IEEE80211_BAND_5GHZ,
-                false, false, false,
-                { 36, 64, 100, 36, 64, 100 } },
-        { EEPROM_HB_OFDM_HT40_BAND, 3, IEEE80211_BAND_5GHZ,
-                false, false, true,
-                { 36, 60, 100 } },
-        { EEPROM_LB_OFDM_20_CHANNEL_13, 2, IEEE80211_BAND_2GHZ,
-                false, false, false,
-                { 13, 13 } },
-        { EEPROM_HB_OFDM_20_CHANNEL_140, 2, IEEE80211_BAND_5GHZ,
-                false, false, false,
-                { 140, 140 } },
-        { EEPROM_HB_OFDM_HT40_BAND_1, 2, IEEE80211_BAND_5GHZ,
-                false, false, true,
-                { 132, 44 } },
-};
-
 /******************************************************************************
  *
  * EEPROM related functions
  *
 ******************************************************************************/
 
-int iwlcore_eeprom_verify_signature(struct iwl_priv *priv)
+static int iwl_eeprom_verify_signature(struct iwl_priv *priv)
 {
         u32 gp = iwl_read32(priv, CSR_EEPROM_GP) & CSR_EEPROM_GP_VALID_MSK;
         int ret = 0;
@@ -246,7 +174,6 @@ int iwlcore_eeprom_verify_signature(struct iwl_priv *priv)
         }
         return ret;
 }
-EXPORT_SYMBOL(iwlcore_eeprom_verify_signature);
 
 static void iwl_set_otp_access(struct iwl_priv *priv, enum iwl_access_mode mode)
 {
@@ -290,49 +217,9 @@ static int iwlcore_get_nvm_type(struct iwl_priv *priv)
         return  nvm_type;
 }
 
-/*
- * The device's EEPROM semaphore prevents conflicts between driver and uCode
- * when accessing the EEPROM; each access is a series of pulses to/from the
- * EEPROM chip, not a single event, so even reads could conflict if they
- * weren't arbitrated by the semaphore.
- */
-int iwlcore_eeprom_acquire_semaphore(struct iwl_priv *priv)
-{
-        u16 count;
-        int ret;
-
-        for (count = 0; count < EEPROM_SEM_RETRY_LIMIT; count++) {
-                /* Request semaphore */
-                iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
-                            CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM);
-
-                /* See if we got it */
-                ret = iwl_poll_bit(priv, CSR_HW_IF_CONFIG_REG,
-                                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM,
-                                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM,
-                                EEPROM_SEM_TIMEOUT);
-                if (ret >= 0) {
-                        IWL_DEBUG_IO(priv, "Acquired semaphore after %d tries.\n",
-                                count+1);
-                        return ret;
-                }
-        }
-
-        return ret;
-}
-EXPORT_SYMBOL(iwlcore_eeprom_acquire_semaphore);
-
-void iwlcore_eeprom_release_semaphore(struct iwl_priv *priv)
-{
-        iwl_clear_bit(priv, CSR_HW_IF_CONFIG_REG,
-                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM);
-
-}
-EXPORT_SYMBOL(iwlcore_eeprom_release_semaphore);
-
 const u8 *iwlcore_eeprom_query_addr(const struct iwl_priv *priv, size_t offset)
 {
-        BUG_ON(offset >= priv->cfg->eeprom_size);
+        BUG_ON(offset >= priv->cfg->base_params->eeprom_size);
         return &priv->eeprom[offset];
 }
 EXPORT_SYMBOL(iwlcore_eeprom_query_addr);
@@ -364,7 +251,7 @@ static int iwl_init_otp_access(struct iwl_priv *priv)
                  * CSR auto clock gate disable bit -
                  * this is only applicable for HW with OTP shadow RAM
                  */
-                if (priv->cfg->shadow_ram_support)
+                if (priv->cfg->base_params->shadow_ram_support)
                         iwl_set_bit(priv, CSR_DBG_LINK_PWR_MGMT_REG,
                                 CSR_RESET_LINK_PWR_MGMT_DISABLED);
         }
@@ -484,13 +371,27 @@ static int iwl_find_otp_image(struct iwl_priv *priv,
                 }
                 /* more in the link list, continue */
                 usedblocks++;
-        } while (usedblocks <= priv->cfg->max_ll_items);
+        } while (usedblocks <= priv->cfg->base_params->max_ll_items);
 
         /* OTP has no valid blocks */
         IWL_DEBUG_INFO(priv, "OTP has no valid blocks\n");
         return -EINVAL;
 }
 
+const u8 *iwl_eeprom_query_addr(const struct iwl_priv *priv, size_t offset)
+{
+        return priv->cfg->ops->lib->eeprom_ops.query_addr(priv, offset);
+}
+EXPORT_SYMBOL(iwl_eeprom_query_addr);
+
+u16 iwl_eeprom_query16(const struct iwl_priv *priv, size_t offset)
+{
+        if (!priv->eeprom)
+                return 0;
+        return (u16)priv->eeprom[offset] | ((u16)priv->eeprom[offset + 1] << 8);
+}
+EXPORT_SYMBOL(iwl_eeprom_query16);
+
 /**
  * iwl_eeprom_init - read EEPROM contents
  *
@@ -512,8 +413,8 @@ int iwl_eeprom_init(struct iwl_priv *priv)
         if (priv->nvm_device_type == -ENOENT)
                 return -ENOENT;
         /* allocate eeprom */
-        IWL_DEBUG_INFO(priv, "NVM size = %d\n", priv->cfg->eeprom_size);
-        sz = priv->cfg->eeprom_size;
+        sz = priv->cfg->base_params->eeprom_size;
+        IWL_DEBUG_INFO(priv, "NVM size = %d\n", sz);
         priv->eeprom = kzalloc(sz, GFP_KERNEL);
         if (!priv->eeprom) {
                 ret = -ENOMEM;
@@ -523,7 +424,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
 
         priv->cfg->ops->lib->apm_ops.init(priv);
 
-        ret = priv->cfg->ops->lib->eeprom_ops.verify_signature(priv);
+        ret = iwl_eeprom_verify_signature(priv);
         if (ret < 0) {
                 IWL_ERR(priv, "EEPROM not found, EEPROM_GP=0x%08x\n", gp);
                 ret = -ENOENT;
@@ -554,7 +455,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                              CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK |
                              CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK);
                 /* traversing the linked list if no shadow ram supported */
-                if (!priv->cfg->shadow_ram_support) {
+                if (!priv->cfg->base_params->shadow_ram_support) {
                         if (iwl_find_otp_image(priv, &validblockaddr)) {
                                 ret = -ENOENT;
                                 goto done;
@@ -604,7 +505,7 @@ err:
         if (ret)
                 iwl_eeprom_free(priv);
         /* Reset chip to save power until we load uCode during "up". */
-        priv->cfg->ops->lib->apm_ops.stop(priv);
+        iwl_apm_stop(priv);
 alloc_err:
         return ret;
 }
@@ -617,53 +518,6 @@ void iwl_eeprom_free(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_eeprom_free);
 
-int iwl_eeprom_check_version(struct iwl_priv *priv)
-{
-        u16 eeprom_ver;
-        u16 calib_ver;
-
-        eeprom_ver = iwl_eeprom_query16(priv, EEPROM_VERSION);
-        calib_ver = priv->cfg->ops->lib->eeprom_ops.calib_version(priv);
-
-        if (eeprom_ver < priv->cfg->eeprom_ver ||
-            calib_ver < priv->cfg->eeprom_calib_ver)
-                goto err;
-
-        IWL_INFO(priv, "device EEPROM VER=0x%x, CALIB=0x%x\n",
-                 eeprom_ver, calib_ver);
-
-        return 0;
-err:
-        IWL_ERR(priv, "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n",
-                  eeprom_ver, priv->cfg->eeprom_ver,
-                  calib_ver,  priv->cfg->eeprom_calib_ver);
-        return -EINVAL;
-
-}
-EXPORT_SYMBOL(iwl_eeprom_check_version);
-
-const u8 *iwl_eeprom_query_addr(const struct iwl_priv *priv, size_t offset)
-{
-        return priv->cfg->ops->lib->eeprom_ops.query_addr(priv, offset);
-}
-EXPORT_SYMBOL(iwl_eeprom_query_addr);
-
-u16 iwl_eeprom_query16(const struct iwl_priv *priv, size_t offset)
-{
-        if (!priv->eeprom)
-                return 0;
-        return (u16)priv->eeprom[offset] | ((u16)priv->eeprom[offset + 1] << 8);
-}
-EXPORT_SYMBOL(iwl_eeprom_query16);
-
-void iwl_eeprom_get_mac(const struct iwl_priv *priv, u8 *mac)
-{
-        const u8 *addr = priv->cfg->ops->lib->eeprom_ops.query_addr(priv,
-                                        EEPROM_MAC_ADDRESS);
-        memcpy(mac, addr, ETH_ALEN);
-}
-EXPORT_SYMBOL(iwl_eeprom_get_mac);
-
 static void iwl_init_band_reference(const struct iwl_priv *priv,
                         int eep_band, int *eeprom_ch_count,
                         const struct iwl_eeprom_channel **eeprom_ch_info,
@@ -722,7 +576,6 @@ static void iwl_init_band_reference(const struct iwl_priv *priv,
 
 #define CHECK_AND_PRINT(x) ((eeprom_ch->flags & EEPROM_CHANNEL_##x) \
                             ? # x " " : "")
-
 /**
  * iwl_mod_ht40_chan_info - Copy ht40 channel info into driver's priv.
  *
@@ -766,205 +619,6 @@ static int iwl_mod_ht40_chan_info(struct iwl_priv *priv,
         return 0;
 }
 
-/**
- * iwl_get_max_txpower_avg - get the highest tx power from all chains.
- *     find the highest tx power from all chains for the channel
- */
-static s8 iwl_get_max_txpower_avg(struct iwl_priv *priv,
-                struct iwl_eeprom_enhanced_txpwr *enhanced_txpower,
-                int element, s8 *max_txpower_in_half_dbm)
-{
-        s8 max_txpower_avg = 0; /* (dBm) */
-
-        IWL_DEBUG_INFO(priv, "%d - "
-                        "chain_a: %d dB chain_b: %d dB "
-                        "chain_c: %d dB mimo2: %d dB mimo3: %d dB\n",
-                        element,
-                        enhanced_txpower[element].chain_a_max >> 1,
-                        enhanced_txpower[element].chain_b_max >> 1,
-                        enhanced_txpower[element].chain_c_max >> 1,
-                        enhanced_txpower[element].mimo2_max >> 1,
-                        enhanced_txpower[element].mimo3_max >> 1);
-        /* Take the highest tx power from any valid chains */
-        if ((priv->cfg->valid_tx_ant & ANT_A) &&
-            (enhanced_txpower[element].chain_a_max > max_txpower_avg))
-                max_txpower_avg = enhanced_txpower[element].chain_a_max;
-        if ((priv->cfg->valid_tx_ant & ANT_B) &&
-            (enhanced_txpower[element].chain_b_max > max_txpower_avg))
-                max_txpower_avg = enhanced_txpower[element].chain_b_max;
-        if ((priv->cfg->valid_tx_ant & ANT_C) &&
-            (enhanced_txpower[element].chain_c_max > max_txpower_avg))
-                max_txpower_avg = enhanced_txpower[element].chain_c_max;
-        if (((priv->cfg->valid_tx_ant == ANT_AB) |
-            (priv->cfg->valid_tx_ant == ANT_BC) |
-            (priv->cfg->valid_tx_ant == ANT_AC)) &&
-            (enhanced_txpower[element].mimo2_max > max_txpower_avg))
-                max_txpower_avg =  enhanced_txpower[element].mimo2_max;
-        if ((priv->cfg->valid_tx_ant == ANT_ABC) &&
-            (enhanced_txpower[element].mimo3_max > max_txpower_avg))
-                max_txpower_avg = enhanced_txpower[element].mimo3_max;
-
-        /*
-         * max. tx power in EEPROM is in 1/2 dBm format
-         * convert from 1/2 dBm to dBm (round-up convert)
-         * but we also do not want to loss 1/2 dBm resolution which
-         * will impact performance
-         */
-        *max_txpower_in_half_dbm = max_txpower_avg;
-        return (max_txpower_avg & 0x01) + (max_txpower_avg >> 1);
-}
-
-/**
- * iwl_update_common_txpower: update channel tx power
- *     update tx power per band based on EEPROM enhanced tx power info.
- */
-static s8 iwl_update_common_txpower(struct iwl_priv *priv,
-                struct iwl_eeprom_enhanced_txpwr *enhanced_txpower,
-                int section, int element, s8 *max_txpower_in_half_dbm)
-{
-        struct iwl_channel_info *ch_info;
-        int ch;
-        bool is_ht40 = false;
-        s8 max_txpower_avg; /* (dBm) */
-
-        /* it is common section, contain all type (Legacy, HT and HT40)
-         * based on the element in the section to determine
-         * is it HT 40 or not
-         */
-        if (element == EEPROM_TXPOWER_COMMON_HT40_INDEX)
-                is_ht40 = true;
-        max_txpower_avg =
-                iwl_get_max_txpower_avg(priv, enhanced_txpower,
-                                        element, max_txpower_in_half_dbm);
-
-        ch_info = priv->channel_info;
-
-        for (ch = 0; ch < priv->channel_count; ch++) {
-                /* find matching band and update tx power if needed */
-                if ((ch_info->band == enhinfo[section].band) &&
-                    (ch_info->max_power_avg < max_txpower_avg) &&
-                    (!is_ht40)) {
-                        /* Update regulatory-based run-time data */
-                        ch_info->max_power_avg = ch_info->curr_txpow =
-                                max_txpower_avg;
-                        ch_info->scan_power = max_txpower_avg;
-                }
-                if ((ch_info->band == enhinfo[section].band) && is_ht40 &&
-                    (ch_info->ht40_max_power_avg < max_txpower_avg)) {
-                        /* Update regulatory-based run-time data */
-                        ch_info->ht40_max_power_avg = max_txpower_avg;
-                }
-                ch_info++;
-        }
-        return max_txpower_avg;
-}
-
-/**
- * iwl_update_channel_txpower: update channel tx power
- *      update channel tx power based on EEPROM enhanced tx power info.
- */
-static s8 iwl_update_channel_txpower(struct iwl_priv *priv,
-                struct iwl_eeprom_enhanced_txpwr *enhanced_txpower,
-                int section, int element, s8 *max_txpower_in_half_dbm)
-{
-        struct iwl_channel_info *ch_info;
-        int ch;
-        u8 channel;
-        s8 max_txpower_avg; /* (dBm) */
-
-        channel = enhinfo[section].iwl_eeprom_section_channel[element];
-        max_txpower_avg =
-                iwl_get_max_txpower_avg(priv, enhanced_txpower,
-                                        element, max_txpower_in_half_dbm);
-
-        ch_info = priv->channel_info;
-        for (ch = 0; ch < priv->channel_count; ch++) {
-                /* find matching channel and update tx power if needed */
-                if (ch_info->channel == channel) {
-                        if ((ch_info->max_power_avg < max_txpower_avg) &&
-                            (!enhinfo[section].is_ht40)) {
-                                /* Update regulatory-based run-time data */
-                                ch_info->max_power_avg = max_txpower_avg;
-                                ch_info->curr_txpow = max_txpower_avg;
-                                ch_info->scan_power = max_txpower_avg;
-                        }
-                        if ((enhinfo[section].is_ht40) &&
-                            (ch_info->ht40_max_power_avg < max_txpower_avg)) {
-                                /* Update regulatory-based run-time data */
-                                ch_info->ht40_max_power_avg = max_txpower_avg;
-                        }
-                        break;
-                }
-                ch_info++;
-        }
-        return max_txpower_avg;
-}
-
-/**
- * iwlcore_eeprom_enhanced_txpower: process enhanced tx power info
- */
-void iwlcore_eeprom_enhanced_txpower(struct iwl_priv *priv)
-{
-        int eeprom_section_count = 0;
-        int section, element;
-        struct iwl_eeprom_enhanced_txpwr *enhanced_txpower;
-        u32 offset;
-        s8 max_txpower_avg; /* (dBm) */
-        s8 max_txpower_in_half_dbm; /* (half-dBm) */
-
-        /* Loop through all the sections
-         * adjust bands and channel's max tx power
-         * Set the tx_power_user_lmt to the highest power
-         * supported by any channels and chains
-         */
-        for (section = 0; section < ARRAY_SIZE(enhinfo); section++) {
-                eeprom_section_count = enhinfo[section].count;
-                offset = enhinfo[section].offset;
-                enhanced_txpower = (struct iwl_eeprom_enhanced_txpwr *)
-                                iwl_eeprom_query_addr(priv, offset);
-
-                /*
-                 * check for valid entry -
-                 * different version of EEPROM might contain different set
-                 * of enhanced tx power table
-                 * always check for valid entry before process
-                 * the information
-                 */
-                if (!enhanced_txpower->common || enhanced_txpower->reserved)
-                        continue;
-
-                for (element = 0; element < eeprom_section_count; element++) {
-                        if (enhinfo[section].is_common)
-                                max_txpower_avg =
-                                        iwl_update_common_txpower(priv,
-                                                enhanced_txpower, section,
-                                                element,
-                                                &max_txpower_in_half_dbm);
-                        else
-                                max_txpower_avg =
-                                        iwl_update_channel_txpower(priv,
-                                                enhanced_txpower, section,
-                                                element,
-                                                &max_txpower_in_half_dbm);
-
-                        /* Update the tx_power_user_lmt to the highest power
-                         * supported by any channel */
-                        if (max_txpower_avg > priv->tx_power_user_lmt)
-                                priv->tx_power_user_lmt = max_txpower_avg;
-
-                        /*
-                         * Update the tx_power_lmt_in_half_dbm to
-                         * the highest power supported by any channel
-                         */
-                        if (max_txpower_in_half_dbm >
-                            priv->tx_power_lmt_in_half_dbm)
-                                priv->tx_power_lmt_in_half_dbm =
-                                        max_txpower_in_half_dbm;
-                }
-        }
-}
-EXPORT_SYMBOL(iwlcore_eeprom_enhanced_txpower);
-
 #define CHECK_AND_PRINT_I(x) ((eeprom_ch_info[ch].flags & EEPROM_CHANNEL_##x) \
                             ? # x " " : "")
 
@@ -1162,4 +816,3 @@ const struct iwl_channel_info *iwl_get_channel_info(const struct iwl_priv *priv,
         return NULL;
 }
 EXPORT_SYMBOL(iwl_get_channel_info);
-
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index a4772aff51fe..d9b590625ae4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -493,7 +493,6 @@ struct iwl_eeprom_calib_info {
 
 struct iwl_eeprom_ops {
         const u32 regulatory_bands[7];
-        int (*verify_signature) (struct iwl_priv *priv);
         int (*acquire_semaphore) (struct iwl_priv *priv);
         void (*release_semaphore) (struct iwl_priv *priv);
         u16 (*calib_version) (struct iwl_priv *priv);
@@ -502,18 +501,13 @@ struct iwl_eeprom_ops {
 };
 
 
-void iwl_eeprom_get_mac(const struct iwl_priv *priv, u8 *mac);
 int iwl_eeprom_init(struct iwl_priv *priv);
 void iwl_eeprom_free(struct iwl_priv *priv);
 int  iwl_eeprom_check_version(struct iwl_priv *priv);
 const u8 *iwl_eeprom_query_addr(const struct iwl_priv *priv, size_t offset);
-u16 iwl_eeprom_query16(const struct iwl_priv *priv, size_t offset);
-
 int iwlcore_eeprom_verify_signature(struct iwl_priv *priv);
-int iwlcore_eeprom_acquire_semaphore(struct iwl_priv *priv);
-void iwlcore_eeprom_release_semaphore(struct iwl_priv *priv);
+u16 iwl_eeprom_query16(const struct iwl_priv *priv, size_t offset);
 const u8 *iwlcore_eeprom_query_addr(const struct iwl_priv *priv, size_t offset);
-void iwlcore_eeprom_enhanced_txpower(struct iwl_priv *priv);
 int iwl_init_channel_map(struct iwl_priv *priv);
 void iwl_free_channel_map(struct iwl_priv *priv);
 const struct iwl_channel_info *iwl_get_channel_info(
diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
index 621abe3c5afc..1aaef70deaec 100644
--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
+++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
@@ -44,11 +44,6 @@ static inline struct ieee80211_conf *ieee80211_get_hw_conf(
         return &hw->conf;
 }
 
-static inline int iwl_check_bits(unsigned long field, unsigned long mask)
-{
-        return ((field & mask) == mask) ? 1 : 0;
-}
-
 static inline unsigned long elapsed_jiffies(unsigned long start,
                                             unsigned long end)
 {
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.c b/drivers/net/wireless/iwlwifi/iwl-led.c
index db5bfcb036ca..86c2b6fed0c6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-led.c
@@ -108,13 +108,13 @@ static int iwl_led_pattern(struct iwl_priv *priv, unsigned int idx)
         BUG_ON(idx > IWL_MAX_BLINK_TBL);
 
         IWL_DEBUG_LED(priv, "Led blink time compensation= %u\n",
-                        priv->cfg->led_compensation);
+                        priv->cfg->base_params->led_compensation);
         led_cmd.on =
                 iwl_blink_compensation(priv, blink_tbl[idx].on_time,
-                                        priv->cfg->led_compensation);
+                                priv->cfg->base_params->led_compensation);
         led_cmd.off =
                 iwl_blink_compensation(priv, blink_tbl[idx].off_time,
-                                        priv->cfg->led_compensation);
+                                priv->cfg->base_params->led_compensation);
 
         return priv->cfg->ops->led->cmd(priv, &led_cmd);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 63c0ab46261f..49d7788937a9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -278,9 +278,9 @@ int iwl_power_update_mode(struct iwl_priv *priv, bool force)
 
         dtimper = priv->hw->conf.ps_dtim_period ?: 1;
 
-        if (priv->cfg->broken_powersave)
+        if (priv->cfg->base_params->broken_powersave)
                 iwl_power_sleep_cam_cmd(priv, &cmd);
-        else if (priv->cfg->supports_idle &&
+        else if (priv->cfg->base_params->supports_idle &&
                  priv->hw->conf.flags & IEEE80211_CONF_IDLE)
                 iwl_static_sleep_cmd(priv, &cmd, IWL_POWER_INDEX_5, 20);
         else if (priv->cfg->ops->lib->tt_ops.lower_power_detection &&
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 10be197b0f22..f436270ca39a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -36,7 +36,6 @@
 #include "iwl-core.h"
 #include "iwl-sta.h"
 #include "iwl-io.h"
-#include "iwl-calib.h"
 #include "iwl-helpers.h"
 /************************** RX-FUNCTIONS ****************************/
 /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 7727f0966d31..67da31295781 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -54,100 +54,133 @@
 #define IWL_PASSIVE_DWELL_BASE      (100)
 #define IWL_CHANNEL_TUNE_TIME       5
 
+static int iwl_send_scan_abort(struct iwl_priv *priv)
+{
+        int ret;
+        struct iwl_rx_packet *pkt;
+        struct iwl_host_cmd cmd = {
+                .id = REPLY_SCAN_ABORT_CMD,
+                .flags = CMD_WANT_SKB,
+        };
 
+        /* Exit instantly with error when device is not ready
+         * to receive scan abort command or it does not perform
+         * hardware scan currently */
+        if (!test_bit(STATUS_READY, &priv->status) ||
+            !test_bit(STATUS_GEO_CONFIGURED, &priv->status) ||
+            !test_bit(STATUS_SCAN_HW, &priv->status) ||
+            test_bit(STATUS_FW_ERROR, &priv->status) ||
+            test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return -EIO;
 
-/**
- * iwl_scan_cancel - Cancel any currently executing HW scan
- *
- * NOTE: priv->mutex is not required before calling this function
- */
-int iwl_scan_cancel(struct iwl_priv *priv)
+        ret = iwl_send_cmd_sync(priv, &cmd);
+        if (ret)
+                return ret;
+
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
+        if (pkt->u.status != CAN_ABORT_STATUS) {
+                /* The scan abort will return 1 for success or
+                 * 2 for "failure".  A failure condition can be
+                 * due to simply not being in an active scan which
+                 * can occur if we send the scan abort before we
+                 * the microcode has notified us that a scan is
+                 * completed. */
+                IWL_DEBUG_SCAN(priv, "SCAN_ABORT ret %d.\n", pkt->u.status);
+                ret = -EIO;
+        }
+
+        iwl_free_pages(priv, cmd.reply_page);
+        return ret;
+}
+
+static void iwl_complete_scan(struct iwl_priv *priv, bool aborted)
 {
-        if (!test_bit(STATUS_SCAN_HW, &priv->status)) {
-                clear_bit(STATUS_SCANNING, &priv->status);
-                return 0;
+        /* check if scan was requested from mac80211 */
+        if (priv->scan_request) {
+                IWL_DEBUG_SCAN(priv, "Complete scan in mac80211\n");
+                ieee80211_scan_completed(priv->hw, aborted);
         }
 
-        if (test_bit(STATUS_SCANNING, &priv->status)) {
-                if (!test_and_set_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                        IWL_DEBUG_SCAN(priv, "Queuing scan abort.\n");
-                        queue_work(priv->workqueue, &priv->abort_scan);
+        priv->is_internal_short_scan = false;
+        priv->scan_vif = NULL;
+        priv->scan_request = NULL;
+}
+
+void iwl_force_scan_end(struct iwl_priv *priv)
+{
+        lockdep_assert_held(&priv->mutex);
+
+        if (!test_bit(STATUS_SCANNING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Forcing scan end while not scanning\n");
+                return;
+        }
+
+        IWL_DEBUG_SCAN(priv, "Forcing scan end\n");
+        clear_bit(STATUS_SCANNING, &priv->status);
+        clear_bit(STATUS_SCAN_HW, &priv->status);
+        clear_bit(STATUS_SCAN_ABORTING, &priv->status);
+        iwl_complete_scan(priv, true);
+}
 
-                } else
-                        IWL_DEBUG_SCAN(priv, "Scan abort already in progress.\n");
+static void iwl_do_scan_abort(struct iwl_priv *priv)
+{
+        int ret;
+
+        lockdep_assert_held(&priv->mutex);
+
+        if (!test_bit(STATUS_SCANNING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Not performing scan to abort\n");
+                return;
+        }
 
-                return test_bit(STATUS_SCANNING, &priv->status);
+        if (test_and_set_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Scan abort in progress\n");
+                return;
         }
 
+        ret = iwl_send_scan_abort(priv);
+        if (ret) {
+                IWL_DEBUG_SCAN(priv, "Send scan abort failed %d\n", ret);
+                iwl_force_scan_end(priv);
+        } else
+                IWL_DEBUG_SCAN(priv, "Sucessfully send scan abort\n");
+}
+
+/**
+ * iwl_scan_cancel - Cancel any currently executing HW scan
+ */
+int iwl_scan_cancel(struct iwl_priv *priv)
+{
+        IWL_DEBUG_SCAN(priv, "Queuing abort scan\n");
+        queue_work(priv->workqueue, &priv->abort_scan);
         return 0;
 }
 EXPORT_SYMBOL(iwl_scan_cancel);
+
 /**
  * iwl_scan_cancel_timeout - Cancel any currently executing HW scan
  * @ms: amount of time to wait (in milliseconds) for scan to abort
  *
- * NOTE: priv->mutex must be held before calling this function
  */
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms)
 {
-        unsigned long now = jiffies;
-        int ret;
+        unsigned long timeout = jiffies + msecs_to_jiffies(ms);
 
-        ret = iwl_scan_cancel(priv);
-        if (ret && ms) {
-                mutex_unlock(&priv->mutex);
-                while (!time_after(jiffies, now + msecs_to_jiffies(ms)) &&
-                                test_bit(STATUS_SCANNING, &priv->status))
-                        msleep(1);
-                mutex_lock(&priv->mutex);
-
-                return test_bit(STATUS_SCANNING, &priv->status);
-        }
-
-        return ret;
-}
-EXPORT_SYMBOL(iwl_scan_cancel_timeout);
+        lockdep_assert_held(&priv->mutex);
 
-static int iwl_send_scan_abort(struct iwl_priv *priv)
-{
-        int ret = 0;
-        struct iwl_rx_packet *pkt;
-        struct iwl_host_cmd cmd = {
-                .id = REPLY_SCAN_ABORT_CMD,
-                .flags = CMD_WANT_SKB,
-        };
+        IWL_DEBUG_SCAN(priv, "Scan cancel timeout\n");
 
-        /* If there isn't a scan actively going on in the hardware
-         * then we are in between scan bands and not actually
-         * actively scanning, so don't send the abort command */
-        if (!test_bit(STATUS_SCAN_HW, &priv->status)) {
-                clear_bit(STATUS_SCAN_ABORTING, &priv->status);
-                return 0;
-        }
+        iwl_do_scan_abort(priv);
 
-        ret = iwl_send_cmd_sync(priv, &cmd);
-        if (ret) {
-                clear_bit(STATUS_SCAN_ABORTING, &priv->status);
-                return ret;
-        }
-
-        pkt = (struct iwl_rx_packet *)cmd.reply_page;
-        if (pkt->u.status != CAN_ABORT_STATUS) {
-                /* The scan abort will return 1 for success or
-                 * 2 for "failure".  A failure condition can be
-                 * due to simply not being in an active scan which
-                 * can occur if we send the scan abort before we
-                 * the microcode has notified us that a scan is
-                 * completed. */
-                IWL_DEBUG_INFO(priv, "SCAN_ABORT returned %d.\n", pkt->u.status);
-                clear_bit(STATUS_SCAN_ABORTING, &priv->status);
-                clear_bit(STATUS_SCAN_HW, &priv->status);
+        while (time_before_eq(jiffies, timeout)) {
+                if (!test_bit(STATUS_SCAN_HW, &priv->status))
+                        break;
+                msleep(20);
         }
 
-        iwl_free_pages(priv, cmd.reply_page);
-
-        return ret;
+        return test_bit(STATUS_SCAN_HW, &priv->status);
 }
+EXPORT_SYMBOL(iwl_scan_cancel_timeout);
 
 /* Service response to REPLY_SCAN_CMD (0x80) */
 static void iwl_rx_reply_scan(struct iwl_priv *priv,
@@ -158,7 +191,7 @@ static void iwl_rx_reply_scan(struct iwl_priv *priv,
         struct iwl_scanreq_notification *notif =
             (struct iwl_scanreq_notification *)pkt->u.raw;
 
-        IWL_DEBUG_RX(priv, "Scan request status = 0x%x\n", notif->status);
+        IWL_DEBUG_SCAN(priv, "Scan request status = 0x%x\n", notif->status);
 #endif
 }
 
@@ -217,26 +250,17 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
         /* The HW is no longer scanning */
         clear_bit(STATUS_SCAN_HW, &priv->status);
 
-        IWL_DEBUG_INFO(priv, "Scan on %sGHz took %dms\n",
+        IWL_DEBUG_SCAN(priv, "Scan on %sGHz took %dms\n",
                        (priv->scan_band == IEEE80211_BAND_2GHZ) ? "2.4" : "5.2",
                        jiffies_to_msecs(elapsed_jiffies
                                         (priv->scan_start, jiffies)));
 
-        /*
-         * If a request to abort was given, or the scan did not succeed
-         * then we reset the scan state machine and terminate,
-         * re-queuing another scan if one has been requested
-         */
-        if (test_and_clear_bit(STATUS_SCAN_ABORTING, &priv->status))
-                IWL_DEBUG_INFO(priv, "Aborted scan completed.\n");
-
-        IWL_DEBUG_INFO(priv, "Setting scan to off\n");
-
-        clear_bit(STATUS_SCANNING, &priv->status);
+        queue_work(priv->workqueue, &priv->scan_completed);
 
         if (priv->iw_mode != NL80211_IFTYPE_ADHOC &&
-            priv->cfg->advanced_bt_coexist && priv->bt_status !=
-            scan_notif->bt_status) {
+            priv->cfg->bt_params &&
+            priv->cfg->bt_params->advanced_bt_coexist &&
+            priv->bt_status != scan_notif->bt_status) {
                 if (scan_notif->bt_status) {
                         /* BT on */
                         if (!priv->bt_ch_announce)
@@ -254,7 +278,6 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
                 priv->bt_status = scan_notif->bt_status;
                 queue_work(priv->workqueue, &priv->bt_traffic_change_work);
         }
-        queue_work(priv->workqueue, &priv->scan_completed);
 }
 
 void iwl_setup_rx_scan_handlers(struct iwl_priv *priv)
@@ -324,19 +347,53 @@ void iwl_init_scan_params(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_init_scan_params);
 
-static int iwl_scan_initiate(struct iwl_priv *priv, struct ieee80211_vif *vif)
+static int __must_check iwl_scan_initiate(struct iwl_priv *priv,
+                                          struct ieee80211_vif *vif,
+                                          bool internal,
+                                          enum ieee80211_band band)
 {
+        int ret;
+
         lockdep_assert_held(&priv->mutex);
 
-        IWL_DEBUG_INFO(priv, "Starting scan...\n");
+        if (WARN_ON(!priv->cfg->ops->utils->request_scan))
+                return -EOPNOTSUPP;
+
+        cancel_delayed_work(&priv->scan_check);
+
+        if (!iwl_is_ready_rf(priv)) {
+                IWL_WARN(priv, "Request scan called when driver not ready.\n");
+                return -EIO;
+        }
+
+        if (test_bit(STATUS_SCAN_HW, &priv->status)) {
+                IWL_DEBUG_SCAN(priv,
+                        "Multiple concurrent scan requests in parallel.\n");
+                return -EBUSY;
+        }
+
+        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Scan request while abort pending.\n");
+                return -EBUSY;
+        }
+
+        IWL_DEBUG_SCAN(priv, "Starting %sscan...\n",
+                        internal ? "internal short " : "");
+
         set_bit(STATUS_SCANNING, &priv->status);
-        priv->is_internal_short_scan = false;
+        priv->is_internal_short_scan = internal;
         priv->scan_start = jiffies;
+        priv->scan_band = band;
 
-        if (WARN_ON(!priv->cfg->ops->utils->request_scan))
-                return -EOPNOTSUPP;
+        ret = priv->cfg->ops->utils->request_scan(priv, vif);
+        if (ret) {
+                clear_bit(STATUS_SCANNING, &priv->status);
+                priv->is_internal_short_scan = false;
+                return ret;
+        }
 
-        priv->cfg->ops->utils->request_scan(priv, vif);
+        queue_delayed_work(priv->workqueue, &priv->scan_check,
+                           IWL_SCAN_CHECK_WATCHDOG);
 
         return 0;
 }
@@ -355,12 +412,6 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mutex);
 
-        if (!iwl_is_ready_rf(priv)) {
-                ret = -EIO;
-                IWL_DEBUG_MAC80211(priv, "leave - not ready or exit pending\n");
-                goto out_unlock;
-        }
-
         if (test_bit(STATUS_SCANNING, &priv->status) &&
             !priv->is_internal_short_scan) {
                 IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
@@ -368,14 +419,7 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
                 goto out_unlock;
         }
 
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                ret = -EAGAIN;
-                goto out_unlock;
-        }
-
         /* mac80211 will only ask for one band at a time */
-        priv->scan_band = req->channels[0]->band;
         priv->scan_request = req;
         priv->scan_vif = vif;
 
@@ -383,10 +427,12 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
          * If an internal scan is in progress, just set
          * up the scan_request as per above.
          */
-        if (priv->is_internal_short_scan)
+        if (priv->is_internal_short_scan) {
+                IWL_DEBUG_SCAN(priv, "SCAN request during internal scan\n");
                 ret = 0;
-        else
-                ret = iwl_scan_initiate(priv, vif);
+        } else
+                ret = iwl_scan_initiate(priv, vif, false,
+                                        req->channels[0]->band);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
@@ -411,6 +457,8 @@ static void iwl_bg_start_internal_scan(struct work_struct *work)
         struct iwl_priv *priv =
                 container_of(work, struct iwl_priv, start_internal_scan);
 
+        IWL_DEBUG_SCAN(priv, "Start internal scan\n");
+
         mutex_lock(&priv->mutex);
 
         if (priv->is_internal_short_scan == true) {
@@ -418,31 +466,13 @@ static void iwl_bg_start_internal_scan(struct work_struct *work)
                 goto unlock;
         }
 
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
-                goto unlock;
-        }
-
         if (test_bit(STATUS_SCANNING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
                 goto unlock;
         }
 
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                goto unlock;
-        }
-
-        priv->scan_band = priv->band;
-
-        IWL_DEBUG_SCAN(priv, "Start internal short scan...\n");
-        set_bit(STATUS_SCANNING, &priv->status);
-        priv->is_internal_short_scan = true;
-
-        if (WARN_ON(!priv->cfg->ops->utils->request_scan))
-                goto unlock;
-
-        priv->cfg->ops->utils->request_scan(priv, NULL);
+        if (iwl_scan_initiate(priv, NULL, true, priv->band))
+                IWL_DEBUG_SCAN(priv, "failed to start internal short scan\n");
  unlock:
         mutex_unlock(&priv->mutex);
 }
@@ -452,18 +482,13 @@ static void iwl_bg_scan_check(struct work_struct *data)
         struct iwl_priv *priv =
             container_of(data, struct iwl_priv, scan_check.work);
 
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
+        IWL_DEBUG_SCAN(priv, "Scan check work\n");
 
+        /* Since we are here firmware does not finish scan and
+         * most likely is in bad shape, so we don't bother to
+         * send abort command, just force scan complete to mac80211 */
         mutex_lock(&priv->mutex);
-        if (test_bit(STATUS_SCANNING, &priv->status) &&
-            !test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Scan completion watchdog (%dms)\n",
-                               jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG));
-
-                if (!test_bit(STATUS_EXIT_PENDING, &priv->status))
-                        iwl_send_scan_abort(priv);
-        }
+        iwl_force_scan_end(priv);
         mutex_unlock(&priv->mutex);
 }
 
@@ -519,15 +544,12 @@ static void iwl_bg_abort_scan(struct work_struct *work)
 {
         struct iwl_priv *priv = container_of(work, struct iwl_priv, abort_scan);
 
-        if (!test_bit(STATUS_READY, &priv->status) ||
-            !test_bit(STATUS_GEO_CONFIGURED, &priv->status))
-                return;
-
-        cancel_delayed_work(&priv->scan_check);
+        IWL_DEBUG_SCAN(priv, "Abort scan work\n");
 
+        /* We keep scan_check work queued in case when firmware will not
+         * report back scan completed notification */
         mutex_lock(&priv->mutex);
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status))
-                iwl_send_scan_abort(priv);
+        iwl_scan_cancel_timeout(priv, 200);
         mutex_unlock(&priv->mutex);
 }
 
@@ -535,55 +557,60 @@ static void iwl_bg_scan_completed(struct work_struct *work)
 {
         struct iwl_priv *priv =
             container_of(work, struct iwl_priv, scan_completed);
-        bool internal = false;
-        bool scan_completed = false;
-        struct iwl_rxon_context *ctx;
+        bool aborted;
 
-        IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
+        IWL_DEBUG_SCAN(priv, "Completed %sscan.\n",
+                       priv->is_internal_short_scan ? "internal short " : "");
 
         cancel_delayed_work(&priv->scan_check);
 
         mutex_lock(&priv->mutex);
-        if (priv->is_internal_short_scan) {
-                priv->is_internal_short_scan = false;
-                IWL_DEBUG_SCAN(priv, "internal short scan completed\n");
-                internal = true;
-        } else if (priv->scan_request) {
-                scan_completed = true;
-                priv->scan_request = NULL;
-                priv->scan_vif = NULL;
+
+        aborted = test_and_clear_bit(STATUS_SCAN_ABORTING, &priv->status);
+        if (aborted)
+                IWL_DEBUG_SCAN(priv, "Aborted scan completed.\n");
+
+        if (!test_and_clear_bit(STATUS_SCANNING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Scan already completed.\n");
+                goto out_settings;
         }
 
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+        if (priv->is_internal_short_scan && !aborted) {
+                int err;
+
+                /* Check if mac80211 requested scan during our internal scan */
+                if (priv->scan_request == NULL)
+                        goto out_complete;
+
+                /* If so request a new scan */
+                err = iwl_scan_initiate(priv, priv->scan_vif, false,
+                                        priv->scan_request->channels[0]->band);
+                if (err) {
+                        IWL_DEBUG_SCAN(priv,
+                                "failed to initiate pending scan: %d\n", err);
+                        aborted = true;
+                        goto out_complete;
+                }
+
                 goto out;
+        }
 
-        if (internal && priv->scan_request)
-                iwl_scan_initiate(priv, priv->scan_vif);
+out_complete:
+        iwl_complete_scan(priv, aborted);
+
+out_settings:
+        /* Can we still talk to firmware ? */
+        if (!iwl_is_ready_rf(priv))
+                goto out;
 
         /* Since setting the TXPOWER may have been deferred while
          * performing the scan, fire one off */
         iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
 
-        /*
-         * Since setting the RXON may have been deferred while
-         * performing the scan, fire one off if needed
-         */
-        for_each_context(priv, ctx)
-                iwlcore_commit_rxon(priv, ctx);
+        priv->cfg->ops->utils->post_scan(priv);
 
  out:
-        if (priv->cfg->ops->hcmd->set_pan_params)
-                priv->cfg->ops->hcmd->set_pan_params(priv);
-
         mutex_unlock(&priv->mutex);
-
-        /*
-         * Do not hold mutex here since this will cause mac80211 to call
-         * into driver again into functions that will attempt to take
-         * mutex.
-         */
-        if (scan_completed)
-                ieee80211_scan_completed(priv->hw, false);
 }
 
 void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
@@ -595,3 +622,16 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
 
+void iwl_cancel_scan_deferred_work(struct iwl_priv *priv)
+{
+        cancel_work_sync(&priv->start_internal_scan);
+        cancel_work_sync(&priv->abort_scan);
+        cancel_work_sync(&priv->scan_completed);
+
+        if (cancel_delayed_work_sync(&priv->scan_check)) {
+                mutex_lock(&priv->mutex);
+                iwl_force_scan_end(priv);
+                mutex_unlock(&priv->mutex);
+        }
+}
+EXPORT_SYMBOL(iwl_cancel_scan_deferred_work);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index ccd09027c7cd..7c7f7dcb1b1e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -228,9 +228,8 @@ static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
  *
  * should be called with sta_lock held
  */
-static u8 iwl_prep_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
-                           const u8 *addr, bool is_ap,
-                           struct ieee80211_sta *sta)
+u8 iwl_prep_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                    const u8 *addr, bool is_ap, struct ieee80211_sta *sta)
 {
         struct iwl_station_entry *station;
         int i;
@@ -317,6 +316,7 @@ static u8 iwl_prep_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
         return sta_id;
 
 }
+EXPORT_SYMBOL_GPL(iwl_prep_station);
 
 #define STA_WAIT_TIMEOUT (HZ/2)
 
@@ -381,111 +381,6 @@ int iwl_add_station_common(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
 }
 EXPORT_SYMBOL(iwl_add_station_common);
 
-static struct iwl_link_quality_cmd *iwl_sta_alloc_lq(struct iwl_priv *priv,
-                                                     u8 sta_id)
-{
-        int i, r;
-        struct iwl_link_quality_cmd *link_cmd;
-        u32 rate_flags;
-
-        link_cmd = kzalloc(sizeof(struct iwl_link_quality_cmd), GFP_KERNEL);
-        if (!link_cmd) {
-                IWL_ERR(priv, "Unable to allocate memory for LQ cmd.\n");
-                return NULL;
-        }
-        /* Set up the rate scaling to start at selected rate, fall back
-         * all the way down to 1M in IEEE order, and then spin on 1M */
-        if (priv->band == IEEE80211_BAND_5GHZ)
-                r = IWL_RATE_6M_INDEX;
-        else
-                r = IWL_RATE_1M_INDEX;
-
-        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
-                rate_flags = 0;
-                if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
-                        rate_flags |= RATE_MCS_CCK_MSK;
-
-                rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
-                                RATE_MCS_ANT_POS;
-
-                link_cmd->rs_table[i].rate_n_flags =
-                        iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
-                r = iwl_get_prev_ieee_rate(r);
-        }
-
-        link_cmd->general_params.single_stream_ant_msk =
-                                first_antenna(priv->hw_params.valid_tx_ant);
-
-        link_cmd->general_params.dual_stream_ant_msk =
-                priv->hw_params.valid_tx_ant &
-                ~first_antenna(priv->hw_params.valid_tx_ant);
-        if (!link_cmd->general_params.dual_stream_ant_msk) {
-                link_cmd->general_params.dual_stream_ant_msk = ANT_AB;
-        } else if (num_of_ant(priv->hw_params.valid_tx_ant) == 2) {
-                link_cmd->general_params.dual_stream_ant_msk =
-                        priv->hw_params.valid_tx_ant;
-        }
-
-        link_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
-        link_cmd->agg_params.agg_time_limit =
-                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
-
-        link_cmd->sta_id = sta_id;
-
-        return link_cmd;
-}
-
-/*
- * iwl_add_bssid_station - Add the special IBSS BSSID station
- *
- * Function sleeps.
- */
-int iwl_add_bssid_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
-                          const u8 *addr, bool init_rs, u8 *sta_id_r)
-{
-        int ret;
-        u8 sta_id;
-        struct iwl_link_quality_cmd *link_cmd;
-        unsigned long flags;
-
-        if (sta_id_r)
-                *sta_id_r = IWL_INVALID_STATION;
-
-        ret = iwl_add_station_common(priv, ctx, addr, 0, NULL, &sta_id);
-        if (ret) {
-                IWL_ERR(priv, "Unable to add station %pM\n", addr);
-                return ret;
-        }
-
-        if (sta_id_r)
-                *sta_id_r = sta_id;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->stations[sta_id].used |= IWL_STA_LOCAL;
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        if (init_rs) {
-                /* Set up default rate scaling table in device's station table */
-                link_cmd = iwl_sta_alloc_lq(priv, sta_id);
-                if (!link_cmd) {
-                        IWL_ERR(priv, "Unable to initialize rate scaling for station %pM.\n",
-                                addr);
-                        return -ENOMEM;
-                }
-
-                ret = iwl_send_lq_cmd(priv, ctx, link_cmd, CMD_SYNC, true);
-                if (ret)
-                        IWL_ERR(priv, "Link quality command failed (%d)\n", ret);
-
-                spin_lock_irqsave(&priv->sta_lock, flags);
-                priv->stations[sta_id].lq = link_cmd;
-                spin_unlock_irqrestore(&priv->sta_lock, flags);
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_add_bssid_station);
-
 /**
  * iwl_sta_ucode_deactivate - deactivate ucode status for a station
  *
@@ -741,405 +636,25 @@ int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_get_free_ucode_key_index);
 
-static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv,
-                                      struct iwl_rxon_context *ctx,
-                                      bool send_if_empty)
-{
-        int i, not_empty = 0;
-        u8 buff[sizeof(struct iwl_wep_cmd) +
-                sizeof(struct iwl_wep_key) * WEP_KEYS_MAX];
-        struct iwl_wep_cmd *wep_cmd = (struct iwl_wep_cmd *)buff;
-        size_t cmd_size  = sizeof(struct iwl_wep_cmd);
-        struct iwl_host_cmd cmd = {
-                .id = ctx->wep_key_cmd,
-                .data = wep_cmd,
-                .flags = CMD_SYNC,
-        };
-
-        might_sleep();
-
-        memset(wep_cmd, 0, cmd_size +
-                        (sizeof(struct iwl_wep_key) * WEP_KEYS_MAX));
-
-        for (i = 0; i < WEP_KEYS_MAX ; i++) {
-                wep_cmd->key[i].key_index = i;
-                if (ctx->wep_keys[i].key_size) {
-                        wep_cmd->key[i].key_offset = i;
-                        not_empty = 1;
-                } else {
-                        wep_cmd->key[i].key_offset = WEP_INVALID_OFFSET;
-                }
-
-                wep_cmd->key[i].key_size = ctx->wep_keys[i].key_size;
-                memcpy(&wep_cmd->key[i].key[3], ctx->wep_keys[i].key,
-                                ctx->wep_keys[i].key_size);
-        }
-
-        wep_cmd->global_key_type = WEP_KEY_WEP_TYPE;
-        wep_cmd->num_keys = WEP_KEYS_MAX;
-
-        cmd_size += sizeof(struct iwl_wep_key) * WEP_KEYS_MAX;
-
-        cmd.len = cmd_size;
-
-        if (not_empty || send_if_empty)
-                return iwl_send_cmd(priv, &cmd);
-        else
-                return 0;
-}
-
-int iwl_restore_default_wep_keys(struct iwl_priv *priv,
-                                 struct iwl_rxon_context *ctx)
-{
-        lockdep_assert_held(&priv->mutex);
-
-        return iwl_send_static_wepkey_cmd(priv, ctx, false);
-}
-EXPORT_SYMBOL(iwl_restore_default_wep_keys);
-
-int iwl_remove_default_wep_key(struct iwl_priv *priv,
-                               struct iwl_rxon_context *ctx,
-                               struct ieee80211_key_conf *keyconf)
-{
-        int ret;
-
-        lockdep_assert_held(&priv->mutex);
-
-        IWL_DEBUG_WEP(priv, "Removing default WEP key: idx=%d\n",
-                      keyconf->keyidx);
-
-        memset(&ctx->wep_keys[keyconf->keyidx], 0, sizeof(ctx->wep_keys[0]));
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_WEP(priv, "Not sending REPLY_WEPKEY command due to RFKILL.\n");
-                /* but keys in device are clear anyway so return success */
-                return 0;
-        }
-        ret = iwl_send_static_wepkey_cmd(priv, ctx, 1);
-        IWL_DEBUG_WEP(priv, "Remove default WEP key: idx=%d ret=%d\n",
-                      keyconf->keyidx, ret);
-
-        return ret;
-}
-EXPORT_SYMBOL(iwl_remove_default_wep_key);
-
-int iwl_set_default_wep_key(struct iwl_priv *priv,
-                            struct iwl_rxon_context *ctx,
-                            struct ieee80211_key_conf *keyconf)
-{
-        int ret;
-
-        lockdep_assert_held(&priv->mutex);
-
-        if (keyconf->keylen != WEP_KEY_LEN_128 &&
-            keyconf->keylen != WEP_KEY_LEN_64) {
-                IWL_DEBUG_WEP(priv, "Bad WEP key length %d\n", keyconf->keylen);
-                return -EINVAL;
-        }
-
-        keyconf->flags &= ~IEEE80211_KEY_FLAG_GENERATE_IV;
-        keyconf->hw_key_idx = HW_KEY_DEFAULT;
-        priv->stations[ctx->ap_sta_id].keyinfo.cipher = keyconf->cipher;
-
-        ctx->wep_keys[keyconf->keyidx].key_size = keyconf->keylen;
-        memcpy(&ctx->wep_keys[keyconf->keyidx].key, &keyconf->key,
-                                                        keyconf->keylen);
-
-        ret = iwl_send_static_wepkey_cmd(priv, ctx, false);
-        IWL_DEBUG_WEP(priv, "Set default WEP key: len=%d idx=%d ret=%d\n",
-                keyconf->keylen, keyconf->keyidx, ret);
-
-        return ret;
-}
-EXPORT_SYMBOL(iwl_set_default_wep_key);
-
-static int iwl_set_wep_dynamic_key_info(struct iwl_priv *priv,
-                                        struct iwl_rxon_context *ctx,
-                                        struct ieee80211_key_conf *keyconf,
-                                        u8 sta_id)
-{
-        unsigned long flags;
-        __le16 key_flags = 0;
-        struct iwl_addsta_cmd sta_cmd;
-
-        lockdep_assert_held(&priv->mutex);
-
-        keyconf->flags &= ~IEEE80211_KEY_FLAG_GENERATE_IV;
-
-        key_flags |= (STA_KEY_FLG_WEP | STA_KEY_FLG_MAP_KEY_MSK);
-        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
-        key_flags &= ~STA_KEY_FLG_INVALID;
-
-        if (keyconf->keylen == WEP_KEY_LEN_128)
-                key_flags |= STA_KEY_FLG_KEY_SIZE_MSK;
-
-        if (sta_id == ctx->bcast_sta_id)
-                key_flags |= STA_KEY_MULTICAST_MSK;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-
-        priv->stations[sta_id].keyinfo.cipher = keyconf->cipher;
-        priv->stations[sta_id].keyinfo.keylen = keyconf->keylen;
-        priv->stations[sta_id].keyinfo.keyidx = keyconf->keyidx;
-
-        memcpy(priv->stations[sta_id].keyinfo.key,
-                                keyconf->key, keyconf->keylen);
-
-        memcpy(&priv->stations[sta_id].sta.key.key[3],
-                                keyconf->key, keyconf->keylen);
-
-        if ((priv->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
-                        == STA_KEY_FLG_NO_ENC)
-                priv->stations[sta_id].sta.key.key_offset =
-                                 iwl_get_free_ucode_key_index(priv);
-        /* else, we are overriding an existing key => no need to allocated room
-         * in uCode. */
-
-        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
-                "no space for a new key");
-
-        priv->stations[sta_id].sta.key.key_flags = key_flags;
-        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
-        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
-
-        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
-}
-
-static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
-                                         struct iwl_rxon_context *ctx,
-                                         struct ieee80211_key_conf *keyconf,
-                                         u8 sta_id)
-{
-        unsigned long flags;
-        __le16 key_flags = 0;
-        struct iwl_addsta_cmd sta_cmd;
-
-        lockdep_assert_held(&priv->mutex);
-
-        key_flags |= (STA_KEY_FLG_CCMP | STA_KEY_FLG_MAP_KEY_MSK);
-        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
-        key_flags &= ~STA_KEY_FLG_INVALID;
-
-        if (sta_id == ctx->bcast_sta_id)
-                key_flags |= STA_KEY_MULTICAST_MSK;
-
-        keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->stations[sta_id].keyinfo.cipher = keyconf->cipher;
-        priv->stations[sta_id].keyinfo.keylen = keyconf->keylen;
-
-        memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key,
-               keyconf->keylen);
-
-        memcpy(priv->stations[sta_id].sta.key.key, keyconf->key,
-               keyconf->keylen);
-
-        if ((priv->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
-                        == STA_KEY_FLG_NO_ENC)
-                priv->stations[sta_id].sta.key.key_offset =
-                                 iwl_get_free_ucode_key_index(priv);
-        /* else, we are overriding an existing key => no need to allocated room
-         * in uCode. */
-
-        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
-                "no space for a new key");
-
-        priv->stations[sta_id].sta.key.key_flags = key_flags;
-        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
-        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
-
-        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
-}
-
-static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
-                                         struct iwl_rxon_context *ctx,
-                                         struct ieee80211_key_conf *keyconf,
-                                         u8 sta_id)
-{
-        unsigned long flags;
-        int ret = 0;
-        __le16 key_flags = 0;
-
-        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
-        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
-        key_flags &= ~STA_KEY_FLG_INVALID;
-
-        if (sta_id == ctx->bcast_sta_id)
-                key_flags |= STA_KEY_MULTICAST_MSK;
-
-        keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
-        keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-
-        priv->stations[sta_id].keyinfo.cipher = keyconf->cipher;
-        priv->stations[sta_id].keyinfo.keylen = 16;
-
-        if ((priv->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
-                        == STA_KEY_FLG_NO_ENC)
-                priv->stations[sta_id].sta.key.key_offset =
-                                 iwl_get_free_ucode_key_index(priv);
-        /* else, we are overriding an existing key => no need to allocated room
-         * in uCode. */
-
-        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
-                "no space for a new key");
-
-        priv->stations[sta_id].sta.key.key_flags = key_flags;
-
-
-        /* This copy is acutally not needed: we get the key with each TX */
-        memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
-
-        memcpy(priv->stations[sta_id].sta.key.key, keyconf->key, 16);
-
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        return ret;
-}
-
-void iwl_update_tkip_key(struct iwl_priv *priv,
-                         struct iwl_rxon_context *ctx,
-                         struct ieee80211_key_conf *keyconf,
-                         struct ieee80211_sta *sta, u32 iv32, u16 *phase1key)
+void iwl_dealloc_bcast_stations(struct iwl_priv *priv)
 {
-        u8 sta_id;
         unsigned long flags;
         int i;
 
-        if (iwl_scan_cancel(priv)) {
-                /* cancel scan failed, just live w/ bad key and rely
-                   briefly on SW decryption */
-                return;
-        }
-
-        sta_id = iwl_sta_id_or_broadcast(priv, ctx, sta);
-        if (sta_id == IWL_INVALID_STATION)
-                return;
-
         spin_lock_irqsave(&priv->sta_lock, flags);
+        for (i = 0; i < priv->hw_params.max_stations; i++) {
+                if (!(priv->stations[i].used & IWL_STA_BCAST))
+                        continue;
 
-        priv->stations[sta_id].sta.key.tkip_rx_tsc_byte2 = (u8) iv32;
-
-        for (i = 0; i < 5; i++)
-                priv->stations[sta_id].sta.key.tkip_rx_ttak[i] =
-                        cpu_to_le16(phase1key[i]);
-
-        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
-        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
-
-        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
-
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-}
-EXPORT_SYMBOL(iwl_update_tkip_key);
-
-int iwl_remove_dynamic_key(struct iwl_priv *priv,
-                           struct iwl_rxon_context *ctx,
-                           struct ieee80211_key_conf *keyconf,
-                           u8 sta_id)
-{
-        unsigned long flags;
-        u16 key_flags;
-        u8 keyidx;
-        struct iwl_addsta_cmd sta_cmd;
-
-        lockdep_assert_held(&priv->mutex);
-
-        ctx->key_mapping_keys--;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        key_flags = le16_to_cpu(priv->stations[sta_id].sta.key.key_flags);
-        keyidx = (key_flags >> STA_KEY_FLG_KEYID_POS) & 0x3;
-
-        IWL_DEBUG_WEP(priv, "Remove dynamic key: idx=%d sta=%d\n",
-                      keyconf->keyidx, sta_id);
-
-        if (keyconf->keyidx != keyidx) {
-                /* We need to remove a key with index different that the one
-                 * in the uCode. This means that the key we need to remove has
-                 * been replaced by another one with different index.
-                 * Don't do anything and return ok
-                 */
-                spin_unlock_irqrestore(&priv->sta_lock, flags);
-                return 0;
-        }
-
-        if (priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET) {
-                IWL_WARN(priv, "Removing wrong key %d 0x%x\n",
-                            keyconf->keyidx, key_flags);
-                spin_unlock_irqrestore(&priv->sta_lock, flags);
-                return 0;
-        }
-
-        if (!test_and_clear_bit(priv->stations[sta_id].sta.key.key_offset,
-                &priv->ucode_key_table))
-                IWL_ERR(priv, "index %d not used in uCode key table.\n",
-                        priv->stations[sta_id].sta.key.key_offset);
-        memset(&priv->stations[sta_id].keyinfo, 0,
-                                        sizeof(struct iwl_hw_key));
-        memset(&priv->stations[sta_id].sta.key, 0,
-                                        sizeof(struct iwl4965_keyinfo));
-        priv->stations[sta_id].sta.key.key_flags =
-                        STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
-        priv->stations[sta_id].sta.key.key_offset = WEP_INVALID_OFFSET;
-        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
-        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
-
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_WEP(priv, "Not sending REPLY_ADD_STA command because RFKILL enabled.\n");
-                spin_unlock_irqrestore(&priv->sta_lock, flags);
-                return 0;
+                priv->stations[i].used &= ~IWL_STA_UCODE_ACTIVE;
+                priv->num_stations--;
+                BUG_ON(priv->num_stations < 0);
+                kfree(priv->stations[i].lq);
+                priv->stations[i].lq = NULL;
         }
-        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
-}
-EXPORT_SYMBOL(iwl_remove_dynamic_key);
-
-int iwl_set_dynamic_key(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
-                        struct ieee80211_key_conf *keyconf, u8 sta_id)
-{
-        int ret;
-
-        lockdep_assert_held(&priv->mutex);
-
-        ctx->key_mapping_keys++;
-        keyconf->hw_key_idx = HW_KEY_DYNAMIC;
-
-        switch (keyconf->cipher) {
-        case WLAN_CIPHER_SUITE_CCMP:
-                ret = iwl_set_ccmp_dynamic_key_info(priv, ctx, keyconf, sta_id);
-                break;
-        case WLAN_CIPHER_SUITE_TKIP:
-                ret = iwl_set_tkip_dynamic_key_info(priv, ctx, keyconf, sta_id);
-                break;
-        case WLAN_CIPHER_SUITE_WEP40:
-        case WLAN_CIPHER_SUITE_WEP104:
-                ret = iwl_set_wep_dynamic_key_info(priv, ctx, keyconf, sta_id);
-                break;
-        default:
-                IWL_ERR(priv,
-                        "Unknown alg: %s cipher = %x\n", __func__,
-                        keyconf->cipher);
-                ret = -EINVAL;
-        }
-
-        IWL_DEBUG_WEP(priv, "Set dynamic key: cipher=%x len=%d idx=%d sta=%d ret=%d\n",
-                      keyconf->cipher, keyconf->keylen, keyconf->keyidx,
-                      sta_id, ret);
-
-        return ret;
 }
-EXPORT_SYMBOL(iwl_set_dynamic_key);
+EXPORT_SYMBOL_GPL(iwl_dealloc_bcast_stations);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
 static void iwl_dump_lq_cmd(struct iwl_priv *priv,
@@ -1243,223 +758,6 @@ int iwl_send_lq_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
 }
 EXPORT_SYMBOL(iwl_send_lq_cmd);
 
-/**
- * iwl_alloc_bcast_station - add broadcast station into driver's station table.
- *
- * This adds the broadcast station into the driver's station table
- * and marks it driver active, so that it will be restored to the
- * device at the next best time.
- */
-int iwl_alloc_bcast_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
-                            bool init_lq)
-{
-        struct iwl_link_quality_cmd *link_cmd;
-        unsigned long flags;
-        u8 sta_id;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        sta_id = iwl_prep_station(priv, ctx, iwl_bcast_addr, false, NULL);
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_ERR(priv, "Unable to prepare broadcast station\n");
-                spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-                return -EINVAL;
-        }
-
-        priv->stations[sta_id].used |= IWL_STA_DRIVER_ACTIVE;
-        priv->stations[sta_id].used |= IWL_STA_BCAST;
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        if (init_lq) {
-                link_cmd = iwl_sta_alloc_lq(priv, sta_id);
-                if (!link_cmd) {
-                        IWL_ERR(priv,
-                                "Unable to initialize rate scaling for bcast station.\n");
-                        return -ENOMEM;
-                }
-
-                spin_lock_irqsave(&priv->sta_lock, flags);
-                priv->stations[sta_id].lq = link_cmd;
-                spin_unlock_irqrestore(&priv->sta_lock, flags);
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(iwl_alloc_bcast_station);
-
-/**
- * iwl_update_bcast_station - update broadcast station's LQ command
- *
- * Only used by iwlagn. Placed here to have all bcast station management
- * code together.
- */
-static int iwl_update_bcast_station(struct iwl_priv *priv,
-                                    struct iwl_rxon_context *ctx)
-{
-        unsigned long flags;
-        struct iwl_link_quality_cmd *link_cmd;
-        u8 sta_id = ctx->bcast_sta_id;
-
-        link_cmd = iwl_sta_alloc_lq(priv, sta_id);
-        if (!link_cmd) {
-                IWL_ERR(priv, "Unable to initialize rate scaling for bcast station.\n");
-                return -ENOMEM;
-        }
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        if (priv->stations[sta_id].lq)
-                kfree(priv->stations[sta_id].lq);
-        else
-                IWL_DEBUG_INFO(priv, "Bcast station rate scaling has not been initialized yet.\n");
-        priv->stations[sta_id].lq = link_cmd;
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        return 0;
-}
-
-int iwl_update_bcast_stations(struct iwl_priv *priv)
-{
-        struct iwl_rxon_context *ctx;
-        int ret = 0;
-
-        for_each_context(priv, ctx) {
-                ret = iwl_update_bcast_station(priv, ctx);
-                if (ret)
-                        break;
-        }
-
-        return ret;
-}
-EXPORT_SYMBOL_GPL(iwl_update_bcast_stations);
-
-void iwl_dealloc_bcast_stations(struct iwl_priv *priv)
-{
-        unsigned long flags;
-        int i;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        for (i = 0; i < priv->hw_params.max_stations; i++) {
-                if (!(priv->stations[i].used & IWL_STA_BCAST))
-                        continue;
-
-                priv->stations[i].used &= ~IWL_STA_UCODE_ACTIVE;
-                priv->num_stations--;
-                BUG_ON(priv->num_stations < 0);
-                kfree(priv->stations[i].lq);
-                priv->stations[i].lq = NULL;
-        }
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-}
-EXPORT_SYMBOL_GPL(iwl_dealloc_bcast_stations);
-
-/**
- * iwl_sta_tx_modify_enable_tid - Enable Tx for this TID in station table
- */
-int iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid)
-{
-        unsigned long flags;
-        struct iwl_addsta_cmd sta_cmd;
-
-        lockdep_assert_held(&priv->mutex);
-
-        /* Remove "disable" flag, to enable Tx for this TID */
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_TID_DISABLE_TX;
-        priv->stations[sta_id].sta.tid_disable_tx &= cpu_to_le16(~(1 << tid));
-        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
-        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
-}
-EXPORT_SYMBOL(iwl_sta_tx_modify_enable_tid);
-
-int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
-                         int tid, u16 ssn)
-{
-        unsigned long flags;
-        int sta_id;
-        struct iwl_addsta_cmd sta_cmd;
-
-        lockdep_assert_held(&priv->mutex);
-
-        sta_id = iwl_sta_id(sta);
-        if (sta_id == IWL_INVALID_STATION)
-                return -ENXIO;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->stations[sta_id].sta.station_flags_msk = 0;
-        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_ADDBA_TID_MSK;
-        priv->stations[sta_id].sta.add_immediate_ba_tid = (u8)tid;
-        priv->stations[sta_id].sta.add_immediate_ba_ssn = cpu_to_le16(ssn);
-        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
-        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
-}
-EXPORT_SYMBOL(iwl_sta_rx_agg_start);
-
-int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
-                        int tid)
-{
-        unsigned long flags;
-        int sta_id;
-        struct iwl_addsta_cmd sta_cmd;
-
-        lockdep_assert_held(&priv->mutex);
-
-        sta_id = iwl_sta_id(sta);
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_ERR(priv, "Invalid station for AGG tid %d\n", tid);
-                return -ENXIO;
-        }
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->stations[sta_id].sta.station_flags_msk = 0;
-        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_DELBA_TID_MSK;
-        priv->stations[sta_id].sta.remove_immediate_ba_tid = (u8)tid;
-        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
-        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
-}
-EXPORT_SYMBOL(iwl_sta_rx_agg_stop);
-
-void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->stations[sta_id].sta.station_flags &= ~STA_FLG_PWR_SAVE_MSK;
-        priv->stations[sta_id].sta.station_flags_msk = STA_FLG_PWR_SAVE_MSK;
-        priv->stations[sta_id].sta.sta.modify_mask = 0;
-        priv->stations[sta_id].sta.sleep_tx_count = 0;
-        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
-        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-}
-EXPORT_SYMBOL(iwl_sta_modify_ps_wake);
-
-void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->stations[sta_id].sta.station_flags |= STA_FLG_PWR_SAVE_MSK;
-        priv->stations[sta_id].sta.station_flags_msk = STA_FLG_PWR_SAVE_MSK;
-        priv->stations[sta_id].sta.sta.modify_mask =
-                                        STA_MODIFY_SLEEP_TX_COUNT_MSK;
-        priv->stations[sta_id].sta.sleep_tx_count = cpu_to_le16(cnt);
-        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
-        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-}
-EXPORT_SYMBOL(iwl_sta_modify_sleep_tx_count);
-
 int iwl_mac_sta_remove(struct ieee80211_hw *hw,
                        struct ieee80211_vif *vif,
                        struct ieee80211_sta *sta)
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.h b/drivers/net/wireless/iwlwifi/iwl-sta.h
index 56bad3f60d81..06475872eee4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.h
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.h
@@ -43,35 +43,13 @@
 #define IWL_STA_BCAST BIT(4) /* this station is the special bcast station */
 
 
-int iwl_remove_default_wep_key(struct iwl_priv *priv,
-                               struct iwl_rxon_context *ctx,
-                               struct ieee80211_key_conf *key);
-int iwl_set_default_wep_key(struct iwl_priv *priv,
-                            struct iwl_rxon_context *ctx,
-                            struct ieee80211_key_conf *key);
-int iwl_restore_default_wep_keys(struct iwl_priv *priv,
-                                 struct iwl_rxon_context *ctx);
-int iwl_set_dynamic_key(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
-                        struct ieee80211_key_conf *key, u8 sta_id);
-int iwl_remove_dynamic_key(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
-                           struct ieee80211_key_conf *key, u8 sta_id);
-void iwl_update_tkip_key(struct iwl_priv *priv,
-                         struct iwl_rxon_context *ctx,
-                         struct ieee80211_key_conf *keyconf,
-                         struct ieee80211_sta *sta, u32 iv32, u16 *phase1key);
-
 void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
 void iwl_clear_ucode_stations(struct iwl_priv *priv,
                               struct iwl_rxon_context *ctx);
-int iwl_alloc_bcast_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
-                            bool init_lq);
 void iwl_dealloc_bcast_stations(struct iwl_priv *priv);
-int iwl_update_bcast_stations(struct iwl_priv *priv);
 int iwl_get_free_ucode_key_index(struct iwl_priv *priv);
 int iwl_send_add_sta(struct iwl_priv *priv,
                      struct iwl_addsta_cmd *sta, u8 flags);
-int iwl_add_bssid_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
-                          const u8 *addr, bool init_rs, u8 *sta_id_r);
 int iwl_add_station_common(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
                            const u8 *addr, bool is_ap,
                            struct ieee80211_sta *sta, u8 *sta_id_r);
@@ -79,13 +57,12 @@ int iwl_remove_station(struct iwl_priv *priv, const u8 sta_id,
                        const u8 *addr);
 int iwl_mac_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct ieee80211_sta *sta);
-int iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid);
-int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
-                         int tid, u16 ssn);
-int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
-                        int tid);
-void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id);
-void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt);
+
+u8 iwl_prep_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                    const u8 *addr, bool is_ap, struct ieee80211_sta *sta);
+
+int iwl_send_lq_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                    struct iwl_link_quality_cmd *lq, u8 flags, bool init);
 
 /**
  * iwl_clear_driver_stations - clear knowledge of all stations from driver
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 347d3dc6a015..7261ee49f282 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -636,41 +636,3 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
         meta->flags = 0;
 }
 EXPORT_SYMBOL(iwl_tx_cmd_complete);
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-#define TX_STATUS_FAIL(x) case TX_STATUS_FAIL_ ## x: return #x
-#define TX_STATUS_POSTPONE(x) case TX_STATUS_POSTPONE_ ## x: return #x
-
-const char *iwl_get_tx_fail_reason(u32 status)
-{
-        switch (status & TX_STATUS_MSK) {
-        case TX_STATUS_SUCCESS:
-                return "SUCCESS";
-                TX_STATUS_POSTPONE(DELAY);
-                TX_STATUS_POSTPONE(FEW_BYTES);
-                TX_STATUS_POSTPONE(BT_PRIO);
-                TX_STATUS_POSTPONE(QUIET_PERIOD);
-                TX_STATUS_POSTPONE(CALC_TTAK);
-                TX_STATUS_FAIL(INTERNAL_CROSSED_RETRY);
-                TX_STATUS_FAIL(SHORT_LIMIT);
-                TX_STATUS_FAIL(LONG_LIMIT);
-                TX_STATUS_FAIL(FIFO_UNDERRUN);
-                TX_STATUS_FAIL(DRAIN_FLOW);
-                TX_STATUS_FAIL(RFKILL_FLUSH);
-                TX_STATUS_FAIL(LIFE_EXPIRE);
-                TX_STATUS_FAIL(DEST_PS);
-                TX_STATUS_FAIL(HOST_ABORTED);
-                TX_STATUS_FAIL(BT_RETRY);
-                TX_STATUS_FAIL(STA_INVALID);
-                TX_STATUS_FAIL(FRAG_DROPPED);
-                TX_STATUS_FAIL(TID_DISABLE);
-                TX_STATUS_FAIL(FIFO_FLUSHED);
-                TX_STATUS_FAIL(INSUFFICIENT_CF_POLL);
-                TX_STATUS_FAIL(FW_DROP);
-                TX_STATUS_FAIL(STA_COLOR_MISMATCH_DROP);
-        }
-
-        return "UNKNOWN";
-}
-EXPORT_SYMBOL(iwl_get_tx_fail_reason);
-#endif /* CONFIG_IWLWIFI_DEBUG */
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 68e624afb987..8f8c4b73f8b9 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -317,15 +317,15 @@ unsigned int iwl3945_fill_beacon_frame(struct iwl_priv *priv,
                                 int left)
 {
 
-        if (!iwl_is_associated(priv, IWL_RXON_CTX_BSS) || !priv->ibss_beacon)
+        if (!iwl_is_associated(priv, IWL_RXON_CTX_BSS) || !priv->beacon_skb)
                 return 0;
 
-        if (priv->ibss_beacon->len > left)
+        if (priv->beacon_skb->len > left)
                 return 0;
 
-        memcpy(hdr, priv->ibss_beacon->data, priv->ibss_beacon->len);
+        memcpy(hdr, priv->beacon_skb->data, priv->beacon_skb->len);
 
-        return priv->ibss_beacon->len;
+        return priv->beacon_skb->len;
 }
 
 static int iwl3945_send_beacon_cmd(struct iwl_priv *priv)
@@ -813,10 +813,10 @@ static void iwl3945_bg_beacon_update(struct work_struct *work)
 
         mutex_lock(&priv->mutex);
         /* new beacon skb is allocated every time; dispose previous.*/
-        if (priv->ibss_beacon)
-                dev_kfree_skb(priv->ibss_beacon);
+        if (priv->beacon_skb)
+                dev_kfree_skb(priv->beacon_skb);
 
-        priv->ibss_beacon = beacon;
+        priv->beacon_skb = beacon;
         mutex_unlock(&priv->mutex);
 
         iwl3945_send_beacon_cmd(priv);
@@ -1581,16 +1581,16 @@ int iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
         num_wraps = iwl_read_targ_mem(priv, base + (2 * sizeof(u32)));
         next_entry = iwl_read_targ_mem(priv, base + (3 * sizeof(u32)));
 
-        if (capacity > priv->cfg->max_event_log_size) {
+        if (capacity > priv->cfg->base_params->max_event_log_size) {
                 IWL_ERR(priv, "Log capacity %d is bogus, limit to %d entries\n",
-                        capacity, priv->cfg->max_event_log_size);
-                capacity = priv->cfg->max_event_log_size;
+                        capacity, priv->cfg->base_params->max_event_log_size);
+                capacity = priv->cfg->base_params->max_event_log_size;
         }
 
-        if (next_entry > priv->cfg->max_event_log_size) {
+        if (next_entry > priv->cfg->base_params->max_event_log_size) {
                 IWL_ERR(priv, "Log write index %d is bogus, limit to %d\n",
-                        next_entry, priv->cfg->max_event_log_size);
-                next_entry = priv->cfg->max_event_log_size;
+                        next_entry, priv->cfg->base_params->max_event_log_size);
+                next_entry = priv->cfg->base_params->max_event_log_size;
         }
 
         size = num_wraps ? capacity : next_entry;
@@ -1730,7 +1730,6 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
                 IWL_ERR(priv, "Microcode SW error detected. "
                         "Restarting 0x%X.\n", inta);
                 priv->isr_stats.sw++;
-                priv->isr_stats.sw_err = inta;
                 iwl_irq_handle_error(priv);
                 handled |= CSR_INT_BIT_SW_ERR;
         }
@@ -2520,7 +2519,8 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
                 /* Enable timer to monitor the driver queues */
                 mod_timer(&priv->monitor_recover,
                         jiffies +
-                        msecs_to_jiffies(priv->cfg->monitor_recover_period));
+                        msecs_to_jiffies(
+                          priv->cfg->base_params->monitor_recover_period));
         }
 
         if (iwl_is_rfkill(priv))
@@ -2547,7 +2547,7 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
         priv->cfg->ops->hcmd->send_bt_config(priv);
 
         /* Configure the adapter for unassociated operation */
-        iwlcore_commit_rxon(priv, ctx);
+        iwl3945_commit_rxon(priv, ctx);
 
         iwl3945_reg_txpower_periodic(priv);
 
@@ -2568,15 +2568,13 @@ static void iwl3945_cancel_deferred_work(struct iwl_priv *priv);
 static void __iwl3945_down(struct iwl_priv *priv)
 {
         unsigned long flags;
-        int exit_pending = test_bit(STATUS_EXIT_PENDING, &priv->status);
-        struct ieee80211_conf *conf = NULL;
+        int exit_pending;
 
         IWL_DEBUG_INFO(priv, DRV_NAME " is going down\n");
 
-        conf = ieee80211_get_hw_conf(priv->hw);
+        iwl_scan_cancel_timeout(priv, 200);
 
-        if (!exit_pending)
-                set_bit(STATUS_EXIT_PENDING, &priv->status);
+        exit_pending = test_and_set_bit(STATUS_EXIT_PENDING, &priv->status);
 
         /* Stop TX queues watchdog. We need to have STATUS_EXIT_PENDING bit set
          * to prevent rearm timer */
@@ -2639,14 +2637,14 @@ static void __iwl3945_down(struct iwl_priv *priv)
         udelay(5);
 
         /* Stop the device, and put it in low power state */
-        priv->cfg->ops->lib->apm_ops.stop(priv);
+        iwl_apm_stop(priv);
 
  exit:
         memset(&priv->card_alive, 0, sizeof(struct iwl_alive_resp));
 
-        if (priv->ibss_beacon)
-                dev_kfree_skb(priv->ibss_beacon);
-        priv->ibss_beacon = NULL;
+        if (priv->beacon_skb)
+                dev_kfree_skb(priv->beacon_skb);
+        priv->beacon_skb = NULL;
 
         /* clear out any free frames */
         iwl3945_clear_free_frames(priv);
@@ -2663,12 +2661,33 @@ static void iwl3945_down(struct iwl_priv *priv)
 
 #define MAX_HW_RESTARTS 5
 
+static int iwl3945_alloc_bcast_station(struct iwl_priv *priv)
+{
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+        unsigned long flags;
+        u8 sta_id;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        sta_id = iwl_prep_station(priv, ctx, iwl_bcast_addr, false, NULL);
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Unable to prepare broadcast station\n");
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+                return -EINVAL;
+        }
+
+        priv->stations[sta_id].used |= IWL_STA_DRIVER_ACTIVE;
+        priv->stations[sta_id].used |= IWL_STA_BCAST;
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return 0;
+}
+
 static int __iwl3945_up(struct iwl_priv *priv)
 {
         int rc, i;
 
-        rc = iwl_alloc_bcast_station(priv, &priv->contexts[IWL_RXON_CTX_BSS],
-                                     false);
+        rc = iwl3945_alloc_bcast_station(priv);
         if (rc)
                 return rc;
 
@@ -2820,7 +2839,7 @@ static void iwl3945_rfkill_poll(struct work_struct *data)
 
 }
 
-void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
+int iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SCAN_CMD,
@@ -2828,61 +2847,19 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                 .flags = CMD_SIZE_HUGE,
         };
         struct iwl3945_scan_cmd *scan;
-        struct ieee80211_conf *conf = NULL;
         u8 n_probes = 0;
         enum ieee80211_band band;
         bool is_active = false;
+        int ret;
 
-        conf = ieee80211_get_hw_conf(priv->hw);
-
-        cancel_delayed_work(&priv->scan_check);
-
-        if (!iwl_is_ready(priv)) {
-                IWL_WARN(priv, "request scan called when driver not ready.\n");
-                goto done;
-        }
-
-        /* Make sure the scan wasn't canceled before this queued work
-         * was given the chance to run... */
-        if (!test_bit(STATUS_SCANNING, &priv->status))
-                goto done;
-
-        /* This should never be called or scheduled if there is currently
-         * a scan active in the hardware. */
-        if (test_bit(STATUS_SCAN_HW, &priv->status)) {
-                IWL_DEBUG_INFO(priv, "Multiple concurrent scan requests  "
-                                "Ignoring second request.\n");
-                goto done;
-        }
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Aborting scan due to device shutdown\n");
-                goto done;
-        }
-
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_HC(priv,
-                        "Scan request while abort pending. Queuing.\n");
-                goto done;
-        }
-
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_HC(priv, "Aborting scan due to RF Kill activation\n");
-                goto done;
-        }
-
-        if (!test_bit(STATUS_READY, &priv->status)) {
-                IWL_DEBUG_HC(priv,
-                        "Scan request while uninitialized. Queuing.\n");
-                goto done;
-        }
+        lockdep_assert_held(&priv->mutex);
 
         if (!priv->scan_cmd) {
                 priv->scan_cmd = kmalloc(sizeof(struct iwl3945_scan_cmd) +
                                          IWL_MAX_SCAN_SIZE, GFP_KERNEL);
                 if (!priv->scan_cmd) {
                         IWL_DEBUG_SCAN(priv, "Fail to allocate scan memory\n");
-                        goto done;
+                        return -ENOMEM;
                 }
         }
         scan = priv->scan_cmd;
@@ -2961,25 +2938,25 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         case IEEE80211_BAND_2GHZ:
                 scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
                 scan->tx_cmd.rate = IWL_RATE_1M_PLCP;
-                scan->good_CRC_th = 0;
                 band = IEEE80211_BAND_2GHZ;
                 break;
         case IEEE80211_BAND_5GHZ:
                 scan->tx_cmd.rate = IWL_RATE_6M_PLCP;
-                /*
-                 * If active scaning is requested but a certain channel
-                 * is marked passive, we can do active scanning if we
-                 * detect transmissions.
-                 */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
-                                                IWL_GOOD_CRC_TH_DISABLED;
                 band = IEEE80211_BAND_5GHZ;
                 break;
         default:
                 IWL_WARN(priv, "Invalid scan band\n");
-                goto done;
+                return -EIO;
         }
 
+        /*
+         * If active scaning is requested but a certain channel
+         * is marked passive, we can do active scanning if we
+         * detect transmissions.
+         */
+        scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                        IWL_GOOD_CRC_TH_DISABLED;
+
         if (!priv->is_internal_short_scan) {
                 scan->tx_cmd.len = cpu_to_le16(
                         iwl_fill_probe_req(priv,
@@ -3012,7 +2989,7 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
         if (scan->channel_count == 0) {
                 IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
-                goto done;
+                return -EIO;
         }
 
         cmd.len += le16_to_cpu(scan->tx_cmd.len) +
@@ -3021,25 +2998,22 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         scan->len = cpu_to_le16(cmd.len);
 
         set_bit(STATUS_SCAN_HW, &priv->status);
-        if (iwl_send_cmd_sync(priv, &cmd))
-                goto done;
-
-        queue_delayed_work(priv->workqueue, &priv->scan_check,
-                           IWL_SCAN_CHECK_WATCHDOG);
+        ret = iwl_send_cmd_sync(priv, &cmd);
+        if (ret)
+                clear_bit(STATUS_SCAN_HW, &priv->status);
+        return ret;
+}
 
-        return;
+void iwl3945_post_scan(struct iwl_priv *priv)
+{
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
- done:
-        /* can not perform scan make sure we clear scanning
-         * bits from status so next scan request can be performed.
-         * if we dont clear scanning status bit here all next scan
-         * will fail
-        */
-        clear_bit(STATUS_SCAN_HW, &priv->status);
-        clear_bit(STATUS_SCANNING, &priv->status);
-
-        /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
+        /*
+         * Since setting the RXON may have been deferred while
+         * performing the scan, fire one off if needed
+         */
+        if (memcmp(&ctx->staging, &ctx->active, sizeof(ctx->staging)))
+                iwl3945_commit_rxon(priv, ctx);
 }
 
 static void iwl3945_bg_restart(struct work_struct *data)
@@ -3108,7 +3082,7 @@ void iwl3945_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
         conf = ieee80211_get_hw_conf(priv->hw);
 
         ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        iwlcore_commit_rxon(priv, ctx);
+        iwl3945_commit_rxon(priv, ctx);
 
         rc = iwl_send_rxon_timing(priv, ctx);
         if (rc)
@@ -3134,7 +3108,7 @@ void iwl3945_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
                         ctx->staging.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
         }
 
-        iwlcore_commit_rxon(priv, ctx);
+        iwl3945_commit_rxon(priv, ctx);
 
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
@@ -3233,15 +3207,6 @@ static void iwl3945_mac_stop(struct ieee80211_hw *hw)
 
         priv->is_open = 0;
 
-        if (iwl_is_ready_rf(priv)) {
-                /* stop mac, cancel any scan request and clear
-                 * RXON_FILTER_ASSOC_MSK BIT
-                 */
-                mutex_lock(&priv->mutex);
-                iwl_scan_cancel_timeout(priv, 100);
-                mutex_unlock(&priv->mutex);
-        }
-
         iwl3945_down(priv);
 
         flush_workqueue(priv->workqueue);
@@ -3282,7 +3247,7 @@ void iwl3945_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
                 /* RXON - unassoc (to set timing command) */
                 ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwlcore_commit_rxon(priv, ctx);
+                iwl3945_commit_rxon(priv, ctx);
 
                 /* RXON Timing */
                 rc = iwl_send_rxon_timing(priv, ctx);
@@ -3309,7 +3274,7 @@ void iwl3945_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
                 }
                 /* restore RXON assoc */
                 ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
-                iwlcore_commit_rxon(priv, ctx);
+                iwl3945_commit_rxon(priv, ctx);
         }
         iwl3945_send_beacon_cmd(priv);
 
@@ -3575,7 +3540,7 @@ static ssize_t store_flags(struct device *d,
                         IWL_DEBUG_INFO(priv, "Committing rxon.flags = 0x%04X\n",
                                        flags);
                         ctx->staging.flags = cpu_to_le32(flags);
-                        iwlcore_commit_rxon(priv, ctx);
+                        iwl3945_commit_rxon(priv, ctx);
                 }
         }
         mutex_unlock(&priv->mutex);
@@ -3613,7 +3578,7 @@ static ssize_t store_filter_flags(struct device *d,
                                        "0x%04X\n", filter_flags);
                         ctx->staging.filter_flags =
                                 cpu_to_le32(filter_flags);
-                        iwlcore_commit_rxon(priv, ctx);
+                        iwl3945_commit_rxon(priv, ctx);
                 }
         }
         mutex_unlock(&priv->mutex);
@@ -3831,10 +3796,10 @@ static void iwl3945_cancel_deferred_work(struct iwl_priv *priv)
         iwl3945_hw_cancel_deferred_work(priv);
 
         cancel_delayed_work_sync(&priv->init_alive_start);
-        cancel_delayed_work(&priv->scan_check);
         cancel_delayed_work(&priv->alive_start);
-        cancel_work_sync(&priv->start_internal_scan);
         cancel_work_sync(&priv->beacon_update);
+
+        iwl_cancel_scan_deferred_work(priv);
 }
 
 static struct attribute *iwl3945_sysfs_entries[] = {
@@ -3883,7 +3848,7 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         struct iwl3945_eeprom *eeprom = (struct iwl3945_eeprom *)priv->eeprom;
 
         priv->retry_rate = 1;
-        priv->ibss_beacon = NULL;
+        priv->beacon_skb = NULL;
 
         spin_lock_init(&priv->sta_lock);
         spin_lock_init(&priv->hcmd_lock);
@@ -3950,7 +3915,7 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
                     IEEE80211_HW_SPECTRUM_MGMT;
 
-        if (!priv->cfg->broken_powersave)
+        if (!priv->cfg->base_params->broken_powersave)
                 hw->flags |= IEEE80211_HW_SUPPORTS_PS |
                              IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
 
@@ -4035,7 +4000,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
          * "the hard way", rather than using device's scan.
          */
         if (iwl3945_mod_params.disable_hw_scan) {
-                IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
+                IWL_ERR(priv, "sw scan support is deprecated\n");
                 iwl3945_hw_ops.hw_scan = NULL;
         }
 
@@ -4247,7 +4212,7 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
          * paths to avoid running iwl_down() at all before leaving driver.
          * This (inexpensive) call *makes sure* device is reset.
          */
-        priv->cfg->ops->lib->apm_ops.stop(priv);
+        iwl_apm_stop(priv);
 
         /* make sure we flush any pending irq or
          * tasklet for the driver
@@ -4291,8 +4256,8 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
         iwl_free_channel_map(priv);
         iwlcore_free_geos(priv);
         kfree(priv->scan_cmd);
-        if (priv->ibss_beacon)
-                dev_kfree_skb(priv->ibss_beacon);
+        if (priv->beacon_skb)
+                dev_kfree_skb(priv->beacon_skb);
 
         ieee80211_free_hw(priv->hw);
 }
@@ -4360,7 +4325,8 @@ MODULE_PARM_DESC(debug, "debug output mask");
 #endif
 module_param_named(disable_hw_scan, iwl3945_mod_params.disable_hw_scan,
                    int, S_IRUGO);
-MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 0)");
+MODULE_PARM_DESC(disable_hw_scan,
+                 "disable hardware scanning (default 0) (deprecated)");
 module_param_named(fw_restart3945, iwl3945_mod_params.restart_fw, int, S_IRUGO);
 MODULE_PARM_DESC(fw_restart3945, "restart firmware in case of error");
 
diff --git a/drivers/net/wireless/iwmc3200wifi/cfg80211.c b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
index 60619678f4ec..c6c0eff9b5ed 100644
--- a/drivers/net/wireless/iwmc3200wifi/cfg80211.c
+++ b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
@@ -161,7 +161,7 @@ static int iwm_key_init(struct iwm_key *key, u8 key_index,
 }
 
 static int iwm_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
-                                u8 key_index, const u8 *mac_addr,
+                                u8 key_index, bool pairwise, const u8 *mac_addr,
                                 struct key_params *params)
 {
         struct iwm_priv *iwm = ndev_to_iwm(ndev);
@@ -181,7 +181,8 @@ static int iwm_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
 }
 
 static int iwm_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
-                                u8 key_index, const u8 *mac_addr, void *cookie,
+                                u8 key_index, bool pairwise, const u8 *mac_addr,
+                                void *cookie,
                                 void (*callback)(void *cookie,
                                                  struct key_params*))
 {
@@ -206,7 +207,7 @@ static int iwm_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
 
 
 static int iwm_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
-                                u8 key_index, const u8 *mac_addr)
+                                u8 key_index, bool pairwise, const u8 *mac_addr)
 {
         struct iwm_priv *iwm = ndev_to_iwm(ndev);
         struct iwm_key *key = &iwm->keys[key_index];
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 317f086ced0a..5046a0005034 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -481,7 +481,6 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
         struct cmd_ds_802_11_scan_rsp *scanresp = (void *)resp;
         int bsssize;
         const u8 *pos;
-        u16 nr_sets;
         const u8 *tsfdesc;
         int tsfsize;
         int i;
@@ -490,12 +489,11 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
         lbs_deb_enter(LBS_DEB_CFG80211);
 
         bsssize = get_unaligned_le16(&scanresp->bssdescriptsize);
-        nr_sets = le16_to_cpu(scanresp->nr_sets);
 
         lbs_deb_scan("scan response: %d BSSs (%d bytes); resp size %d bytes\n",
-                        nr_sets, bsssize, le16_to_cpu(resp->size));
+                        scanresp->nr_sets, bsssize, le16_to_cpu(resp->size));
 
-        if (nr_sets == 0) {
+        if (scanresp->nr_sets == 0) {
                 ret = 0;
                 goto done;
         }
@@ -1442,7 +1440,7 @@ static int lbs_cfg_set_default_key(struct wiphy *wiphy,
 
 
 static int lbs_cfg_add_key(struct wiphy *wiphy, struct net_device *netdev,
-                           u8 idx, const u8 *mac_addr,
+                           u8 idx, bool pairwise, const u8 *mac_addr,
                            struct key_params *params)
 {
         struct lbs_private *priv = wiphy_priv(wiphy);
@@ -1502,7 +1500,7 @@ static int lbs_cfg_add_key(struct wiphy *wiphy, struct net_device *netdev,
 
 
 static int lbs_cfg_del_key(struct wiphy *wiphy, struct net_device *netdev,
-                           u8 key_index, const u8 *mac_addr)
+                           u8 key_index, bool pairwise, const u8 *mac_addr)
 {
 
         lbs_deb_enter(LBS_DEB_CFG80211);
diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
index e906616232a2..efaf85032208 100644
--- a/drivers/net/wireless/libertas/if_usb.c
+++ b/drivers/net/wireless/libertas/if_usb.c
@@ -487,11 +487,12 @@ static int if_usb_reset_device(struct if_usb_card *cardp)
  */
 static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb)
 {
-        int ret = -1;
+        int ret;
 
         /* check if device is removed */
         if (cardp->surprise_removed) {
                 lbs_deb_usbd(&cardp->udev->dev, "Device removed\n");
+                ret = -ENODEV;
                 goto tx_ret;
         }
 
@@ -504,7 +505,6 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb
 
         if ((ret = usb_submit_urb(cardp->tx_urb, GFP_ATOMIC))) {
                 lbs_deb_usbd(&cardp->udev->dev, "usb_submit_urb failed: %d\n", ret);
-                ret = -1;
         } else {
                 lbs_deb_usb2(&cardp->udev->dev, "usb_submit_urb success\n");
                 ret = 0;
diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c
index 194762ab0142..acf3bf63ee33 100644
--- a/drivers/net/wireless/libertas/mesh.c
+++ b/drivers/net/wireless/libertas/mesh.c
@@ -574,7 +574,7 @@ int lbs_mesh_bt_set_inverted(struct lbs_private *priv, bool inverted)
         memset(&cmd, 0, sizeof(cmd));
         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
         cmd.action = cpu_to_le16(CMD_ACT_BT_ACCESS_SET_INVERT);
-        cmd.id = !!inverted;
+        cmd.id = cpu_to_le32(!!inverted);
 
         ret = lbs_cmd_with_response(priv, CMD_BT_ACCESS, &cmd);
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 92b486d46eb9..7eaaa3bab547 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -595,7 +595,8 @@ static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
                                         struct ieee80211_vif *vif)
 {
         wiphy_debug(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
-                    __func__, vif->type, vif->addr);
+                    __func__, ieee80211_vif_type_p2p(vif),
+                    vif->addr);
         hwsim_set_magic(vif);
         return 0;
 }
@@ -603,11 +604,14 @@ static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
 
 static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,
                                            struct ieee80211_vif *vif,
-                                           enum nl80211_iftype newtype)
+                                           enum nl80211_iftype newtype,
+                                           bool newp2p)
 {
+        newtype = ieee80211_iftype_p2p(newtype, newp2p);
         wiphy_debug(hw->wiphy,
                     "%s (old type=%d, new type=%d, mac_addr=%pM)\n",
-                    __func__, vif->type, newtype, vif->addr);
+                    __func__, ieee80211_vif_type_p2p(vif),
+                    newtype, vif->addr);
         hwsim_check_magic(vif);
 
         return 0;
@@ -617,7 +621,8 @@ static void mac80211_hwsim_remove_interface(
         struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
         wiphy_debug(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
-                    __func__, vif->type, vif->addr);
+                    __func__, ieee80211_vif_type_p2p(vif),
+                    vif->addr);
         hwsim_check_magic(vif);
         hwsim_clear_magic(vif);
 }
@@ -1310,6 +1315,8 @@ static int __init init_mac80211_hwsim(void)
                 hw->wiphy->interface_modes =
                         BIT(NL80211_IFTYPE_STATION) |
                         BIT(NL80211_IFTYPE_AP) |
+                        BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                        BIT(NL80211_IFTYPE_P2P_GO) |
                         BIT(NL80211_IFTYPE_ADHOC) |
                         BIT(NL80211_IFTYPE_MESH_POINT);
 
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
index 8c05266d37f4..35b09aa0529b 100644
--- a/drivers/net/wireless/p54/eeprom.c
+++ b/drivers/net/wireless/p54/eeprom.c
@@ -261,8 +261,10 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
         list->max_entries = max_channel_num;
         list->channels = kzalloc(sizeof(struct p54_channel_entry) *
                                  max_channel_num, GFP_KERNEL);
-        if (!list->channels)
+        if (!list->channels) {
+                ret = -ENOMEM;
                 goto free;
+        }
 
         for (i = 0; i < max_channel_num; i++) {
                 if (i < priv->iq_autocal_len) {
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 156e57dbd2cf..18d24b7b1e34 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -202,6 +202,8 @@ static int p54spi_request_eeprom(struct ieee80211_hw *dev)
                 dev_info(&priv->spi->dev, "loading default eeprom...\n");
                 ret = p54_parse_eeprom(dev, (void *) p54spi_eeprom,
                                        sizeof(p54spi_eeprom));
+#else
+                dev_err(&priv->spi->dev, "Failed to request user eeprom\n");
 #endif /* CONFIG_P54_SPI_DEFAULT_EEPROM */
         } else {
                 dev_info(&priv->spi->dev, "loading user eeprom...\n");
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 063248b35069..d5bc21e5a02c 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -33,8 +33,17 @@ MODULE_ALIAS("prism54usb");
 MODULE_FIRMWARE("isl3886usb");
 MODULE_FIRMWARE("isl3887usb");
 
+/*
+ * Note:
+ *
+ * Always update our wiki's device list (located at:
+ * http://wireless.kernel.org/en/users/Drivers/p54/devices ),
+ * whenever you add a new device.
+ */
+
 static struct usb_device_id p54u_table[] __devinitdata = {
         /* Version 1 devices (pci chip + net2280) */
+        {USB_DEVICE(0x045e, 0x00c2)},   /* Microsoft MN-710 */
         {USB_DEVICE(0x0506, 0x0a11)},   /* 3COM 3CRWE254G72 */
         {USB_DEVICE(0x06b9, 0x0120)},   /* Thomson SpeedTouch 120g */
         {USB_DEVICE(0x0707, 0xee06)},   /* SMC 2862W-G */
@@ -47,7 +56,9 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x0846, 0x4220)},   /* Netgear WG111 */
         {USB_DEVICE(0x09aa, 0x1000)},   /* Spinnaker Proto board */
         {USB_DEVICE(0x0cde, 0x0006)},   /* Medion 40900, Roper Europe */
+        {USB_DEVICE(0x107b, 0x55f2)},   /* Gateway WGU-210 (Gemtek) */
         {USB_DEVICE(0x124a, 0x4023)},   /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */
+        {USB_DEVICE(0x1630, 0x0005)},   /* 2Wire 802.11g USB (v1) / Z-Com */
         {USB_DEVICE(0x1915, 0x2234)},   /* Linksys WUSB54G OEM */
         {USB_DEVICE(0x1915, 0x2235)},   /* Linksys WUSB54G Portable OEM */
         {USB_DEVICE(0x2001, 0x3701)},   /* DLink DWL-G120 Spinnaker */
@@ -60,6 +71,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x050d, 0x7050)},   /* Belkin F5D7050 ver 1000 */
         {USB_DEVICE(0x0572, 0x2000)},   /* Cohiba Proto board */
         {USB_DEVICE(0x0572, 0x2002)},   /* Cohiba Proto board */
+        {USB_DEVICE(0x06a9, 0x000e)},   /* Westell 802.11g USB (A90-211WG-01) */
         {USB_DEVICE(0x06b9, 0x0121)},   /* Thomson SpeedTouch 121g */
         {USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
         {USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
@@ -80,6 +92,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x13B1, 0x000C)},   /* Linksys WUSB54AG */
         {USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
         {USB_DEVICE(0x1435, 0x0427)},   /* Inventel UR054G */
+        {USB_DEVICE(0x1668, 0x1050)},   /* Actiontec 802UIG-1 */
         {USB_DEVICE(0x2001, 0x3704)},   /* DLink DWL-G122 rev A2 */
         {USB_DEVICE(0x413c, 0x5513)},   /* Dell WLA3310 USB Wireless Adapter */
         {USB_DEVICE(0x413c, 0x8102)},   /* Spinnaker DUT */
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index d91a831a7700..5ca624a64c42 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -194,7 +194,7 @@ module_param(bc, int, 0);
 module_param(phy_addr, charp, 0);
 module_param(ray_mem_speed, int, 0);
 
-static UCHAR b5_default_startup_parms[] = {
+static const UCHAR b5_default_startup_parms[] = {
         0, 0,                   /* Adhoc station */
         'L', 'I', 'N', 'U', 'X', 0, 0, 0,       /* 32 char ESSID */
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -229,7 +229,7 @@ static UCHAR b5_default_startup_parms[] = {
         2, 0, 0, 0, 0, 0, 0, 0  /* basic rate set */
 };
 
-static UCHAR b4_default_startup_parms[] = {
+static const UCHAR b4_default_startup_parms[] = {
         0, 0,                   /* Adhoc station */
         'L', 'I', 'N', 'U', 'X', 0, 0, 0,       /* 32 char ESSID */
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -261,9 +261,9 @@ static UCHAR b4_default_startup_parms[] = {
 };
 
 /*===========================================================================*/
-static unsigned char eth2_llc[] = { 0xaa, 0xaa, 3, 0, 0, 0 };
+static const u8 eth2_llc[] = { 0xaa, 0xaa, 3, 0, 0, 0 };
 
-static char hop_pattern_length[] = { 1,
+static const char hop_pattern_length[] = { 1,
         USA_HOP_MOD, EUROPE_HOP_MOD,
         JAPAN_HOP_MOD, KOREA_HOP_MOD,
         SPAIN_HOP_MOD, FRANCE_HOP_MOD,
@@ -271,7 +271,7 @@ static char hop_pattern_length[] = { 1,
         JAPAN_TEST_HOP_MOD
 };
 
-static char rcsid[] =
+static const char rcsid[] =
     "Raylink/WebGear wireless LAN - Corey <Thomas corey@world.std.com>";
 
 static const struct net_device_ops ray_netdev_ops = {
@@ -2575,7 +2575,7 @@ static void clear_interrupt(ray_dev_t *local)
 #ifdef CONFIG_PROC_FS
 #define MAXDATA (PAGE_SIZE - 80)
 
-static char *card_status[] = {
+static const char *card_status[] = {
         "Card inserted - uninitialized",        /* 0 */
         "Card not downloaded",                  /* 1 */
         "Waiting for download parameters",      /* 2 */
@@ -2592,8 +2592,8 @@ static char *card_status[] = {
         "Association failed"                    /* 16 */
 };
 
-static char *nettype[] = { "Adhoc", "Infra " };
-static char *framing[] = { "Encapsulation", "Translation" }
+static const char *nettype[] = { "Adhoc", "Infra " };
+static const char *framing[] = { "Encapsulation", "Translation" }
 
 ;
 /*===========================================================================*/
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 719573bbbf81..71b5971da597 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -540,11 +540,11 @@ static int rndis_set_channel(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_channel *chan, enum nl80211_channel_type channel_type);
 
 static int rndis_add_key(struct wiphy *wiphy, struct net_device *netdev,
-                                        u8 key_index, const u8 *mac_addr,
-                                        struct key_params *params);
+                         u8 key_index, bool pairwise, const u8 *mac_addr,
+                         struct key_params *params);
 
 static int rndis_del_key(struct wiphy *wiphy, struct net_device *netdev,
-                                        u8 key_index, const u8 *mac_addr);
+                         u8 key_index, bool pairwise, const u8 *mac_addr);
 
 static int rndis_set_default_key(struct wiphy *wiphy, struct net_device *netdev,
                                                                 u8 key_index);
@@ -2308,8 +2308,8 @@ static int rndis_set_channel(struct wiphy *wiphy, struct net_device *netdev,
 }
 
 static int rndis_add_key(struct wiphy *wiphy, struct net_device *netdev,
-                                        u8 key_index, const u8 *mac_addr,
-                                        struct key_params *params)
+                         u8 key_index, bool pairwise, const u8 *mac_addr,
+                         struct key_params *params)
 {
         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
         struct usbnet *usbdev = priv->usbdev;
@@ -2344,7 +2344,7 @@ static int rndis_add_key(struct wiphy *wiphy, struct net_device *netdev,
 }
 
 static int rndis_del_key(struct wiphy *wiphy, struct net_device *netdev,
-                                        u8 key_index, const u8 *mac_addr)
+                         u8 key_index, bool pairwise, const u8 *mac_addr)
 {
         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
         struct usbnet *usbdev = priv->usbdev;
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 103c71164f10..4f420a9ec5dc 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -321,7 +321,8 @@ static void rt2400pci_config_intf(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt2400pci_config_erp(struct rt2x00_dev *rt2x00dev,
-                                 struct rt2x00lib_erp *erp)
+                                 struct rt2x00lib_erp *erp,
+                                 u32 changed)
 {
         int preamble_mask;
         u32 reg;
@@ -329,59 +330,72 @@ static void rt2400pci_config_erp(struct rt2x00_dev *rt2x00dev,
         /*
          * When short preamble is enabled, we should set bit 0x08
          */
-        preamble_mask = erp->short_preamble << 3;
-
-        rt2x00pci_register_read(rt2x00dev, TXCSR1, &reg);
-        rt2x00_set_field32(&reg, TXCSR1_ACK_TIMEOUT, 0x1ff);
-        rt2x00_set_field32(&reg, TXCSR1_ACK_CONSUME_TIME, 0x13a);
-        rt2x00_set_field32(&reg, TXCSR1_TSF_OFFSET, IEEE80211_HEADER);
-        rt2x00_set_field32(&reg, TXCSR1_AUTORESPONDER, 1);
-        rt2x00pci_register_write(rt2x00dev, TXCSR1, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR2, &reg);
-        rt2x00_set_field32(&reg, ARCSR2_SIGNAL, 0x00);
-        rt2x00_set_field32(&reg, ARCSR2_SERVICE, 0x04);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 10));
-        rt2x00pci_register_write(rt2x00dev, ARCSR2, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR3, &reg);
-        rt2x00_set_field32(&reg, ARCSR3_SIGNAL, 0x01 | preamble_mask);
-        rt2x00_set_field32(&reg, ARCSR3_SERVICE, 0x04);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 20));
-        rt2x00pci_register_write(rt2x00dev, ARCSR3, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR4, &reg);
-        rt2x00_set_field32(&reg, ARCSR4_SIGNAL, 0x02 | preamble_mask);
-        rt2x00_set_field32(&reg, ARCSR4_SERVICE, 0x04);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 55));
-        rt2x00pci_register_write(rt2x00dev, ARCSR4, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR5, &reg);
-        rt2x00_set_field32(&reg, ARCSR5_SIGNAL, 0x03 | preamble_mask);
-        rt2x00_set_field32(&reg, ARCSR5_SERVICE, 0x84);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 110));
-        rt2x00pci_register_write(rt2x00dev, ARCSR5, reg);
-
-        rt2x00pci_register_write(rt2x00dev, ARCSR1, erp->basic_rates);
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                preamble_mask = erp->short_preamble << 3;
+
+                rt2x00pci_register_read(rt2x00dev, TXCSR1, &reg);
+                rt2x00_set_field32(&reg, TXCSR1_ACK_TIMEOUT, 0x1ff);
+                rt2x00_set_field32(&reg, TXCSR1_ACK_CONSUME_TIME, 0x13a);
+                rt2x00_set_field32(&reg, TXCSR1_TSF_OFFSET, IEEE80211_HEADER);
+                rt2x00_set_field32(&reg, TXCSR1_AUTORESPONDER, 1);
+                rt2x00pci_register_write(rt2x00dev, TXCSR1, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR2, &reg);
+                rt2x00_set_field32(&reg, ARCSR2_SIGNAL, 0x00);
+                rt2x00_set_field32(&reg, ARCSR2_SERVICE, 0x04);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 10));
+                rt2x00pci_register_write(rt2x00dev, ARCSR2, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR3, &reg);
+                rt2x00_set_field32(&reg, ARCSR3_SIGNAL, 0x01 | preamble_mask);
+                rt2x00_set_field32(&reg, ARCSR3_SERVICE, 0x04);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 20));
+                rt2x00pci_register_write(rt2x00dev, ARCSR3, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR4, &reg);
+                rt2x00_set_field32(&reg, ARCSR4_SIGNAL, 0x02 | preamble_mask);
+                rt2x00_set_field32(&reg, ARCSR4_SERVICE, 0x04);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 55));
+                rt2x00pci_register_write(rt2x00dev, ARCSR4, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR5, &reg);
+                rt2x00_set_field32(&reg, ARCSR5_SIGNAL, 0x03 | preamble_mask);
+                rt2x00_set_field32(&reg, ARCSR5_SERVICE, 0x84);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 110));
+                rt2x00pci_register_write(rt2x00dev, ARCSR5, reg);
+        }
 
-        rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
-        rt2x00_set_field32(&reg, CSR11_SLOT_TIME, erp->slot_time);
-        rt2x00pci_register_write(rt2x00dev, CSR11, reg);
+        if (changed & BSS_CHANGED_BASIC_RATES)
+                rt2x00pci_register_write(rt2x00dev, ARCSR1, erp->basic_rates);
 
-        rt2x00pci_register_read(rt2x00dev, CSR12, &reg);
-        rt2x00_set_field32(&reg, CSR12_BEACON_INTERVAL, erp->beacon_int * 16);
-        rt2x00_set_field32(&reg, CSR12_CFP_MAX_DURATION, erp->beacon_int * 16);
-        rt2x00pci_register_write(rt2x00dev, CSR12, reg);
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
+                rt2x00_set_field32(&reg, CSR11_SLOT_TIME, erp->slot_time);
+                rt2x00pci_register_write(rt2x00dev, CSR11, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR18, &reg);
-        rt2x00_set_field32(&reg, CSR18_SIFS, erp->sifs);
-        rt2x00_set_field32(&reg, CSR18_PIFS, erp->pifs);
-        rt2x00pci_register_write(rt2x00dev, CSR18, reg);
+                rt2x00pci_register_read(rt2x00dev, CSR18, &reg);
+                rt2x00_set_field32(&reg, CSR18_SIFS, erp->sifs);
+                rt2x00_set_field32(&reg, CSR18_PIFS, erp->pifs);
+                rt2x00pci_register_write(rt2x00dev, CSR18, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR19, &reg);
-        rt2x00_set_field32(&reg, CSR19_DIFS, erp->difs);
-        rt2x00_set_field32(&reg, CSR19_EIFS, erp->eifs);
-        rt2x00pci_register_write(rt2x00dev, CSR19, reg);
+                rt2x00pci_register_read(rt2x00dev, CSR19, &reg);
+                rt2x00_set_field32(&reg, CSR19_DIFS, erp->difs);
+                rt2x00_set_field32(&reg, CSR19_EIFS, erp->eifs);
+                rt2x00pci_register_write(rt2x00dev, CSR19, reg);
+        }
+
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                rt2x00pci_register_read(rt2x00dev, CSR12, &reg);
+                rt2x00_set_field32(&reg, CSR12_BEACON_INTERVAL,
+                                   erp->beacon_int * 16);
+                rt2x00_set_field32(&reg, CSR12_CFP_MAX_DURATION,
+                                   erp->beacon_int * 16);
+                rt2x00pci_register_write(rt2x00dev, CSR12, reg);
+        }
 }
 
 static void rt2400pci_config_ant(struct rt2x00_dev *rt2x00dev,
@@ -1090,7 +1104,7 @@ static void rt2400pci_write_beacon(struct queue_entry *entry,
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 
-        rt2x00queue_map_txskb(rt2x00dev, entry->skb);
+        rt2x00queue_map_txskb(entry);
 
         /*
          * Write the TX descriptor for the beacon.
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index ab0507110e42..97feb7aef809 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -327,7 +327,8 @@ static void rt2500pci_config_intf(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt2500pci_config_erp(struct rt2x00_dev *rt2x00dev,
-                                 struct rt2x00lib_erp *erp)
+                                 struct rt2x00lib_erp *erp,
+                                 u32 changed)
 {
         int preamble_mask;
         u32 reg;
@@ -335,59 +336,73 @@ static void rt2500pci_config_erp(struct rt2x00_dev *rt2x00dev,
         /*
          * When short preamble is enabled, we should set bit 0x08
          */
-        preamble_mask = erp->short_preamble << 3;
-
-        rt2x00pci_register_read(rt2x00dev, TXCSR1, &reg);
-        rt2x00_set_field32(&reg, TXCSR1_ACK_TIMEOUT, 0x162);
-        rt2x00_set_field32(&reg, TXCSR1_ACK_CONSUME_TIME, 0xa2);
-        rt2x00_set_field32(&reg, TXCSR1_TSF_OFFSET, IEEE80211_HEADER);
-        rt2x00_set_field32(&reg, TXCSR1_AUTORESPONDER, 1);
-        rt2x00pci_register_write(rt2x00dev, TXCSR1, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR2, &reg);
-        rt2x00_set_field32(&reg, ARCSR2_SIGNAL, 0x00);
-        rt2x00_set_field32(&reg, ARCSR2_SERVICE, 0x04);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 10));
-        rt2x00pci_register_write(rt2x00dev, ARCSR2, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR3, &reg);
-        rt2x00_set_field32(&reg, ARCSR3_SIGNAL, 0x01 | preamble_mask);
-        rt2x00_set_field32(&reg, ARCSR3_SERVICE, 0x04);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 20));
-        rt2x00pci_register_write(rt2x00dev, ARCSR3, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR4, &reg);
-        rt2x00_set_field32(&reg, ARCSR4_SIGNAL, 0x02 | preamble_mask);
-        rt2x00_set_field32(&reg, ARCSR4_SERVICE, 0x04);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 55));
-        rt2x00pci_register_write(rt2x00dev, ARCSR4, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR5, &reg);
-        rt2x00_set_field32(&reg, ARCSR5_SIGNAL, 0x03 | preamble_mask);
-        rt2x00_set_field32(&reg, ARCSR5_SERVICE, 0x84);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 110));
-        rt2x00pci_register_write(rt2x00dev, ARCSR5, reg);
-
-        rt2x00pci_register_write(rt2x00dev, ARCSR1, erp->basic_rates);
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                preamble_mask = erp->short_preamble << 3;
+
+                rt2x00pci_register_read(rt2x00dev, TXCSR1, &reg);
+                rt2x00_set_field32(&reg, TXCSR1_ACK_TIMEOUT, 0x162);
+                rt2x00_set_field32(&reg, TXCSR1_ACK_CONSUME_TIME, 0xa2);
+                rt2x00_set_field32(&reg, TXCSR1_TSF_OFFSET, IEEE80211_HEADER);
+                rt2x00_set_field32(&reg, TXCSR1_AUTORESPONDER, 1);
+                rt2x00pci_register_write(rt2x00dev, TXCSR1, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR2, &reg);
+                rt2x00_set_field32(&reg, ARCSR2_SIGNAL, 0x00);
+                rt2x00_set_field32(&reg, ARCSR2_SERVICE, 0x04);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 10));
+                rt2x00pci_register_write(rt2x00dev, ARCSR2, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR3, &reg);
+                rt2x00_set_field32(&reg, ARCSR3_SIGNAL, 0x01 | preamble_mask);
+                rt2x00_set_field32(&reg, ARCSR3_SERVICE, 0x04);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 20));
+                rt2x00pci_register_write(rt2x00dev, ARCSR3, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR4, &reg);
+                rt2x00_set_field32(&reg, ARCSR4_SIGNAL, 0x02 | preamble_mask);
+                rt2x00_set_field32(&reg, ARCSR4_SERVICE, 0x04);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 55));
+                rt2x00pci_register_write(rt2x00dev, ARCSR4, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR5, &reg);
+                rt2x00_set_field32(&reg, ARCSR5_SIGNAL, 0x03 | preamble_mask);
+                rt2x00_set_field32(&reg, ARCSR5_SERVICE, 0x84);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 110));
+                rt2x00pci_register_write(rt2x00dev, ARCSR5, reg);
+        }
 
-        rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
-        rt2x00_set_field32(&reg, CSR11_SLOT_TIME, erp->slot_time);
-        rt2x00pci_register_write(rt2x00dev, CSR11, reg);
+        if (changed & BSS_CHANGED_BASIC_RATES)
+                rt2x00pci_register_write(rt2x00dev, ARCSR1, erp->basic_rates);
+
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
+                rt2x00_set_field32(&reg, CSR11_SLOT_TIME, erp->slot_time);
+                rt2x00pci_register_write(rt2x00dev, CSR11, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR12, &reg);
-        rt2x00_set_field32(&reg, CSR12_BEACON_INTERVAL, erp->beacon_int * 16);
-        rt2x00_set_field32(&reg, CSR12_CFP_MAX_DURATION, erp->beacon_int * 16);
-        rt2x00pci_register_write(rt2x00dev, CSR12, reg);
+                rt2x00pci_register_read(rt2x00dev, CSR18, &reg);
+                rt2x00_set_field32(&reg, CSR18_SIFS, erp->sifs);
+                rt2x00_set_field32(&reg, CSR18_PIFS, erp->pifs);
+                rt2x00pci_register_write(rt2x00dev, CSR18, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR18, &reg);
-        rt2x00_set_field32(&reg, CSR18_SIFS, erp->sifs);
-        rt2x00_set_field32(&reg, CSR18_PIFS, erp->pifs);
-        rt2x00pci_register_write(rt2x00dev, CSR18, reg);
+                rt2x00pci_register_read(rt2x00dev, CSR19, &reg);
+                rt2x00_set_field32(&reg, CSR19_DIFS, erp->difs);
+                rt2x00_set_field32(&reg, CSR19_EIFS, erp->eifs);
+                rt2x00pci_register_write(rt2x00dev, CSR19, reg);
+        }
+
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                rt2x00pci_register_read(rt2x00dev, CSR12, &reg);
+                rt2x00_set_field32(&reg, CSR12_BEACON_INTERVAL,
+                                   erp->beacon_int * 16);
+                rt2x00_set_field32(&reg, CSR12_CFP_MAX_DURATION,
+                                   erp->beacon_int * 16);
+                rt2x00pci_register_write(rt2x00dev, CSR12, reg);
+        }
 
-        rt2x00pci_register_read(rt2x00dev, CSR19, &reg);
-        rt2x00_set_field32(&reg, CSR19_DIFS, erp->difs);
-        rt2x00_set_field32(&reg, CSR19_EIFS, erp->eifs);
-        rt2x00pci_register_write(rt2x00dev, CSR19, reg);
 }
 
 static void rt2500pci_config_ant(struct rt2x00_dev *rt2x00dev,
@@ -1243,7 +1258,7 @@ static void rt2500pci_write_beacon(struct queue_entry *entry,
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 
-        rt2x00queue_map_txskb(rt2x00dev, entry->skb);
+        rt2x00queue_map_txskb(entry);
 
         /*
          * Write the TX descriptor for the beacon.
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index db64df4267d8..93e44c7f3a74 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -494,24 +494,34 @@ static void rt2500usb_config_intf(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt2500usb_config_erp(struct rt2x00_dev *rt2x00dev,
-                                 struct rt2x00lib_erp *erp)
+                                 struct rt2x00lib_erp *erp,
+                                 u32 changed)
 {
         u16 reg;
 
-        rt2500usb_register_read(rt2x00dev, TXRX_CSR10, &reg);
-        rt2x00_set_field16(&reg, TXRX_CSR10_AUTORESPOND_PREAMBLE,
-                           !!erp->short_preamble);
-        rt2500usb_register_write(rt2x00dev, TXRX_CSR10, reg);
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                rt2500usb_register_read(rt2x00dev, TXRX_CSR10, &reg);
+                rt2x00_set_field16(&reg, TXRX_CSR10_AUTORESPOND_PREAMBLE,
+                                   !!erp->short_preamble);
+                rt2500usb_register_write(rt2x00dev, TXRX_CSR10, reg);
+        }
 
-        rt2500usb_register_write(rt2x00dev, TXRX_CSR11, erp->basic_rates);
+        if (changed & BSS_CHANGED_BASIC_RATES)
+                rt2500usb_register_write(rt2x00dev, TXRX_CSR11,
+                                         erp->basic_rates);
 
-        rt2500usb_register_read(rt2x00dev, TXRX_CSR18, &reg);
-        rt2x00_set_field16(&reg, TXRX_CSR18_INTERVAL, erp->beacon_int * 4);
-        rt2500usb_register_write(rt2x00dev, TXRX_CSR18, reg);
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                rt2500usb_register_read(rt2x00dev, TXRX_CSR18, &reg);
+                rt2x00_set_field16(&reg, TXRX_CSR18_INTERVAL,
+                                   erp->beacon_int * 4);
+                rt2500usb_register_write(rt2x00dev, TXRX_CSR18, reg);
+        }
 
-        rt2500usb_register_write(rt2x00dev, MAC_CSR10, erp->slot_time);
-        rt2500usb_register_write(rt2x00dev, MAC_CSR11, erp->sifs);
-        rt2500usb_register_write(rt2x00dev, MAC_CSR12, erp->eifs);
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rt2500usb_register_write(rt2x00dev, MAC_CSR10, erp->slot_time);
+                rt2500usb_register_write(rt2x00dev, MAC_CSR11, erp->sifs);
+                rt2500usb_register_write(rt2x00dev, MAC_CSR12, erp->eifs);
+        }
 }
 
 static void rt2500usb_config_ant(struct rt2x00_dev *rt2x00dev,
@@ -1664,10 +1674,15 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 
         /*
          * Initialize all hw fields.
+         *
+         * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING unless we are
+         * capable of sending the buffered frames out after the DTIM
+         * transmission using rt2x00lib_beacondone. This will send out
+         * multicast and broadcast traffic immediately instead of buffering it
+         * infinitly and thus dropping it after some time.
          */
         rt2x00dev->hw->flags =
             IEEE80211_HW_RX_INCLUDES_FCS |
-            IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
             IEEE80211_HW_SIGNAL_DBM |
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK;
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index 70a5cb86405b..eb8b6cab9925 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -1,5 +1,6 @@
 /*
-        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2004 - 2010 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2010 Willow Garage <http://www.willowgarage.com>
         Copyright (C) 2009 Alban Browaeys <prahal@yahoo.com>
         Copyright (C) 2009 Felix Fietkau <nbd@openwrt.org>
         Copyright (C) 2009 Luis Correia <luis.f.correia@gmail.com>
@@ -639,6 +640,18 @@
 #define LED_CFG_LED_POLAR               FIELD32(0x40000000)
 
 /*
+ * AMPDU_BA_WINSIZE: Force BlockAck window size
+ * FORCE_WINSIZE_ENABLE:
+ *   0: Disable forcing of BlockAck window size
+ *   1: Enable forcing of BlockAck window size, overwrites values BlockAck
+ *      window size values in the TXWI
+ * FORCE_WINSIZE: BlockAck window size
+ */
+#define AMPDU_BA_WINSIZE                0x1040
+#define AMPDU_BA_WINSIZE_FORCE_WINSIZE_ENABLE FIELD32(0x00000020)
+#define AMPDU_BA_WINSIZE_FORCE_WINSIZE  FIELD32(0x0000001f)
+
+/*
  * XIFS_TIME_CFG: MAC timing
  * CCKM_SIFS_TIME: unit 1us. Applied after CCK RX/TX
  * OFDM_SIFS_TIME: unit 1us. Applied after OFDM RX/TX
@@ -698,8 +711,14 @@
 
 /*
  * TBTT_SYNC_CFG:
+ * BCN_AIFSN: Beacon AIFSN after TBTT interrupt in slots
+ * BCN_CWMIN: Beacon CWMin after TBTT interrupt in slots
  */
 #define TBTT_SYNC_CFG                   0x1118
+#define TBTT_SYNC_CFG_TBTT_ADJUST       FIELD32(0x000000ff)
+#define TBTT_SYNC_CFG_BCN_EXP_WIN       FIELD32(0x0000ff00)
+#define TBTT_SYNC_CFG_BCN_AIFSN         FIELD32(0x000f0000)
+#define TBTT_SYNC_CFG_BCN_CWMIN         FIELD32(0x00f00000)
 
 /*
  * TSF_TIMER_DW0: Local lsb TSF timer, read-only
@@ -735,16 +754,21 @@
 #define INT_TIMER_EN_GP_TIMER           FIELD32(0x00000002)
 
 /*
- * CH_IDLE_STA: channel idle time
+ * CH_IDLE_STA: channel idle time (in us)
  */
 #define CH_IDLE_STA                     0x1130
 
 /*
- * CH_BUSY_STA: channel busy time
+ * CH_BUSY_STA: channel busy time on primary channel (in us)
  */
 #define CH_BUSY_STA                     0x1134
 
 /*
+ * CH_BUSY_STA_SEC: channel busy time on secondary channel in HT40 mode (in us)
+ */
+#define CH_BUSY_STA_SEC                 0x1138
+
+/*
  * MAC_STATUS_CFG:
  * BBP_RF_BUSY: When set to 0, BBP and RF are stable.
  *      if 1 or higher one of the 2 registers is busy.
@@ -1330,6 +1354,9 @@
  * PID_TYPE: The PID latched from the PID field in the TXWI, can be used
  *           to match a frame with its tx result (even though the PID is
  *           only 4 bits wide).
+ * PID_QUEUE: Part of PID_TYPE, this is the queue index number (0-3)
+ * PID_ENTRY: Part of PID_TYPE, this is the queue entry index number (1-3)
+ *            This identification number is calculated by ((idx % 3) + 1).
  * TX_SUCCESS: Indicates tx success (1) or failure (0)
  * TX_AGGRE: Indicates if the frame was part of an aggregate (1) or not (0)
  * TX_ACK_REQUIRED: Indicates if the frame needed to get ack'ed (1) or not (0)
@@ -1341,6 +1368,8 @@
 #define TX_STA_FIFO                     0x1718
 #define TX_STA_FIFO_VALID               FIELD32(0x00000001)
 #define TX_STA_FIFO_PID_TYPE            FIELD32(0x0000001e)
+#define TX_STA_FIFO_PID_QUEUE           FIELD32(0x00000006)
+#define TX_STA_FIFO_PID_ENTRY           FIELD32(0x00000018)
 #define TX_STA_FIFO_TX_SUCCESS          FIELD32(0x00000020)
 #define TX_STA_FIFO_TX_AGGRE            FIELD32(0x00000040)
 #define TX_STA_FIFO_TX_ACK_REQUIRED     FIELD32(0x00000080)
@@ -1423,6 +1452,24 @@
 
 /*
  * Security key table memory.
+ *
+ * The pairwise key table shares some memory with the beacon frame
+ * buffers 6 and 7. That basically means that when beacon 6 & 7
+ * are used we should only use the reduced pairwise key table which
+ * has a maximum of 222 entries.
+ *
+ * ---------------------------------------------
+ * |0x4000 | Pairwise Key   | Reduced Pairwise |
+ * |       | Table          | Key Table        |
+ * |       | Size: 256 * 32 | Size: 222 * 32   |
+ * |0x5BC0 |                |-------------------
+ * |       |                | Beacon 6         |
+ * |0x5DC0 |                |-------------------
+ * |       |                | Beacon 7         |
+ * |0x5FC0 |                |-------------------
+ * |0x5FFF |                |
+ * --------------------------
+ *
  * MAC_WCID_BASE: 8-bytes (use only 6 bytes) * 256 entry
  * PAIRWISE_KEY_TABLE_BASE: 32-byte * 256 entry
  * MAC_IVEIV_TABLE_BASE: 8-byte * 256-entry
@@ -1572,7 +1619,8 @@ struct mac_iveiv_entry {
  * 2. Extract memory from FCE table for BCN 4~5
  * 3. Extract memory from Pair-wise key table for BCN 6~7
  *    It occupied those memory of wcid 238~253 for BCN 6
- *    and wcid 222~237 for BCN 7
+ *    and wcid 222~237 for BCN 7 (see Security key table memory
+ *    for more info).
  *
  * IMPORTANT NOTE: Not sure why legacy driver does this,
  * but HW_BEACON_BASE7 is 0x0200 bytes below HW_BEACON_BASE6.
@@ -1951,10 +1999,17 @@ struct mac_iveiv_entry {
  * FRAG: 1 To inform TKIP engine this is a fragment.
  * MIMO_PS: The remote peer is in dynamic MIMO-PS mode
  * TX_OP: 0:HT TXOP rule , 1:PIFS TX ,2:Backoff, 3:sifs
- * BW: Channel bandwidth 20MHz or 40 MHz
+ * BW: Channel bandwidth 0:20MHz, 1:40 MHz (for legacy rates this will
+ *     duplicate the frame to both channels).
  * STBC: 1: STBC support MCS =0-7, 2,3 : RESERVED
  * AMPDU: 1: this frame is eligible for AMPDU aggregation, the hw will
- *        aggregate consecutive frames with the same RA and QoS TID.
+ *        aggregate consecutive frames with the same RA and QoS TID. If
+ *        a frame A with the same RA and QoS TID but AMPDU=0 is queued
+ *        directly after a frame B with AMPDU=1, frame A might still
+ *        get aggregated into the AMPDU started by frame B. So, setting
+ *        AMPDU to 0 does _not_ necessarily mean the frame is sent as
+ *        MPDU, it can still end up in an AMPDU if the previous frame
+ *        was tagged as AMPDU.
  */
 #define TXWI_W0_FRAG                    FIELD32(0x00000001)
 #define TXWI_W0_MIMO_PS                 FIELD32(0x00000002)
@@ -1981,6 +2036,10 @@ struct mac_iveiv_entry {
  *           frame was processed. If multiple frames are aggregated together
  *           (AMPDU==1) the reported tx status will always contain the packet
  *           id of the first frame. 0: Don't report tx status for this frame.
+ * PACKETID_QUEUE: Part of PACKETID, This is the queue index (0-3)
+ * PACKETID_ENTRY: Part of PACKETID, THis is the queue entry index (1-3)
+ *                 This identification number is calculated by ((idx % 3) + 1).
+ *                 The (+1) is required to prevent PACKETID to become 0.
  */
 #define TXWI_W1_ACK                     FIELD32(0x00000001)
 #define TXWI_W1_NSEQ                    FIELD32(0x00000002)
@@ -1988,6 +2047,8 @@ struct mac_iveiv_entry {
 #define TXWI_W1_WIRELESS_CLI_ID         FIELD32(0x0000ff00)
 #define TXWI_W1_MPDU_TOTAL_BYTE_COUNT   FIELD32(0x0fff0000)
 #define TXWI_W1_PACKETID                FIELD32(0xf0000000)
+#define TXWI_W1_PACKETID_QUEUE          FIELD32(0x30000000)
+#define TXWI_W1_PACKETID_ENTRY          FIELD32(0xc0000000)
 
 /*
  * Word2
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 27a6e225083c..5f00e00789d8 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -483,7 +483,8 @@ void rt2800_write_tx_data(struct queue_entry *entry,
                            txdesc->key_idx : 0xff);
         rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
                            txdesc->length);
-        rt2x00_set_field32(&word, TXWI_W1_PACKETID, txdesc->qid + 1);
+        rt2x00_set_field32(&word, TXWI_W1_PACKETID_QUEUE, txdesc->qid);
+        rt2x00_set_field32(&word, TXWI_W1_PACKETID_ENTRY, (entry->entry_idx % 3) + 1);
         rt2x00_desc_write(txwi, 1, word);
 
         /*
@@ -498,7 +499,7 @@ void rt2800_write_tx_data(struct queue_entry *entry,
 }
 EXPORT_SYMBOL_GPL(rt2800_write_tx_data);
 
-static int rt2800_agc_to_rssi(struct rt2x00_dev *rt2x00dev, int rxwi_w2)
+static int rt2800_agc_to_rssi(struct rt2x00_dev *rt2x00dev, u32 rxwi_w2)
 {
         int rssi0 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI0);
         int rssi1 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI1);
@@ -630,15 +631,90 @@ static bool rt2800_txdone_entry_check(struct queue_entry *entry, u32 reg)
         return true;
 }
 
+void rt2800_txdone_entry(struct queue_entry *entry, u32 status)
+{
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        struct txdone_entry_desc txdesc;
+        u32 word;
+        u16 mcs, real_mcs;
+        int aggr, ampdu;
+        __le32 *txwi;
+
+        /*
+         * Obtain the status about this packet.
+         */
+        txdesc.flags = 0;
+        txwi = rt2800_drv_get_txwi(entry);
+        rt2x00_desc_read(txwi, 0, &word);
+
+        mcs = rt2x00_get_field32(word, TXWI_W0_MCS);
+        ampdu = rt2x00_get_field32(word, TXWI_W0_AMPDU);
+
+        real_mcs = rt2x00_get_field32(status, TX_STA_FIFO_MCS);
+        aggr = rt2x00_get_field32(status, TX_STA_FIFO_TX_AGGRE);
+
+        /*
+         * If a frame was meant to be sent as a single non-aggregated MPDU
+         * but ended up in an aggregate the used tx rate doesn't correlate
+         * with the one specified in the TXWI as the whole aggregate is sent
+         * with the same rate.
+         *
+         * For example: two frames are sent to rt2x00, the first one sets
+         * AMPDU=1 and requests MCS7 whereas the second frame sets AMDPU=0
+         * and requests MCS15. If the hw aggregates both frames into one
+         * AMDPU the tx status for both frames will contain MCS7 although
+         * the frame was sent successfully.
+         *
+         * Hence, replace the requested rate with the real tx rate to not
+         * confuse the rate control algortihm by providing clearly wrong
+         * data.
+         */
+        if (aggr == 1 && ampdu == 0 && real_mcs != mcs) {
+                skbdesc->tx_rate_idx = real_mcs;
+                mcs = real_mcs;
+        }
+
+        /*
+         * Ralink has a retry mechanism using a global fallback
+         * table. We setup this fallback table to try the immediate
+         * lower rate for all rates. In the TX_STA_FIFO, the MCS field
+         * always contains the MCS used for the last transmission, be
+         * it successful or not.
+         */
+        if (rt2x00_get_field32(status, TX_STA_FIFO_TX_SUCCESS)) {
+                /*
+                 * Transmission succeeded. The number of retries is
+                 * mcs - real_mcs
+                 */
+                __set_bit(TXDONE_SUCCESS, &txdesc.flags);
+                txdesc.retry = ((mcs > real_mcs) ? mcs - real_mcs : 0);
+        } else {
+                /*
+                 * Transmission failed. The number of retries is
+                 * always 7 in this case (for a total number of 8
+                 * frames sent).
+                 */
+                __set_bit(TXDONE_FAILURE, &txdesc.flags);
+                txdesc.retry = rt2x00dev->long_retry;
+        }
+
+        /*
+         * the frame was retried at least once
+         * -> hw used fallback rates
+         */
+        if (txdesc.retry)
+                __set_bit(TXDONE_FALLBACK, &txdesc.flags);
+
+        rt2x00lib_txdone(entry, &txdesc);
+}
+EXPORT_SYMBOL_GPL(rt2800_txdone_entry);
+
 void rt2800_txdone(struct rt2x00_dev *rt2x00dev)
 {
         struct data_queue *queue;
         struct queue_entry *entry;
-        __le32 *txwi;
-        struct txdone_entry_desc txdesc;
-        u32 word;
         u32 reg;
-        u16 mcs, real_mcs;
         u8 pid;
         int i;
 
@@ -660,7 +736,7 @@ void rt2800_txdone(struct rt2x00_dev *rt2x00dev)
                  * Skip this entry when it contains an invalid
                  * queue identication number.
                  */
-                pid = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE) - 1;
+                pid = rt2x00_get_field32(reg, TX_STA_FIFO_PID_QUEUE);
                 if (pid >= QID_RX)
                         continue;
 
@@ -673,7 +749,6 @@ void rt2800_txdone(struct rt2x00_dev *rt2x00dev)
                  * order. We first check that the queue is not empty.
                  */
                 entry = NULL;
-                txwi = NULL;
                 while (!rt2x00queue_empty(queue)) {
                         entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
                         if (rt2800_txdone_entry_check(entry, reg))
@@ -683,48 +758,7 @@ void rt2800_txdone(struct rt2x00_dev *rt2x00dev)
                 if (!entry || rt2x00queue_empty(queue))
                         break;
 
-
-                /*
-                 * Obtain the status about this packet.
-                 */
-                txdesc.flags = 0;
-                txwi = rt2800_drv_get_txwi(entry);
-                rt2x00_desc_read(txwi, 0, &word);
-                mcs = rt2x00_get_field32(word, TXWI_W0_MCS);
-                real_mcs = rt2x00_get_field32(reg, TX_STA_FIFO_MCS);
-
-                /*
-                 * Ralink has a retry mechanism using a global fallback
-                 * table. We setup this fallback table to try the immediate
-                 * lower rate for all rates. In the TX_STA_FIFO, the MCS field
-                 * always contains the MCS used for the last transmission, be
-                 * it successful or not.
-                 */
-                if (rt2x00_get_field32(reg, TX_STA_FIFO_TX_SUCCESS)) {
-                        /*
-                         * Transmission succeeded. The number of retries is
-                         * mcs - real_mcs
-                         */
-                        __set_bit(TXDONE_SUCCESS, &txdesc.flags);
-                        txdesc.retry = ((mcs > real_mcs) ? mcs - real_mcs : 0);
-                } else {
-                        /*
-                         * Transmission failed. The number of retries is
-                         * always 7 in this case (for a total number of 8
-                         * frames sent).
-                         */
-                        __set_bit(TXDONE_FAILURE, &txdesc.flags);
-                        txdesc.retry = rt2x00dev->long_retry;
-                }
-
-                /*
-                 * the frame was retried at least once
-                 * -> hw used fallback rates
-                 */
-                if (txdesc.retry)
-                        __set_bit(TXDONE_FALLBACK, &txdesc.flags);
-
-                rt2x00lib_txdone(entry, &txdesc);
+                rt2800_txdone_entry(entry, reg);
         }
 }
 EXPORT_SYMBOL_GPL(rt2800_txdone);
@@ -1031,8 +1065,12 @@ int rt2800_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
                  * 1 pairwise key is possible per AID, this means that the AID
                  * equals our hw_key_idx. Make sure the WCID starts _after_ the
                  * last possible shared key entry.
+                 *
+                 * Since parts of the pairwise key table might be shared with
+                 * the beacon frame buffers 6 & 7 we should only write into the
+                 * first 222 entries.
                  */
-                if (crypto->aid > (256 - 32))
+                if (crypto->aid > (222 - 32))
                         return -ENOSPC;
 
                 key->hw_key_idx = 32 + crypto->aid;
@@ -1159,38 +1197,149 @@ void rt2800_config_intf(struct rt2x00_dev *rt2x00dev, struct rt2x00_intf *intf,
 }
 EXPORT_SYMBOL_GPL(rt2800_config_intf);
 
-void rt2800_config_erp(struct rt2x00_dev *rt2x00dev, struct rt2x00lib_erp *erp)
+static void rt2800_config_ht_opmode(struct rt2x00_dev *rt2x00dev,
+                                    struct rt2x00lib_erp *erp)
 {
+        bool any_sta_nongf = !!(erp->ht_opmode &
+                                IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
+        u8 protection = erp->ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION;
+        u8 mm20_mode, mm40_mode, gf20_mode, gf40_mode;
+        u16 mm20_rate, mm40_rate, gf20_rate, gf40_rate;
         u32 reg;
 
-        rt2800_register_read(rt2x00dev, AUTO_RSP_CFG, &reg);
-        rt2x00_set_field32(&reg, AUTO_RSP_CFG_BAC_ACK_POLICY,
-                           !!erp->short_preamble);
-        rt2x00_set_field32(&reg, AUTO_RSP_CFG_AR_PREAMBLE,
-                           !!erp->short_preamble);
-        rt2800_register_write(rt2x00dev, AUTO_RSP_CFG, reg);
+        /* default protection rate for HT20: OFDM 24M */
+        mm20_rate = gf20_rate = 0x4004;
 
-        rt2800_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_CTRL,
-                           erp->cts_protection ? 2 : 0);
-        rt2800_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+        /* default protection rate for HT40: duplicate OFDM 24M */
+        mm40_rate = gf40_rate = 0x4084;
 
-        rt2800_register_write(rt2x00dev, LEGACY_BASIC_RATE,
-                                 erp->basic_rates);
-        rt2800_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
+        switch (protection) {
+        case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
+                /*
+                 * All STAs in this BSS are HT20/40 but there might be
+                 * STAs not supporting greenfield mode.
+                 * => Disable protection for HT transmissions.
+                 */
+                mm20_mode = mm40_mode = gf20_mode = gf40_mode = 0;
 
-        rt2800_register_read(rt2x00dev, BKOFF_SLOT_CFG, &reg);
-        rt2x00_set_field32(&reg, BKOFF_SLOT_CFG_SLOT_TIME, erp->slot_time);
-        rt2800_register_write(rt2x00dev, BKOFF_SLOT_CFG, reg);
+                break;
+        case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
+                /*
+                 * All STAs in this BSS are HT20 or HT20/40 but there
+                 * might be STAs not supporting greenfield mode.
+                 * => Protect all HT40 transmissions.
+                 */
+                mm20_mode = gf20_mode = 0;
+                mm40_mode = gf40_mode = 2;
 
-        rt2800_register_read(rt2x00dev, XIFS_TIME_CFG, &reg);
-        rt2x00_set_field32(&reg, XIFS_TIME_CFG_EIFS, erp->eifs);
-        rt2800_register_write(rt2x00dev, XIFS_TIME_CFG, reg);
+                break;
+        case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
+                /*
+                 * Nonmember protection:
+                 * According to 802.11n we _should_ protect all
+                 * HT transmissions (but we don't have to).
+                 *
+                 * But if cts_protection is enabled we _shall_ protect
+                 * all HT transmissions using a CCK rate.
+                 *
+                 * And if any station is non GF we _shall_ protect
+                 * GF transmissions.
+                 *
+                 * We decide to protect everything
+                 * -> fall through to mixed mode.
+                 */
+        case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
+                /*
+                 * Legacy STAs are present
+                 * => Protect all HT transmissions.
+                 */
+                mm20_mode = mm40_mode = gf20_mode = gf40_mode = 2;
 
-        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL,
-                           erp->beacon_int * 16);
-        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+                /*
+                 * If erp protection is needed we have to protect HT
+                 * transmissions with CCK 11M long preamble.
+                 */
+                if (erp->cts_protection) {
+                        /* don't duplicate RTS/CTS in CCK mode */
+                        mm20_rate = mm40_rate = 0x0003;
+                        gf20_rate = gf40_rate = 0x0003;
+                }
+                break;
+        };
+
+        /* check for STAs not supporting greenfield mode */
+        if (any_sta_nongf)
+                gf20_mode = gf40_mode = 2;
+
+        /* Update HT protection config */
+        rt2800_register_read(rt2x00dev, MM20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_RATE, mm20_rate);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_CTRL, mm20_mode);
+        rt2800_register_write(rt2x00dev, MM20_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, MM40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_RATE, mm40_rate);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_CTRL, mm40_mode);
+        rt2800_register_write(rt2x00dev, MM40_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, GF20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_RATE, gf20_rate);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_CTRL, gf20_mode);
+        rt2800_register_write(rt2x00dev, GF20_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, GF40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_RATE, gf40_rate);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_CTRL, gf40_mode);
+        rt2800_register_write(rt2x00dev, GF40_PROT_CFG, reg);
+}
+
+void rt2800_config_erp(struct rt2x00_dev *rt2x00dev, struct rt2x00lib_erp *erp,
+                       u32 changed)
+{
+        u32 reg;
+
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                rt2800_register_read(rt2x00dev, AUTO_RSP_CFG, &reg);
+                rt2x00_set_field32(&reg, AUTO_RSP_CFG_BAC_ACK_POLICY,
+                                   !!erp->short_preamble);
+                rt2x00_set_field32(&reg, AUTO_RSP_CFG_AR_PREAMBLE,
+                                   !!erp->short_preamble);
+                rt2800_register_write(rt2x00dev, AUTO_RSP_CFG, reg);
+        }
+
+        if (changed & BSS_CHANGED_ERP_CTS_PROT) {
+                rt2800_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
+                rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_CTRL,
+                                   erp->cts_protection ? 2 : 0);
+                rt2800_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+        }
+
+        if (changed & BSS_CHANGED_BASIC_RATES) {
+                rt2800_register_write(rt2x00dev, LEGACY_BASIC_RATE,
+                                         erp->basic_rates);
+                rt2800_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
+        }
+
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rt2800_register_read(rt2x00dev, BKOFF_SLOT_CFG, &reg);
+                rt2x00_set_field32(&reg, BKOFF_SLOT_CFG_SLOT_TIME,
+                                   erp->slot_time);
+                rt2800_register_write(rt2x00dev, BKOFF_SLOT_CFG, reg);
+
+                rt2800_register_read(rt2x00dev, XIFS_TIME_CFG, &reg);
+                rt2x00_set_field32(&reg, XIFS_TIME_CFG_EIFS, erp->eifs);
+                rt2800_register_write(rt2x00dev, XIFS_TIME_CFG, reg);
+        }
+
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL,
+                                   erp->beacon_int * 16);
+                rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+        }
+
+        if (changed & BSS_CHANGED_HT)
+                rt2800_config_ht_opmode(rt2x00dev, erp);
 }
 EXPORT_SYMBOL_GPL(rt2800_config_erp);
 
@@ -1895,8 +2044,7 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
 
         rt2800_register_read(rt2x00dev, MM40_PROT_CFG, &reg);
         rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_RATE, 0x4084);
-        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_CTRL,
-                           !rt2x00_is_usb(rt2x00dev));
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_CTRL, 0);
         rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_NAV, 1);
         rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_CCK, 1);
         rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
@@ -2053,6 +2201,14 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2800_register_write(rt2x00dev, LG_FBK_CFG1, reg);
 
         /*
+         * Do not force the BA window size, we use the TXWI to set it
+         */
+        rt2800_register_read(rt2x00dev, AMPDU_BA_WINSIZE, &reg);
+        rt2x00_set_field32(&reg, AMPDU_BA_WINSIZE_FORCE_WINSIZE_ENABLE, 0);
+        rt2x00_set_field32(&reg, AMPDU_BA_WINSIZE_FORCE_WINSIZE, 0);
+        rt2800_register_write(rt2x00dev, AMPDU_BA_WINSIZE, reg);
+
+        /*
          * We must clear the error counters.
          * These registers are cleared on read,
          * so we may pass a useless variable to store the value.
@@ -3036,11 +3192,20 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
          * Initialize all hw fields.
          */
         rt2x00dev->hw->flags =
-            IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
             IEEE80211_HW_SIGNAL_DBM |
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK |
             IEEE80211_HW_AMPDU_AGGREGATION;
+        /*
+         * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING for USB devices
+         * unless we are capable of sending the buffered frames out after the
+         * DTIM transmission using rt2x00lib_beacondone. This will send out
+         * multicast and broadcast traffic immediately instead of buffering it
+         * infinitly and thus dropping it after some time.
+         */
+        if (!rt2x00_is_usb(rt2x00dev))
+                rt2x00dev->hw->flags |=
+                        IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING;
 
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
@@ -3051,12 +3216,13 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
          * As rt2800 has a global fallback table we cannot specify
          * more then one tx rate per frame but since the hw will
          * try several rates (based on the fallback table) we should
-         * still initialize max_rates to the maximum number of rates
+         * initialize max_report_rates to the maximum number of rates
          * we are going to try. Otherwise mac80211 will truncate our
          * reported tx rates and the rc algortihm will end up with
          * incorrect data.
          */
-        rt2x00dev->hw->max_rates = 7;
+        rt2x00dev->hw->max_rates = 1;
+        rt2x00dev->hw->max_report_rates = 7;
         rt2x00dev->hw->max_rate_tries = 1;
 
         rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &eeprom);
@@ -3313,8 +3479,12 @@ int rt2800_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
         case IEEE80211_AMPDU_RX_STOP:
-                /* we don't support RX aggregation yet */
-                ret = -ENOTSUPP;
+                /*
+                 * The hw itself takes care of setting up BlockAck mechanisms.
+                 * So, we only have to allow mac80211 to nagotiate a BlockAck
+                 * agreement. Once that is done, the hw will BlockAck incoming
+                 * AMPDUs without further setup.
+                 */
                 break;
         case IEEE80211_AMPDU_TX_START:
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.h b/drivers/net/wireless/rt2x00/rt2800lib.h
index 986229c06c19..81cbc92e7857 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.h
+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
@@ -153,6 +153,7 @@ void rt2800_write_tx_data(struct queue_entry *entry,
 void rt2800_process_rxwi(struct queue_entry *entry, struct rxdone_entry_desc *txdesc);
 
 void rt2800_txdone(struct rt2x00_dev *rt2x00dev);
+void rt2800_txdone_entry(struct queue_entry *entry, u32 status);
 
 void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc);
 
@@ -169,7 +170,8 @@ void rt2800_config_filter(struct rt2x00_dev *rt2x00dev,
                           const unsigned int filter_flags);
 void rt2800_config_intf(struct rt2x00_dev *rt2x00dev, struct rt2x00_intf *intf,
                         struct rt2x00intf_conf *conf, const unsigned int flags);
-void rt2800_config_erp(struct rt2x00_dev *rt2x00dev, struct rt2x00lib_erp *erp);
+void rt2800_config_erp(struct rt2x00_dev *rt2x00dev, struct rt2x00lib_erp *erp,
+                       u32 changed);
 void rt2800_config_ant(struct rt2x00_dev *rt2x00dev, struct antenna_setup *ant);
 void rt2800_config(struct rt2x00_dev *rt2x00dev,
                    struct rt2x00lib_conf *libconf,
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 2bcb1507e3ac..b26739535986 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -241,6 +241,7 @@ static void rt2800pci_clear_entry(struct queue_entry *entry)
 {
         struct queue_entry_priv_pci *entry_priv = entry->priv_data;
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         u32 word;
 
         if (entry->queue->qid == QID_RX) {
@@ -251,6 +252,13 @@ static void rt2800pci_clear_entry(struct queue_entry *entry)
                 rt2x00_desc_read(entry_priv->desc, 1, &word);
                 rt2x00_set_field32(&word, RXD_W1_DMA_DONE, 0);
                 rt2x00_desc_write(entry_priv->desc, 1, word);
+
+                /*
+                 * Set RX IDX in register to inform hardware that we have
+                 * handled this entry and it is available for reuse again.
+                 */
+                rt2800_register_write(rt2x00dev, RX_CRX_IDX,
+                                      entry->entry_idx);
         } else {
                 rt2x00_desc_read(entry_priv->desc, 1, &word);
                 rt2x00_set_field32(&word, TXD_W1_DMA_DONE, 1);
@@ -342,24 +350,24 @@ static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
         }
 
         rt2800_register_read(rt2x00dev, INT_MASK_CSR, &reg);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_RXDELAYINT, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_TXDELAYINT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RXDELAYINT, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_TXDELAYINT, 0);
         rt2x00_set_field32(&reg, INT_MASK_CSR_RX_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_AC0_DMA_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_AC1_DMA_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_AC2_DMA_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_AC3_DMA_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_HCCA_DMA_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_MGMT_DMA_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_MCU_COMMAND, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_RXTX_COHERENT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC0_DMA_DONE, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC1_DMA_DONE, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC2_DMA_DONE, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC3_DMA_DONE, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_HCCA_DMA_DONE, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_MGMT_DMA_DONE, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_MCU_COMMAND, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RXTX_COHERENT, 0);
         rt2x00_set_field32(&reg, INT_MASK_CSR_TBTT, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_PRE_TBTT, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_TX_FIFO_STATUS, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_AUTO_WAKEUP, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_GPTIMER, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_RX_COHERENT, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_TX_COHERENT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_GPTIMER, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RX_COHERENT, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_TX_COHERENT, 0);
         rt2800_register_write(rt2x00dev, INT_MASK_CSR, reg);
 }
 
@@ -565,7 +573,7 @@ static void rt2800pci_kick_tx_queue(struct data_queue *queue)
 {
         struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
         struct queue_entry *entry = rt2x00queue_get_entry(queue, Q_INDEX);
-        unsigned int qidx = 0;
+        unsigned int qidx;
 
         if (queue->qid == QID_MGMT)
                 qidx = 5;
@@ -599,7 +607,6 @@ static void rt2800pci_kill_tx_queue(struct data_queue *queue)
 static void rt2800pci_fill_rxdone(struct queue_entry *entry,
                                   struct rxdone_entry_desc *rxdesc)
 {
-        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct queue_entry_priv_pci *entry_priv = entry->priv_data;
         __le32 *rxd = entry_priv->desc;
         u32 word;
@@ -641,12 +648,6 @@ static void rt2800pci_fill_rxdone(struct queue_entry *entry,
          * Process the RXWI structure that is at the start of the buffer.
          */
         rt2800_process_rxwi(entry, rxdesc);
-
-        /*
-         * Set RX IDX in register to inform hardware that we have handled
-         * this entry and it is available for reuse again.
-         */
-        rt2800_register_write(rt2x00dev, RX_CRX_IDX, entry->entry_idx);
 }
 
 /*
@@ -660,6 +661,63 @@ static void rt2800pci_wakeup(struct rt2x00_dev *rt2x00dev)
         rt2800_config(rt2x00dev, &libconf, IEEE80211_CONF_CHANGE_PS);
 }
 
+static void rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+        struct queue_entry *entry;
+        u32 status;
+        u8 qid;
+
+        while (!kfifo_is_empty(&rt2x00dev->txstatus_fifo)) {
+                /* Now remove the tx status from the FIFO */
+                if (kfifo_out(&rt2x00dev->txstatus_fifo, &status,
+                              sizeof(status)) != sizeof(status)) {
+                        WARN_ON(1);
+                        break;
+                }
+
+                qid = rt2x00_get_field32(status, TX_STA_FIFO_PID_QUEUE);
+                if (qid >= QID_RX) {
+                        /*
+                         * Unknown queue, this shouldn't happen. Just drop
+                         * this tx status.
+                         */
+                        WARNING(rt2x00dev, "Got TX status report with "
+                                           "unexpected pid %u, dropping", qid);
+                        break;
+                }
+
+                queue = rt2x00queue_get_queue(rt2x00dev, qid);
+                if (unlikely(queue == NULL)) {
+                        /*
+                         * The queue is NULL, this shouldn't happen. Stop
+                         * processing here and drop the tx status
+                         */
+                        WARNING(rt2x00dev, "Got TX status for an unavailable "
+                                           "queue %u, dropping", qid);
+                        break;
+                }
+
+                if (rt2x00queue_empty(queue)) {
+                        /*
+                         * The queue is empty. Stop processing here
+                         * and drop the tx status.
+                         */
+                        WARNING(rt2x00dev, "Got TX status for an empty "
+                                           "queue %u, dropping", qid);
+                        break;
+                }
+
+                entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+                rt2800_txdone_entry(entry, status);
+        }
+}
+
+static void rt2800pci_txstatus_tasklet(unsigned long data)
+{
+        rt2800pci_txdone((struct rt2x00_dev *)data);
+}
+
 static irqreturn_t rt2800pci_interrupt_thread(int irq, void *dev_instance)
 {
         struct rt2x00_dev *rt2x00dev = dev_instance;
@@ -684,13 +742,7 @@ static irqreturn_t rt2800pci_interrupt_thread(int irq, void *dev_instance)
                 rt2x00pci_rxdone(rt2x00dev);
 
         /*
-         * 4 - Tx done interrupt.
-         */
-        if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS))
-                rt2800_txdone(rt2x00dev);
-
-        /*
-         * 5 - Auto wakeup interrupt.
+         * 4 - Auto wakeup interrupt.
          */
         if (rt2x00_get_field32(reg, INT_SOURCE_CSR_AUTO_WAKEUP))
                 rt2800pci_wakeup(rt2x00dev);
@@ -702,10 +754,58 @@ static irqreturn_t rt2800pci_interrupt_thread(int irq, void *dev_instance)
         return IRQ_HANDLED;
 }
 
+static void rt2800pci_txstatus_interrupt(struct rt2x00_dev *rt2x00dev)
+{
+        u32 status;
+        int i;
+
+        /*
+         * The TX_FIFO_STATUS interrupt needs special care. We should
+         * read TX_STA_FIFO but we should do it immediately as otherwise
+         * the register can overflow and we would lose status reports.
+         *
+         * Hence, read the TX_STA_FIFO register and copy all tx status
+         * reports into a kernel FIFO which is handled in the txstatus
+         * tasklet. We use a tasklet to process the tx status reports
+         * because we can schedule the tasklet multiple times (when the
+         * interrupt fires again during tx status processing).
+         *
+         * Furthermore we don't disable the TX_FIFO_STATUS
+         * interrupt here but leave it enabled so that the TX_STA_FIFO
+         * can also be read while the interrupt thread gets executed.
+         *
+         * Since we have only one producer and one consumer we don't
+         * need to lock the kfifo.
+         */
+        for (i = 0; i < TX_ENTRIES; i++) {
+                rt2800_register_read(rt2x00dev, TX_STA_FIFO, &status);
+
+                if (!rt2x00_get_field32(status, TX_STA_FIFO_VALID))
+                        break;
+
+                if (kfifo_is_full(&rt2x00dev->txstatus_fifo)) {
+                        WARNING(rt2x00dev, "TX status FIFO overrun,"
+                                " drop tx status report.\n");
+                        break;
+                }
+
+                if (kfifo_in(&rt2x00dev->txstatus_fifo, &status,
+                             sizeof(status)) != sizeof(status)) {
+                        WARNING(rt2x00dev, "TX status FIFO overrun,"
+                                "drop tx status report.\n");
+                        break;
+                }
+        }
+
+        /* Schedule the tasklet for processing the tx status. */
+        tasklet_schedule(&rt2x00dev->txstatus_tasklet);
+}
+
 static irqreturn_t rt2800pci_interrupt(int irq, void *dev_instance)
 {
         struct rt2x00_dev *rt2x00dev = dev_instance;
         u32 reg;
+        irqreturn_t ret = IRQ_HANDLED;
 
         /* Read status and ACK all interrupts */
         rt2800_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
@@ -717,15 +817,38 @@ static irqreturn_t rt2800pci_interrupt(int irq, void *dev_instance)
         if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
                 return IRQ_HANDLED;
 
-        /* Store irqvalue for use in the interrupt thread. */
-        rt2x00dev->irqvalue[0] = reg;
+        if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS))
+                rt2800pci_txstatus_interrupt(rt2x00dev);
 
-        /* Disable interrupts, will be enabled again in the interrupt thread. */
-        rt2x00dev->ops->lib->set_device_state(rt2x00dev,
-                                              STATE_RADIO_IRQ_OFF_ISR);
+        if (rt2x00_get_field32(reg, INT_SOURCE_CSR_PRE_TBTT) ||
+            rt2x00_get_field32(reg, INT_SOURCE_CSR_TBTT) ||
+            rt2x00_get_field32(reg, INT_SOURCE_CSR_RX_DONE) ||
+            rt2x00_get_field32(reg, INT_SOURCE_CSR_AUTO_WAKEUP)) {
+                /*
+                 * All other interrupts are handled in the interrupt thread.
+                 * Store irqvalue for use in the interrupt thread.
+                 */
+                rt2x00dev->irqvalue[0] = reg;
+
+                /*
+                 * Disable interrupts, will be enabled again in the
+                 * interrupt thread.
+                */
+                rt2x00dev->ops->lib->set_device_state(rt2x00dev,
+                                                      STATE_RADIO_IRQ_OFF_ISR);
+
+                /*
+                 * Leave the TX_FIFO_STATUS interrupt enabled to not lose any
+                 * tx status reports.
+                 */
+                rt2800_register_read(rt2x00dev, INT_MASK_CSR, &reg);
+                rt2x00_set_field32(&reg, INT_MASK_CSR_TX_FIFO_STATUS, 1);
+                rt2800_register_write(rt2x00dev, INT_MASK_CSR, reg);
 
+                ret = IRQ_WAKE_THREAD;
+        }
 
-        return IRQ_WAKE_THREAD;
+        return ret;
 }
 
 /*
@@ -788,6 +911,7 @@ static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 __set_bit(DRIVER_REQUIRE_FIRMWARE, &rt2x00dev->flags);
         __set_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags);
         __set_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_TXSTATUS_FIFO, &rt2x00dev->flags);
         if (!modparam_nohwcrypt)
                 __set_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags);
         __set_bit(DRIVER_SUPPORT_LINK_TUNING, &rt2x00dev->flags);
@@ -837,6 +961,7 @@ static const struct rt2800_ops rt2800pci_rt2800_ops = {
 static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
         .irq_handler            = rt2800pci_interrupt,
         .irq_handler_thread     = rt2800pci_interrupt_thread,
+        .txstatus_tasklet       = rt2800pci_txstatus_tasklet,
         .probe_hw               = rt2800pci_probe_hw,
         .get_firmware_name      = rt2800pci_get_firmware_name,
         .check_firmware         = rt2800_check_firmware,
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 0ae942cb66df..94fe589acfaa 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -36,6 +36,7 @@
 #include <linux/mutex.h>
 #include <linux/etherdevice.h>
 #include <linux/input-polldev.h>
+#include <linux/kfifo.h>
 
 #include <net/mac80211.h>
 
@@ -337,6 +338,11 @@ struct link {
 
         /*
          * Work structure for scheduling periodic watchdog monitoring.
+         * This work must be scheduled on the kernel workqueue, while
+         * all other work structures must be queued on the mac80211
+         * workqueue. This guarantees that the watchdog can schedule
+         * other work structures and wait for their completion in order
+         * to bring the device/driver back into the desired state.
          */
         struct delayed_work watchdog_work;
 };
@@ -457,6 +463,7 @@ struct rt2x00lib_erp {
         short eifs;
 
         u16 beacon_int;
+        u16 ht_opmode;
 };
 
 /*
@@ -522,6 +529,11 @@ struct rt2x00lib_ops {
         irq_handler_t irq_handler_thread;
 
         /*
+         * TX status tasklet handler.
+         */
+        void (*txstatus_tasklet) (unsigned long data);
+
+        /*
          * Device init handlers.
          */
         int (*probe_hw) (struct rt2x00_dev *rt2x00dev);
@@ -596,7 +608,8 @@ struct rt2x00lib_ops {
 #define CONFIG_UPDATE_BSSID             ( 1 << 3 )
 
         void (*config_erp) (struct rt2x00_dev *rt2x00dev,
-                            struct rt2x00lib_erp *erp);
+                            struct rt2x00lib_erp *erp,
+                            u32 changed);
         void (*config_ant) (struct rt2x00_dev *rt2x00dev,
                             struct antenna_setup *ant);
         void (*config) (struct rt2x00_dev *rt2x00dev,
@@ -650,6 +663,7 @@ enum rt2x00_flags {
         DRIVER_REQUIRE_DMA,
         DRIVER_REQUIRE_COPY_IV,
         DRIVER_REQUIRE_L2PAD,
+        DRIVER_REQUIRE_TXSTATUS_FIFO,
 
         /*
          * Driver features
@@ -883,6 +897,16 @@ struct rt2x00_dev {
          * and interrupt thread routine.
          */
         u32 irqvalue[2];
+
+        /*
+         * FIFO for storing tx status reports between isr and tasklet.
+         */
+        struct kfifo txstatus_fifo;
+
+        /*
+         * Tasklet for processing tx status reports (rt2800pci).
+         */
+        struct tasklet_struct txstatus_tasklet;
 };
 
 /*
@@ -1017,17 +1041,15 @@ static inline bool rt2x00_is_soc(struct rt2x00_dev *rt2x00dev)
 
 /**
  * rt2x00queue_map_txskb - Map a skb into DMA for TX purposes.
- * @rt2x00dev: Pointer to &struct rt2x00_dev.
- * @skb: The skb to map.
+ * @entry: Pointer to &struct queue_entry
  */
-void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb);
+void rt2x00queue_map_txskb(struct queue_entry *entry);
 
 /**
  * rt2x00queue_unmap_skb - Unmap a skb from DMA.
- * @rt2x00dev: Pointer to &struct rt2x00_dev.
- * @skb: The skb to unmap.
+ * @entry: Pointer to &struct queue_entry
  */
-void rt2x00queue_unmap_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb);
+void rt2x00queue_unmap_skb(struct queue_entry *entry);
 
 /**
  * rt2x00queue_get_queue - Convert queue index to queue pointer
@@ -1074,8 +1096,7 @@ void rt2x00lib_dmadone(struct queue_entry *entry);
 void rt2x00lib_txdone(struct queue_entry *entry,
                       struct txdone_entry_desc *txdesc);
 void rt2x00lib_txdone_noinfo(struct queue_entry *entry, u32 status);
-void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
-                      struct queue_entry *entry);
+void rt2x00lib_rxdone(struct queue_entry *entry);
 
 /*
  * mac80211 handlers.
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 34f34fa7f53a..54ffb5aeb34e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -81,7 +81,8 @@ void rt2x00lib_config_intf(struct rt2x00_dev *rt2x00dev,
 
 void rt2x00lib_config_erp(struct rt2x00_dev *rt2x00dev,
                           struct rt2x00_intf *intf,
-                          struct ieee80211_bss_conf *bss_conf)
+                          struct ieee80211_bss_conf *bss_conf,
+                          u32 changed)
 {
         struct rt2x00lib_erp erp;
 
@@ -102,7 +103,10 @@ void rt2x00lib_config_erp(struct rt2x00_dev *rt2x00dev,
         /* Update global beacon interval time, this is needed for PS support */
         rt2x00dev->beacon_int = bss_conf->beacon_int;
 
-        rt2x00dev->ops->lib->config_erp(rt2x00dev, &erp);
+        if (changed & BSS_CHANGED_HT)
+                erp.ht_opmode = bss_conf->ht_operation_mode;
+
+        rt2x00dev->ops->lib->config_erp(rt2x00dev, &erp, changed);
 }
 
 static inline
@@ -129,12 +133,12 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
          */
         if (!(ant->flags & ANTENNA_RX_DIVERSITY))
                 config.rx = rt2x00lib_config_antenna_check(config.rx, def->rx);
-        else
+        else if(config.rx == ANTENNA_SW_DIVERSITY)
                 config.rx = active->rx;
 
         if (!(ant->flags & ANTENNA_TX_DIVERSITY))
                 config.tx = rt2x00lib_config_antenna_check(config.tx, def->tx);
-        else
+        else if (config.tx == ANTENNA_SW_DIVERSITY)
                 config.tx = active->tx;
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index b8cf45c4e9f5..c1710b27ba70 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -380,7 +380,7 @@ static ssize_t rt2x00debug_read_crypto_stats(struct file *file,
                                              loff_t *offset)
 {
         struct rt2x00debug_intf *intf = file->private_data;
-        char *name[] = { "WEP64", "WEP128", "TKIP", "AES" };
+        static const char * const name[] = { "WEP64", "WEP128", "TKIP", "AES" };
         char *data;
         char *temp;
         size_t size;
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 053fdd3bd720..5ba79b935f09 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -253,6 +253,7 @@ EXPORT_SYMBOL_GPL(rt2x00lib_pretbtt);
 
 void rt2x00lib_dmadone(struct queue_entry *entry)
 {
+        clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
         rt2x00queue_index_inc(entry->queue, Q_INDEX_DMA_DONE);
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_dmadone);
@@ -273,7 +274,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         /*
          * Unmap the skb.
          */
-        rt2x00queue_unmap_skb(rt2x00dev, entry->skb);
+        rt2x00queue_unmap_skb(entry);
 
         /*
          * Remove the extra tx headroom from the skb.
@@ -432,42 +433,50 @@ static int rt2x00lib_rxdone_read_signal(struct rt2x00_dev *rt2x00dev,
         struct ieee80211_supported_band *sband;
         const struct rt2x00_rate *rate;
         unsigned int i;
-        int signal;
-        int type;
-
-        /*
-         * For non-HT rates the MCS value needs to contain the
-         * actually used rate modulation (CCK or OFDM).
-         */
-        if (rxdesc->dev_flags & RXDONE_SIGNAL_MCS)
-                signal = RATE_MCS(rxdesc->rate_mode, rxdesc->signal);
-        else
-                signal = rxdesc->signal;
-
-        type = (rxdesc->dev_flags & RXDONE_SIGNAL_MASK);
-
-        sband = &rt2x00dev->bands[rt2x00dev->curr_band];
-        for (i = 0; i < sband->n_bitrates; i++) {
-                rate = rt2x00_get_rate(sband->bitrates[i].hw_value);
-
-                if (((type == RXDONE_SIGNAL_PLCP) &&
-                     (rate->plcp == signal)) ||
-                    ((type == RXDONE_SIGNAL_BITRATE) &&
-                      (rate->bitrate == signal)) ||
-                    ((type == RXDONE_SIGNAL_MCS) &&
-                      (rate->mcs == signal))) {
-                        return i;
+        int signal = rxdesc->signal;
+        int type = (rxdesc->dev_flags & RXDONE_SIGNAL_MASK);
+
+        switch (rxdesc->rate_mode) {
+        case RATE_MODE_CCK:
+        case RATE_MODE_OFDM:
+                /*
+                 * For non-HT rates the MCS value needs to contain the
+                 * actually used rate modulation (CCK or OFDM).
+                 */
+                if (rxdesc->dev_flags & RXDONE_SIGNAL_MCS)
+                        signal = RATE_MCS(rxdesc->rate_mode, signal);
+
+                sband = &rt2x00dev->bands[rt2x00dev->curr_band];
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        rate = rt2x00_get_rate(sband->bitrates[i].hw_value);
+                        if (((type == RXDONE_SIGNAL_PLCP) &&
+                             (rate->plcp == signal)) ||
+                            ((type == RXDONE_SIGNAL_BITRATE) &&
+                              (rate->bitrate == signal)) ||
+                            ((type == RXDONE_SIGNAL_MCS) &&
+                              (rate->mcs == signal))) {
+                                return i;
+                        }
                 }
+                break;
+        case RATE_MODE_HT_MIX:
+        case RATE_MODE_HT_GREENFIELD:
+                if (signal >= 0 && signal <= 76)
+                        return signal;
+                break;
+        default:
+                break;
         }
 
         WARNING(rt2x00dev, "Frame received with unrecognized signal, "
-                "signal=0x%.4x, type=%d.\n", signal, type);
+                "mode=0x%.4x, signal=0x%.4x, type=%d.\n",
+                rxdesc->rate_mode, signal, type);
         return 0;
 }
 
-void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
-                      struct queue_entry *entry)
+void rt2x00lib_rxdone(struct queue_entry *entry)
 {
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct rxdone_entry_desc rxdesc;
         struct sk_buff *skb;
         struct ieee80211_rx_status *rx_status;
@@ -481,14 +490,14 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
          * Allocate a new sk_buffer. If no new buffer available, drop the
          * received frame and reuse the existing buffer.
          */
-        skb = rt2x00queue_alloc_rxskb(rt2x00dev, entry);
+        skb = rt2x00queue_alloc_rxskb(entry);
         if (!skb)
-                return;
+                goto submit_entry;
 
         /*
          * Unmap the skb.
          */
-        rt2x00queue_unmap_skb(rt2x00dev, entry->skb);
+        rt2x00queue_unmap_skb(entry);
 
         /*
          * Extract the RXD details.
@@ -523,18 +532,12 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
         skb_trim(entry->skb, rxdesc.size);
 
         /*
-         * Check if the frame was received using HT. In that case,
-         * the rate is the MCS index and should be passed to mac80211
-         * directly. Otherwise we need to translate the signal to
-         * the correct bitrate index.
+         * Translate the signal to the correct bitrate index.
          */
-        if (rxdesc.rate_mode == RATE_MODE_CCK ||
-            rxdesc.rate_mode == RATE_MODE_OFDM) {
-                rate_idx = rt2x00lib_rxdone_read_signal(rt2x00dev, &rxdesc);
-        } else {
+        rate_idx = rt2x00lib_rxdone_read_signal(rt2x00dev, &rxdesc);
+        if (rxdesc.rate_mode == RATE_MODE_HT_MIX ||
+            rxdesc.rate_mode == RATE_MODE_HT_GREENFIELD)
                 rxdesc.flags |= RX_FLAG_HT;
-                rate_idx = rxdesc.signal;
-        }
 
         /*
          * Update extra components
@@ -813,6 +816,30 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
                 rt2x00dev->hw->extra_tx_headroom += RT2X00_ALIGN_SIZE;
 
         /*
+         * Allocate tx status FIFO for driver use.
+         */
+        if (test_bit(DRIVER_REQUIRE_TXSTATUS_FIFO, &rt2x00dev->flags) &&
+            rt2x00dev->ops->lib->txstatus_tasklet) {
+                /*
+                 * Allocate txstatus fifo and tasklet, we use a size of 512
+                 * for the kfifo which is big enough to store 512/4=128 tx
+                 * status reports. In the worst case (tx status for all tx
+                 * queues gets reported before we've got a chance to handle
+                 * them) 24*4=384 tx status reports need to be cached.
+                 */
+                status = kfifo_alloc(&rt2x00dev->txstatus_fifo, 512,
+                                     GFP_KERNEL);
+                if (status)
+                        return status;
+
+                /* tasklet for processing the tx status reports. */
+                tasklet_init(&rt2x00dev->txstatus_tasklet,
+                             rt2x00dev->ops->lib->txstatus_tasklet,
+                             (unsigned long)rt2x00dev);
+
+        }
+
+        /*
          * Register HW.
          */
         status = ieee80211_register_hw(rt2x00dev->hw);
@@ -909,10 +936,8 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
 
         /* Enable the radio */
         retval = rt2x00lib_enable_radio(rt2x00dev);
-        if (retval) {
-                rt2x00queue_uninitialize(rt2x00dev);
+        if (retval)
                 return retval;
-        }
 
         set_bit(DEVICE_STATE_STARTED, &rt2x00dev->flags);
 
@@ -1028,6 +1053,16 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
         cancel_work_sync(&rt2x00dev->txdone_work);
 
         /*
+         * Free the tx status fifo.
+         */
+        kfifo_free(&rt2x00dev->txstatus_fifo);
+
+        /*
+         * Kill the tx status tasklet.
+         */
+        tasklet_kill(&rt2x00dev->txstatus_tasklet);
+
+        /*
          * Uninitialize device.
          */
         rt2x00lib_uninitialize(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2x00ht.c b/drivers/net/wireless/rt2x00/rt2x00ht.c
index ad3c7ff4837b..c637bcaec5f8 100644
--- a/drivers/net/wireless/rt2x00/rt2x00ht.c
+++ b/drivers/net/wireless/rt2x00/rt2x00ht.c
@@ -60,9 +60,10 @@ void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
                  * when using more then one tx stream (>MCS7).
                  */
                 if (tx_info->control.sta && txdesc->mcs > 7 &&
-                    (tx_info->control.sta->ht_cap.cap &
-                     (WLAN_HT_CAP_SM_PS_DYNAMIC <<
-                      IEEE80211_HT_CAP_SM_PS_SHIFT)))
+                    ((tx_info->control.sta->ht_cap.cap &
+                      IEEE80211_HT_CAP_SM_PS) >>
+                     IEEE80211_HT_CAP_SM_PS_SHIFT) ==
+                    WLAN_HT_CAP_SM_PS_DYNAMIC)
                         __set_bit(ENTRY_TXD_HT_MIMO_PS, &txdesc->flags);
         } else {
                 txdesc->mcs = rt2x00_get_rate_mcs(hwrate->mcs);
@@ -72,9 +73,11 @@ void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
 
 
         /*
-         * Convert flags
+         * This frame is eligible for an AMPDU, however, don't aggregate
+         * frames that are intended to probe a specific tx rate.
          */
-        if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
+        if (tx_info->flags & IEEE80211_TX_CTL_AMPDU &&
+            !(tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
                 __set_bit(ENTRY_TXD_HT_AMPDU, &txdesc->flags);
 
         /*
@@ -84,7 +87,13 @@ void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
                 txdesc->rate_mode = RATE_MODE_HT_MIX;
         if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
                 txdesc->rate_mode = RATE_MODE_HT_GREENFIELD;
-        if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+
+        /*
+         * Set 40Mhz mode if necessary (for legacy rates this will
+         * duplicate the frame to both channels).
+         */
+        if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH ||
+            txrate->flags & IEEE80211_TX_RC_DUP_DATA)
                 __set_bit(ENTRY_TXD_HT_BW_40, &txdesc->flags);
         if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
                 __set_bit(ENTRY_TXD_HT_SHORT_GI, &txdesc->flags);
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index dc5c6574aaf4..619da23b7b56 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -86,7 +86,8 @@ void rt2x00lib_config_intf(struct rt2x00_dev *rt2x00dev,
                            const u8 *mac, const u8 *bssid);
 void rt2x00lib_config_erp(struct rt2x00_dev *rt2x00dev,
                           struct rt2x00_intf *intf,
-                          struct ieee80211_bss_conf *conf);
+                          struct ieee80211_bss_conf *conf,
+                          u32 changed);
 void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
                               struct antenna_setup ant);
 void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
@@ -99,18 +100,15 @@ void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
 
 /**
  * rt2x00queue_alloc_rxskb - allocate a skb for RX purposes.
- * @rt2x00dev: Pointer to &struct rt2x00_dev.
- * @queue: The queue for which the skb will be applicable.
+ * @entry: The entry for which the skb will be applicable.
  */
-struct sk_buff *rt2x00queue_alloc_rxskb(struct rt2x00_dev *rt2x00dev,
-                                        struct queue_entry *entry);
+struct sk_buff *rt2x00queue_alloc_rxskb(struct queue_entry *entry);
 
 /**
  * rt2x00queue_free_skb - free a skb
- * @rt2x00dev: Pointer to &struct rt2x00_dev.
- * @skb: The skb to free.
+ * @entry: The entry for which the skb will be applicable.
  */
-void rt2x00queue_free_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb);
+void rt2x00queue_free_skb(struct queue_entry *entry);
 
 /**
  * rt2x00queue_align_frame - Align 802.11 frame to 4-byte boundary
diff --git a/drivers/net/wireless/rt2x00/rt2x00link.c b/drivers/net/wireless/rt2x00/rt2x00link.c
index 666cef3f8472..b971d8798ebf 100644
--- a/drivers/net/wireless/rt2x00/rt2x00link.c
+++ b/drivers/net/wireless/rt2x00/rt2x00link.c
@@ -188,7 +188,6 @@ static void rt2x00lib_antenna_diversity_eval(struct rt2x00_dev *rt2x00dev)
 static bool rt2x00lib_antenna_diversity(struct rt2x00_dev *rt2x00dev)
 {
         struct link_ant *ant = &rt2x00dev->link.ant;
-        unsigned int flags = ant->flags;
 
         /*
          * Determine if software diversity is enabled for
@@ -196,13 +195,13 @@ static bool rt2x00lib_antenna_diversity(struct rt2x00_dev *rt2x00dev)
          * Always perform this check since within the link
          * tuner interval the configuration might have changed.
          */
-        flags &= ~ANTENNA_RX_DIVERSITY;
-        flags &= ~ANTENNA_TX_DIVERSITY;
+        ant->flags &= ~ANTENNA_RX_DIVERSITY;
+        ant->flags &= ~ANTENNA_TX_DIVERSITY;
 
         if (rt2x00dev->default_ant.rx == ANTENNA_SW_DIVERSITY)
-                flags |= ANTENNA_RX_DIVERSITY;
+                ant->flags |= ANTENNA_RX_DIVERSITY;
         if (rt2x00dev->default_ant.tx == ANTENNA_SW_DIVERSITY)
-                flags |= ANTENNA_TX_DIVERSITY;
+                ant->flags |= ANTENNA_TX_DIVERSITY;
 
         if (!(ant->flags & ANTENNA_RX_DIVERSITY) &&
             !(ant->flags & ANTENNA_TX_DIVERSITY)) {
@@ -210,9 +209,6 @@ static bool rt2x00lib_antenna_diversity(struct rt2x00_dev *rt2x00dev)
                 return true;
         }
 
-        /* Update flags */
-        ant->flags = flags;
-
         /*
          * If we have only sampled the data over the last period
          * we should now harvest the data. Otherwise just evaluate
@@ -240,6 +236,12 @@ void rt2x00link_update_stats(struct rt2x00_dev *rt2x00dev,
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
         /*
+         * No need to update the stats for !=STA interfaces
+         */
+        if (!rt2x00dev->intf_sta_count)
+                return;
+
+        /*
          * Frame was received successfully since non-succesfull
          * frames would have been dropped by the hardware.
          */
@@ -415,8 +417,7 @@ void rt2x00link_start_watchdog(struct rt2x00_dev *rt2x00dev)
             !test_bit(DRIVER_SUPPORT_WATCHDOG, &rt2x00dev->flags))
                 return;
 
-        ieee80211_queue_delayed_work(rt2x00dev->hw,
-                                     &link->watchdog_work, WATCHDOG_INTERVAL);
+        schedule_delayed_work(&link->watchdog_work, WATCHDOG_INTERVAL);
 }
 
 void rt2x00link_stop_watchdog(struct rt2x00_dev *rt2x00dev)
@@ -440,8 +441,7 @@ static void rt2x00link_watchdog(struct work_struct *work)
         rt2x00dev->ops->lib->watchdog(rt2x00dev);
 
         if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
-                ieee80211_queue_delayed_work(rt2x00dev->hw,
-                                             &link->watchdog_work, WATCHDOG_INTERVAL);
+                schedule_delayed_work(&link->watchdog_work, WATCHDOG_INTERVAL);
 }
 
 void rt2x00link_register(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 235e037e6509..c3c206a97d54 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -669,8 +669,10 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
          * When the erp information has changed, we should perform
          * additional configuration steps. For all other changes we are done.
          */
-        if (changes & ~(BSS_CHANGED_ASSOC | BSS_CHANGED_HT))
-                rt2x00lib_config_erp(rt2x00dev, intf, bss_conf);
+        if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_ERP_PREAMBLE |
+                       BSS_CHANGED_ERP_SLOT | BSS_CHANGED_BASIC_RATES |
+                       BSS_CHANGED_BEACON_INT | BSS_CHANGED_HT))
+                rt2x00lib_config_erp(rt2x00dev, intf, bss_conf, changes);
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_bss_info_changed);
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 63c2cc408e15..2449d785cf8d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -84,7 +84,7 @@ void rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev)
                 /*
                  * Send the frame to rt2x00lib for further processing.
                  */
-                rt2x00lib_rxdone(rt2x00dev, entry);
+                rt2x00lib_rxdone(entry);
         }
 }
 EXPORT_SYMBOL_GPL(rt2x00pci_rxdone);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index eede99939db9..e360d287defb 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -33,9 +33,9 @@
 #include "rt2x00.h"
 #include "rt2x00lib.h"
 
-struct sk_buff *rt2x00queue_alloc_rxskb(struct rt2x00_dev *rt2x00dev,
-                                        struct queue_entry *entry)
+struct sk_buff *rt2x00queue_alloc_rxskb(struct queue_entry *entry)
 {
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct sk_buff *skb;
         struct skb_frame_desc *skbdesc;
         unsigned int frame_size;
@@ -97,41 +97,42 @@ struct sk_buff *rt2x00queue_alloc_rxskb(struct rt2x00_dev *rt2x00dev,
         return skb;
 }
 
-void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
+void rt2x00queue_map_txskb(struct queue_entry *entry)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
+        struct device *dev = entry->queue->rt2x00dev->dev;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
 
         skbdesc->skb_dma =
-            dma_map_single(rt2x00dev->dev, skb->data, skb->len, DMA_TO_DEVICE);
+            dma_map_single(dev, entry->skb->data, entry->skb->len, DMA_TO_DEVICE);
         skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
 }
 EXPORT_SYMBOL_GPL(rt2x00queue_map_txskb);
 
-void rt2x00queue_unmap_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
+void rt2x00queue_unmap_skb(struct queue_entry *entry)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
+        struct device *dev = entry->queue->rt2x00dev->dev;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
 
         if (skbdesc->flags & SKBDESC_DMA_MAPPED_RX) {
-                dma_unmap_single(rt2x00dev->dev, skbdesc->skb_dma, skb->len,
+                dma_unmap_single(dev, skbdesc->skb_dma, entry->skb->len,
                                  DMA_FROM_DEVICE);
                 skbdesc->flags &= ~SKBDESC_DMA_MAPPED_RX;
-        }
-
-        if (skbdesc->flags & SKBDESC_DMA_MAPPED_TX) {
-                dma_unmap_single(rt2x00dev->dev, skbdesc->skb_dma, skb->len,
+        } else if (skbdesc->flags & SKBDESC_DMA_MAPPED_TX) {
+                dma_unmap_single(dev, skbdesc->skb_dma, entry->skb->len,
                                  DMA_TO_DEVICE);
                 skbdesc->flags &= ~SKBDESC_DMA_MAPPED_TX;
         }
 }
 EXPORT_SYMBOL_GPL(rt2x00queue_unmap_skb);
 
-void rt2x00queue_free_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
+void rt2x00queue_free_skb(struct queue_entry *entry)
 {
-        if (!skb)
+        if (!entry->skb)
                 return;
 
-        rt2x00queue_unmap_skb(rt2x00dev, skb);
-        dev_kfree_skb_any(skb);
+        rt2x00queue_unmap_skb(entry);
+        dev_kfree_skb_any(entry->skb);
+        entry->skb = NULL;
 }
 
 void rt2x00queue_align_frame(struct sk_buff *skb)
@@ -440,7 +441,7 @@ static int rt2x00queue_write_tx_data(struct queue_entry *entry,
          * Map the skb to DMA.
          */
         if (test_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags))
-                rt2x00queue_map_txskb(rt2x00dev, entry->skb);
+                rt2x00queue_map_txskb(entry);
 
         return 0;
 }
@@ -491,7 +492,8 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
         if (unlikely(rt2x00queue_full(queue)))
                 return -ENOBUFS;
 
-        if (test_and_set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags)) {
+        if (unlikely(test_and_set_bit(ENTRY_OWNER_DEVICE_DATA,
+                                      &entry->flags))) {
                 ERROR(queue->rt2x00dev,
                       "Arrived at non-free entry in the non-full queue %d.\n"
                       "Please file bug report to %s.\n",
@@ -586,8 +588,7 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
         /*
          * Clean up the beacon skb.
          */
-        rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb);
-        intf->beacon->skb = NULL;
+        rt2x00queue_free_skb(intf->beacon);
 
         if (!enable_beacon) {
                 rt2x00dev->ops->lib->kill_tx_queue(intf->beacon->queue);
@@ -828,8 +829,7 @@ static int rt2x00queue_alloc_entries(struct data_queue *queue,
         return 0;
 }
 
-static void rt2x00queue_free_skbs(struct rt2x00_dev *rt2x00dev,
-                                  struct data_queue *queue)
+static void rt2x00queue_free_skbs(struct data_queue *queue)
 {
         unsigned int i;
 
@@ -837,19 +837,17 @@ static void rt2x00queue_free_skbs(struct rt2x00_dev *rt2x00dev,
                 return;
 
         for (i = 0; i < queue->limit; i++) {
-                if (queue->entries[i].skb)
-                        rt2x00queue_free_skb(rt2x00dev, queue->entries[i].skb);
+                rt2x00queue_free_skb(&queue->entries[i]);
         }
 }
 
-static int rt2x00queue_alloc_rxskbs(struct rt2x00_dev *rt2x00dev,
-                                    struct data_queue *queue)
+static int rt2x00queue_alloc_rxskbs(struct data_queue *queue)
 {
         unsigned int i;
         struct sk_buff *skb;
 
         for (i = 0; i < queue->limit; i++) {
-                skb = rt2x00queue_alloc_rxskb(rt2x00dev, &queue->entries[i]);
+                skb = rt2x00queue_alloc_rxskb(&queue->entries[i]);
                 if (!skb)
                         return -ENOMEM;
                 queue->entries[i].skb = skb;
@@ -884,7 +882,7 @@ int rt2x00queue_initialize(struct rt2x00_dev *rt2x00dev)
                         goto exit;
         }
 
-        status = rt2x00queue_alloc_rxskbs(rt2x00dev, rt2x00dev->rx);
+        status = rt2x00queue_alloc_rxskbs(rt2x00dev->rx);
         if (status)
                 goto exit;
 
@@ -902,7 +900,7 @@ void rt2x00queue_uninitialize(struct rt2x00_dev *rt2x00dev)
 {
         struct data_queue *queue;
 
-        rt2x00queue_free_skbs(rt2x00dev, rt2x00dev->rx);
+        rt2x00queue_free_skbs(rt2x00dev->rx);
 
         queue_for_each(rt2x00dev, queue) {
                 kfree(queue->entries);
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 4c5ae3d45625..b3317df7a7d4 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -208,7 +208,7 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
         struct queue_entry *entry = (struct queue_entry *)urb->context;
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
 
-        if (!__test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+        if (!test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
                 return;
 
         /*
@@ -220,7 +220,7 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
          * Check if the frame was correctly uploaded
          */
         if (urb->status)
-                __set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+                set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
 
         /*
          * Schedule the delayed work for reading the TX status
@@ -253,7 +253,10 @@ static void rt2x00usb_kick_tx_entry(struct queue_entry *entry)
                           entry->skb->data, length,
                           rt2x00usb_interrupt_txdone, entry);
 
-        usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
+        if (usb_submit_urb(entry_priv->urb, GFP_ATOMIC)) {
+                set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+                rt2x00lib_dmadone(entry);
+        }
 }
 
 void rt2x00usb_kick_tx_queue(struct data_queue *queue)
@@ -280,14 +283,6 @@ static void rt2x00usb_kill_tx_entry(struct queue_entry *entry)
         if ((entry->queue->qid == QID_BEACON) &&
             (test_bit(DRIVER_REQUIRE_BEACON_GUARD, &rt2x00dev->flags)))
                 usb_kill_urb(bcn_priv->guardian_urb);
-
-        /*
-         * We need a short delay here to wait for
-         * the URB to be canceled
-         */
-        do {
-                udelay(100);
-        } while (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags));
 }
 
 void rt2x00usb_kill_tx_queue(struct data_queue *queue)
@@ -363,10 +358,12 @@ void rt2x00usb_watchdog(struct rt2x00_dev *rt2x00dev)
         struct data_queue *queue;
 
         tx_queue_for_each(rt2x00dev, queue) {
-                if (rt2x00queue_dma_timeout(queue))
-                        rt2x00usb_watchdog_tx_dma(queue);
-                if (rt2x00queue_timeout(queue))
-                        rt2x00usb_watchdog_tx_status(queue);
+                if (!rt2x00queue_empty(queue)) {
+                        if (rt2x00queue_dma_timeout(queue))
+                                rt2x00usb_watchdog_tx_dma(queue);
+                        if (rt2x00queue_timeout(queue))
+                                rt2x00usb_watchdog_tx_status(queue);
+                }
         }
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_watchdog);
@@ -398,7 +395,7 @@ static void rt2x00usb_work_rxdone(struct work_struct *work)
                 /*
                  * Send the frame to rt2x00lib for further processing.
                  */
-                rt2x00lib_rxdone(rt2x00dev, entry);
+                rt2x00lib_rxdone(entry);
         }
 }
 
@@ -407,7 +404,7 @@ static void rt2x00usb_interrupt_rxdone(struct urb *urb)
         struct queue_entry *entry = (struct queue_entry *)urb->context;
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
 
-        if (!__test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+        if (!test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
                 return;
 
         /*
@@ -421,7 +418,7 @@ static void rt2x00usb_interrupt_rxdone(struct urb *urb)
          * a problem.
          */
         if (urb->actual_length < entry->queue->desc_size || urb->status)
-                __set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+                set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
 
         /*
          * Schedule the delayed work for reading the RX status
@@ -467,7 +464,10 @@ void rt2x00usb_clear_entry(struct queue_entry *entry)
                                 rt2x00usb_interrupt_rxdone, entry);
 
                 set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
-                usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
+                if (usb_submit_urb(entry_priv->urb, GFP_ATOMIC)) {
+                        set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+                        rt2x00lib_dmadone(entry);
+                }
         }
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_clear_entry);
@@ -542,9 +542,9 @@ static int rt2x00usb_find_endpoints(struct rt2x00_dev *rt2x00dev)
         return 0;
 }
 
-static int rt2x00usb_alloc_urb(struct rt2x00_dev *rt2x00dev,
-                               struct data_queue *queue)
+static int rt2x00usb_alloc_entries(struct data_queue *queue)
 {
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
         struct queue_entry_priv_usb *entry_priv;
         struct queue_entry_priv_usb_bcn *bcn_priv;
         unsigned int i;
@@ -561,7 +561,7 @@ static int rt2x00usb_alloc_urb(struct rt2x00_dev *rt2x00dev,
          * no guardian byte was required for the beacon,
          * then we are done.
          */
-        if (rt2x00dev->bcn != queue ||
+        if (queue->qid != QID_BEACON ||
             !test_bit(DRIVER_REQUIRE_BEACON_GUARD, &rt2x00dev->flags))
                 return 0;
 
@@ -575,9 +575,9 @@ static int rt2x00usb_alloc_urb(struct rt2x00_dev *rt2x00dev,
         return 0;
 }
 
-static void rt2x00usb_free_urb(struct rt2x00_dev *rt2x00dev,
-                               struct data_queue *queue)
+static void rt2x00usb_free_entries(struct data_queue *queue)
 {
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
         struct queue_entry_priv_usb *entry_priv;
         struct queue_entry_priv_usb_bcn *bcn_priv;
         unsigned int i;
@@ -596,7 +596,7 @@ static void rt2x00usb_free_urb(struct rt2x00_dev *rt2x00dev,
          * no guardian byte was required for the beacon,
          * then we are done.
          */
-        if (rt2x00dev->bcn != queue ||
+        if (queue->qid != QID_BEACON ||
             !test_bit(DRIVER_REQUIRE_BEACON_GUARD, &rt2x00dev->flags))
                 return;
 
@@ -623,7 +623,7 @@ int rt2x00usb_initialize(struct rt2x00_dev *rt2x00dev)
          * Allocate DMA
          */
         queue_for_each(rt2x00dev, queue) {
-                status = rt2x00usb_alloc_urb(rt2x00dev, queue);
+                status = rt2x00usb_alloc_entries(queue);
                 if (status)
                         goto exit;
         }
@@ -642,7 +642,7 @@ void rt2x00usb_uninitialize(struct rt2x00_dev *rt2x00dev)
         struct data_queue *queue;
 
         queue_for_each(rt2x00dev, queue)
-                rt2x00usb_free_urb(rt2x00dev, queue);
+                rt2x00usb_free_entries(queue);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_uninitialize);
 
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 3a7759929190..af548c87f108 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -594,7 +594,8 @@ static void rt61pci_config_intf(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt61pci_config_erp(struct rt2x00_dev *rt2x00dev,
-                               struct rt2x00lib_erp *erp)
+                               struct rt2x00lib_erp *erp,
+                               u32 changed)
 {
         u32 reg;
 
@@ -603,28 +604,36 @@ static void rt61pci_config_erp(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, TXRX_CSR0_TSF_OFFSET, IEEE80211_HEADER);
         rt2x00pci_register_write(rt2x00dev, TXRX_CSR0, reg);
 
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR4, &reg);
-        rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_ENABLE, 1);
-        rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_PREAMBLE,
-                           !!erp->short_preamble);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR4, reg);
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                rt2x00pci_register_read(rt2x00dev, TXRX_CSR4, &reg);
+                rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_ENABLE, 1);
+                rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_PREAMBLE,
+                                   !!erp->short_preamble);
+                rt2x00pci_register_write(rt2x00dev, TXRX_CSR4, reg);
+        }
 
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR5, erp->basic_rates);
+        if (changed & BSS_CHANGED_BASIC_RATES)
+                rt2x00pci_register_write(rt2x00dev, TXRX_CSR5,
+                                         erp->basic_rates);
 
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
-        rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_INTERVAL,
-                           erp->beacon_int * 16);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
+                rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_INTERVAL,
+                                   erp->beacon_int * 16);
+                rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+        }
 
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR9, &reg);
-        rt2x00_set_field32(&reg, MAC_CSR9_SLOT_TIME, erp->slot_time);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR9, reg);
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rt2x00pci_register_read(rt2x00dev, MAC_CSR9, &reg);
+                rt2x00_set_field32(&reg, MAC_CSR9_SLOT_TIME, erp->slot_time);
+                rt2x00pci_register_write(rt2x00dev, MAC_CSR9, reg);
 
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR8, &reg);
-        rt2x00_set_field32(&reg, MAC_CSR8_SIFS, erp->sifs);
-        rt2x00_set_field32(&reg, MAC_CSR8_SIFS_AFTER_RX_OFDM, 3);
-        rt2x00_set_field32(&reg, MAC_CSR8_EIFS, erp->eifs);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR8, reg);
+                rt2x00pci_register_read(rt2x00dev, MAC_CSR8, &reg);
+                rt2x00_set_field32(&reg, MAC_CSR8_SIFS, erp->sifs);
+                rt2x00_set_field32(&reg, MAC_CSR8_SIFS_AFTER_RX_OFDM, 3);
+                rt2x00_set_field32(&reg, MAC_CSR8_EIFS, erp->eifs);
+                rt2x00pci_register_write(rt2x00dev, MAC_CSR8, reg);
+        }
 }
 
 static void rt61pci_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
@@ -1645,6 +1654,7 @@ static void rt61pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
         rt2x00pci_register_read(rt2x00dev, INT_MASK_CSR, &reg);
         rt2x00_set_field32(&reg, INT_MASK_CSR_TXDONE, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_RXDONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_BEACON_DONE, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_ENABLE_MITIGATION, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_MITIGATION_PERIOD, 0xff);
         rt2x00pci_register_write(rt2x00dev, INT_MASK_CSR, reg);
@@ -1658,6 +1668,7 @@ static void rt61pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_5, mask);
         rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_6, mask);
         rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_7, mask);
+        rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_TWAKEUP, mask);
         rt2x00pci_register_write(rt2x00dev, MCU_INT_MASK_CSR, reg);
 }
 
@@ -2106,7 +2117,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
                                 "TX status report missed for entry %d\n",
                                 entry_done->entry_idx);
 
-                        rt2x00lib_txdone_noinfo(entry, TXDONE_UNKNOWN);
+                        rt2x00lib_txdone_noinfo(entry_done, TXDONE_UNKNOWN);
                         entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
                 }
 
@@ -2619,12 +2630,13 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
          * As rt61 has a global fallback table we cannot specify
          * more then one tx rate per frame but since the hw will
          * try several rates (based on the fallback table) we should
-         * still initialize max_rates to the maximum number of rates
+         * initialize max_report_rates to the maximum number of rates
          * we are going to try. Otherwise mac80211 will truncate our
          * reported tx rates and the rc algortihm will end up with
          * incorrect data.
          */
-        rt2x00dev->hw->max_rates = 7;
+        rt2x00dev->hw->max_rates = 1;
+        rt2x00dev->hw->max_report_rates = 7;
         rt2x00dev->hw->max_rate_tries = 1;
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 87fb2201537b..9be8089317e4 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -545,7 +545,8 @@ static void rt73usb_config_intf(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt73usb_config_erp(struct rt2x00_dev *rt2x00dev,
-                               struct rt2x00lib_erp *erp)
+                               struct rt2x00lib_erp *erp,
+                               u32 changed)
 {
         u32 reg;
 
@@ -554,28 +555,36 @@ static void rt73usb_config_erp(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, TXRX_CSR0_TSF_OFFSET, IEEE80211_HEADER);
         rt2x00usb_register_write(rt2x00dev, TXRX_CSR0, reg);
 
-        rt2x00usb_register_read(rt2x00dev, TXRX_CSR4, &reg);
-        rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_ENABLE, 1);
-        rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_PREAMBLE,
-                           !!erp->short_preamble);
-        rt2x00usb_register_write(rt2x00dev, TXRX_CSR4, reg);
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                rt2x00usb_register_read(rt2x00dev, TXRX_CSR4, &reg);
+                rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_ENABLE, 1);
+                rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_PREAMBLE,
+                                   !!erp->short_preamble);
+                rt2x00usb_register_write(rt2x00dev, TXRX_CSR4, reg);
+        }
 
-        rt2x00usb_register_write(rt2x00dev, TXRX_CSR5, erp->basic_rates);
+        if (changed & BSS_CHANGED_BASIC_RATES)
+                rt2x00usb_register_write(rt2x00dev, TXRX_CSR5,
+                                         erp->basic_rates);
 
-        rt2x00usb_register_read(rt2x00dev, TXRX_CSR9, &reg);
-        rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_INTERVAL,
-                           erp->beacon_int * 16);
-        rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                rt2x00usb_register_read(rt2x00dev, TXRX_CSR9, &reg);
+                rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_INTERVAL,
+                                   erp->beacon_int * 16);
+                rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
+        }
 
-        rt2x00usb_register_read(rt2x00dev, MAC_CSR9, &reg);
-        rt2x00_set_field32(&reg, MAC_CSR9_SLOT_TIME, erp->slot_time);
-        rt2x00usb_register_write(rt2x00dev, MAC_CSR9, reg);
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rt2x00usb_register_read(rt2x00dev, MAC_CSR9, &reg);
+                rt2x00_set_field32(&reg, MAC_CSR9_SLOT_TIME, erp->slot_time);
+                rt2x00usb_register_write(rt2x00dev, MAC_CSR9, reg);
 
-        rt2x00usb_register_read(rt2x00dev, MAC_CSR8, &reg);
-        rt2x00_set_field32(&reg, MAC_CSR8_SIFS, erp->sifs);
-        rt2x00_set_field32(&reg, MAC_CSR8_SIFS_AFTER_RX_OFDM, 3);
-        rt2x00_set_field32(&reg, MAC_CSR8_EIFS, erp->eifs);
-        rt2x00usb_register_write(rt2x00dev, MAC_CSR8, reg);
+                rt2x00usb_register_read(rt2x00dev, MAC_CSR8, &reg);
+                rt2x00_set_field32(&reg, MAC_CSR8_SIFS, erp->sifs);
+                rt2x00_set_field32(&reg, MAC_CSR8_SIFS_AFTER_RX_OFDM, 3);
+                rt2x00_set_field32(&reg, MAC_CSR8_EIFS, erp->eifs);
+                rt2x00usb_register_write(rt2x00dev, MAC_CSR8, reg);
+        }
 }
 
 static void rt73usb_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
@@ -2054,9 +2063,14 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 
         /*
          * Initialize all hw fields.
+         *
+         * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING unless we are
+         * capable of sending the buffered frames out after the DTIM
+         * transmission using rt2x00lib_beacondone. This will send out
+         * multicast and broadcast traffic immediately instead of buffering it
+         * infinitly and thus dropping it after some time.
          */
         rt2x00dev->hw->flags =
-            IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
             IEEE80211_HW_SIGNAL_DBM |
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK;
@@ -2356,6 +2370,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x0411, 0x00f4), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0411, 0x0116), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0411, 0x0119), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0411, 0x0137), USB_DEVICE_DATA(&rt73usb_ops) },
         /* CEIVA */
         { USB_DEVICE(0x178d, 0x02be), USB_DEVICE_DATA(&rt73usb_ops) },
         /* CNet */
diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
index 05c6badbe201..707c688da618 100644
--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
@@ -99,66 +99,19 @@ void rtl8180_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data)
         }
 }
 
-static void rtl8180_handle_tx(struct ieee80211_hw *dev)
+static void rtl8180_handle_rx(struct ieee80211_hw *dev)
 {
         struct rtl8180_priv *priv = dev->priv;
-        struct rtl8180_tx_ring *ring;
-        int prio;
-
-        spin_lock(&priv->lock);
-
-        for (prio = 3; prio >= 0; prio--) {
-                ring = &priv->tx_ring[prio];
-
-                while (skb_queue_len(&ring->queue)) {
-                        struct rtl8180_tx_desc *entry = &ring->desc[ring->idx];
-                        struct sk_buff *skb;
-                        struct ieee80211_tx_info *info;
-                        u32 flags = le32_to_cpu(entry->flags);
-
-                        if (flags & RTL818X_TX_DESC_FLAG_OWN)
-                                break;
-
-                        ring->idx = (ring->idx + 1) % ring->entries;
-                        skb = __skb_dequeue(&ring->queue);
-                        pci_unmap_single(priv->pdev, le32_to_cpu(entry->tx_buf),
-                                         skb->len, PCI_DMA_TODEVICE);
-
-                        info = IEEE80211_SKB_CB(skb);
-                        ieee80211_tx_info_clear_status(info);
-
-                        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
-                            (flags & RTL818X_TX_DESC_FLAG_TX_OK))
-                                info->flags |= IEEE80211_TX_STAT_ACK;
-
-                        info->status.rates[0].count = (flags & 0xFF) + 1;
-                        info->status.rates[1].idx = -1;
-
-                        ieee80211_tx_status(dev, skb);
-                        if (ring->entries - skb_queue_len(&ring->queue) == 2)
-                                ieee80211_wake_queue(dev, prio);
-                }
-        }
-
-        spin_unlock(&priv->lock);
-}
-
-static int rtl8180_poll(struct ieee80211_hw *dev, int budget)
-{
-        struct rtl8180_priv *priv = dev->priv;
-        unsigned int count = 0;
+        unsigned int count = 32;
         u8 signal, agc, sq;
 
-        /* handle pending Tx queue cleanup */
-        rtl8180_handle_tx(dev);
-
-        while (count++ < budget) {
+        while (count--) {
                 struct rtl8180_rx_desc *entry = &priv->rx_ring[priv->rx_idx];
                 struct sk_buff *skb = priv->rx_buf[priv->rx_idx];
                 u32 flags = le32_to_cpu(entry->flags);
 
                 if (flags & RTL818X_RX_DESC_FLAG_OWN)
-                        break;
+                        return;
 
                 if (unlikely(flags & (RTL818X_RX_DESC_FLAG_DMA_FAIL |
                                       RTL818X_RX_DESC_FLAG_FOF |
@@ -198,7 +151,7 @@ static int rtl8180_poll(struct ieee80211_hw *dev, int budget)
                                 rx_status.flag |= RX_FLAG_FAILED_FCS_CRC;
 
                         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
-                        ieee80211_rx(dev, skb);
+                        ieee80211_rx_irqsafe(dev, skb);
 
                         skb = new_skb;
                         priv->rx_buf[priv->rx_idx] = skb;
@@ -215,16 +168,41 @@ static int rtl8180_poll(struct ieee80211_hw *dev, int budget)
                         entry->flags |= cpu_to_le32(RTL818X_RX_DESC_FLAG_EOR);
                 priv->rx_idx = (priv->rx_idx + 1) % 32;
         }
+}
+
+static void rtl8180_handle_tx(struct ieee80211_hw *dev, unsigned int prio)
+{
+        struct rtl8180_priv *priv = dev->priv;
+        struct rtl8180_tx_ring *ring = &priv->tx_ring[prio];
 
-        if (count < budget) {
-                /* disable polling */
-                ieee80211_napi_complete(dev);
+        while (skb_queue_len(&ring->queue)) {
+                struct rtl8180_tx_desc *entry = &ring->desc[ring->idx];
+                struct sk_buff *skb;
+                struct ieee80211_tx_info *info;
+                u32 flags = le32_to_cpu(entry->flags);
 
-                /* enable interrupts */
-                rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0xFFFF);
-        }
+                if (flags & RTL818X_TX_DESC_FLAG_OWN)
+                        return;
+
+                ring->idx = (ring->idx + 1) % ring->entries;
+                skb = __skb_dequeue(&ring->queue);
+                pci_unmap_single(priv->pdev, le32_to_cpu(entry->tx_buf),
+                                 skb->len, PCI_DMA_TODEVICE);
+
+                info = IEEE80211_SKB_CB(skb);
+                ieee80211_tx_info_clear_status(info);
+
+                if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
+                    (flags & RTL818X_TX_DESC_FLAG_TX_OK))
+                        info->flags |= IEEE80211_TX_STAT_ACK;
+
+                info->status.rates[0].count = (flags & 0xFF) + 1;
+                info->status.rates[1].idx = -1;
 
-        return count;
+                ieee80211_tx_status_irqsafe(dev, skb);
+                if (ring->entries - skb_queue_len(&ring->queue) == 2)
+                        ieee80211_wake_queue(dev, prio);
+        }
 }
 
 static irqreturn_t rtl8180_interrupt(int irq, void *dev_id)
@@ -233,17 +211,31 @@ static irqreturn_t rtl8180_interrupt(int irq, void *dev_id)
         struct rtl8180_priv *priv = dev->priv;
         u16 reg;
 
+        spin_lock(&priv->lock);
         reg = rtl818x_ioread16(priv, &priv->map->INT_STATUS);
-        if (unlikely(reg == 0xFFFF))
+        if (unlikely(reg == 0xFFFF)) {
+                spin_unlock(&priv->lock);
                 return IRQ_HANDLED;
+        }
 
         rtl818x_iowrite16(priv, &priv->map->INT_STATUS, reg);
 
-        /* disable interrupts */
-        rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0);
+        if (reg & (RTL818X_INT_TXB_OK | RTL818X_INT_TXB_ERR))
+                rtl8180_handle_tx(dev, 3);
+
+        if (reg & (RTL818X_INT_TXH_OK | RTL818X_INT_TXH_ERR))
+                rtl8180_handle_tx(dev, 2);
+
+        if (reg & (RTL818X_INT_TXN_OK | RTL818X_INT_TXN_ERR))
+                rtl8180_handle_tx(dev, 1);
 
-        /* enable polling */
-        ieee80211_napi_schedule(dev);
+        if (reg & (RTL818X_INT_TXL_OK | RTL818X_INT_TXL_ERR))
+                rtl8180_handle_tx(dev, 0);
+
+        if (reg & (RTL818X_INT_RX_OK | RTL818X_INT_RX_ERR))
+                rtl8180_handle_rx(dev);
+
+        spin_unlock(&priv->lock);
 
         return IRQ_HANDLED;
 }
@@ -255,6 +247,7 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         struct rtl8180_priv *priv = dev->priv;
         struct rtl8180_tx_ring *ring;
         struct rtl8180_tx_desc *entry;
+        unsigned long flags;
         unsigned int idx, prio;
         dma_addr_t mapping;
         u32 tx_flags;
@@ -301,7 +294,7 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
                         plcp_len |= 1 << 15;
         }
 
-        spin_lock(&priv->lock);
+        spin_lock_irqsave(&priv->lock, flags);
 
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
                 if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
@@ -325,7 +318,7 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         if (ring->entries - skb_queue_len(&ring->queue) < 2)
                 ieee80211_stop_queue(dev, prio);
 
-        spin_unlock(&priv->lock);
+        spin_unlock_irqrestore(&priv->lock, flags);
 
         rtl818x_iowrite8(priv, &priv->map->TX_DMA_POLLING, (1 << (prio + 4)));
 
@@ -871,7 +864,6 @@ static const struct ieee80211_ops rtl8180_ops = {
         .prepare_multicast      = rtl8180_prepare_multicast,
         .configure_filter       = rtl8180_configure_filter,
         .get_tsf                = rtl8180_get_tsf,
-        .napi_poll              = rtl8180_poll,
 };
 
 static void rtl8180_eeprom_register_read(struct eeprom_93cx6 *eeprom)
@@ -1003,8 +995,6 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
         dev->queues = 1;
         dev->max_signal = 65;
 
-        dev->napi_weight = 64;
-
         reg = rtl818x_ioread32(priv, &priv->map->TX_CONF);
         reg &= RTL818X_TX_CONF_HWVER_MASK;
         switch (reg) {
diff --git a/drivers/net/wireless/wl1251/Kconfig b/drivers/net/wireless/wl1251/Kconfig
new file mode 100644
index 000000000000..1fb65849414f
--- /dev/null
+++ b/drivers/net/wireless/wl1251/Kconfig
@@ -0,0 +1,33 @@
+menuconfig WL1251
+        tristate "TI wl1251 driver support"
+        depends on MAC80211 && EXPERIMENTAL && GENERIC_HARDIRQS
+        select FW_LOADER
+        select CRC7
+        ---help---
+          This will enable TI wl1251 driver support. The drivers make
+          use of the mac80211 stack.
+
+          If you choose to build a module, it'll be called wl1251. Say
+          N if unsure.
+
+config WL1251_SPI
+        tristate "TI wl1251 SPI support"
+        depends on WL1251 && SPI_MASTER
+        ---help---
+          This module adds support for the SPI interface of adapters using
+          TI wl1251 chipset.  Select this if your platform is using
+          the SPI bus.
+
+          If you choose to build a module, it'll be called wl1251_spi.
+          Say N if unsure.
+
+config WL1251_SDIO
+        tristate "TI wl1251 SDIO support"
+        depends on WL1251 && MMC
+        ---help---
+          This module adds support for the SDIO interface of adapters using
+          TI wl1251 chipset.  Select this if your platform is using
+          the SDIO bus.
+
+          If you choose to build a module, it'll be called
+          wl1251_sdio. Say N if unsure.
diff --git a/drivers/net/wireless/wl1251/Makefile b/drivers/net/wireless/wl1251/Makefile
new file mode 100644
index 000000000000..4fe246824db3
--- /dev/null
+++ b/drivers/net/wireless/wl1251/Makefile
@@ -0,0 +1,6 @@
+wl1251-objs             = main.o event.o tx.o rx.o ps.o cmd.o \
+                          acx.o boot.o init.o debugfs.o io.o
+
+obj-$(CONFIG_WL1251)    += wl1251.o
+obj-$(CONFIG_WL1251_SPI)        += spi.o
+obj-$(CONFIG_WL1251_SDIO)       += sdio.o
diff --git a/drivers/net/wireless/wl12xx/wl1251_acx.c b/drivers/net/wireless/wl1251/acx.c
index 2f8a2ba744dc..64a0214cfb29 100644
--- a/drivers/net/wireless/wl12xx/wl1251_acx.c
+++ b/drivers/net/wireless/wl1251/acx.c
@@ -1,13 +1,13 @@
-#include "wl1251_acx.h"
+#include "acx.h"
 
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/crc7.h>
 
 #include "wl1251.h"
-#include "wl1251_reg.h"
-#include "wl1251_cmd.h"
-#include "wl1251_ps.h"
+#include "reg.h"
+#include "cmd.h"
+#include "ps.h"
 
 int wl1251_acx_frame_rates(struct wl1251 *wl, u8 ctrl_rate, u8 ctrl_mod,
                            u8 mgt_rate, u8 mgt_mod)
diff --git a/drivers/net/wireless/wl12xx/wl1251_acx.h b/drivers/net/wireless/wl1251/acx.h
index c7cc5c1e8a75..e54b21a4f8b1 100644
--- a/drivers/net/wireless/wl12xx/wl1251_acx.h
+++ b/drivers/net/wireless/wl1251/acx.h
@@ -24,7 +24,7 @@
 #define __WL1251_ACX_H__
 
 #include "wl1251.h"
-#include "wl1251_cmd.h"
+#include "cmd.h"
 
 /* Target's information element */
 struct acx_header {
diff --git a/drivers/net/wireless/wl12xx/wl1251_boot.c b/drivers/net/wireless/wl1251/boot.c
index 468b47b0328a..61572dfa1f60 100644
--- a/drivers/net/wireless/wl12xx/wl1251_boot.c
+++ b/drivers/net/wireless/wl1251/boot.c
@@ -22,12 +22,12 @@
 #include <linux/gpio.h>
 #include <linux/slab.h>
 
-#include "wl1251_reg.h"
-#include "wl1251_boot.h"
-#include "wl1251_io.h"
-#include "wl1251_spi.h"
-#include "wl1251_event.h"
-#include "wl1251_acx.h"
+#include "reg.h"
+#include "boot.h"
+#include "io.h"
+#include "spi.h"
+#include "event.h"
+#include "acx.h"
 
 void wl1251_boot_target_enable_interrupts(struct wl1251 *wl)
 {
diff --git a/drivers/net/wireless/wl12xx/wl1251_boot.h b/drivers/net/wireless/wl1251/boot.h
index 7661bc5e4662..7661bc5e4662 100644
--- a/drivers/net/wireless/wl12xx/wl1251_boot.h
+++ b/drivers/net/wireless/wl1251/boot.h
diff --git a/drivers/net/wireless/wl12xx/wl1251_cmd.c b/drivers/net/wireless/wl1251/cmd.c
index 15fb68c6b542..0ade4bd617c0 100644
--- a/drivers/net/wireless/wl12xx/wl1251_cmd.c
+++ b/drivers/net/wireless/wl1251/cmd.c
@@ -1,14 +1,14 @@
-#include "wl1251_cmd.h"
+#include "cmd.h"
 
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/crc7.h>
 
 #include "wl1251.h"
-#include "wl1251_reg.h"
-#include "wl1251_io.h"
-#include "wl1251_ps.h"
-#include "wl1251_acx.h"
+#include "reg.h"
+#include "io.h"
+#include "ps.h"
+#include "acx.h"
 
 /**
  * send command to firmware
diff --git a/drivers/net/wireless/wl12xx/wl1251_cmd.h b/drivers/net/wireless/wl1251/cmd.h
index e5c74c631374..e5c74c631374 100644
--- a/drivers/net/wireless/wl12xx/wl1251_cmd.h
+++ b/drivers/net/wireless/wl1251/cmd.h
diff --git a/drivers/net/wireless/wl12xx/wl1251_debugfs.c b/drivers/net/wireless/wl1251/debugfs.c
index 6ffe4cd58561..6e5caaa9f613 100644
--- a/drivers/net/wireless/wl12xx/wl1251_debugfs.c
+++ b/drivers/net/wireless/wl1251/debugfs.c
@@ -19,14 +19,14 @@
  *
  */
 
-#include "wl1251_debugfs.h"
+#include "debugfs.h"
 
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 
 #include "wl1251.h"
-#include "wl1251_acx.h"
-#include "wl1251_ps.h"
+#include "acx.h"
+#include "ps.h"
 
 /* ms */
 #define WL1251_DEBUGFS_STATS_LIFETIME 1000
diff --git a/drivers/net/wireless/wl12xx/wl1251_debugfs.h b/drivers/net/wireless/wl1251/debugfs.h
index b3417c02a218..b3417c02a218 100644
--- a/drivers/net/wireless/wl12xx/wl1251_debugfs.h
+++ b/drivers/net/wireless/wl1251/debugfs.h
diff --git a/drivers/net/wireless/wl12xx/wl1251_event.c b/drivers/net/wireless/wl1251/event.c
index 54223556b308..712372e50a87 100644
--- a/drivers/net/wireless/wl12xx/wl1251_event.c
+++ b/drivers/net/wireless/wl1251/event.c
@@ -21,10 +21,10 @@
  */
 
 #include "wl1251.h"
-#include "wl1251_reg.h"
-#include "wl1251_io.h"
-#include "wl1251_event.h"
-#include "wl1251_ps.h"
+#include "reg.h"
+#include "io.h"
+#include "event.h"
+#include "ps.h"
 
 static int wl1251_event_scan_complete(struct wl1251 *wl,
                                       struct event_mailbox *mbox)
diff --git a/drivers/net/wireless/wl12xx/wl1251_event.h b/drivers/net/wireless/wl1251/event.h
index 30eb5d150bf7..30eb5d150bf7 100644
--- a/drivers/net/wireless/wl12xx/wl1251_event.h
+++ b/drivers/net/wireless/wl1251/event.h
diff --git a/drivers/net/wireless/wl12xx/wl1251_init.c b/drivers/net/wireless/wl1251/init.c
index c5daec05d9ee..89b43d35473c 100644
--- a/drivers/net/wireless/wl12xx/wl1251_init.c
+++ b/drivers/net/wireless/wl1251/init.c
@@ -23,11 +23,11 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 
-#include "wl1251_init.h"
+#include "init.h"
 #include "wl12xx_80211.h"
-#include "wl1251_acx.h"
-#include "wl1251_cmd.h"
-#include "wl1251_reg.h"
+#include "acx.h"
+#include "cmd.h"
+#include "reg.h"
 
 int wl1251_hw_init_hwenc_config(struct wl1251 *wl)
 {
diff --git a/drivers/net/wireless/wl12xx/wl1251_init.h b/drivers/net/wireless/wl1251/init.h
index 543f17582ead..543f17582ead 100644
--- a/drivers/net/wireless/wl12xx/wl1251_init.h
+++ b/drivers/net/wireless/wl1251/init.h
diff --git a/drivers/net/wireless/wl12xx/wl1251_io.c b/drivers/net/wireless/wl1251/io.c
index ad6ca68b303f..cdcadbf6ac2c 100644
--- a/drivers/net/wireless/wl12xx/wl1251_io.c
+++ b/drivers/net/wireless/wl1251/io.c
@@ -20,8 +20,8 @@
  */
 
 #include "wl1251.h"
-#include "wl1251_reg.h"
-#include "wl1251_io.h"
+#include "reg.h"
+#include "io.h"
 
 /* FIXME: this is static data nowadays and the table can be removed */
 static enum wl12xx_acx_int_reg wl1251_io_reg_table[ACX_REG_TABLE_LEN] = {
diff --git a/drivers/net/wireless/wl12xx/wl1251_io.h b/drivers/net/wireless/wl1251/io.h
index c545e9d5f512..c545e9d5f512 100644
--- a/drivers/net/wireless/wl12xx/wl1251_io.h
+++ b/drivers/net/wireless/wl1251/io.h
diff --git a/drivers/net/wireless/wl12xx/wl1251_main.c b/drivers/net/wireless/wl1251/main.c
index faf221ca3f41..7a8762553cdc 100644
--- a/drivers/net/wireless/wl12xx/wl1251_main.c
+++ b/drivers/net/wireless/wl1251/main.c
@@ -31,16 +31,16 @@
 
 #include "wl1251.h"
 #include "wl12xx_80211.h"
-#include "wl1251_reg.h"
-#include "wl1251_io.h"
-#include "wl1251_cmd.h"
-#include "wl1251_event.h"
-#include "wl1251_tx.h"
-#include "wl1251_rx.h"
-#include "wl1251_ps.h"
-#include "wl1251_init.h"
-#include "wl1251_debugfs.h"
-#include "wl1251_boot.h"
+#include "reg.h"
+#include "io.h"
+#include "cmd.h"
+#include "event.h"
+#include "tx.h"
+#include "rx.h"
+#include "ps.h"
+#include "init.h"
+#include "debugfs.h"
+#include "boot.h"
 
 void wl1251_enable_interrupts(struct wl1251 *wl)
 {
diff --git a/drivers/net/wireless/wl12xx/wl1251_ps.c b/drivers/net/wireless/wl1251/ps.c
index 0b997bdfec09..5ed47c8373d2 100644
--- a/drivers/net/wireless/wl12xx/wl1251_ps.c
+++ b/drivers/net/wireless/wl1251/ps.c
@@ -19,10 +19,10 @@
  *
  */
 
-#include "wl1251_reg.h"
-#include "wl1251_ps.h"
-#include "wl1251_cmd.h"
-#include "wl1251_io.h"
+#include "reg.h"
+#include "ps.h"
+#include "cmd.h"
+#include "io.h"
 
 /* in ms */
 #define WL1251_WAKEUP_TIMEOUT 100
diff --git a/drivers/net/wireless/wl12xx/wl1251_ps.h b/drivers/net/wireless/wl1251/ps.h
index e5db81fc1dfc..55c3dda75e69 100644
--- a/drivers/net/wireless/wl12xx/wl1251_ps.h
+++ b/drivers/net/wireless/wl1251/ps.h
@@ -24,7 +24,7 @@
 #define __WL1251_PS_H__
 
 #include "wl1251.h"
-#include "wl1251_acx.h"
+#include "acx.h"
 
 int wl1251_ps_set_mode(struct wl1251 *wl, enum wl1251_cmd_ps_mode mode);
 void wl1251_ps_elp_sleep(struct wl1251 *wl);
diff --git a/drivers/net/wireless/wl12xx/wl1251_reg.h b/drivers/net/wireless/wl1251/reg.h
index a5809019c5c1..a5809019c5c1 100644
--- a/drivers/net/wireless/wl12xx/wl1251_reg.h
+++ b/drivers/net/wireless/wl1251/reg.h
diff --git a/drivers/net/wireless/wl12xx/wl1251_rx.c b/drivers/net/wireless/wl1251/rx.c
index 25764592a596..efa53607d5c9 100644
--- a/drivers/net/wireless/wl12xx/wl1251_rx.c
+++ b/drivers/net/wireless/wl1251/rx.c
@@ -25,11 +25,11 @@
 #include <net/mac80211.h>
 
 #include "wl1251.h"
-#include "wl1251_reg.h"
-#include "wl1251_io.h"
-#include "wl1251_rx.h"
-#include "wl1251_cmd.h"
-#include "wl1251_acx.h"
+#include "reg.h"
+#include "io.h"
+#include "rx.h"
+#include "cmd.h"
+#include "acx.h"
 
 static void wl1251_rx_header(struct wl1251 *wl,
                              struct wl1251_rx_descriptor *desc)
diff --git a/drivers/net/wireless/wl12xx/wl1251_rx.h b/drivers/net/wireless/wl1251/rx.h
index 4448f635a4d8..4448f635a4d8 100644
--- a/drivers/net/wireless/wl12xx/wl1251_rx.h
+++ b/drivers/net/wireless/wl1251/rx.h
diff --git a/drivers/net/wireless/wl12xx/wl1251_sdio.c b/drivers/net/wireless/wl1251/sdio.c
index c0b68b0a9aa8..74ba9ced5393 100644
--- a/drivers/net/wireless/wl12xx/wl1251_sdio.c
+++ b/drivers/net/wireless/wl1251/sdio.c
@@ -24,7 +24,7 @@
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/sdio_ids.h>
 #include <linux/platform_device.h>
-#include <linux/spi/wl12xx.h>
+#include <linux/wl12xx.h>
 #include <linux/irq.h>
 
 #include "wl1251.h"
diff --git a/drivers/net/wireless/wl12xx/wl1251_spi.c b/drivers/net/wireless/wl1251/spi.c
index 334ded9881c0..88fa8e69d0d1 100644
--- a/drivers/net/wireless/wl12xx/wl1251_spi.c
+++ b/drivers/net/wireless/wl1251/spi.c
@@ -24,11 +24,11 @@
 #include <linux/slab.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
-#include <linux/spi/wl12xx.h>
+#include <linux/wl12xx.h>
 
 #include "wl1251.h"
-#include "wl1251_reg.h"
-#include "wl1251_spi.h"
+#include "reg.h"
+#include "spi.h"
 
 static irqreturn_t wl1251_irq(int irq, void *cookie)
 {
diff --git a/drivers/net/wireless/wl12xx/wl1251_spi.h b/drivers/net/wireless/wl1251/spi.h
index 7dcf3cf7ae40..16d506955cc0 100644
--- a/drivers/net/wireless/wl12xx/wl1251_spi.h
+++ b/drivers/net/wireless/wl1251/spi.h
@@ -23,9 +23,9 @@
 #ifndef __WL1251_SPI_H__
 #define __WL1251_SPI_H__
 
-#include "wl1251_cmd.h"
-#include "wl1251_acx.h"
-#include "wl1251_reg.h"
+#include "cmd.h"
+#include "acx.h"
+#include "reg.h"
 
 #define WSPI_CMD_READ                 0x40000000
 #define WSPI_CMD_WRITE                0x00000000
diff --git a/drivers/net/wireless/wl12xx/wl1251_tx.c b/drivers/net/wireless/wl1251/tx.c
index 388492a7f41f..554b4f9a3d3e 100644
--- a/drivers/net/wireless/wl12xx/wl1251_tx.c
+++ b/drivers/net/wireless/wl1251/tx.c
@@ -24,10 +24,10 @@
 #include <linux/module.h>
 
 #include "wl1251.h"
-#include "wl1251_reg.h"
-#include "wl1251_tx.h"
-#include "wl1251_ps.h"
-#include "wl1251_io.h"
+#include "reg.h"
+#include "tx.h"
+#include "ps.h"
+#include "io.h"
 
 static bool wl1251_tx_double_buffer_busy(struct wl1251 *wl, u32 data_out_count)
 {
diff --git a/drivers/net/wireless/wl12xx/wl1251_tx.h b/drivers/net/wireless/wl1251/tx.h
index 96011e78cd5a..81338d39b43e 100644
--- a/drivers/net/wireless/wl12xx/wl1251_tx.h
+++ b/drivers/net/wireless/wl1251/tx.h
@@ -24,7 +24,7 @@
 #define __WL1251_TX_H__
 
 #include <linux/bitops.h>
-#include "wl1251_acx.h"
+#include "acx.h"
 
 /*
  *
diff --git a/drivers/net/wireless/wl12xx/wl1251.h b/drivers/net/wireless/wl1251/wl1251.h
index e113d4c1fb35..e113d4c1fb35 100644
--- a/drivers/net/wireless/wl12xx/wl1251.h
+++ b/drivers/net/wireless/wl1251/wl1251.h
diff --git a/drivers/net/wireless/wl1251/wl12xx_80211.h b/drivers/net/wireless/wl1251/wl12xx_80211.h
new file mode 100644
index 000000000000..184628027213
--- /dev/null
+++ b/drivers/net/wireless/wl1251/wl12xx_80211.h
@@ -0,0 +1,156 @@
+#ifndef __WL12XX_80211_H__
+#define __WL12XX_80211_H__
+
+#include <linux/if_ether.h>     /* ETH_ALEN */
+
+/* RATES */
+#define IEEE80211_CCK_RATE_1MB                  0x02
+#define IEEE80211_CCK_RATE_2MB                  0x04
+#define IEEE80211_CCK_RATE_5MB                  0x0B
+#define IEEE80211_CCK_RATE_11MB                 0x16
+#define IEEE80211_OFDM_RATE_6MB                 0x0C
+#define IEEE80211_OFDM_RATE_9MB                 0x12
+#define IEEE80211_OFDM_RATE_12MB                0x18
+#define IEEE80211_OFDM_RATE_18MB                0x24
+#define IEEE80211_OFDM_RATE_24MB                0x30
+#define IEEE80211_OFDM_RATE_36MB                0x48
+#define IEEE80211_OFDM_RATE_48MB                0x60
+#define IEEE80211_OFDM_RATE_54MB                0x6C
+#define IEEE80211_BASIC_RATE_MASK               0x80
+
+#define IEEE80211_CCK_RATE_1MB_MASK             (1<<0)
+#define IEEE80211_CCK_RATE_2MB_MASK             (1<<1)
+#define IEEE80211_CCK_RATE_5MB_MASK             (1<<2)
+#define IEEE80211_CCK_RATE_11MB_MASK            (1<<3)
+#define IEEE80211_OFDM_RATE_6MB_MASK            (1<<4)
+#define IEEE80211_OFDM_RATE_9MB_MASK            (1<<5)
+#define IEEE80211_OFDM_RATE_12MB_MASK           (1<<6)
+#define IEEE80211_OFDM_RATE_18MB_MASK           (1<<7)
+#define IEEE80211_OFDM_RATE_24MB_MASK           (1<<8)
+#define IEEE80211_OFDM_RATE_36MB_MASK           (1<<9)
+#define IEEE80211_OFDM_RATE_48MB_MASK           (1<<10)
+#define IEEE80211_OFDM_RATE_54MB_MASK           (1<<11)
+
+#define IEEE80211_CCK_RATES_MASK          0x0000000F
+#define IEEE80211_CCK_BASIC_RATES_MASK   (IEEE80211_CCK_RATE_1MB_MASK | \
+        IEEE80211_CCK_RATE_2MB_MASK)
+#define IEEE80211_CCK_DEFAULT_RATES_MASK (IEEE80211_CCK_BASIC_RATES_MASK | \
+        IEEE80211_CCK_RATE_5MB_MASK | \
+        IEEE80211_CCK_RATE_11MB_MASK)
+
+#define IEEE80211_OFDM_RATES_MASK         0x00000FF0
+#define IEEE80211_OFDM_BASIC_RATES_MASK   (IEEE80211_OFDM_RATE_6MB_MASK | \
+        IEEE80211_OFDM_RATE_12MB_MASK | \
+        IEEE80211_OFDM_RATE_24MB_MASK)
+#define IEEE80211_OFDM_DEFAULT_RATES_MASK (IEEE80211_OFDM_BASIC_RATES_MASK | \
+        IEEE80211_OFDM_RATE_9MB_MASK  | \
+        IEEE80211_OFDM_RATE_18MB_MASK | \
+        IEEE80211_OFDM_RATE_36MB_MASK | \
+        IEEE80211_OFDM_RATE_48MB_MASK | \
+        IEEE80211_OFDM_RATE_54MB_MASK)
+#define IEEE80211_DEFAULT_RATES_MASK (IEEE80211_OFDM_DEFAULT_RATES_MASK | \
+                                      IEEE80211_CCK_DEFAULT_RATES_MASK)
+
+
+/* This really should be 8, but not for our firmware */
+#define MAX_SUPPORTED_RATES 32
+#define COUNTRY_STRING_LEN 3
+#define MAX_COUNTRY_TRIPLETS 32
+
+/* Headers */
+struct ieee80211_header {
+        __le16 frame_ctl;
+        __le16 duration_id;
+        u8 da[ETH_ALEN];
+        u8 sa[ETH_ALEN];
+        u8 bssid[ETH_ALEN];
+        __le16 seq_ctl;
+        u8 payload[0];
+} __packed;
+
+struct wl12xx_ie_header {
+        u8 id;
+        u8 len;
+} __packed;
+
+/* IEs */
+
+struct wl12xx_ie_ssid {
+        struct wl12xx_ie_header header;
+        char ssid[IW_ESSID_MAX_SIZE];
+} __packed;
+
+struct wl12xx_ie_rates {
+        struct wl12xx_ie_header header;
+        u8 rates[MAX_SUPPORTED_RATES];
+} __packed;
+
+struct wl12xx_ie_ds_params {
+        struct wl12xx_ie_header header;
+        u8 channel;
+} __packed;
+
+struct country_triplet {
+        u8 channel;
+        u8 num_channels;
+        u8 max_tx_power;
+} __packed;
+
+struct wl12xx_ie_country {
+        struct wl12xx_ie_header header;
+        u8 country_string[COUNTRY_STRING_LEN];
+        struct country_triplet triplets[MAX_COUNTRY_TRIPLETS];
+} __packed;
+
+
+/* Templates */
+
+struct wl12xx_beacon_template {
+        struct ieee80211_header header;
+        __le32 time_stamp[2];
+        __le16 beacon_interval;
+        __le16 capability;
+        struct wl12xx_ie_ssid ssid;
+        struct wl12xx_ie_rates rates;
+        struct wl12xx_ie_rates ext_rates;
+        struct wl12xx_ie_ds_params ds_params;
+        struct wl12xx_ie_country country;
+} __packed;
+
+struct wl12xx_null_data_template {
+        struct ieee80211_header header;
+} __packed;
+
+struct wl12xx_ps_poll_template {
+        __le16 fc;
+        __le16 aid;
+        u8 bssid[ETH_ALEN];
+        u8 ta[ETH_ALEN];
+} __packed;
+
+struct wl12xx_qos_null_data_template {
+        struct ieee80211_header header;
+        __le16 qos_ctl;
+} __packed;
+
+struct wl12xx_probe_req_template {
+        struct ieee80211_header header;
+        struct wl12xx_ie_ssid ssid;
+        struct wl12xx_ie_rates rates;
+        struct wl12xx_ie_rates ext_rates;
+} __packed;
+
+
+struct wl12xx_probe_resp_template {
+        struct ieee80211_header header;
+        __le32 time_stamp[2];
+        __le16 beacon_interval;
+        __le16 capability;
+        struct wl12xx_ie_ssid ssid;
+        struct wl12xx_ie_rates rates;
+        struct wl12xx_ie_rates ext_rates;
+        struct wl12xx_ie_ds_params ds_params;
+        struct wl12xx_ie_country country;
+} __packed;
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/Kconfig b/drivers/net/wireless/wl12xx/Kconfig
index 2f98058be451..b447559f1db5 100644
--- a/drivers/net/wireless/wl12xx/Kconfig
+++ b/drivers/net/wireless/wl12xx/Kconfig
@@ -5,40 +5,6 @@ menuconfig WL12XX
           This will enable TI wl12xx driver support. The drivers make
           use of the mac80211 stack.
 
-config WL1251
-        tristate "TI wl1251 support"
-        depends on WL12XX && GENERIC_HARDIRQS
-        select FW_LOADER
-        select CRC7
-        ---help---
-          This module adds support for wireless adapters based on
-          TI wl1251 chipset.
-
-          If you choose to build a module, it'll be called wl1251. Say
-          N if unsure.
-
-config WL1251_SPI
-        tristate "TI wl1251 SPI support"
-        depends on WL1251 && SPI_MASTER
-        ---help---
-          This module adds support for the SPI interface of adapters using
-          TI wl1251 chipset.  Select this if your platform is using
-          the SPI bus.
-
-          If you choose to build a module, it'll be called wl1251_spi.
-          Say N if unsure.
-
-config WL1251_SDIO
-        tristate "TI wl1251 SDIO support"
-        depends on WL1251 && MMC
-        ---help---
-          This module adds support for the SDIO interface of adapters using
-          TI wl1251 chipset.  Select this if your platform is using
-          the SDIO bus.
-
-          If you choose to build a module, it'll be called
-          wl1251_sdio. Say N if unsure.
-
 config WL1271
         tristate "TI wl1271 support"
         depends on WL12XX && GENERIC_HARDIRQS
@@ -74,4 +40,7 @@ config WL1271_SDIO
           If you choose to build a module, it'll be called
           wl1271_sdio. Say N if unsure.
 
-
+config WL12XX_PLATFORM_DATA
+        bool
+        depends on WL1271_SDIO != n
+        default y
diff --git a/drivers/net/wireless/wl12xx/Makefile b/drivers/net/wireless/wl12xx/Makefile
index 078b4398ac1f..3a807444b2af 100644
--- a/drivers/net/wireless/wl12xx/Makefile
+++ b/drivers/net/wireless/wl12xx/Makefile
@@ -1,12 +1,3 @@
-wl1251-objs             = wl1251_main.o wl1251_event.o \
-                          wl1251_tx.o wl1251_rx.o wl1251_ps.o wl1251_cmd.o \
-                          wl1251_acx.o wl1251_boot.o wl1251_init.o \
-                          wl1251_debugfs.o wl1251_io.o
-
-obj-$(CONFIG_WL1251)    += wl1251.o
-obj-$(CONFIG_WL1251_SPI)        += wl1251_spi.o
-obj-$(CONFIG_WL1251_SDIO)       += wl1251_sdio.o
-
 wl1271-objs             = wl1271_main.o  wl1271_cmd.o wl1271_io.o \
                           wl1271_event.o wl1271_tx.o  wl1271_rx.o   \
                           wl1271_ps.o    wl1271_acx.o wl1271_boot.o \
@@ -16,3 +7,6 @@ wl1271-$(CONFIG_NL80211_TESTMODE)	+= wl1271_testmode.o
 obj-$(CONFIG_WL1271)    += wl1271.o
 obj-$(CONFIG_WL1271_SPI)        += wl1271_spi.o
 obj-$(CONFIG_WL1271_SDIO)       += wl1271_sdio.o
+
+# small builtin driver bit
+obj-$(CONFIG_WL12XX_PLATFORM_DATA)      += wl12xx_platform_data.o
diff --git a/drivers/net/wireless/wl12xx/wl1271.h b/drivers/net/wireless/wl12xx/wl1271.h
index dd3cee6ea5bb..8a4cd763e5a2 100644
--- a/drivers/net/wireless/wl12xx/wl1271.h
+++ b/drivers/net/wireless/wl12xx/wl1271.h
@@ -117,10 +117,7 @@ enum {
 #define WL1271_TX_SECURITY_LO16(s) ((u16)((s) & 0xffff))
 #define WL1271_TX_SECURITY_HI32(s) ((u32)(((s) >> 16) & 0xffffffff))
 
-/*
- * Enable/disable 802.11a support for WL1273
- */
-#undef WL1271_80211A_ENABLED
+#define WL1271_CIPHER_SUITE_GEM 0x00147201
 
 #define WL1271_BUSY_WORD_CNT 1
 #define WL1271_BUSY_WORD_LEN (WL1271_BUSY_WORD_CNT * sizeof(u32))
@@ -133,6 +130,8 @@ enum {
 
 #define ACX_TX_DESCRIPTORS         32
 
+#define WL1271_AGGR_BUFFER_SIZE (4 * PAGE_SIZE)
+
 enum wl1271_state {
         WL1271_STATE_OFF,
         WL1271_STATE_ON,
@@ -301,6 +300,7 @@ struct wl1271_rx_mem_pool_addr {
 struct wl1271_scan {
         struct cfg80211_scan_request *req;
         bool *scanned_ch;
+        bool failed;
         u8 state;
         u8 ssid[IW_ESSID_MAX_SIZE+1];
         size_t ssid_len;
@@ -313,7 +313,7 @@ struct wl1271_if_operations {
                      bool fixed);
         void (*reset)(struct wl1271 *wl);
         void (*init)(struct wl1271 *wl);
-        void (*power)(struct wl1271 *wl, bool enable);
+        int (*power)(struct wl1271 *wl, bool enable);
         struct device* (*dev)(struct wl1271 *wl);
         void (*enable_irq)(struct wl1271 *wl);
         void (*disable_irq)(struct wl1271 *wl);
@@ -330,6 +330,7 @@ struct wl1271 {
 
         void (*set_power)(bool enable);
         int irq;
+        int ref_clock;
 
         spinlock_t wl_lock;
 
@@ -349,6 +350,7 @@ struct wl1271 {
 #define WL1271_FLAG_IDLE              (10)
 #define WL1271_FLAG_IDLE_REQUESTED    (11)
 #define WL1271_FLAG_PSPOLL_FAILURE    (12)
+#define WL1271_FLAG_STA_STATE_SENT    (13)
         unsigned long flags;
 
         struct wl1271_partition_set part;
@@ -361,6 +363,7 @@ struct wl1271 {
         u8 *fw;
         size_t fw_len;
         struct wl1271_nvs_file *nvs;
+        size_t nvs_len;
 
         s8 hw_pg_ver;
 
@@ -407,9 +410,15 @@ struct wl1271 {
         /* Rx memory pool address */
         struct wl1271_rx_mem_pool_addr rx_mem_pool_addr;
 
+        /* Intermediate buffer, used for packet aggregation */
+        u8 *aggr_buf;
+
         /* The target interrupt mask */
         struct work_struct irq_work;
 
+        /* Hardware recovery work */
+        struct work_struct recovery_work;
+
         /* The mbox event mask */
         u32 event_mask;
 
@@ -418,6 +427,7 @@ struct wl1271 {
 
         /* Are we currently scanning */
         struct wl1271_scan scan;
+        struct delayed_work scan_complete_work;
 
         /* Our association ID */
         u16 aid;
@@ -474,6 +484,8 @@ struct wl1271 {
 
         bool sg_enabled;
 
+        bool enable_11a;
+
         struct list_head list;
 
         /* Most recently reported noise in dBm */
@@ -497,14 +509,4 @@ int wl1271_plt_stop(struct wl1271 *wl);
 #define WL1271_PRE_POWER_ON_SLEEP 20 /* in miliseconds */
 #define WL1271_POWER_ON_SLEEP 200 /* in miliseconds */
 
-static inline bool wl1271_11a_enabled(void)
-{
-        /* FIXME: this could be determined based on the NVS-INI file */
-#ifdef WL1271_80211A_ENABLED
-        return true;
-#else
-        return false;
-#endif
-}
-
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.c b/drivers/net/wireless/wl12xx/wl1271_acx.c
index f03ad088db8b..618993405262 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.c
@@ -86,40 +86,6 @@ out:
         return ret;
 }
 
-int wl1271_acx_fw_version(struct wl1271 *wl, char *buf, size_t len)
-{
-        struct acx_revision *rev;
-        int ret;
-
-        wl1271_debug(DEBUG_ACX, "acx fw rev");
-
-        rev = kzalloc(sizeof(*rev), GFP_KERNEL);
-        if (!rev) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        ret = wl1271_cmd_interrogate(wl, ACX_FW_REV, rev, sizeof(*rev));
-        if (ret < 0) {
-                wl1271_warning("ACX_FW_REV interrogate failed");
-                goto out;
-        }
-
-        /* be careful with the buffer sizes */
-        strncpy(buf, rev->fw_version, min(len, sizeof(rev->fw_version)));
-
-        /*
-         * if the firmware version string is exactly
-         * sizeof(rev->fw_version) long or fw_len is less than
-         * sizeof(rev->fw_version) it won't be null terminated
-         */
-        buf[min(len, sizeof(rev->fw_version)) - 1] = '\0';
-
-out:
-        kfree(rev);
-        return ret;
-}
-
 int wl1271_acx_tx_power(struct wl1271 *wl, int power)
 {
         struct acx_current_tx_power *acx;
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.h b/drivers/net/wireless/wl12xx/wl1271_acx.h
index 4235bc56f750..ebb341d36e8c 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.h
@@ -100,35 +100,6 @@ struct acx_error_counter {
         __le32 seq_num_miss;
 } __packed;
 
-struct acx_revision {
-        struct acx_header header;
-
-        /*
-         * The WiLink firmware version, an ASCII string x.x.x.x,
-         * that uniquely identifies the current firmware.
-         * The left most digit is incremented each time a
-         * significant change is made to the firmware, such as
-         * code redesign or new platform support.
-         * The second digit is incremented when major enhancements
-         * are added or major fixes are made.
-         * The third digit is incremented for each GA release.
-         * The fourth digit is incremented for each build.
-         * The first two digits identify a firmware release version,
-         * in other words, a unique set of features.
-         * The first three digits identify a GA release.
-         */
-        char fw_version[20];
-
-        /*
-         * This 4 byte field specifies the WiLink hardware version.
-         * bits 0  - 15: Reserved.
-         * bits 16 - 23: Version ID - The WiLink version ID
-         *              (1 = first spin, 2 = second spin, and so on).
-         * bits 24 - 31: Chip ID - The WiLink chip ID.
-         */
-        __le32 hw_version;
-} __packed;
-
 enum wl1271_psm_mode {
         /* Active mode */
         WL1271_PSM_CAM = 0,
@@ -1060,7 +1031,6 @@ enum {
         ACX_PEER_HT_CAP             = 0x0057,
         ACX_HT_BSS_OPERATION        = 0x0058,
         ACX_COEX_ACTIVITY           = 0x0059,
-        ACX_SET_SMART_REFLEX_DEBUG  = 0x005A,
         ACX_SET_DCO_ITRIM_PARAMS    = 0x0061,
         DOT11_RX_MSDU_LIFE_TIME     = 0x1004,
         DOT11_CUR_TX_PWR            = 0x100D,
@@ -1077,7 +1047,6 @@ enum {
 
 int wl1271_acx_wake_up_conditions(struct wl1271 *wl);
 int wl1271_acx_sleep_auth(struct wl1271 *wl, u8 sleep_auth);
-int wl1271_acx_fw_version(struct wl1271 *wl, char *buf, size_t len);
 int wl1271_acx_tx_power(struct wl1271 *wl, int power);
 int wl1271_acx_feature_cfg(struct wl1271 *wl);
 int wl1271_acx_mem_map(struct wl1271 *wl,
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.c b/drivers/net/wireless/wl12xx/wl1271_boot.c
index f36430b0336d..b91021242098 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.c
@@ -225,6 +225,28 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
         if (wl->nvs == NULL)
                 return -ENODEV;
 
+        /*
+         * FIXME: the LEGACY NVS image support (NVS's missing the 5GHz band
+         * configurations) can be removed when those NVS files stop floating
+         * around.
+         */
+        if (wl->nvs_len == sizeof(struct wl1271_nvs_file) ||
+            wl->nvs_len == WL1271_INI_LEGACY_NVS_FILE_SIZE) {
+                if (wl->nvs->general_params.dual_mode_select)
+                        wl->enable_11a = true;
+        }
+
+        if (wl->nvs_len != sizeof(struct wl1271_nvs_file) &&
+            (wl->nvs_len != WL1271_INI_LEGACY_NVS_FILE_SIZE ||
+             wl->enable_11a)) {
+                wl1271_error("nvs size is not as expected: %zu != %zu",
+                             wl->nvs_len, sizeof(struct wl1271_nvs_file));
+                kfree(wl->nvs);
+                wl->nvs = NULL;
+                wl->nvs_len = 0;
+                return -EILSEQ;
+        }
+
         /* only the first part of the NVS needs to be uploaded */
         nvs_len = sizeof(wl->nvs->nvs);
         nvs_ptr = (u8 *)wl->nvs->nvs;
@@ -251,8 +273,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
                 burst_len = nvs_ptr[0];
                 dest_addr = (nvs_ptr[1] & 0xfe) | ((u32)(nvs_ptr[2] << 8));
 
-                /* FIXME: Due to our new wl1271_translate_reg_addr function,
-                   we need to add the REGISTER_BASE to the destination */
+                /*
+                 * Due to our new wl1271_translate_reg_addr function,
+                 * we need to add the REGISTER_BASE to the destination
+                 */
                 dest_addr += REGISTERS_BASE;
 
                 /* We move our pointer to the data */
@@ -274,31 +298,21 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
 
         /*
          * We've reached the first zero length, the first NVS table
-         * is 7 bytes further.
+         * is located at an aligned offset which is at least 7 bytes further.
          */
-        nvs_ptr += 7;
+        nvs_ptr = (u8 *)wl->nvs->nvs +
+                        ALIGN(nvs_ptr - (u8 *)wl->nvs->nvs + 7, 4);
         nvs_len -= nvs_ptr - (u8 *)wl->nvs->nvs;
-        nvs_len = ALIGN(nvs_len, 4);
 
-        /* FIXME: The driver sets the partition here, but this is not needed,
-           since it sets to the same one as currently in use */
         /* Now we must set the partition correctly */
         wl1271_set_partition(wl, &part_table[PART_WORK]);
 
         /* Copy the NVS tables to a new block to ensure alignment */
-        /* FIXME: We jump 3 more bytes before uploading the NVS.  It seems
-        that our NVS files have three extra zeros here.  I'm not sure whether
-        the problem is in our NVS generation or we should really jumpt these
-        3 bytes here */
-        nvs_ptr += 3;
-
-        nvs_aligned = kmemdup(nvs_ptr, nvs_len, GFP_KERNEL); if
-        (!nvs_aligned) return -ENOMEM;
+        nvs_aligned = kmemdup(nvs_ptr, nvs_len, GFP_KERNEL);
+        if (!nvs_aligned)
+                return -ENOMEM;
 
         /* And finally we upload the NVS tables */
-        /* FIXME: In wl1271, we upload everything at once.
-           No endianness handling needed here?! The ref driver doesn't do
-           anything about it at this point */
         wl1271_write(wl, CMD_MBOX_ADDRESS, nvs_aligned, nvs_len, false);
 
         kfree(nvs_aligned);
@@ -457,17 +471,20 @@ int wl1271_boot(struct wl1271 *wl)
 {
         int ret = 0;
         u32 tmp, clk, pause;
+        int ref_clock = wl->ref_clock;
 
         wl1271_boot_hw_version(wl);
 
-        if (REF_CLOCK == 0 || REF_CLOCK == 2 || REF_CLOCK == 4)
+        if (ref_clock == 0 || ref_clock == 2 || ref_clock == 4)
                 /* ref clk: 19.2/38.4/38.4-XTAL */
                 clk = 0x3;
-        else if (REF_CLOCK == 1 || REF_CLOCK == 3)
+        else if (ref_clock == 1 || ref_clock == 3)
                 /* ref clk: 26/52 */
                 clk = 0x5;
+        else
+                return -EINVAL;
 
-        if (REF_CLOCK != 0) {
+        if (ref_clock != 0) {
                 u16 val;
                 /* Set clock type (open drain) */
                 val = wl1271_top_reg_read(wl, OCP_REG_CLK_TYPE);
@@ -493,10 +510,7 @@ int wl1271_boot(struct wl1271 *wl)
 
         wl1271_debug(DEBUG_BOOT, "pause1 0x%x", pause);
 
-        pause &= ~(WU_COUNTER_PAUSE_VAL); /* FIXME: This should probably be
-                                           * WU_COUNTER_PAUSE_VAL instead of
-                                           * 0x3ff (magic number ).  How does
-                                           * this work?! */
+        pause &= ~(WU_COUNTER_PAUSE_VAL);
         pause |= WU_COUNTER_PAUSE_VAL;
         wl1271_write32(wl, WU_COUNTER_PAUSE, pause);
 
@@ -516,7 +530,7 @@ int wl1271_boot(struct wl1271 *wl)
         wl1271_debug(DEBUG_BOOT, "clk2 0x%x", clk);
 
         /* 2 */
-        clk |= (REF_CLOCK << 1) << 4;
+        clk |= (ref_clock << 1) << 4;
         wl1271_write32(wl, DRPW_SCRATCH_START, clk);
 
         wl1271_set_partition(wl, &part_table[PART_WORK]);
@@ -550,7 +564,6 @@ int wl1271_boot(struct wl1271 *wl)
         if (ret < 0)
                 goto out;
 
-        /* FIXME: Need to check whether this is really what we want */
         wl1271_write32(wl, ACX_REG_INTERRUPT_MASK,
                        WL1271_ACX_ALL_EVENTS_VECTOR);
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.h b/drivers/net/wireless/wl12xx/wl1271_boot.h
index f829699d597e..f73b0b15a280 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.h
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.h
@@ -46,7 +46,6 @@ struct wl1271_static_data {
 /* delay between retries */
 #define INIT_LOOP_DELAY 50
 
-#define REF_CLOCK            2
 #define WU_COUNTER_PAUSE_VAL 0x3FF
 #define WELP_ARM_COMMAND_VAL 0x4
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.c b/drivers/net/wireless/wl12xx/wl1271_cmd.c
index ce503ddd5a41..5d3e8485ea4e 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.c
@@ -94,6 +94,7 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
         status = le16_to_cpu(cmd->status);
         if (status != CMD_STATUS_SUCCESS) {
                 wl1271_error("command execute failure %d", status);
+                ieee80211_queue_work(wl->hw, &wl->recovery_work);
                 ret = -EIO;
         }
 
@@ -107,6 +108,8 @@ out:
 int wl1271_cmd_general_parms(struct wl1271 *wl)
 {
         struct wl1271_general_parms_cmd *gen_parms;
+        struct wl1271_ini_general_params *gp = &wl->nvs->general_params;
+        bool answer = false;
         int ret;
 
         if (!wl->nvs)
@@ -118,13 +121,24 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
 
         gen_parms->test.id = TEST_CMD_INI_FILE_GENERAL_PARAM;
 
-        memcpy(&gen_parms->general_params, &wl->nvs->general_params,
-               sizeof(struct wl1271_ini_general_params));
+        memcpy(&gen_parms->general_params, gp, sizeof(*gp));
 
-        ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), 0);
-        if (ret < 0)
+        if (gp->tx_bip_fem_auto_detect)
+                answer = true;
+
+        ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), answer);
+        if (ret < 0) {
                 wl1271_warning("CMD_INI_FILE_GENERAL_PARAM failed");
+                goto out;
+        }
+
+        gp->tx_bip_fem_manufacturer =
+                gen_parms->general_params.tx_bip_fem_manufacturer;
+
+        wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
+                     answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
 
+out:
         kfree(gen_parms);
         return ret;
 }
@@ -170,6 +184,39 @@ int wl1271_cmd_radio_parms(struct wl1271 *wl)
         return ret;
 }
 
+int wl1271_cmd_ext_radio_parms(struct wl1271 *wl)
+{
+        struct wl1271_ext_radio_parms_cmd *ext_radio_parms;
+        struct conf_rf_settings *rf = &wl->conf.rf;
+        int ret;
+
+        if (!wl->nvs)
+                return -ENODEV;
+
+        ext_radio_parms = kzalloc(sizeof(*ext_radio_parms), GFP_KERNEL);
+        if (!ext_radio_parms)
+                return -ENOMEM;
+
+        ext_radio_parms->test.id = TEST_CMD_INI_FILE_RF_EXTENDED_PARAM;
+
+        memcpy(ext_radio_parms->tx_per_channel_power_compensation_2,
+               rf->tx_per_channel_power_compensation_2,
+               CONF_TX_PWR_COMPENSATION_LEN_2);
+        memcpy(ext_radio_parms->tx_per_channel_power_compensation_5,
+               rf->tx_per_channel_power_compensation_5,
+               CONF_TX_PWR_COMPENSATION_LEN_5);
+
+        wl1271_dump(DEBUG_CMD, "TEST_CMD_INI_FILE_EXT_RADIO_PARAM: ",
+                    ext_radio_parms, sizeof(*ext_radio_parms));
+
+        ret = wl1271_cmd_test(wl, ext_radio_parms, sizeof(*ext_radio_parms), 0);
+        if (ret < 0)
+                wl1271_warning("TEST_CMD_INI_FILE_RF_EXTENDED_PARAM failed");
+
+        kfree(ext_radio_parms);
+        return ret;
+}
+
 /*
  * Poll the mailbox event field until any of the bits in the mask is set or a
  * timeout occurs (WL1271_EVENT_TIMEOUT in msecs)
@@ -182,8 +229,10 @@ static int wl1271_cmd_wait_for_event(struct wl1271 *wl, u32 mask)
         timeout = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT);
 
         do {
-                if (time_after(jiffies, timeout))
+                if (time_after(jiffies, timeout)) {
+                        ieee80211_queue_work(wl->hw, &wl->recovery_work);
                         return -ETIMEDOUT;
+                }
 
                 msleep(1);
 
@@ -390,18 +439,11 @@ out:
         return ret;
 }
 
-int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, bool send)
+int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, u32 rates, bool send)
 {
         struct wl1271_cmd_ps_params *ps_params = NULL;
         int ret = 0;
 
-        /* FIXME: this should be in ps.c */
-        ret = wl1271_acx_wake_up_conditions(wl);
-        if (ret < 0) {
-                wl1271_error("couldn't set wake up conditions");
-                goto out;
-        }
-
         wl1271_debug(DEBUG_CMD, "cmd set ps mode");
 
         ps_params = kzalloc(sizeof(*ps_params), GFP_KERNEL);
@@ -412,9 +454,9 @@ int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, bool send)
 
         ps_params->ps_mode = ps_mode;
         ps_params->send_null_data = send;
-        ps_params->retries = 5;
-        ps_params->hang_over_period = 1;
-        ps_params->null_data_rate = cpu_to_le32(wl->basic_rate_set);
+        ps_params->retries = wl->conf.conn.psm_entry_nullfunc_retries;
+        ps_params->hang_over_period = wl->conf.conn.psm_entry_hangover_period;
+        ps_params->null_data_rate = cpu_to_le32(rates);
 
         ret = wl1271_cmd_send(wl, CMD_SET_PS_MODE, ps_params,
                               sizeof(*ps_params), 0);
@@ -428,41 +470,6 @@ out:
         return ret;
 }
 
-int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
-                           size_t len)
-{
-        struct cmd_read_write_memory *cmd;
-        int ret = 0;
-
-        wl1271_debug(DEBUG_CMD, "cmd read memory");
-
-        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
-        if (!cmd) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        WARN_ON(len > MAX_READ_SIZE);
-        len = min_t(size_t, len, MAX_READ_SIZE);
-
-        cmd->addr = cpu_to_le32(addr);
-        cmd->size = cpu_to_le32(len);
-
-        ret = wl1271_cmd_send(wl, CMD_READ_MEMORY, cmd, sizeof(*cmd),
-                              sizeof(*cmd));
-        if (ret < 0) {
-                wl1271_error("read memory command failed: %d", ret);
-                goto out;
-        }
-
-        /* the read command got in */
-        memcpy(answer, cmd->value, len);
-
-out:
-        kfree(cmd);
-        return ret;
-}
-
 int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
                             void *buf, size_t buf_len, int index, u32 rates)
 {
@@ -523,7 +530,7 @@ int wl1271_cmd_build_null_data(struct wl1271 *wl)
         }
 
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, ptr, size, 0,
-                                      WL1271_RATE_AUTOMATIC);
+                                      wl->basic_rate);
 
 out:
         dev_kfree_skb(skb);
@@ -546,7 +553,7 @@ int wl1271_cmd_build_klv_null_data(struct wl1271 *wl)
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_KLV,
                                       skb->data, skb->len,
                                       CMD_TEMPL_KLV_IDX_NULL_DATA,
-                                      WL1271_RATE_AUTOMATIC);
+                                      wl->basic_rate);
 
 out:
         dev_kfree_skb(skb);
@@ -623,7 +630,7 @@ int wl1271_build_qos_null_data(struct wl1271 *wl)
 
         return wl1271_cmd_template_set(wl, CMD_TEMPL_QOS_NULL_DATA, &template,
                                        sizeof(template), 0,
-                                       WL1271_RATE_AUTOMATIC);
+                                       wl->basic_rate);
 }
 
 int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id)
@@ -746,3 +753,31 @@ out_free:
 out:
         return ret;
 }
+
+int wl1271_cmd_set_sta_state(struct wl1271 *wl)
+{
+        struct wl1271_cmd_set_sta_state *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd set sta state");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        cmd->state = WL1271_CMD_STA_STATE_CONNECTED;
+
+        ret = wl1271_cmd_send(wl, CMD_SET_STA_STATE, cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send set STA state command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(cmd);
+
+out:
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.h b/drivers/net/wireless/wl12xx/wl1271_cmd.h
index af577ee8eb02..a0caf4fc37b1 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.h
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.h
@@ -33,12 +33,13 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
                     size_t res_len);
 int wl1271_cmd_general_parms(struct wl1271 *wl);
 int wl1271_cmd_radio_parms(struct wl1271 *wl);
+int wl1271_cmd_ext_radio_parms(struct wl1271 *wl);
 int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type);
 int wl1271_cmd_test(struct wl1271 *wl, void *buf, size_t buf_len, u8 answer);
 int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len);
 int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len);
 int wl1271_cmd_data_path(struct wl1271 *wl, bool enable);
-int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, bool send);
+int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, u32 rates, bool send);
 int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
                            size_t len);
 int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
@@ -55,6 +56,7 @@ int wl1271_cmd_set_key(struct wl1271 *wl, u16 action, u8 id, u8 key_type,
                        u8 key_size, const u8 *key, const u8 *addr,
                        u32 tx_seq_32, u16 tx_seq_16);
 int wl1271_cmd_disconnect(struct wl1271 *wl);
+int wl1271_cmd_set_sta_state(struct wl1271 *wl);
 
 enum wl1271_commands {
         CMD_INTERROGATE     = 1,    /*use this to read information elements*/
@@ -160,41 +162,6 @@ enum {
         MAX_COMMAND_STATUS              = 0xff
 };
 
-
-/*
- * CMD_READ_MEMORY
- *
- * The host issues this command to read the WiLink device memory/registers.
- *
- * Note: The Base Band address has special handling (16 bits registers and
- * addresses). For more information, see the hardware specification.
- */
-/*
- * CMD_WRITE_MEMORY
- *
- * The host issues this command to write the WiLink device memory/registers.
- *
- * The Base Band address has special handling (16 bits registers and
- * addresses). For more information, see the hardware specification.
- */
-#define MAX_READ_SIZE 256
-
-struct cmd_read_write_memory {
-        struct wl1271_cmd_header header;
-
-        /* The address of the memory to read from or write to.*/
-        __le32 addr;
-
-        /* The amount of data in bytes to read from or write to the WiLink
-         * device.*/
-        __le32 size;
-
-        /* The actual value read from or written to the Wilink. The source
-           of this field is the Host in WRITE command or the Wilink in READ
-           command. */
-        u8 value[MAX_READ_SIZE];
-} __packed;
-
 #define CMDMBOX_HEADER_LEN 4
 #define CMDMBOX_INFO_ELEM_HEADER_LEN 4
 
@@ -313,7 +280,7 @@ enum wl1271_cmd_key_type {
         KEY_WEP  = 1,
         KEY_TKIP = 2,
         KEY_AES  = 3,
-        KEY_GEM  = 4
+        KEY_GEM  = 4,
 };
 
 /* FIXME: Add description for key-types */
@@ -358,13 +325,14 @@ enum wl1271_channel_tune_bands {
         WL1271_CHANNEL_TUNE_BAND_4_9
 };
 
-#define WL1271_PD_REFERENCE_POINT_BAND_B_G 0
+#define WL1271_PD_REFERENCE_POINT_BAND_B_G  0
 
-#define TEST_CMD_P2G_CAL                   0x02
-#define TEST_CMD_CHANNEL_TUNE              0x0d
-#define TEST_CMD_UPDATE_PD_REFERENCE_POINT 0x1d
-#define TEST_CMD_INI_FILE_RADIO_PARAM      0x19
-#define TEST_CMD_INI_FILE_GENERAL_PARAM    0x1E
+#define TEST_CMD_P2G_CAL                    0x02
+#define TEST_CMD_CHANNEL_TUNE               0x0d
+#define TEST_CMD_UPDATE_PD_REFERENCE_POINT  0x1d
+#define TEST_CMD_INI_FILE_RADIO_PARAM       0x19
+#define TEST_CMD_INI_FILE_GENERAL_PARAM     0x1E
+#define TEST_CMD_INI_FILE_RF_EXTENDED_PARAM 0x26
 
 struct wl1271_general_parms_cmd {
         struct wl1271_cmd_header header;
@@ -397,6 +365,16 @@ struct wl1271_radio_parms_cmd {
         u8 padding3[2];
 } __packed;
 
+struct wl1271_ext_radio_parms_cmd {
+        struct wl1271_cmd_header header;
+
+        struct wl1271_cmd_test_header test;
+
+        u8 tx_per_channel_power_compensation_2[CONF_TX_PWR_COMPENSATION_LEN_2];
+        u8 tx_per_channel_power_compensation_5[CONF_TX_PWR_COMPENSATION_LEN_5];
+        u8 padding[3];
+} __packed;
+
 struct wl1271_cmd_cal_channel_tune {
         struct wl1271_cmd_header header;
 
@@ -469,4 +447,13 @@ struct wl1271_cmd_disconnect {
         u8  padding;
 } __packed;
 
+#define WL1271_CMD_STA_STATE_CONNECTED  1
+
+struct wl1271_cmd_set_sta_state {
+        struct wl1271_cmd_header header;
+
+        u8 state;
+        u8 padding[3];
+} __packed;
+
 #endif /* __WL1271_CMD_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_conf.h b/drivers/net/wireless/wl12xx/wl1271_conf.h
index 0435ffda8f73..5f78a6cb1433 100644
--- a/drivers/net/wireless/wl12xx/wl1271_conf.h
+++ b/drivers/net/wireless/wl12xx/wl1271_conf.h
@@ -595,7 +595,7 @@ struct conf_tx_ac_category {
         u16 tx_op_limit;
 };
 
-#define CONF_TX_MAX_TID_COUNT 7
+#define CONF_TX_MAX_TID_COUNT 8
 
 enum {
         CONF_CHANNEL_TYPE_DCF = 0,   /* DC/LEGACY*/
@@ -912,6 +912,22 @@ struct conf_conn_settings {
         u8 psm_entry_retries;
 
         /*
+         * Specifies the maximum number of times to try transmit the PSM entry
+         * null-func frame for each PSM entry attempt
+         *
+         * Range 0 - 255
+         */
+        u8 psm_entry_nullfunc_retries;
+
+        /*
+         * Specifies the time to linger in active mode after successfully
+         * transmitting the PSM entry null-func frame.
+         *
+         * Range 0 - 255 TU's
+         */
+        u8 psm_entry_hangover_period;
+
+        /*
          *
          * Specifies the interval of the connection keep-alive null-func
          * frame in ms.
@@ -1016,6 +1032,64 @@ struct conf_roam_trigger_settings {
         u8 avg_weight_snr_data;
 };
 
+struct conf_scan_settings {
+        /*
+         * The minimum time to wait on each channel for active scans
+         *
+         * Range: 0 - 65536 tu
+         */
+        u16 min_dwell_time_active;
+
+        /*
+         * The maximum time to wait on each channel for active scans
+         *
+         * Range: 0 - 65536 tu
+         */
+        u16 max_dwell_time_active;
+
+        /*
+         * The maximum time to wait on each channel for passive scans
+         *
+         * Range: 0 - 65536 tu
+         */
+        u16 min_dwell_time_passive;
+
+        /*
+         * The maximum time to wait on each channel for passive scans
+         *
+         * Range: 0 - 65536 tu
+         */
+        u16 max_dwell_time_passive;
+
+        /*
+         * Number of probe requests to transmit on each active scan channel
+         *
+         * Range: u8
+         */
+        u16 num_probe_reqs;
+
+};
+
+/* these are number of channels on the band divided by two, rounded up */
+#define CONF_TX_PWR_COMPENSATION_LEN_2 7
+#define CONF_TX_PWR_COMPENSATION_LEN_5 18
+
+struct conf_rf_settings {
+        /*
+         * Per channel power compensation for 2.4GHz
+         *
+         * Range: s8
+         */
+        u8 tx_per_channel_power_compensation_2[CONF_TX_PWR_COMPENSATION_LEN_2];
+
+        /*
+         * Per channel power compensation for 5GHz
+         *
+         * Range: s8
+         */
+        u8 tx_per_channel_power_compensation_5[CONF_TX_PWR_COMPENSATION_LEN_5];
+};
+
 struct conf_drv_settings {
         struct conf_sg_settings sg;
         struct conf_rx_settings rx;
@@ -1024,6 +1098,8 @@ struct conf_drv_settings {
         struct conf_itrim_settings itrim;
         struct conf_pm_config_settings pm_config;
         struct conf_roam_trigger_settings roam_trigger;
+        struct conf_scan_settings scan;
+        struct conf_rf_settings rf;
 };
 
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.c b/drivers/net/wireless/wl12xx/wl1271_event.c
index 25ce2cd5e3f3..7b3f50382963 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.c
+++ b/drivers/net/wireless/wl12xx/wl1271_event.c
@@ -41,6 +41,9 @@ void wl1271_pspoll_work(struct work_struct *work)
 
         mutex_lock(&wl->mutex);
 
+        if (unlikely(wl->state == WL1271_STATE_OFF))
+                goto out;
+
         if (!test_and_clear_bit(WL1271_FLAG_PSPOLL_FAILURE, &wl->flags))
                 goto out;
 
@@ -52,7 +55,7 @@ void wl1271_pspoll_work(struct work_struct *work)
          * delivery failure occurred, and no-one changed state since, so
          * we should go back to powersave.
          */
-        wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE, true);
+        wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE, wl->basic_rate, true);
 
 out:
         mutex_unlock(&wl->mutex);
@@ -70,7 +73,8 @@ static void wl1271_event_pspoll_delivery_fail(struct wl1271 *wl)
 
         /* force active mode receive data from the AP */
         if (test_bit(WL1271_FLAG_PSM, &wl->flags)) {
-                ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE, true);
+                ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE,
+                                         wl->basic_rate, true);
                 if (ret < 0)
                         return;
                 set_bit(WL1271_FLAG_PSPOLL_FAILURE, &wl->flags);
@@ -91,6 +95,7 @@ static int wl1271_event_ps_report(struct wl1271 *wl,
                                   bool *beacon_loss)
 {
         int ret = 0;
+        u32 total_retries = wl->conf.conn.psm_entry_retries;
 
         wl1271_debug(DEBUG_EVENT, "ps_status: 0x%x", mbox->ps_status);
 
@@ -104,10 +109,10 @@ static int wl1271_event_ps_report(struct wl1271 *wl,
                         break;
                 }
 
-                if (wl->psm_entry_retry < wl->conf.conn.psm_entry_retries) {
+                if (wl->psm_entry_retry < total_retries) {
                         wl->psm_entry_retry++;
                         ret = wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE,
-                                                 true);
+                                                 wl->basic_rate, true);
                 } else {
                         wl1271_info("No ack to nullfunc from AP.");
                         wl->psm_entry_retry = 0;
@@ -143,7 +148,7 @@ static int wl1271_event_ps_report(struct wl1271 *wl,
                 /* make sure the firmware goes to active mode - the frame to
                    be sent next will indicate to the AP, that we are active. */
                 ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE,
-                                         false);
+                                         wl->basic_rate, false);
                 break;
         case EVENT_EXIT_POWER_SAVE_SUCCESS:
         default:
diff --git a/drivers/net/wireless/wl12xx/wl1271_init.c b/drivers/net/wireless/wl12xx/wl1271_init.c
index 4447af1557f5..8044bba70ee7 100644
--- a/drivers/net/wireless/wl12xx/wl1271_init.c
+++ b/drivers/net/wireless/wl12xx/wl1271_init.c
@@ -53,6 +53,7 @@ static int wl1271_init_hwenc_config(struct wl1271 *wl)
 int wl1271_init_templates_config(struct wl1271 *wl)
 {
         int ret, i;
+        size_t size;
 
         /* send empty templates for fw memory reservation */
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4, NULL,
@@ -61,14 +62,12 @@ int wl1271_init_templates_config(struct wl1271 *wl)
         if (ret < 0)
                 return ret;
 
-        if (wl1271_11a_enabled()) {
-                size_t size = sizeof(struct wl12xx_probe_req_template);
-                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_5,
-                                              NULL, size, 0,
-                                              WL1271_RATE_AUTOMATIC);
-                if (ret < 0)
-                        return ret;
-        }
+        size = sizeof(struct wl12xx_probe_req_template);
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_5,
+                                      NULL, size, 0,
+                                      WL1271_RATE_AUTOMATIC);
+        if (ret < 0)
+                return ret;
 
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, NULL,
                                       sizeof(struct wl12xx_null_data_template),
@@ -223,6 +222,10 @@ int wl1271_hw_init(struct wl1271 *wl)
         if (ret < 0)
                 return ret;
 
+        ret = wl1271_cmd_ext_radio_parms(wl);
+        if (ret < 0)
+                return ret;
+
         /* Template settings */
         ret = wl1271_init_templates_config(wl);
         if (ret < 0)
@@ -291,8 +294,16 @@ int wl1271_hw_init(struct wl1271 *wl)
         if (ret < 0)
                 goto out_free_memmap;
 
-        /* Default TID configuration */
+        /* Default TID/AC configuration */
+        BUG_ON(wl->conf.tx.tid_conf_count != wl->conf.tx.ac_conf_count);
         for (i = 0; i < wl->conf.tx.tid_conf_count; i++) {
+                conf_ac = &wl->conf.tx.ac_conf[i];
+                ret = wl1271_acx_ac_cfg(wl, conf_ac->ac, conf_ac->cw_min,
+                                        conf_ac->cw_max, conf_ac->aifsn,
+                                        conf_ac->tx_op_limit);
+                if (ret < 0)
+                        goto out_free_memmap;
+
                 conf_tid = &wl->conf.tx.tid_conf[i];
                 ret = wl1271_acx_tid_cfg(wl, conf_tid->queue_id,
                                          conf_tid->channel_type,
@@ -305,16 +316,6 @@ int wl1271_hw_init(struct wl1271 *wl)
                         goto out_free_memmap;
         }
 
-        /* Default AC configuration */
-        for (i = 0; i < wl->conf.tx.ac_conf_count; i++) {
-                conf_ac = &wl->conf.tx.ac_conf[i];
-                ret = wl1271_acx_ac_cfg(wl, conf_ac->ac, conf_ac->cw_min,
-                                        conf_ac->cw_max, conf_ac->aifsn,
-                                        conf_ac->tx_op_limit);
-                if (ret < 0)
-                        goto out_free_memmap;
-        }
-
         /* Configure TX rate classes */
         ret = wl1271_acx_rate_policies(wl);
         if (ret < 0)
diff --git a/drivers/net/wireless/wl12xx/wl1271_io.h b/drivers/net/wireless/wl12xx/wl1271_io.h
index bc806c74c63a..c1f92e65ded0 100644
--- a/drivers/net/wireless/wl12xx/wl1271_io.h
+++ b/drivers/net/wireless/wl12xx/wl1271_io.h
@@ -144,10 +144,13 @@ static inline void wl1271_power_off(struct wl1271 *wl)
         clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
 }
 
-static inline void wl1271_power_on(struct wl1271 *wl)
+static inline int wl1271_power_on(struct wl1271 *wl)
 {
-        wl->if_ops->power(wl, true);
-        set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+        int ret = wl->if_ops->power(wl, true);
+        if (ret == 0)
+                set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+
+        return ret;
 }
 
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/wl1271_main.c
index 8e55cf8d509d..48a4b9961ae6 100644
--- a/drivers/net/wireless/wl12xx/wl1271_main.c
+++ b/drivers/net/wireless/wl12xx/wl1271_main.c
@@ -124,28 +124,28 @@ static struct conf_drv_settings default_conf = {
                 },
                 .ac_conf_count               = 4,
                 .ac_conf                     = {
-                        [0] = {
+                        [CONF_TX_AC_BE] = {
                                 .ac          = CONF_TX_AC_BE,
                                 .cw_min      = 15,
                                 .cw_max      = 63,
                                 .aifsn       = 3,
                                 .tx_op_limit = 0,
                         },
-                        [1] = {
+                        [CONF_TX_AC_BK] = {
                                 .ac          = CONF_TX_AC_BK,
                                 .cw_min      = 15,
                                 .cw_max      = 63,
                                 .aifsn       = 7,
                                 .tx_op_limit = 0,
                         },
-                        [2] = {
+                        [CONF_TX_AC_VI] = {
                                 .ac          = CONF_TX_AC_VI,
                                 .cw_min      = 15,
                                 .cw_max      = 63,
                                 .aifsn       = CONF_TX_AIFS_PIFS,
                                 .tx_op_limit = 3008,
                         },
-                        [3] = {
+                        [CONF_TX_AC_VO] = {
                                 .ac          = CONF_TX_AC_VO,
                                 .cw_min      = 15,
                                 .cw_max      = 63,
@@ -153,64 +153,40 @@ static struct conf_drv_settings default_conf = {
                                 .tx_op_limit = 1504,
                         },
                 },
-                .tid_conf_count = 7,
+                .tid_conf_count = 4,
                 .tid_conf = {
-                        [0] = {
-                                .queue_id    = 0,
-                                .channel_type = CONF_CHANNEL_TYPE_DCF,
-                                .tsid        = CONF_TX_AC_BE,
-                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
-                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
-                                .apsd_conf   = {0, 0},
-                        },
-                        [1] = {
-                                .queue_id    = 1,
-                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                        [CONF_TX_AC_BE] = {
+                                .queue_id    = CONF_TX_AC_BE,
+                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
                                 .tsid        = CONF_TX_AC_BE,
                                 .ps_scheme   = CONF_PS_SCHEME_LEGACY,
                                 .ack_policy  = CONF_ACK_POLICY_LEGACY,
                                 .apsd_conf   = {0, 0},
                         },
-                        [2] = {
-                                .queue_id    = 2,
-                                .channel_type = CONF_CHANNEL_TYPE_DCF,
-                                .tsid        = CONF_TX_AC_BE,
+                        [CONF_TX_AC_BK] = {
+                                .queue_id    = CONF_TX_AC_BK,
+                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
+                                .tsid        = CONF_TX_AC_BK,
                                 .ps_scheme   = CONF_PS_SCHEME_LEGACY,
                                 .ack_policy  = CONF_ACK_POLICY_LEGACY,
                                 .apsd_conf   = {0, 0},
                         },
-                        [3] = {
-                                .queue_id    = 3,
-                                .channel_type = CONF_CHANNEL_TYPE_DCF,
-                                .tsid        = CONF_TX_AC_BE,
-                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
-                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
-                                .apsd_conf   = {0, 0},
-                        },
-                        [4] = {
-                                .queue_id    = 4,
-                                .channel_type = CONF_CHANNEL_TYPE_DCF,
-                                .tsid        = CONF_TX_AC_BE,
+                        [CONF_TX_AC_VI] = {
+                                .queue_id    = CONF_TX_AC_VI,
+                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
+                                .tsid        = CONF_TX_AC_VI,
                                 .ps_scheme   = CONF_PS_SCHEME_LEGACY,
                                 .ack_policy  = CONF_ACK_POLICY_LEGACY,
                                 .apsd_conf   = {0, 0},
                         },
-                        [5] = {
-                                .queue_id    = 5,
-                                .channel_type = CONF_CHANNEL_TYPE_DCF,
-                                .tsid        = CONF_TX_AC_BE,
+                        [CONF_TX_AC_VO] = {
+                                .queue_id    = CONF_TX_AC_VO,
+                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
+                                .tsid        = CONF_TX_AC_VO,
                                 .ps_scheme   = CONF_PS_SCHEME_LEGACY,
                                 .ack_policy  = CONF_ACK_POLICY_LEGACY,
                                 .apsd_conf   = {0, 0},
                         },
-                        [6] = {
-                                .queue_id    = 6,
-                                .channel_type = CONF_CHANNEL_TYPE_DCF,
-                                .tsid        = CONF_TX_AC_BE,
-                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
-                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
-                                .apsd_conf   = {0, 0},
-                        }
                 },
                 .frag_threshold              = IEEE80211_MAX_FRAG_THRESHOLD,
                 .tx_compl_timeout            = 700,
@@ -238,7 +214,9 @@ static struct conf_drv_settings default_conf = {
                 .ps_poll_recovery_period     = 700,
                 .bet_enable                  = CONF_BET_MODE_ENABLE,
                 .bet_max_consecutive         = 10,
-                .psm_entry_retries           = 3,
+                .psm_entry_retries           = 5,
+                .psm_entry_nullfunc_retries  = 3,
+                .psm_entry_hangover_period   = 1,
                 .keep_alive_interval         = 55000,
                 .max_listen_interval         = 20,
         },
@@ -251,15 +229,34 @@ static struct conf_drv_settings default_conf = {
                 .host_fast_wakeup_support = false
         },
         .roam_trigger = {
-                /* FIXME: due to firmware bug, must use value 1 for now */
                 .trigger_pacing               = 1,
                 .avg_weight_rssi_beacon       = 20,
                 .avg_weight_rssi_data         = 10,
                 .avg_weight_snr_beacon        = 20,
                 .avg_weight_snr_data          = 10
-        }
+        },
+        .scan = {
+                .min_dwell_time_active        = 7500,
+                .max_dwell_time_active        = 30000,
+                .min_dwell_time_passive       = 30000,
+                .max_dwell_time_passive       = 60000,
+                .num_probe_reqs               = 2,
+        },
+        .rf = {
+                .tx_per_channel_power_compensation_2 = {
+                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                },
+                .tx_per_channel_power_compensation_5 = {
+                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                },
+        },
 };
 
+static void __wl1271_op_remove_interface(struct wl1271 *wl);
+
+
 static void wl1271_device_release(struct device *dev)
 {
 
@@ -277,6 +274,67 @@ static struct platform_device wl1271_device = {
 
 static LIST_HEAD(wl_list);
 
+static int wl1271_dev_notify(struct notifier_block *me, unsigned long what,
+                             void *arg)
+{
+        struct net_device *dev = arg;
+        struct wireless_dev *wdev;
+        struct wiphy *wiphy;
+        struct ieee80211_hw *hw;
+        struct wl1271 *wl;
+        struct wl1271 *wl_temp;
+        int ret = 0;
+
+        /* Check that this notification is for us. */
+        if (what != NETDEV_CHANGE)
+                return NOTIFY_DONE;
+
+        wdev = dev->ieee80211_ptr;
+        if (wdev == NULL)
+                return NOTIFY_DONE;
+
+        wiphy = wdev->wiphy;
+        if (wiphy == NULL)
+                return NOTIFY_DONE;
+
+        hw = wiphy_priv(wiphy);
+        if (hw == NULL)
+                return NOTIFY_DONE;
+
+        wl_temp = hw->priv;
+        list_for_each_entry(wl, &wl_list, list) {
+                if (wl == wl_temp)
+                        break;
+        }
+        if (wl != wl_temp)
+                return NOTIFY_DONE;
+
+        mutex_lock(&wl->mutex);
+
+        if (wl->state == WL1271_STATE_OFF)
+                goto out;
+
+        if (!test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
+        if ((dev->operstate == IF_OPER_UP) &&
+            !test_and_set_bit(WL1271_FLAG_STA_STATE_SENT, &wl->flags)) {
+                wl1271_cmd_set_sta_state(wl);
+                wl1271_info("Association completed.");
+        }
+
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return NOTIFY_OK;
+}
+
 static void wl1271_conf_init(struct wl1271 *wl)
 {
 
@@ -309,6 +367,10 @@ static int wl1271_plt_init(struct wl1271 *wl)
         if (ret < 0)
                 return ret;
 
+        ret = wl1271_cmd_ext_radio_parms(wl);
+        if (ret < 0)
+                return ret;
+
         ret = wl1271_init_templates_config(wl);
         if (ret < 0)
                 return ret;
@@ -346,8 +408,16 @@ static int wl1271_plt_init(struct wl1271 *wl)
         if (ret < 0)
                 goto out_free_memmap;
 
-        /* Default TID configuration */
+        /* Default TID/AC configuration */
+        BUG_ON(wl->conf.tx.tid_conf_count != wl->conf.tx.ac_conf_count);
         for (i = 0; i < wl->conf.tx.tid_conf_count; i++) {
+                conf_ac = &wl->conf.tx.ac_conf[i];
+                ret = wl1271_acx_ac_cfg(wl, conf_ac->ac, conf_ac->cw_min,
+                                        conf_ac->cw_max, conf_ac->aifsn,
+                                        conf_ac->tx_op_limit);
+                if (ret < 0)
+                        goto out_free_memmap;
+
                 conf_tid = &wl->conf.tx.tid_conf[i];
                 ret = wl1271_acx_tid_cfg(wl, conf_tid->queue_id,
                                          conf_tid->channel_type,
@@ -360,16 +430,6 @@ static int wl1271_plt_init(struct wl1271 *wl)
                         goto out_free_memmap;
         }
 
-        /* Default AC configuration */
-        for (i = 0; i < wl->conf.tx.ac_conf_count; i++) {
-                conf_ac = &wl->conf.tx.ac_conf[i];
-                ret = wl1271_acx_ac_cfg(wl, conf_ac->ac, conf_ac->cw_min,
-                                        conf_ac->cw_max, conf_ac->aifsn,
-                                        conf_ac->tx_op_limit);
-                if (ret < 0)
-                        goto out_free_memmap;
-        }
-
         /* Enable data path */
         ret = wl1271_cmd_data_path(wl, 1);
         if (ret < 0)
@@ -562,20 +622,6 @@ static int wl1271_fetch_nvs(struct wl1271 *wl)
                 return ret;
         }
 
-        /*
-         * FIXME: the LEGACY NVS image support (NVS's missing the 5GHz band
-         * configurations) can be removed when those NVS files stop floating
-         * around.
-         */
-        if (fw->size != sizeof(struct wl1271_nvs_file) &&
-            (fw->size != WL1271_INI_LEGACY_NVS_FILE_SIZE ||
-             wl1271_11a_enabled())) {
-                wl1271_error("nvs size is not as expected: %zu != %zu",
-                             fw->size, sizeof(struct wl1271_nvs_file));
-                ret = -EILSEQ;
-                goto out;
-        }
-
         wl->nvs = kmemdup(fw->data, sizeof(struct wl1271_nvs_file), GFP_KERNEL);
 
         if (!wl->nvs) {
@@ -584,12 +630,37 @@ static int wl1271_fetch_nvs(struct wl1271 *wl)
                 goto out;
         }
 
+        wl->nvs_len = fw->size;
+
 out:
         release_firmware(fw);
 
         return ret;
 }
 
+static void wl1271_recovery_work(struct work_struct *work)
+{
+        struct wl1271 *wl =
+                container_of(work, struct wl1271, recovery_work);
+
+        mutex_lock(&wl->mutex);
+
+        if (wl->state != WL1271_STATE_ON)
+                goto out;
+
+        wl1271_info("Hardware recovery in progress.");
+
+        if (test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags))
+                ieee80211_connection_loss(wl->vif);
+
+        /* reboot the chipset */
+        __wl1271_op_remove_interface(wl);
+        ieee80211_restart_hw(wl->hw);
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
 static void wl1271_fw_wakeup(struct wl1271 *wl)
 {
         u32 elp_reg;
@@ -610,8 +681,6 @@ static int wl1271_setup(struct wl1271 *wl)
                 return -ENOMEM;
         }
 
-        INIT_WORK(&wl->irq_work, wl1271_irq_work);
-        INIT_WORK(&wl->tx_work, wl1271_tx_work);
         return 0;
 }
 
@@ -621,7 +690,9 @@ static int wl1271_chip_wakeup(struct wl1271 *wl)
         int ret = 0;
 
         msleep(WL1271_PRE_POWER_ON_SLEEP);
-        wl1271_power_on(wl);
+        ret = wl1271_power_on(wl);
+        if (ret < 0)
+                goto out;
         msleep(WL1271_POWER_ON_SLEEP);
         wl1271_io_reset(wl);
         wl1271_io_init(wl);
@@ -766,10 +837,12 @@ int wl1271_plt_stop(struct wl1271 *wl)
 out:
         mutex_unlock(&wl->mutex);
 
+        cancel_work_sync(&wl->irq_work);
+        cancel_work_sync(&wl->recovery_work);
+
         return ret;
 }
 
-
 static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct wl1271 *wl = hw->priv;
@@ -812,6 +885,10 @@ static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         return NETDEV_TX_OK;
 }
 
+static struct notifier_block wl1271_dev_notifier = {
+        .notifier_call = wl1271_dev_notify,
+};
+
 static int wl1271_op_start(struct ieee80211_hw *hw)
 {
         wl1271_debug(DEBUG_MAC80211, "mac80211 start");
@@ -928,13 +1005,10 @@ out:
         return ret;
 }
 
-static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
-                                       struct ieee80211_vif *vif)
+static void __wl1271_op_remove_interface(struct wl1271 *wl)
 {
-        struct wl1271 *wl = hw->priv;
         int i;
 
-        mutex_lock(&wl->mutex);
         wl1271_debug(DEBUG_MAC80211, "mac80211 remove interface");
 
         wl1271_info("down");
@@ -948,10 +1022,10 @@ static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
                 ieee80211_enable_dyn_ps(wl->vif);
 
         if (wl->scan.state != WL1271_SCAN_STATE_IDLE) {
-                ieee80211_scan_completed(wl->hw, true);
                 wl->scan.state = WL1271_SCAN_STATE_IDLE;
                 kfree(wl->scan.scanned_ch);
                 wl->scan.scanned_ch = NULL;
+                ieee80211_scan_completed(wl->hw, true);
         }
 
         wl->state = WL1271_STATE_OFF;
@@ -960,9 +1034,11 @@ static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
 
         mutex_unlock(&wl->mutex);
 
+        cancel_delayed_work_sync(&wl->scan_complete_work);
         cancel_work_sync(&wl->irq_work);
         cancel_work_sync(&wl->tx_work);
         cancel_delayed_work_sync(&wl->pspoll_work);
+        cancel_delayed_work_sync(&wl->elp_work);
 
         mutex_lock(&wl->mutex);
 
@@ -1004,8 +1080,19 @@ static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
         wl->tx_res_if = NULL;
         kfree(wl->target_mem_map);
         wl->target_mem_map = NULL;
+}
+
+static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif)
+{
+        struct wl1271 *wl = hw->priv;
 
+        mutex_lock(&wl->mutex);
+        WARN_ON(wl->vif != vif);
+        __wl1271_op_remove_interface(wl);
         mutex_unlock(&wl->mutex);
+
+        cancel_work_sync(&wl->recovery_work);
 }
 
 static void wl1271_configure_filters(struct wl1271 *wl, unsigned int filters)
@@ -1287,7 +1374,7 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
                 if (test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags)) {
                         wl1271_debug(DEBUG_PSM, "psm enabled");
                         ret = wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE,
-                                                 true);
+                                                 wl->basic_rate, true);
                 }
         } else if (!(conf->flags & IEEE80211_CONF_PS) &&
                    test_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags)) {
@@ -1297,7 +1384,7 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
 
                 if (test_bit(WL1271_FLAG_PSM, &wl->flags))
                         ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE,
-                                                 true);
+                                                 wl->basic_rate, true);
         }
 
         if (conf->power_level != wl->power_level) {
@@ -1474,6 +1561,11 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 tx_seq_32 = WL1271_TX_SECURITY_HI32(wl->tx_security_seq);
                 tx_seq_16 = WL1271_TX_SECURITY_LO16(wl->tx_security_seq);
                 break;
+        case WL1271_CIPHER_SUITE_GEM:
+                key_type = KEY_GEM;
+                tx_seq_32 = WL1271_TX_SECURITY_HI32(wl->tx_security_seq);
+                tx_seq_16 = WL1271_TX_SECURITY_LO16(wl->tx_security_seq);
+                break;
         default:
                 wl1271_error("Unknown key algo 0x%x", key_conf->cipher);
 
@@ -1557,10 +1649,7 @@ static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
-        if (wl1271_11a_enabled())
-                ret = wl1271_scan(hw->priv, ssid, len, req);
-        else
-                ret = wl1271_scan(hw->priv, ssid, len, req);
+        ret = wl1271_scan(hw->priv, ssid, len, req);
 
         wl1271_ps_elp_sleep(wl);
 
@@ -1632,7 +1721,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
-        if ((changed && BSS_CHANGED_BEACON_INT) &&
+        if ((changed & BSS_CHANGED_BEACON_INT) &&
             (wl->bss_type == BSS_TYPE_IBSS)) {
                 wl1271_debug(DEBUG_ADHOC, "ad-hoc beacon interval updated: %d",
                         bss_conf->beacon_int);
@@ -1641,7 +1730,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                 do_join = true;
         }
 
-        if ((changed && BSS_CHANGED_BEACON) &&
+        if ((changed & BSS_CHANGED_BEACON) &&
             (wl->bss_type == BSS_TYPE_IBSS)) {
                 struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
 
@@ -1775,12 +1864,15 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                         if (test_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags) &&
                             !test_bit(WL1271_FLAG_PSM, &wl->flags)) {
                                 mode = STATION_POWER_SAVE_MODE;
-                                ret = wl1271_ps_set_mode(wl, mode, true);
+                                ret = wl1271_ps_set_mode(wl, mode,
+                                                         wl->basic_rate,
+                                                         true);
                                 if (ret < 0)
                                         goto out_sleep;
                         }
                 } else {
                         /* use defaults when not associated */
+                        clear_bit(WL1271_FLAG_STA_STATE_SENT, &wl->flags);
                         clear_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags);
                         wl->aid = 0;
 
@@ -1992,21 +2084,24 @@ static struct ieee80211_rate wl1271_rates[] = {
           .hw_value_short = CONF_HW_BIT_RATE_54MBPS, },
 };
 
-/* can't be const, mac80211 writes to this */
+/*
+ * Can't be const, mac80211 writes to this. The order of the channels here
+ * is designed to improve scanning.
+ */
 static struct ieee80211_channel wl1271_channels[] = {
         { .hw_value = 1, .center_freq = 2412, .max_power = 25 },
-        { .hw_value = 2, .center_freq = 2417, .max_power = 25 },
-        { .hw_value = 3, .center_freq = 2422, .max_power = 25 },
-        { .hw_value = 4, .center_freq = 2427, .max_power = 25 },
         { .hw_value = 5, .center_freq = 2432, .max_power = 25 },
-        { .hw_value = 6, .center_freq = 2437, .max_power = 25 },
-        { .hw_value = 7, .center_freq = 2442, .max_power = 25 },
-        { .hw_value = 8, .center_freq = 2447, .max_power = 25 },
         { .hw_value = 9, .center_freq = 2452, .max_power = 25 },
-        { .hw_value = 10, .center_freq = 2457, .max_power = 25 },
-        { .hw_value = 11, .center_freq = 2462, .max_power = 25 },
-        { .hw_value = 12, .center_freq = 2467, .max_power = 25 },
         { .hw_value = 13, .center_freq = 2472, .max_power = 25 },
+        { .hw_value = 4, .center_freq = 2427, .max_power = 25 },
+        { .hw_value = 8, .center_freq = 2447, .max_power = 25 },
+        { .hw_value = 12, .center_freq = 2467, .max_power = 25 },
+        { .hw_value = 3, .center_freq = 2422, .max_power = 25 },
+        { .hw_value = 7, .center_freq = 2442, .max_power = 25 },
+        { .hw_value = 11, .center_freq = 2462, .max_power = 25 },
+        { .hw_value = 2, .center_freq = 2417, .max_power = 25 },
+        { .hw_value = 6, .center_freq = 2437, .max_power = 25 },
+        { .hw_value = 10, .center_freq = 2457, .max_power = 25 },
 };
 
 /* mapping to indexes for wl1271_rates */
@@ -2075,49 +2170,52 @@ static struct ieee80211_rate wl1271_rates_5ghz[] = {
           .hw_value_short = CONF_HW_BIT_RATE_54MBPS, },
 };
 
-/* 5 GHz band channels for WL1273 */
+/*
+ * 5 GHz band channels for WL1273 - can't be const, mac80211 writes to this.
+ * The order of the channels here is designed to improve scanning.
+ */
 static struct ieee80211_channel wl1271_channels_5ghz[] = {
         { .hw_value = 183, .center_freq = 4915},
-        { .hw_value = 184, .center_freq = 4920},
-        { .hw_value = 185, .center_freq = 4925},
-        { .hw_value = 187, .center_freq = 4935},
         { .hw_value = 188, .center_freq = 4940},
-        { .hw_value = 189, .center_freq = 4945},
-        { .hw_value = 192, .center_freq = 4960},
-        { .hw_value = 196, .center_freq = 4980},
-        { .hw_value = 7, .center_freq = 5035},
         { .hw_value = 8, .center_freq = 5040},
-        { .hw_value = 9, .center_freq = 5045},
-        { .hw_value = 11, .center_freq = 5055},
-        { .hw_value = 12, .center_freq = 5060},
-        { .hw_value = 16, .center_freq = 5080},
         { .hw_value = 34, .center_freq = 5170},
-        { .hw_value = 36, .center_freq = 5180},
-        { .hw_value = 38, .center_freq = 5190},
-        { .hw_value = 40, .center_freq = 5200},
-        { .hw_value = 42, .center_freq = 5210},
         { .hw_value = 44, .center_freq = 5220},
-        { .hw_value = 46, .center_freq = 5230},
-        { .hw_value = 48, .center_freq = 5240},
-        { .hw_value = 52, .center_freq = 5260},
-        { .hw_value = 56, .center_freq = 5280},
         { .hw_value = 60, .center_freq = 5300},
-        { .hw_value = 64, .center_freq = 5320},
-        { .hw_value = 100, .center_freq = 5500},
-        { .hw_value = 104, .center_freq = 5520},
-        { .hw_value = 108, .center_freq = 5540},
         { .hw_value = 112, .center_freq = 5560},
-        { .hw_value = 116, .center_freq = 5580},
-        { .hw_value = 120, .center_freq = 5600},
-        { .hw_value = 124, .center_freq = 5620},
-        { .hw_value = 128, .center_freq = 5640},
         { .hw_value = 132, .center_freq = 5660},
+        { .hw_value = 157, .center_freq = 5785},
+        { .hw_value = 184, .center_freq = 4920},
+        { .hw_value = 189, .center_freq = 4945},
+        { .hw_value = 9, .center_freq = 5045},
+        { .hw_value = 36, .center_freq = 5180},
+        { .hw_value = 46, .center_freq = 5230},
+        { .hw_value = 64, .center_freq = 5320},
+        { .hw_value = 116, .center_freq = 5580},
         { .hw_value = 136, .center_freq = 5680},
+        { .hw_value = 192, .center_freq = 4960},
+        { .hw_value = 11, .center_freq = 5055},
+        { .hw_value = 38, .center_freq = 5190},
+        { .hw_value = 48, .center_freq = 5240},
+        { .hw_value = 100, .center_freq = 5500},
+        { .hw_value = 120, .center_freq = 5600},
         { .hw_value = 140, .center_freq = 5700},
+        { .hw_value = 185, .center_freq = 4925},
+        { .hw_value = 196, .center_freq = 4980},
+        { .hw_value = 12, .center_freq = 5060},
+        { .hw_value = 40, .center_freq = 5200},
+        { .hw_value = 52, .center_freq = 5260},
+        { .hw_value = 104, .center_freq = 5520},
+        { .hw_value = 124, .center_freq = 5620},
         { .hw_value = 149, .center_freq = 5745},
-        { .hw_value = 153, .center_freq = 5765},
-        { .hw_value = 157, .center_freq = 5785},
         { .hw_value = 161, .center_freq = 5805},
+        { .hw_value = 187, .center_freq = 4935},
+        { .hw_value = 7, .center_freq = 5035},
+        { .hw_value = 16, .center_freq = 5080},
+        { .hw_value = 42, .center_freq = 5210},
+        { .hw_value = 56, .center_freq = 5280},
+        { .hw_value = 108, .center_freq = 5540},
+        { .hw_value = 128, .center_freq = 5640},
+        { .hw_value = 153, .center_freq = 5765},
         { .hw_value = 165, .center_freq = 5825},
 };
 
@@ -2210,8 +2308,7 @@ static ssize_t wl1271_sysfs_show_bt_coex_state(struct device *dev,
         struct wl1271 *wl = dev_get_drvdata(dev);
         ssize_t len;
 
-        /* FIXME: what's the maximum length of buf? page size?*/
-        len = 500;
+        len = PAGE_SIZE;
 
         mutex_lock(&wl->mutex);
         len = snprintf(buf, len, "%d\n\n0 - off\n1 - on\n",
@@ -2272,8 +2369,7 @@ static ssize_t wl1271_sysfs_show_hw_pg_ver(struct device *dev,
         struct wl1271 *wl = dev_get_drvdata(dev);
         ssize_t len;
 
-        /* FIXME: what's the maximum length of buf? page size?*/
-        len = 500;
+        len = PAGE_SIZE;
 
         mutex_lock(&wl->mutex);
         if (wl->hw_pg_ver >= 0)
@@ -2305,6 +2401,8 @@ int wl1271_register_hw(struct wl1271 *wl)
 
         wl->mac80211_registered = true;
 
+        register_netdevice_notifier(&wl1271_dev_notifier);
+
         wl1271_notice("loaded");
 
         return 0;
@@ -2313,6 +2411,7 @@ EXPORT_SYMBOL_GPL(wl1271_register_hw);
 
 void wl1271_unregister_hw(struct wl1271 *wl)
 {
+        unregister_netdevice_notifier(&wl1271_dev_notifier);
         ieee80211_unregister_hw(wl->hw);
         wl->mac80211_registered = false;
 
@@ -2321,6 +2420,14 @@ EXPORT_SYMBOL_GPL(wl1271_unregister_hw);
 
 int wl1271_init_ieee80211(struct wl1271 *wl)
 {
+        static const u32 cipher_suites[] = {
+                WLAN_CIPHER_SUITE_WEP40,
+                WLAN_CIPHER_SUITE_WEP104,
+                WLAN_CIPHER_SUITE_TKIP,
+                WLAN_CIPHER_SUITE_CCMP,
+                WL1271_CIPHER_SUITE_GEM,
+        };
+
         /* The tx descriptor buffer and the TKIP space. */
         wl->hw->extra_tx_headroom = WL1271_TKIP_IV_SPACE +
                 sizeof(struct wl1271_tx_hw_descr);
@@ -2338,13 +2445,14 @@ int wl1271_init_ieee80211(struct wl1271 *wl)
                 IEEE80211_HW_CONNECTION_MONITOR |
                 IEEE80211_HW_SUPPORTS_CQM_RSSI;
 
+        wl->hw->wiphy->cipher_suites = cipher_suites;
+        wl->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+
         wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC);
         wl->hw->wiphy->max_scan_ssids = 1;
         wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wl1271_band_2ghz;
-
-        if (wl1271_11a_enabled())
-                wl->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &wl1271_band_5ghz;
+        wl->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &wl1271_band_5ghz;
 
         wl->hw->queues = 4;
         wl->hw->max_rates = 1;
@@ -2363,6 +2471,7 @@ struct ieee80211_hw *wl1271_alloc_hw(void)
         struct platform_device *plat_dev = NULL;
         struct wl1271 *wl;
         int i, ret;
+        unsigned int order;
 
         hw = ieee80211_alloc_hw(sizeof(*wl), &wl1271_ops);
         if (!hw) {
@@ -2390,6 +2499,10 @@ struct ieee80211_hw *wl1271_alloc_hw(void)
 
         INIT_DELAYED_WORK(&wl->elp_work, wl1271_elp_work);
         INIT_DELAYED_WORK(&wl->pspoll_work, wl1271_pspoll_work);
+        INIT_WORK(&wl->irq_work, wl1271_irq_work);
+        INIT_WORK(&wl->tx_work, wl1271_tx_work);
+        INIT_WORK(&wl->recovery_work, wl1271_recovery_work);
+        INIT_DELAYED_WORK(&wl->scan_complete_work, wl1271_scan_complete_work);
         wl->channel = WL1271_DEFAULT_CHANNEL;
         wl->beacon_int = WL1271_DEFAULT_BEACON_INT;
         wl->default_key = 0;
@@ -2421,11 +2534,18 @@ struct ieee80211_hw *wl1271_alloc_hw(void)
 
         wl1271_debugfs_init(wl);
 
+        order = get_order(WL1271_AGGR_BUFFER_SIZE);
+        wl->aggr_buf = (u8 *)__get_free_pages(GFP_KERNEL, order);
+        if (!wl->aggr_buf) {
+                ret = -ENOMEM;
+                goto err_hw;
+        }
+
         /* Register platform device */
         ret = platform_device_register(wl->plat_dev);
         if (ret) {
                 wl1271_error("couldn't register platform device");
-                goto err_hw;
+                goto err_aggr;
         }
         dev_set_drvdata(&wl->plat_dev->dev, wl);
 
@@ -2451,6 +2571,9 @@ err_bt_coex_state:
 err_platform:
         platform_device_unregister(wl->plat_dev);
 
+err_aggr:
+        free_pages((unsigned long)wl->aggr_buf, order);
+
 err_hw:
         wl1271_debugfs_exit(wl);
         kfree(plat_dev);
@@ -2467,6 +2590,8 @@ EXPORT_SYMBOL_GPL(wl1271_alloc_hw);
 int wl1271_free_hw(struct wl1271 *wl)
 {
         platform_device_unregister(wl->plat_dev);
+        free_pages((unsigned long)wl->aggr_buf,
+                        get_order(WL1271_AGGR_BUFFER_SIZE));
         kfree(wl->plat_dev);
 
         wl1271_debugfs_exit(wl);
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.c b/drivers/net/wireless/wl12xx/wl1271_ps.c
index a5e60e0403e5..e3c332e2f97c 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1271_ps.c
@@ -39,6 +39,9 @@ void wl1271_elp_work(struct work_struct *work)
 
         mutex_lock(&wl->mutex);
 
+        if (unlikely(wl->state == WL1271_STATE_OFF))
+                goto out;
+
         if (test_bit(WL1271_FLAG_IN_ELP, &wl->flags) ||
             (!test_bit(WL1271_FLAG_PSM, &wl->flags) &&
              !test_bit(WL1271_FLAG_IDLE, &wl->flags)))
@@ -61,7 +64,7 @@ void wl1271_ps_elp_sleep(struct wl1271 *wl)
             test_bit(WL1271_FLAG_IDLE, &wl->flags)) {
                 cancel_delayed_work(&wl->elp_work);
                 ieee80211_queue_delayed_work(wl->hw, &wl->elp_work,
-                                        msecs_to_jiffies(ELP_ENTRY_DELAY));
+                                             msecs_to_jiffies(ELP_ENTRY_DELAY));
         }
 }
 
@@ -96,6 +99,7 @@ int wl1271_ps_elp_wakeup(struct wl1271 *wl, bool chip_awake)
                         &compl, msecs_to_jiffies(WL1271_WAKEUP_TIMEOUT));
                 if (ret == 0) {
                         wl1271_error("ELP wakeup timeout!");
+                        ieee80211_queue_work(wl->hw, &wl->recovery_work);
                         ret = -ETIMEDOUT;
                         goto err;
                 } else if (ret < 0) {
@@ -121,7 +125,7 @@ out:
 }
 
 int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode,
-                       bool send)
+                       u32 rates, bool send)
 {
         int ret;
 
@@ -129,7 +133,14 @@ int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode,
         case STATION_POWER_SAVE_MODE:
                 wl1271_debug(DEBUG_PSM, "entering psm");
 
-                ret = wl1271_cmd_ps_mode(wl, STATION_POWER_SAVE_MODE, send);
+                ret = wl1271_acx_wake_up_conditions(wl);
+                if (ret < 0) {
+                        wl1271_error("couldn't set wake up conditions");
+                        return ret;
+                }
+
+                ret = wl1271_cmd_ps_mode(wl, STATION_POWER_SAVE_MODE,
+                                         rates, send);
                 if (ret < 0)
                         return ret;
 
@@ -152,7 +163,8 @@ int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode,
                 if (ret < 0)
                         return ret;
 
-                ret = wl1271_cmd_ps_mode(wl, STATION_ACTIVE_MODE, send);
+                ret = wl1271_cmd_ps_mode(wl, STATION_ACTIVE_MODE,
+                                         rates, send);
                 if (ret < 0)
                         return ret;
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.h b/drivers/net/wireless/wl12xx/wl1271_ps.h
index 940276f517a4..6ba7b032736f 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ps.h
+++ b/drivers/net/wireless/wl12xx/wl1271_ps.h
@@ -28,7 +28,7 @@
 #include "wl1271_acx.h"
 
 int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode,
-                       bool send);
+                       u32 rates, bool send);
 void wl1271_ps_elp_sleep(struct wl1271 *wl);
 int wl1271_ps_elp_wakeup(struct wl1271 *wl, bool chip_awake);
 void wl1271_elp_work(struct work_struct *work);
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.c b/drivers/net/wireless/wl12xx/wl1271_rx.c
index 019aa79cd9df..bea133b6e489 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.c
@@ -74,9 +74,8 @@ static void wl1271_rx_status(struct wl1271 *wl,
         }
 }
 
-static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
+static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length)
 {
-        struct ieee80211_rx_status rx_status;
         struct wl1271_rx_descriptor *desc;
         struct sk_buff *skb;
         u16 *fc;
@@ -88,16 +87,16 @@ static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
          * workaround this by not retrieving them at all.
          */
         if (unlikely(wl->state == WL1271_STATE_PLT))
-                return;
+                return -EINVAL;
 
         skb = __dev_alloc_skb(length, GFP_KERNEL);
         if (!skb) {
                 wl1271_error("Couldn't allocate RX frame");
-                return;
+                return -ENOMEM;
         }
 
         buf = skb_put(skb, length);
-        wl1271_read(wl, WL1271_SLV_MEM_DATA, buf, length, true);
+        memcpy(buf, data, length);
 
         /* the data read starts with the descriptor */
         desc = (struct wl1271_rx_descriptor *) buf;
@@ -109,15 +108,16 @@ static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
         if ((*fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON)
                 beacon = 1;
 
-        wl1271_rx_status(wl, desc, &rx_status, beacon);
+        wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon);
 
         wl1271_debug(DEBUG_RX, "rx skb 0x%p: %d B %s", skb, skb->len,
                      beacon ? "beacon" : "");
 
         skb_trim(skb, skb->len - desc->pad_len);
 
-        memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
         ieee80211_rx_ni(wl->hw, skb);
+
+        return 0;
 }
 
 void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status)
@@ -126,31 +126,60 @@ void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status)
         u32 buf_size;
         u32 fw_rx_counter  = status->fw_rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
         u32 drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
+        u32 rx_counter;
         u32 mem_block;
+        u32 pkt_length;
+        u32 pkt_offset;
 
         while (drv_rx_counter != fw_rx_counter) {
-                mem_block = wl1271_rx_get_mem_block(status, drv_rx_counter);
-                buf_size = wl1271_rx_get_buf_size(status, drv_rx_counter);
+                buf_size = 0;
+                rx_counter = drv_rx_counter;
+                while (rx_counter != fw_rx_counter) {
+                        pkt_length = wl1271_rx_get_buf_size(status, rx_counter);
+                        if (buf_size + pkt_length > WL1271_AGGR_BUFFER_SIZE)
+                                break;
+                        buf_size += pkt_length;
+                        rx_counter++;
+                        rx_counter &= NUM_RX_PKT_DESC_MOD_MASK;
+                }
 
                 if (buf_size == 0) {
                         wl1271_warning("received empty data");
                         break;
                 }
 
+                /*
+                 * Choose the block we want to read
+                 * For aggregated packets, only the first memory block should
+                 * be retrieved. The FW takes care of the rest.
+                 */
+                mem_block = wl1271_rx_get_mem_block(status, drv_rx_counter);
                 wl->rx_mem_pool_addr.addr = (mem_block << 8) +
                         le32_to_cpu(wl_mem_map->packet_memory_pool_start);
                 wl->rx_mem_pool_addr.addr_extra =
                         wl->rx_mem_pool_addr.addr + 4;
-
-                /* Choose the block we want to read */
                 wl1271_write(wl, WL1271_SLV_REG_DATA, &wl->rx_mem_pool_addr,
-                             sizeof(wl->rx_mem_pool_addr), false);
-
-                wl1271_rx_handle_data(wl, buf_size);
-
-                wl->rx_counter++;
-                drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
+                                sizeof(wl->rx_mem_pool_addr), false);
+
+                /* Read all available packets at once */
+                wl1271_read(wl, WL1271_SLV_MEM_DATA, wl->aggr_buf,
+                                buf_size, true);
+
+                /* Split data into separate packets */
+                pkt_offset = 0;
+                while (pkt_offset < buf_size) {
+                        pkt_length = wl1271_rx_get_buf_size(status,
+                                        drv_rx_counter);
+                        if (wl1271_rx_handle_data(wl,
+                                        wl->aggr_buf + pkt_offset,
+                                        pkt_length) < 0)
+                                break;
+                        wl->rx_counter++;
+                        drv_rx_counter++;
+                        drv_rx_counter &= NUM_RX_PKT_DESC_MOD_MASK;
+                        pkt_offset += pkt_length;
+                }
         }
-
-        wl1271_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
+        wl1271_write32(wl, RX_DRIVER_COUNTER_ADDRESS,
+                        cpu_to_le32(wl->rx_counter));
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_scan.c b/drivers/net/wireless/wl12xx/wl1271_scan.c
index e4950c8e396e..909bb47995b6 100644
--- a/drivers/net/wireless/wl12xx/wl1271_scan.c
+++ b/drivers/net/wireless/wl12xx/wl1271_scan.c
@@ -28,11 +28,43 @@
 #include "wl1271_scan.h"
 #include "wl1271_acx.h"
 
+void wl1271_scan_complete_work(struct work_struct *work)
+{
+        struct delayed_work *dwork;
+        struct wl1271 *wl;
+
+        dwork = container_of(work, struct delayed_work, work);
+        wl = container_of(dwork, struct wl1271, scan_complete_work);
+
+        wl1271_debug(DEBUG_SCAN, "Scanning complete");
+
+        mutex_lock(&wl->mutex);
+
+        if (wl->scan.state == WL1271_SCAN_STATE_IDLE) {
+                mutex_unlock(&wl->mutex);
+                return;
+        }
+
+        wl->scan.state = WL1271_SCAN_STATE_IDLE;
+        kfree(wl->scan.scanned_ch);
+        wl->scan.scanned_ch = NULL;
+        mutex_unlock(&wl->mutex);
+
+        ieee80211_scan_completed(wl->hw, false);
+
+        if (wl->scan.failed) {
+                wl1271_info("Scan completed due to error.");
+                ieee80211_queue_work(wl->hw, &wl->recovery_work);
+        }
+}
+
+
 static int wl1271_get_scan_channels(struct wl1271 *wl,
                                     struct cfg80211_scan_request *req,
                                     struct basic_scan_channel_params *channels,
                                     enum ieee80211_band band, bool passive)
 {
+        struct conf_scan_settings *c = &wl->conf.scan;
         int i, j;
         u32 flags;
 
@@ -60,10 +92,17 @@ static int wl1271_get_scan_channels(struct wl1271 *wl,
                         wl1271_debug(DEBUG_SCAN, "beacon_found %d",
                                      req->channels[i]->beacon_found);
 
-                        channels[j].min_duration =
-                                cpu_to_le32(WL1271_SCAN_CHAN_MIN_DURATION);
-                        channels[j].max_duration =
-                                cpu_to_le32(WL1271_SCAN_CHAN_MAX_DURATION);
+                        if (!passive) {
+                                channels[j].min_duration =
+                                        cpu_to_le32(c->min_dwell_time_active);
+                                channels[j].max_duration =
+                                        cpu_to_le32(c->max_dwell_time_active);
+                        } else {
+                                channels[j].min_duration =
+                                        cpu_to_le32(c->min_dwell_time_passive);
+                                channels[j].max_duration =
+                                        cpu_to_le32(c->max_dwell_time_passive);
+                        }
                         channels[j].early_termination = 0;
                         channels[j].tx_power_att = req->channels[i]->max_power;
                         channels[j].channel = req->channels[i]->hw_value;
@@ -100,8 +139,11 @@ static int wl1271_scan_send(struct wl1271 *wl, enum ieee80211_band band,
 
         /* We always use high priority scans */
         scan_options = WL1271_SCAN_OPT_PRIORITY_HIGH;
-        if(passive)
+
+        /* No SSIDs means that we have a forced passive scan */
+        if (passive || wl->scan.req->n_ssids == 0)
                 scan_options |= WL1271_SCAN_OPT_PASSIVE;
+
         cmd->params.scan_options = cpu_to_le16(scan_options);
 
         cmd->params.n_ch = wl1271_get_scan_channels(wl, wl->scan.req,
@@ -117,7 +159,7 @@ static int wl1271_scan_send(struct wl1271 *wl, enum ieee80211_band band,
         cmd->params.rx_filter_options =
                 cpu_to_le32(CFG_RX_PRSP_EN | CFG_RX_MGMT_EN | CFG_RX_BCN_EN);
 
-        cmd->params.n_probe_reqs = WL1271_SCAN_PROBE_REQS;
+        cmd->params.n_probe_reqs = wl->conf.scan.num_probe_reqs;
         cmd->params.tx_rate = cpu_to_le32(basic_rate);
         cmd->params.tid_trigger = 0;
         cmd->params.scan_tag = WL1271_SCAN_DEFAULT_TAG;
@@ -165,7 +207,7 @@ out:
 
 void wl1271_scan_stm(struct wl1271 *wl)
 {
-        int ret;
+        int ret = 0;
 
         switch (wl->scan.state) {
         case WL1271_SCAN_STATE_IDLE:
@@ -185,7 +227,7 @@ void wl1271_scan_stm(struct wl1271 *wl)
                 ret = wl1271_scan_send(wl, IEEE80211_BAND_2GHZ, true,
                                        wl->conf.tx.basic_rate);
                 if (ret == WL1271_NOTHING_TO_SCAN) {
-                        if (wl1271_11a_enabled())
+                        if (wl->enable_11a)
                                 wl->scan.state = WL1271_SCAN_STATE_5GHZ_ACTIVE;
                         else
                                 wl->scan.state = WL1271_SCAN_STATE_DONE;
@@ -215,18 +257,22 @@ void wl1271_scan_stm(struct wl1271 *wl)
                 break;
 
         case WL1271_SCAN_STATE_DONE:
-                ieee80211_scan_completed(wl->hw, false);
-
-                kfree(wl->scan.scanned_ch);
-                wl->scan.scanned_ch = NULL;
-
-                wl->scan.state = WL1271_SCAN_STATE_IDLE;
+                wl->scan.failed = false;
+                cancel_delayed_work(&wl->scan_complete_work);
+                ieee80211_queue_delayed_work(wl->hw, &wl->scan_complete_work,
+                                             msecs_to_jiffies(0));
                 break;
 
         default:
                 wl1271_error("invalid scan state");
                 break;
         }
+
+        if (ret < 0) {
+                cancel_delayed_work(&wl->scan_complete_work);
+                ieee80211_queue_delayed_work(wl->hw, &wl->scan_complete_work,
+                                             msecs_to_jiffies(0));
+        }
 }
 
 int wl1271_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
@@ -249,6 +295,11 @@ int wl1271_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
         wl->scan.scanned_ch = kcalloc(req->n_channels,
                                       sizeof(*wl->scan.scanned_ch),
                                       GFP_KERNEL);
+        /* we assume failure so that timeout scenarios are handled correctly */
+        wl->scan.failed = true;
+        ieee80211_queue_delayed_work(wl->hw, &wl->scan_complete_work,
+                                     msecs_to_jiffies(WL1271_SCAN_TIMEOUT));
+
         wl1271_scan_stm(wl);
 
         return 0;
diff --git a/drivers/net/wireless/wl12xx/wl1271_scan.h b/drivers/net/wireless/wl12xx/wl1271_scan.h
index f1815700f5f9..6d57127b5e6b 100644
--- a/drivers/net/wireless/wl12xx/wl1271_scan.h
+++ b/drivers/net/wireless/wl12xx/wl1271_scan.h
@@ -32,6 +32,7 @@ int wl1271_scan_build_probe_req(struct wl1271 *wl,
                                 const u8 *ssid, size_t ssid_len,
                                 const u8 *ie, size_t ie_len, u8 band);
 void wl1271_scan_stm(struct wl1271 *wl);
+void wl1271_scan_complete_work(struct work_struct *work);
 
 #define WL1271_SCAN_MAX_CHANNELS       24
 #define WL1271_SCAN_DEFAULT_TAG        1
@@ -39,11 +40,10 @@ void wl1271_scan_stm(struct wl1271 *wl);
 #define WL1271_SCAN_OPT_ACTIVE         0
 #define WL1271_SCAN_OPT_PASSIVE        1
 #define WL1271_SCAN_OPT_PRIORITY_HIGH  4
-#define WL1271_SCAN_CHAN_MIN_DURATION  30000  /* TU */
-#define WL1271_SCAN_CHAN_MAX_DURATION  60000  /* TU */
 #define WL1271_SCAN_BAND_2_4_GHZ 0
 #define WL1271_SCAN_BAND_5_GHZ 1
-#define WL1271_SCAN_PROBE_REQS 3
+
+#define WL1271_SCAN_TIMEOUT    10000 /* msec */
 
 enum {
         WL1271_SCAN_STATE_IDLE,
diff --git a/drivers/net/wireless/wl12xx/wl1271_sdio.c b/drivers/net/wireless/wl12xx/wl1271_sdio.c
index 7059b5cccf0f..784ef3432641 100644
--- a/drivers/net/wireless/wl12xx/wl1271_sdio.c
+++ b/drivers/net/wireless/wl12xx/wl1271_sdio.c
@@ -29,14 +29,13 @@
 #include <linux/mmc/sdio_ids.h>
 #include <linux/mmc/card.h>
 #include <linux/gpio.h>
+#include <linux/wl12xx.h>
+#include <linux/pm_runtime.h>
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
 #include "wl1271_io.h"
 
-
-#define RX71_WL1271_IRQ_GPIO            42
-
 #ifndef SDIO_VENDOR_ID_TI
 #define SDIO_VENDOR_ID_TI               0x0097
 #endif
@@ -107,6 +106,8 @@ static void wl1271_sdio_raw_read(struct wl1271 *wl, int addr, void *buf,
         int ret;
         struct sdio_func *func = wl_to_func(wl);
 
+        sdio_claim_host(func);
+
         if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG_ADDR)) {
                 ((u8 *)buf)[0] = sdio_f0_readb(func, addr, &ret);
                 wl1271_debug(DEBUG_SDIO, "sdio read 52 addr 0x%x, byte 0x%02x",
@@ -122,9 +123,10 @@ static void wl1271_sdio_raw_read(struct wl1271 *wl, int addr, void *buf,
                 wl1271_dump_ascii(DEBUG_SDIO, "data: ", buf, len);
         }
 
+        sdio_release_host(func);
+
         if (ret)
                 wl1271_error("sdio read failed (%d)", ret);
-
 }
 
 static void wl1271_sdio_raw_write(struct wl1271 *wl, int addr, void *buf,
@@ -133,6 +135,8 @@ static void wl1271_sdio_raw_write(struct wl1271 *wl, int addr, void *buf,
         int ret;
         struct sdio_func *func = wl_to_func(wl);
 
+        sdio_claim_host(func);
+
         if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG_ADDR)) {
                 sdio_f0_writeb(func, ((u8 *)buf)[0], addr, &ret);
                 wl1271_debug(DEBUG_SDIO, "sdio write 52 addr 0x%x, byte 0x%02x",
@@ -147,26 +151,49 @@ static void wl1271_sdio_raw_write(struct wl1271 *wl, int addr, void *buf,
                 else
                         ret = sdio_memcpy_toio(func, addr, buf, len);
         }
+
+        sdio_release_host(func);
+
         if (ret)
                 wl1271_error("sdio write failed (%d)", ret);
+}
 
+static int wl1271_sdio_power_on(struct wl1271 *wl)
+{
+        struct sdio_func *func = wl_to_func(wl);
+        int ret;
+
+        /* Power up the card */
+        ret = pm_runtime_get_sync(&func->dev);
+        if (ret < 0)
+                goto out;
+
+        sdio_claim_host(func);
+        sdio_enable_func(func);
+        sdio_release_host(func);
+
+out:
+        return ret;
 }
 
-static void wl1271_sdio_set_power(struct wl1271 *wl, bool enable)
+static int wl1271_sdio_power_off(struct wl1271 *wl)
 {
         struct sdio_func *func = wl_to_func(wl);
 
-        /* Let the SDIO stack handle wlan_enable control, so we
-         * keep host claimed while wlan is in use to keep wl1271
-         * alive.
-         */
-        if (enable) {
-                sdio_claim_host(func);
-                sdio_enable_func(func);
-        } else {
-                sdio_disable_func(func);
-                sdio_release_host(func);
-        }
+        sdio_claim_host(func);
+        sdio_disable_func(func);
+        sdio_release_host(func);
+
+        /* Power down the card */
+        return pm_runtime_put_sync(&func->dev);
+}
+
+static int wl1271_sdio_set_power(struct wl1271 *wl, bool enable)
+{
+        if (enable)
+                return wl1271_sdio_power_on(wl);
+        else
+                return wl1271_sdio_power_off(wl);
 }
 
 static struct wl1271_if_operations sdio_ops = {
@@ -184,6 +211,7 @@ static int __devinit wl1271_probe(struct sdio_func *func,
                                   const struct sdio_device_id *id)
 {
         struct ieee80211_hw *hw;
+        const struct wl12xx_platform_data *wlan_data;
         struct wl1271 *wl;
         int ret;
 
@@ -203,13 +231,16 @@ static int __devinit wl1271_probe(struct sdio_func *func,
         /* Grab access to FN0 for ELP reg. */
         func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
 
-        wl->irq = gpio_to_irq(RX71_WL1271_IRQ_GPIO);
-        if (wl->irq < 0) {
-                ret = wl->irq;
-                wl1271_error("could not get irq!");
+        wlan_data = wl12xx_get_platform_data();
+        if (IS_ERR(wlan_data)) {
+                ret = PTR_ERR(wlan_data);
+                wl1271_error("missing wlan platform data: %d", ret);
                 goto out_free;
         }
 
+        wl->irq = wlan_data->irq;
+        wl->ref_clock = wlan_data->board_ref_clock;
+
         ret = request_irq(wl->irq, wl1271_irq, 0, DRIVER_NAME, wl);
         if (ret < 0) {
                 wl1271_error("request_irq() failed: %d", ret);
@@ -230,6 +261,9 @@ static int __devinit wl1271_probe(struct sdio_func *func,
 
         sdio_set_drvdata(func, wl);
 
+        /* Tell PM core that we don't need the card to be powered now */
+        pm_runtime_put_noidle(&func->dev);
+
         wl1271_notice("initialized");
 
         return 0;
@@ -248,17 +282,39 @@ static void __devexit wl1271_remove(struct sdio_func *func)
 {
         struct wl1271 *wl = sdio_get_drvdata(func);
 
-        free_irq(wl->irq, wl);
+        /* Undo decrement done above in wl1271_probe */
+        pm_runtime_get_noresume(&func->dev);
 
         wl1271_unregister_hw(wl);
+        free_irq(wl->irq, wl);
         wl1271_free_hw(wl);
 }
 
+static int wl1271_suspend(struct device *dev)
+{
+        /* Tell MMC/SDIO core it's OK to power down the card
+         * (if it isn't already), but not to remove it completely */
+        return 0;
+}
+
+static int wl1271_resume(struct device *dev)
+{
+        return 0;
+}
+
+static const struct dev_pm_ops wl1271_sdio_pm_ops = {
+        .suspend        = wl1271_suspend,
+        .resume         = wl1271_resume,
+};
+
 static struct sdio_driver wl1271_sdio_driver = {
         .name           = "wl1271_sdio",
         .id_table       = wl1271_devices,
         .probe          = wl1271_probe,
         .remove         = __devexit_p(wl1271_remove),
+        .drv = {
+                .pm = &wl1271_sdio_pm_ops,
+        },
 };
 
 static int __init wl1271_init(void)
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.c b/drivers/net/wireless/wl12xx/wl1271_spi.c
index 4cb99c541e2a..ef801680773f 100644
--- a/drivers/net/wireless/wl12xx/wl1271_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1271_spi.c
@@ -25,7 +25,7 @@
 #include <linux/module.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
-#include <linux/spi/wl12xx.h>
+#include <linux/wl12xx.h>
 #include <linux/slab.h>
 
 #include "wl1271.h"
@@ -63,6 +63,11 @@
                 ((WL1271_BUSY_WORD_LEN - 4) / sizeof(u32))
 #define HW_ACCESS_WSPI_INIT_CMD_MASK  0
 
+/* HW limitation: maximum possible chunk size is 4095 bytes */
+#define WSPI_MAX_CHUNK_SIZE    4092
+
+#define WSPI_MAX_NUM_OF_CHUNKS (WL1271_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE)
+
 static inline struct spi_device *wl_to_spi(struct wl1271 *wl)
 {
         return wl->if_priv;
@@ -202,90 +207,117 @@ static int wl1271_spi_read_busy(struct wl1271 *wl)
 static void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
                                 size_t len, bool fixed)
 {
-        struct spi_transfer t[3];
+        struct spi_transfer t[2];
         struct spi_message m;
         u32 *busy_buf;
         u32 *cmd;
+        u32 chunk_len;
 
-        cmd = &wl->buffer_cmd;
-        busy_buf = wl->buffer_busyword;
+        while (len > 0) {
+                chunk_len = min((size_t)WSPI_MAX_CHUNK_SIZE, len);
 
-        *cmd = 0;
-        *cmd |= WSPI_CMD_READ;
-        *cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
-        *cmd |= addr & WSPI_CMD_BYTE_ADDR;
+                cmd = &wl->buffer_cmd;
+                busy_buf = wl->buffer_busyword;
 
-        if (fixed)
-                *cmd |= WSPI_CMD_FIXED;
+                *cmd = 0;
+                *cmd |= WSPI_CMD_READ;
+                *cmd |= (chunk_len << WSPI_CMD_BYTE_LENGTH_OFFSET) &
+                        WSPI_CMD_BYTE_LENGTH;
+                *cmd |= addr & WSPI_CMD_BYTE_ADDR;
 
-        spi_message_init(&m);
-        memset(t, 0, sizeof(t));
+                if (fixed)
+                        *cmd |= WSPI_CMD_FIXED;
 
-        t[0].tx_buf = cmd;
-        t[0].len = 4;
-        t[0].cs_change = true;
-        spi_message_add_tail(&t[0], &m);
+                spi_message_init(&m);
+                memset(t, 0, sizeof(t));
 
-        /* Busy and non busy words read */
-        t[1].rx_buf = busy_buf;
-        t[1].len = WL1271_BUSY_WORD_LEN;
-        t[1].cs_change = true;
-        spi_message_add_tail(&t[1], &m);
+                t[0].tx_buf = cmd;
+                t[0].len = 4;
+                t[0].cs_change = true;
+                spi_message_add_tail(&t[0], &m);
 
-        spi_sync(wl_to_spi(wl), &m);
+                /* Busy and non busy words read */
+                t[1].rx_buf = busy_buf;
+                t[1].len = WL1271_BUSY_WORD_LEN;
+                t[1].cs_change = true;
+                spi_message_add_tail(&t[1], &m);
 
-        if (!(busy_buf[WL1271_BUSY_WORD_CNT - 1] & 0x1) &&
-            wl1271_spi_read_busy(wl)) {
-                memset(buf, 0, len);
-                return;
-        }
+                spi_sync(wl_to_spi(wl), &m);
 
-        spi_message_init(&m);
-        memset(t, 0, sizeof(t));
+                if (!(busy_buf[WL1271_BUSY_WORD_CNT - 1] & 0x1) &&
+                    wl1271_spi_read_busy(wl)) {
+                        memset(buf, 0, chunk_len);
+                        return;
+                }
 
-        t[0].rx_buf = buf;
-        t[0].len = len;
-        t[0].cs_change = true;
-        spi_message_add_tail(&t[0], &m);
+                spi_message_init(&m);
+                memset(t, 0, sizeof(t));
 
-        spi_sync(wl_to_spi(wl), &m);
+                t[0].rx_buf = buf;
+                t[0].len = chunk_len;
+                t[0].cs_change = true;
+                spi_message_add_tail(&t[0], &m);
 
-        wl1271_dump(DEBUG_SPI, "spi_read cmd -> ", cmd, sizeof(*cmd));
-        wl1271_dump(DEBUG_SPI, "spi_read buf <- ", buf, len);
+                spi_sync(wl_to_spi(wl), &m);
+
+                wl1271_dump(DEBUG_SPI, "spi_read cmd -> ", cmd, sizeof(*cmd));
+                wl1271_dump(DEBUG_SPI, "spi_read buf <- ", buf, chunk_len);
+
+                if (!fixed)
+                        addr += chunk_len;
+                buf += chunk_len;
+                len -= chunk_len;
+        }
 }
 
 static void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
                           size_t len, bool fixed)
 {
-        struct spi_transfer t[2];
+        struct spi_transfer t[2 * WSPI_MAX_NUM_OF_CHUNKS];
         struct spi_message m;
+        u32 commands[WSPI_MAX_NUM_OF_CHUNKS];
         u32 *cmd;
+        u32 chunk_len;
+        int i;
 
-        cmd = &wl->buffer_cmd;
-
-        *cmd = 0;
-        *cmd |= WSPI_CMD_WRITE;
-        *cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
-        *cmd |= addr & WSPI_CMD_BYTE_ADDR;
-
-        if (fixed)
-                *cmd |= WSPI_CMD_FIXED;
+        WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
 
         spi_message_init(&m);
         memset(t, 0, sizeof(t));
 
-        t[0].tx_buf = cmd;
-        t[0].len = sizeof(*cmd);
-        spi_message_add_tail(&t[0], &m);
+        cmd = &commands[0];
+        i = 0;
+        while (len > 0) {
+                chunk_len = min((size_t)WSPI_MAX_CHUNK_SIZE, len);
 
-        t[1].tx_buf = buf;
-        t[1].len = len;
-        spi_message_add_tail(&t[1], &m);
+                *cmd = 0;
+                *cmd |= WSPI_CMD_WRITE;
+                *cmd |= (chunk_len << WSPI_CMD_BYTE_LENGTH_OFFSET) &
+                        WSPI_CMD_BYTE_LENGTH;
+                *cmd |= addr & WSPI_CMD_BYTE_ADDR;
 
-        spi_sync(wl_to_spi(wl), &m);
+                if (fixed)
+                        *cmd |= WSPI_CMD_FIXED;
+
+                t[i].tx_buf = cmd;
+                t[i].len = sizeof(*cmd);
+                spi_message_add_tail(&t[i++], &m);
+
+                t[i].tx_buf = buf;
+                t[i].len = chunk_len;
+                spi_message_add_tail(&t[i++], &m);
 
-        wl1271_dump(DEBUG_SPI, "spi_write cmd -> ", cmd, sizeof(*cmd));
-        wl1271_dump(DEBUG_SPI, "spi_write buf -> ", buf, len);
+                wl1271_dump(DEBUG_SPI, "spi_write cmd -> ", cmd, sizeof(*cmd));
+                wl1271_dump(DEBUG_SPI, "spi_write buf -> ", buf, chunk_len);
+
+                if (!fixed)
+                        addr += chunk_len;
+                buf += chunk_len;
+                len -= chunk_len;
+                cmd++;
+        }
+
+        spi_sync(wl_to_spi(wl), &m);
 }
 
 static irqreturn_t wl1271_irq(int irq, void *cookie)
@@ -312,10 +344,12 @@ static irqreturn_t wl1271_irq(int irq, void *cookie)
         return IRQ_HANDLED;
 }
 
-static void wl1271_spi_set_power(struct wl1271 *wl, bool enable)
+static int wl1271_spi_set_power(struct wl1271 *wl, bool enable)
 {
         if (wl->set_power)
                 wl->set_power(enable);
+
+        return 0;
 }
 
 static struct wl1271_if_operations spi_ops = {
@@ -370,6 +404,8 @@ static int __devinit wl1271_probe(struct spi_device *spi)
                 goto out_free;
         }
 
+        wl->ref_clock = pdata->board_ref_clock;
+
         wl->irq = spi->irq;
         if (wl->irq < 0) {
                 wl1271_error("irq missing in platform data");
@@ -412,9 +448,8 @@ static int __devexit wl1271_remove(struct spi_device *spi)
 {
         struct wl1271 *wl = dev_get_drvdata(&spi->dev);
 
-        free_irq(wl->irq, wl);
-
         wl1271_unregister_hw(wl);
+        free_irq(wl->irq, wl);
         wl1271_free_hw(wl);
 
         return 0;
diff --git a/drivers/net/wireless/wl12xx/wl1271_testmode.c b/drivers/net/wireless/wl12xx/wl1271_testmode.c
index 6e0952f79e9a..a3aa84386c88 100644
--- a/drivers/net/wireless/wl12xx/wl1271_testmode.c
+++ b/drivers/net/wireless/wl12xx/wl1271_testmode.c
@@ -199,19 +199,6 @@ static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[])
         buf = nla_data(tb[WL1271_TM_ATTR_DATA]);
         len = nla_len(tb[WL1271_TM_ATTR_DATA]);
 
-        /*
-         * FIXME: the LEGACY NVS image support (NVS's missing the 5GHz band
-         * configurations) can be removed when those NVS files stop floating
-         * around.
-         */
-        if (len != sizeof(struct wl1271_nvs_file) &&
-            (len != WL1271_INI_LEGACY_NVS_FILE_SIZE ||
-             wl1271_11a_enabled())) {
-                wl1271_error("nvs size is not as expected: %zu != %zu",
-                             len, sizeof(struct wl1271_nvs_file));
-                return -EMSGSIZE;
-        }
-
         mutex_lock(&wl->mutex);
 
         kfree(wl->nvs);
@@ -224,6 +211,7 @@ static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[])
         }
 
         memcpy(wl->nvs, buf, len);
+        wl->nvs_len = len;
 
         wl1271_debug(DEBUG_TESTMODE, "testmode pushed nvs");
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.c b/drivers/net/wireless/wl12xx/wl1271_tx.c
index dc0b46c93c4b..e3dc13c4d01a 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.c
@@ -43,13 +43,17 @@ static int wl1271_tx_id(struct wl1271 *wl, struct sk_buff *skb)
         return -EBUSY;
 }
 
-static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra)
+static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra,
+                                u32 buf_offset)
 {
         struct wl1271_tx_hw_descr *desc;
         u32 total_len = skb->len + sizeof(struct wl1271_tx_hw_descr) + extra;
         u32 total_blocks;
         int id, ret = -EBUSY;
 
+        if (buf_offset + total_len > WL1271_AGGR_BUFFER_SIZE)
+                return -EBUSY;
+
         /* allocate free identifier for the packet */
         id = wl1271_tx_id(wl, skb);
         if (id < 0)
@@ -82,7 +86,7 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra)
         return ret;
 }
 
-static int wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
+static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
                               u32 extra, struct ieee80211_tx_info *control)
 {
         struct timespec ts;
@@ -110,9 +114,9 @@ static int wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
         /* configure the tx attributes */
         tx_attr = wl->session_counter << TX_HW_ATTR_OFST_SESSION_COUNTER;
 
-        /* queue */
+        /* queue (we use same identifiers for tid's and ac's */
         ac = wl1271_tx_get_queue(skb_get_queue_mapping(skb));
-        desc->tid = wl1271_tx_ac_to_tid(ac);
+        desc->tid = ac;
 
         desc->aid = TX_HW_DEFAULT_AID;
         desc->reserved = 0;
@@ -133,59 +137,17 @@ static int wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
         desc->tx_attr = cpu_to_le16(tx_attr);
 
         wl1271_debug(DEBUG_TX, "tx_fill_hdr: pad: %d", pad);
-        return 0;
-}
-
-static int wl1271_tx_send_packet(struct wl1271 *wl, struct sk_buff *skb,
-                                 struct ieee80211_tx_info *control)
-{
-
-        struct wl1271_tx_hw_descr *desc;
-        int len;
-
-        /* FIXME: This is a workaround for getting non-aligned packets.
-           This happens at least with EAPOL packets from the user space.
-           Our DMA requires packets to be aligned on a 4-byte boundary.
-        */
-        if (unlikely((long)skb->data & 0x03)) {
-                int offset = (4 - (long)skb->data) & 0x03;
-                wl1271_debug(DEBUG_TX, "skb offset %d", offset);
-
-                /* check whether the current skb can be used */
-                if (!skb_cloned(skb) && (skb_tailroom(skb) >= offset)) {
-                        unsigned char *src = skb->data;
-
-                        /* align the buffer on a 4-byte boundary */
-                        skb_reserve(skb, offset);
-                        memmove(skb->data, src, skb->len);
-                } else {
-                        wl1271_info("No handler, fixme!");
-                        return -EINVAL;
-                }
-        }
-
-        len = WL1271_TX_ALIGN(skb->len);
-
-        /* perform a fixed address block write with the packet */
-        wl1271_write(wl, WL1271_SLV_MEM_DATA, skb->data, len, true);
-
-        /* write packet new counter into the write access register */
-        wl->tx_packets_count++;
-
-        desc = (struct wl1271_tx_hw_descr *) skb->data;
-        wl1271_debug(DEBUG_TX, "tx id %u skb 0x%p payload %u (%u words)",
-                     desc->id, skb, len, desc->length);
-
-        return 0;
 }
 
 /* caller must hold wl->mutex */
-static int wl1271_tx_frame(struct wl1271 *wl, struct sk_buff *skb)
+static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct sk_buff *skb,
+                                                        u32 buf_offset)
 {
         struct ieee80211_tx_info *info;
         u32 extra = 0;
         int ret = 0;
         u8 idx;
+        u32 total_len;
 
         if (!skb)
                 return -EINVAL;
@@ -208,19 +170,22 @@ static int wl1271_tx_frame(struct wl1271 *wl, struct sk_buff *skb)
                 }
         }
 
-        ret = wl1271_tx_allocate(wl, skb, extra);
+        ret = wl1271_tx_allocate(wl, skb, extra, buf_offset);
         if (ret < 0)
                 return ret;
 
-        ret = wl1271_tx_fill_hdr(wl, skb, extra, info);
-        if (ret < 0)
-                return ret;
+        wl1271_tx_fill_hdr(wl, skb, extra, info);
 
-        ret = wl1271_tx_send_packet(wl, skb, info);
-        if (ret < 0)
-                return ret;
+        /*
+         * The length of each packet is stored in terms of words. Thus, we must
+         * pad the skb data to make sure its length is aligned.
+         * The number of padding bytes is computed and set in wl1271_tx_fill_hdr
+         */
+        total_len = WL1271_TX_ALIGN(skb->len);
+        memcpy(wl->aggr_buf + buf_offset, skb->data, skb->len);
+        memset(wl->aggr_buf + buf_offset + skb->len, 0, total_len - skb->len);
 
-        return ret;
+        return total_len;
 }
 
 u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set)
@@ -245,7 +210,7 @@ void wl1271_tx_work(struct work_struct *work)
         struct sk_buff *skb;
         bool woken_up = false;
         u32 sta_rates = 0;
-        u32 prev_tx_packets_count;
+        u32 buf_offset;
         int ret;
 
         /* check if the rates supported by the AP have changed */
@@ -262,14 +227,15 @@ void wl1271_tx_work(struct work_struct *work)
         if (unlikely(wl->state == WL1271_STATE_OFF))
                 goto out;
 
-        prev_tx_packets_count = wl->tx_packets_count;
-
         /* if rates have changed, re-configure the rate policy */
         if (unlikely(sta_rates)) {
                 wl->rate_set = wl1271_tx_enabled_rates_get(wl, sta_rates);
                 wl1271_acx_rate_policies(wl);
         }
 
+        /* Prepare the transfer buffer, by aggregating all
+         * available packets */
+        buf_offset = 0;
         while ((skb = skb_dequeue(&wl->tx_queue))) {
                 if (!woken_up) {
                         ret = wl1271_ps_elp_wakeup(wl, false);
@@ -278,21 +244,30 @@ void wl1271_tx_work(struct work_struct *work)
                         woken_up = true;
                 }
 
-                ret = wl1271_tx_frame(wl, skb);
+                ret = wl1271_prepare_tx_frame(wl, skb, buf_offset);
                 if (ret == -EBUSY) {
-                        /* firmware buffer is full, lets stop transmitting. */
+                        /*
+                         * Either the firmware buffer is full, or the
+                         * aggregation buffer is.
+                         * Queue back last skb, and stop aggregating.
+                         */
                         skb_queue_head(&wl->tx_queue, skb);
                         goto out_ack;
                 } else if (ret < 0) {
                         dev_kfree_skb(skb);
                         goto out_ack;
                 }
+                buf_offset += ret;
+                wl->tx_packets_count++;
         }
 
 out_ack:
-        /* interrupt the firmware with the new packets */
-        if (prev_tx_packets_count != wl->tx_packets_count)
+        if (buf_offset) {
+                wl1271_write(wl, WL1271_SLV_MEM_DATA, wl->aggr_buf,
+                                buf_offset, true);
+                /* interrupt the firmware with the new packets */
                 wl1271_write32(wl, WL1271_HOST_WR_ACCESS, wl->tx_packets_count);
+        }
 
 out:
         if (woken_up)
@@ -422,8 +397,6 @@ void wl1271_tx_reset(struct wl1271 *wl)
         struct sk_buff *skb;
 
         /* TX failure */
-/*      control->flags = 0; FIXME */
-
         while ((skb = skb_dequeue(&wl->tx_queue))) {
                 wl1271_debug(DEBUG_TX, "freeing skb 0x%p", skb);
                 ieee80211_tx_status(wl->hw, skb);
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.h b/drivers/net/wireless/wl12xx/wl1271_tx.h
index 48bf92621c03..d12a129ad11c 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.h
@@ -139,23 +139,6 @@ static inline int wl1271_tx_get_queue(int queue)
         }
 }
 
-/* wl1271 tx descriptor needs the tid and we need to convert it from ac */
-static inline int wl1271_tx_ac_to_tid(int ac)
-{
-        switch (ac) {
-        case 0:
-                return 0;
-        case 1:
-                return 2;
-        case 2:
-                return 4;
-        case 3:
-                return 6;
-        default:
-                return 0;
-        }
-}
-
 void wl1271_tx_work(struct work_struct *work);
 void wl1271_tx_complete(struct wl1271 *wl);
 void wl1271_tx_reset(struct wl1271 *wl);
diff --git a/drivers/net/wireless/wl12xx/wl12xx_platform_data.c b/drivers/net/wireless/wl12xx/wl12xx_platform_data.c
new file mode 100644
index 000000000000..973b11060a8f
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl12xx_platform_data.c
@@ -0,0 +1,28 @@
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/wl12xx.h>
+
+static const struct wl12xx_platform_data *platform_data;
+
+int __init wl12xx_set_platform_data(const struct wl12xx_platform_data *data)
+{
+        if (platform_data)
+                return -EBUSY;
+        if (!data)
+                return -EINVAL;
+
+        platform_data = kmemdup(data, sizeof(*data), GFP_KERNEL);
+        if (!platform_data)
+                return -ENOMEM;
+
+        return 0;
+}
+
+const struct wl12xx_platform_data *wl12xx_get_platform_data(void)
+{
+        if (!platform_data)
+                return ERR_PTR(-ENODEV);
+
+        return platform_data;
+}
+EXPORT_SYMBOL(wl12xx_get_platform_data);
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 788a9bc1dbac..630fb8664768 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -135,7 +135,7 @@ static void skb_entry_set_link(union skb_entry *list, unsigned short id)
 static int skb_entry_is_link(const union skb_entry *list)
 {
         BUILD_BUG_ON(sizeof(list->skb) != sizeof(list->link));
-        return ((unsigned long)list->skb < PAGE_OFFSET);
+        return (unsigned long)list->skb < PAGE_OFFSET;
 }
 
 /*
@@ -203,8 +203,8 @@ static void rx_refill_timeout(unsigned long data)
 
 static int netfront_tx_slot_available(struct netfront_info *np)
 {
-        return ((np->tx.req_prod_pvt - np->tx.rsp_cons) <
-                (TX_MAX_TARGET - MAX_SKB_FRAGS - 2));
+        return (np->tx.req_prod_pvt - np->tx.rsp_cons) <
+                (TX_MAX_TARGET - MAX_SKB_FRAGS - 2);
 }
 
 static void xennet_maybe_wake_tx(struct net_device *dev)
diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
index a9352b2c7ac4..b7e755f4178a 100644
--- a/drivers/oprofile/buffer_sync.c
+++ b/drivers/oprofile/buffer_sync.c
@@ -141,16 +141,6 @@ static struct notifier_block module_load_nb = {
         .notifier_call = module_load_notify,
 };
 
-
-static void end_sync(void)
-{
-        end_cpu_work();
-        /* make sure we don't leak task structs */
-        process_task_mortuary();
-        process_task_mortuary();
-}
-
-
 int sync_start(void)
 {
         int err;
@@ -158,7 +148,7 @@ int sync_start(void)
         if (!zalloc_cpumask_var(&marked_cpus, GFP_KERNEL))
                 return -ENOMEM;
 
-        start_cpu_work();
+        mutex_lock(&buffer_mutex);
 
         err = task_handoff_register(&task_free_nb);
         if (err)
@@ -173,7 +163,10 @@ int sync_start(void)
         if (err)
                 goto out4;
 
+        start_cpu_work();
+
 out:
+        mutex_unlock(&buffer_mutex);
         return err;
 out4:
         profile_event_unregister(PROFILE_MUNMAP, &munmap_nb);
@@ -182,7 +175,6 @@ out3:
 out2:
         task_handoff_unregister(&task_free_nb);
 out1:
-        end_sync();
         free_cpumask_var(marked_cpus);
         goto out;
 }
@@ -190,11 +182,20 @@ out1:
 
 void sync_stop(void)
 {
+        /* flush buffers */
+        mutex_lock(&buffer_mutex);
+        end_cpu_work();
         unregister_module_notifier(&module_load_nb);
         profile_event_unregister(PROFILE_MUNMAP, &munmap_nb);
         profile_event_unregister(PROFILE_TASK_EXIT, &task_exit_nb);
         task_handoff_unregister(&task_free_nb);
-        end_sync();
+        mutex_unlock(&buffer_mutex);
+        flush_scheduled_work();
+
+        /* make sure we don't leak task structs */
+        process_task_mortuary();
+        process_task_mortuary();
+
         free_cpumask_var(marked_cpus);
 }
 
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
index 219f79e2210a..f179ac2ea801 100644
--- a/drivers/oprofile/cpu_buffer.c
+++ b/drivers/oprofile/cpu_buffer.c
@@ -120,8 +120,6 @@ void end_cpu_work(void)
 
                 cancel_delayed_work(&b->work);
         }
-
-        flush_scheduled_work();
 }
 
 /*
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index c3ceebb5be84..4789f8e8bf7a 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -71,6 +71,49 @@
 #define DMA_32BIT_PFN           IOVA_PFN(DMA_BIT_MASK(32))
 #define DMA_64BIT_PFN           IOVA_PFN(DMA_BIT_MASK(64))
 
+/* page table handling */
+#define LEVEL_STRIDE            (9)
+#define LEVEL_MASK              (((u64)1 << LEVEL_STRIDE) - 1)
+
+static inline int agaw_to_level(int agaw)
+{
+        return agaw + 2;
+}
+
+static inline int agaw_to_width(int agaw)
+{
+        return 30 + agaw * LEVEL_STRIDE;
+}
+
+static inline int width_to_agaw(int width)
+{
+        return (width - 30) / LEVEL_STRIDE;
+}
+
+static inline unsigned int level_to_offset_bits(int level)
+{
+        return (level - 1) * LEVEL_STRIDE;
+}
+
+static inline int pfn_level_offset(unsigned long pfn, int level)
+{
+        return (pfn >> level_to_offset_bits(level)) & LEVEL_MASK;
+}
+
+static inline unsigned long level_mask(int level)
+{
+        return -1UL << level_to_offset_bits(level);
+}
+
+static inline unsigned long level_size(int level)
+{
+        return 1UL << level_to_offset_bits(level);
+}
+
+static inline unsigned long align_to_level(unsigned long pfn, int level)
+{
+        return (pfn + level_size(level) - 1) & level_mask(level);
+}
 
 /* VT-d pages must always be _smaller_ than MM pages. Otherwise things
    are never going to work. */
@@ -434,8 +477,6 @@ void free_iova_mem(struct iova *iova)
 }
 
 
-static inline int width_to_agaw(int width);
-
 static int __iommu_calculate_agaw(struct intel_iommu *iommu, int max_gaw)
 {
         unsigned long sagaw;
@@ -646,51 +687,6 @@ out:
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
-/* page table handling */
-#define LEVEL_STRIDE            (9)
-#define LEVEL_MASK              (((u64)1 << LEVEL_STRIDE) - 1)
-
-static inline int agaw_to_level(int agaw)
-{
-        return agaw + 2;
-}
-
-static inline int agaw_to_width(int agaw)
-{
-        return 30 + agaw * LEVEL_STRIDE;
-
-}
-
-static inline int width_to_agaw(int width)
-{
-        return (width - 30) / LEVEL_STRIDE;
-}
-
-static inline unsigned int level_to_offset_bits(int level)
-{
-        return (level - 1) * LEVEL_STRIDE;
-}
-
-static inline int pfn_level_offset(unsigned long pfn, int level)
-{
-        return (pfn >> level_to_offset_bits(level)) & LEVEL_MASK;
-}
-
-static inline unsigned long level_mask(int level)
-{
-        return -1UL << level_to_offset_bits(level);
-}
-
-static inline unsigned long level_size(int level)
-{
-        return 1UL << level_to_offset_bits(level);
-}
-
-static inline unsigned long align_to_level(unsigned long pfn, int level)
-{
-        return (pfn + level_size(level) - 1) & level_mask(level);
-}
-
 static struct dma_pte *pfn_to_dma_pte(struct dmar_domain *domain,
                                       unsigned long pfn)
 {
@@ -3761,6 +3757,33 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
 
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
 
+#define GGC 0x52
+#define GGC_MEMORY_SIZE_MASK    (0xf << 8)
+#define GGC_MEMORY_SIZE_NONE    (0x0 << 8)
+#define GGC_MEMORY_SIZE_1M      (0x1 << 8)
+#define GGC_MEMORY_SIZE_2M      (0x3 << 8)
+#define GGC_MEMORY_VT_ENABLED   (0x8 << 8)
+#define GGC_MEMORY_SIZE_2M_VT   (0x9 << 8)
+#define GGC_MEMORY_SIZE_3M_VT   (0xa << 8)
+#define GGC_MEMORY_SIZE_4M_VT   (0xb << 8)
+
+static void __devinit quirk_calpella_no_shadow_gtt(struct pci_dev *dev)
+{
+        unsigned short ggc;
+
+        if (pci_read_config_word(dev, GGC, &ggc))
+                return;
+
+        if (!(ggc & GGC_MEMORY_VT_ENABLED)) {
+                printk(KERN_INFO "DMAR: BIOS has allocated no shadow GTT; disabling IOMMU for graphics\n");
+                dmar_map_gfx = 0;
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0040, quirk_calpella_no_shadow_gtt);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0044, quirk_calpella_no_shadow_gtt);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0062, quirk_calpella_no_shadow_gtt);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x006a, quirk_calpella_no_shadow_gtt);
+
 /* On Tylersburg chipsets, some BIOSes have been known to enable the
    ISOCH DMAR unit for the Azalia sound device, but not give it any
    TLB entries, which causes it to deadlock. Check for that.  We do
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index ce6a3666b3d9..553d8ee55c1c 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -608,7 +608,7 @@ int pci_iov_resource_bar(struct pci_dev *dev, int resno,
  * the VF BAR size multiplied by the number of VFs.  The alignment
  * is just the VF BAR size.
  */
-int pci_sriov_resource_alignment(struct pci_dev *dev, int resno)
+resource_size_t pci_sriov_resource_alignment(struct pci_dev *dev, int resno)
 {
         struct resource tmp;
         enum pci_bar_type type;
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 7754a678ab15..6beb11b617a9 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -264,7 +264,8 @@ extern int pci_iov_init(struct pci_dev *dev);
 extern void pci_iov_release(struct pci_dev *dev);
 extern int pci_iov_resource_bar(struct pci_dev *dev, int resno,
                                 enum pci_bar_type *type);
-extern int pci_sriov_resource_alignment(struct pci_dev *dev, int resno);
+extern resource_size_t pci_sriov_resource_alignment(struct pci_dev *dev,
+                                                    int resno);
 extern void pci_restore_iov_state(struct pci_dev *dev);
 extern int pci_iov_bus_range(struct pci_bus *bus);
 
@@ -320,7 +321,7 @@ static inline int pci_ats_enabled(struct pci_dev *dev)
 }
 #endif /* CONFIG_PCI_IOV */
 
-static inline int pci_resource_alignment(struct pci_dev *dev,
+static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
                                          struct resource *res)
 {
 #ifdef CONFIG_PCI_IOV
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 89ed181cd90c..857ae01734a6 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -163,6 +163,26 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC,	PCI_DEVICE_ID_NEC_CBUS_2,	quirk_isa_d
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC,      PCI_DEVICE_ID_NEC_CBUS_3,       quirk_isa_dma_hangs);
 
 /*
+ * Intel NM10 "TigerPoint" LPC PM1a_STS.BM_STS must be clear
+ * for some HT machines to use C4 w/o hanging.
+ */
+static void __devinit quirk_tigerpoint_bm_sts(struct pci_dev *dev)
+{
+        u32 pmbase;
+        u16 pm1a;
+
+        pci_read_config_dword(dev, 0x40, &pmbase);
+        pmbase = pmbase & 0xff80;
+        pm1a = inw(pmbase);
+
+        if (pm1a & 0x10) {
+                dev_info(&dev->dev, FW_BUG "TigerPoint LPC.BM_STS cleared\n");
+                outw(0x10, pmbase);
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_TGP_LPC, quirk_tigerpoint_bm_sts);
+
+/*
  *      Chipsets where PCI->PCI transfers vanish or hang
  */
 static void __devinit quirk_nopcipci(struct pci_dev *dev)
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 54aa1c238cb3..9ba4dade69a4 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -163,7 +163,7 @@ static int pcmcia_access_config(struct pcmcia_device *p_dev,
         c = p_dev->function_config;
 
         if (!(c->state & CONFIG_LOCKED)) {
-                dev_dbg(&s->dev, "Configuration isnt't locked\n");
+                dev_dbg(&p_dev->dev, "Configuration isnt't locked\n");
                 mutex_unlock(&s->ops_mutex);
                 return -EACCES;
         }
@@ -220,7 +220,7 @@ int pcmcia_map_mem_page(struct pcmcia_device *p_dev, window_handle_t wh,
         s->win[w].card_start = offset;
         ret = s->ops->set_mem_map(s, &s->win[w]);
         if (ret)
-                dev_warn(&s->dev, "failed to set_mem_map\n");
+                dev_warn(&p_dev->dev, "failed to set_mem_map\n");
         mutex_unlock(&s->ops_mutex);
         return ret;
 } /* pcmcia_map_mem_page */
@@ -244,18 +244,18 @@ int pcmcia_modify_configuration(struct pcmcia_device *p_dev,
         c = p_dev->function_config;
 
         if (!(s->state & SOCKET_PRESENT)) {
-                dev_dbg(&s->dev, "No card present\n");
+                dev_dbg(&p_dev->dev, "No card present\n");
                 ret = -ENODEV;
                 goto unlock;
         }
         if (!(c->state & CONFIG_LOCKED)) {
-                dev_dbg(&s->dev, "Configuration isnt't locked\n");
+                dev_dbg(&p_dev->dev, "Configuration isnt't locked\n");
                 ret = -EACCES;
                 goto unlock;
         }
 
         if (mod->Attributes & (CONF_IRQ_CHANGE_VALID | CONF_VCC_CHANGE_VALID)) {
-                dev_dbg(&s->dev,
+                dev_dbg(&p_dev->dev,
                         "changing Vcc or IRQ is not allowed at this time\n");
                 ret = -EINVAL;
                 goto unlock;
@@ -265,20 +265,22 @@ int pcmcia_modify_configuration(struct pcmcia_device *p_dev,
         if ((mod->Attributes & CONF_VPP1_CHANGE_VALID) &&
             (mod->Attributes & CONF_VPP2_CHANGE_VALID)) {
                 if (mod->Vpp1 != mod->Vpp2) {
-                        dev_dbg(&s->dev, "Vpp1 and Vpp2 must be the same\n");
+                        dev_dbg(&p_dev->dev,
+                                "Vpp1 and Vpp2 must be the same\n");
                         ret = -EINVAL;
                         goto unlock;
                 }
                 s->socket.Vpp = mod->Vpp1;
                 if (s->ops->set_socket(s, &s->socket)) {
-                        dev_printk(KERN_WARNING, &s->dev,
+                        dev_printk(KERN_WARNING, &p_dev->dev,
                                    "Unable to set VPP\n");
                         ret = -EIO;
                         goto unlock;
                 }
         } else if ((mod->Attributes & CONF_VPP1_CHANGE_VALID) ||
                    (mod->Attributes & CONF_VPP2_CHANGE_VALID)) {
-                dev_dbg(&s->dev, "changing Vcc is not allowed at this time\n");
+                dev_dbg(&p_dev->dev,
+                        "changing Vcc is not allowed at this time\n");
                 ret = -EINVAL;
                 goto unlock;
         }
@@ -401,7 +403,7 @@ int pcmcia_release_window(struct pcmcia_device *p_dev, struct resource *res)
         win = &s->win[w];
 
         if (!(p_dev->_win & CLIENT_WIN_REQ(w))) {
-                dev_dbg(&s->dev, "not releasing unknown window\n");
+                dev_dbg(&p_dev->dev, "not releasing unknown window\n");
                 mutex_unlock(&s->ops_mutex);
                 return -EINVAL;
         }
@@ -439,7 +441,7 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
                 return -ENODEV;
 
         if (req->IntType & INT_CARDBUS) {
-                dev_dbg(&s->dev, "IntType may not be INT_CARDBUS\n");
+                dev_dbg(&p_dev->dev, "IntType may not be INT_CARDBUS\n");
                 return -EINVAL;
         }
 
@@ -447,7 +449,7 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
         c = p_dev->function_config;
         if (c->state & CONFIG_LOCKED) {
                 mutex_unlock(&s->ops_mutex);
-                dev_dbg(&s->dev, "Configuration is locked\n");
+                dev_dbg(&p_dev->dev, "Configuration is locked\n");
                 return -EACCES;
         }
 
@@ -455,7 +457,7 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
         s->socket.Vpp = req->Vpp;
         if (s->ops->set_socket(s, &s->socket)) {
                 mutex_unlock(&s->ops_mutex);
-                dev_printk(KERN_WARNING, &s->dev,
+                dev_printk(KERN_WARNING, &p_dev->dev,
                            "Unable to set socket state\n");
                 return -EINVAL;
         }
@@ -569,19 +571,20 @@ int pcmcia_request_io(struct pcmcia_device *p_dev)
         int ret = -EINVAL;
 
         mutex_lock(&s->ops_mutex);
-        dev_dbg(&s->dev, "pcmcia_request_io: %pR , %pR", &c->io[0], &c->io[1]);
+        dev_dbg(&p_dev->dev, "pcmcia_request_io: %pR , %pR",
+                &c->io[0], &c->io[1]);
 
         if (!(s->state & SOCKET_PRESENT)) {
-                dev_dbg(&s->dev, "pcmcia_request_io: No card present\n");
+                dev_dbg(&p_dev->dev, "pcmcia_request_io: No card present\n");
                 goto out;
         }
 
         if (c->state & CONFIG_LOCKED) {
-                dev_dbg(&s->dev, "Configuration is locked\n");
+                dev_dbg(&p_dev->dev, "Configuration is locked\n");
                 goto out;
         }
         if (c->state & CONFIG_IO_REQ) {
-                dev_dbg(&s->dev, "IO already configured\n");
+                dev_dbg(&p_dev->dev, "IO already configured\n");
                 goto out;
         }
 
@@ -592,7 +595,13 @@ int pcmcia_request_io(struct pcmcia_device *p_dev)
         if (c->io[1].end) {
                 ret = alloc_io_space(s, &c->io[1], p_dev->io_lines);
                 if (ret) {
+                        struct resource tmp = c->io[0];
+                        /* release the previously allocated resource */
                         release_io_space(s, &c->io[0]);
+                        /* but preserve the settings, for they worked... */
+                        c->io[0].end = resource_size(&tmp);
+                        c->io[0].start = tmp.start;
+                        c->io[0].flags = tmp.flags;
                         goto out;
                 }
         } else
@@ -601,7 +610,7 @@ int pcmcia_request_io(struct pcmcia_device *p_dev)
         c->state |= CONFIG_IO_REQ;
         p_dev->_io = 1;
 
-        dev_dbg(&s->dev, "pcmcia_request_io succeeded: %pR , %pR",
+        dev_dbg(&p_dev->dev, "pcmcia_request_io succeeded: %pR , %pR",
                 &c->io[0], &c->io[1]);
 out:
         mutex_unlock(&s->ops_mutex);
@@ -800,7 +809,7 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
         int w;
 
         if (!(s->state & SOCKET_PRESENT)) {
-                dev_dbg(&s->dev, "No card present\n");
+                dev_dbg(&p_dev->dev, "No card present\n");
                 return -ENODEV;
         }
 
@@ -809,12 +818,12 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
                 req->Size = s->map_size;
         align = (s->features & SS_CAP_MEM_ALIGN) ? req->Size : s->map_size;
         if (req->Size & (s->map_size-1)) {
-                dev_dbg(&s->dev, "invalid map size\n");
+                dev_dbg(&p_dev->dev, "invalid map size\n");
                 return -EINVAL;
         }
         if ((req->Base && (s->features & SS_CAP_STATIC_MAP)) ||
             (req->Base & (align-1))) {
-                dev_dbg(&s->dev, "invalid base address\n");
+                dev_dbg(&p_dev->dev, "invalid base address\n");
                 return -EINVAL;
         }
         if (req->Base)
@@ -826,7 +835,7 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
                 if (!(s->state & SOCKET_WIN_REQ(w)))
                         break;
         if (w == MAX_WIN) {
-                dev_dbg(&s->dev, "all windows are used already\n");
+                dev_dbg(&p_dev->dev, "all windows are used already\n");
                 mutex_unlock(&s->ops_mutex);
                 return -EINVAL;
         }
@@ -837,7 +846,7 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
                 win->res = pcmcia_find_mem_region(req->Base, req->Size, align,
                                                 0, s);
                 if (!win->res) {
-                        dev_dbg(&s->dev, "allocating mem region failed\n");
+                        dev_dbg(&p_dev->dev, "allocating mem region failed\n");
                         mutex_unlock(&s->ops_mutex);
                         return -EINVAL;
                 }
@@ -851,7 +860,7 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
         win->card_start = 0;
 
         if (s->ops->set_mem_map(s, win) != 0) {
-                dev_dbg(&s->dev, "failed to set memory mapping\n");
+                dev_dbg(&p_dev->dev, "failed to set memory mapping\n");
                 mutex_unlock(&s->ops_mutex);
                 return -EIO;
         }
@@ -874,7 +883,7 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
         if (win->res)
                 request_resource(&iomem_resource, res);
 
-        dev_dbg(&s->dev, "request_window results in %pR\n", res);
+        dev_dbg(&p_dev->dev, "request_window results in %pR\n", res);
 
         mutex_unlock(&s->ops_mutex);
         *wh = res;
diff --git a/drivers/pcmcia/pd6729.c b/drivers/pcmcia/pd6729.c
index b8a869af0f44..deef6656ab7b 100644
--- a/drivers/pcmcia/pd6729.c
+++ b/drivers/pcmcia/pd6729.c
@@ -646,7 +646,7 @@ static int __devinit pd6729_pci_probe(struct pci_dev *dev,
         if (!pci_resource_start(dev, 0)) {
                 dev_warn(&dev->dev, "refusing to load the driver as the "
                         "io_base is NULL.\n");
-                goto err_out_free_mem;
+                goto err_out_disable;
         }
 
         dev_info(&dev->dev, "Cirrus PD6729 PCI to PCMCIA Bridge at 0x%llx "
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index e35ed128bdef..2d61186ad5a2 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -3093,7 +3093,8 @@ static const struct tpacpi_quirk tpacpi_hotkey_qtable[] __initconst = {
         TPACPI_Q_IBM('1', 'D', TPACPI_HK_Q_INIMASK), /* X22, X23, X24 */
 };
 
-typedef u16 tpacpi_keymap_t[TPACPI_HOTKEY_MAP_LEN];
+typedef u16 tpacpi_keymap_entry_t;
+typedef tpacpi_keymap_entry_t tpacpi_keymap_t[TPACPI_HOTKEY_MAP_LEN];
 
 static int __init hotkey_init(struct ibm_init_struct *iibm)
 {
@@ -3230,7 +3231,7 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
         };
 
 #define TPACPI_HOTKEY_MAP_SIZE          sizeof(tpacpi_keymap_t)
-#define TPACPI_HOTKEY_MAP_TYPESIZE      sizeof(tpacpi_keymap_t[0])
+#define TPACPI_HOTKEY_MAP_TYPESIZE      sizeof(tpacpi_keymap_entry_t)
 
         int res, i;
         int status;
diff --git a/drivers/power/apm_power.c b/drivers/power/apm_power.c
index 936bae560fa1..dc628cb2e762 100644
--- a/drivers/power/apm_power.c
+++ b/drivers/power/apm_power.c
@@ -233,6 +233,7 @@ static int calculate_capacity(enum apm_source source)
                 empty_design_prop = POWER_SUPPLY_PROP_ENERGY_EMPTY_DESIGN;
                 now_prop = POWER_SUPPLY_PROP_ENERGY_NOW;
                 avg_prop = POWER_SUPPLY_PROP_ENERGY_AVG;
+                break;
         case SOURCE_VOLTAGE:
                 full_prop = POWER_SUPPLY_PROP_VOLTAGE_MAX;
                 empty_prop = POWER_SUPPLY_PROP_VOLTAGE_MIN;
diff --git a/drivers/power/intel_mid_battery.c b/drivers/power/intel_mid_battery.c
index c61ffec2ff10..2a10cd361181 100644
--- a/drivers/power/intel_mid_battery.c
+++ b/drivers/power/intel_mid_battery.c
@@ -185,8 +185,8 @@ static int pmic_scu_ipc_battery_property_get(struct battery_property *prop)
 {
         u32 data[3];
         u8 *p = (u8 *)&data[1];
-        int err = intel_scu_ipc_command(IPC_CMD_BATTERY_PROPERTY,
-                                IPCMSG_BATTERY, NULL, 0, data, 3);
+        int err = intel_scu_ipc_command(IPCMSG_BATTERY,
+                                IPC_CMD_BATTERY_PROPERTY, NULL, 0, data, 3);
 
         prop->capacity = data[0];
         prop->crnt = *p++;
@@ -207,7 +207,7 @@ static int pmic_scu_ipc_battery_property_get(struct battery_property *prop)
 
 static int pmic_scu_ipc_set_charger(int charger)
 {
-        return intel_scu_ipc_simple_command(charger, IPCMSG_BATTERY);
+        return intel_scu_ipc_simple_command(IPCMSG_BATTERY, charger);
 }
 
 /**
diff --git a/drivers/regulator/88pm8607.c b/drivers/regulator/88pm8607.c
index 7d149a8d8d9b..2ce2eb71d0f5 100644
--- a/drivers/regulator/88pm8607.c
+++ b/drivers/regulator/88pm8607.c
@@ -215,7 +215,7 @@ static int pm8607_list_voltage(struct regulator_dev *rdev, unsigned index)
         struct pm8607_regulator_info *info = rdev_get_drvdata(rdev);
         int ret = -EINVAL;
 
-        if (info->vol_table && (index < (2 << info->vol_nbits))) {
+        if (info->vol_table && (index < (1 << info->vol_nbits))) {
                 ret = info->vol_table[index];
                 if (info->slope_double)
                         ret <<= 1;
@@ -233,7 +233,7 @@ static int choose_voltage(struct regulator_dev *rdev, int min_uV, int max_uV)
                 max_uV = max_uV >> 1;
         }
         if (info->vol_table) {
-                for (i = 0; i < (2 << info->vol_nbits); i++) {
+                for (i = 0; i < (1 << info->vol_nbits); i++) {
                         if (!info->vol_table[i])
                                 break;
                         if ((min_uV <= info->vol_table[i])
diff --git a/drivers/regulator/ab3100.c b/drivers/regulator/ab3100.c
index 11790990277a..b349266a43de 100644
--- a/drivers/regulator/ab3100.c
+++ b/drivers/regulator/ab3100.c
@@ -634,12 +634,9 @@ static int __devinit ab3100_regulators_probe(struct platform_device *pdev)
                                 "%s: failed to register regulator %s err %d\n",
                                 __func__, ab3100_regulator_desc[i].name,
                                 err);
-                        i--;
                         /* remove the already registered regulators */
-                        while (i > 0) {
+                        while (--i >= 0)
                                 regulator_unregister(ab3100_regulators[i].rdev);
-                                i--;
-                        }
                         return err;
                 }
 
diff --git a/drivers/regulator/ab8500.c b/drivers/regulator/ab8500.c
index dc3f1a491675..28c7ae67cec9 100644
--- a/drivers/regulator/ab8500.c
+++ b/drivers/regulator/ab8500.c
@@ -157,7 +157,7 @@ static int ab8500_list_voltage(struct regulator_dev *rdev, unsigned selector)
         if (info->fixed_uV)
                 return info->fixed_uV;
 
-        if (selector > info->voltages_len)
+        if (selector >= info->voltages_len)
                 return -EINVAL;
 
         return info->supported_voltages[selector];
@@ -344,13 +344,14 @@ static inline struct ab8500_regulator_info *find_regulator_info(int id)
 static __devinit int ab8500_regulator_probe(struct platform_device *pdev)
 {
         struct ab8500 *ab8500 = dev_get_drvdata(pdev->dev.parent);
-        struct ab8500_platform_data *pdata = dev_get_platdata(ab8500->dev);
+        struct ab8500_platform_data *pdata;
         int i, err;
 
         if (!ab8500) {
                 dev_err(&pdev->dev, "null mfd parent\n");
                 return -EINVAL;
         }
+        pdata = dev_get_platdata(ab8500->dev);
 
         /* register all regulators */
         for (i = 0; i < ARRAY_SIZE(ab8500_regulator_info); i++) {
@@ -368,11 +369,9 @@ static __devinit int ab8500_regulator_probe(struct platform_device *pdev)
                         dev_err(&pdev->dev, "failed to register regulator %s\n",
                                         info->desc.name);
                         /* when we fail, un-register all earlier regulators */
-                        i--;
-                        while (i > 0) {
+                        while (--i >= 0) {
                                 info = &ab8500_regulator_info[i];
                                 regulator_unregister(info->regulator);
-                                i--;
                         }
                         return err;
                 }
diff --git a/drivers/regulator/ad5398.c b/drivers/regulator/ad5398.c
index d59d2f2314af..df1fb53c09d2 100644
--- a/drivers/regulator/ad5398.c
+++ b/drivers/regulator/ad5398.c
@@ -25,7 +25,7 @@ struct ad5398_chip_info {
         unsigned int current_level;
         unsigned int current_mask;
         unsigned int current_offset;
-        struct regulator_dev rdev;
+        struct regulator_dev *rdev;
 };
 
 static int ad5398_calc_current(struct ad5398_chip_info *chip,
@@ -211,7 +211,6 @@ MODULE_DEVICE_TABLE(i2c, ad5398_id);
 static int __devinit ad5398_probe(struct i2c_client *client,
                                 const struct i2c_device_id *id)
 {
-        struct regulator_dev *rdev;
         struct regulator_init_data *init_data = client->dev.platform_data;
         struct ad5398_chip_info *chip;
         const struct ad5398_current_data_format *df =
@@ -233,9 +232,10 @@ static int __devinit ad5398_probe(struct i2c_client *client,
         chip->current_offset = df->current_offset;
         chip->current_mask = (chip->current_level - 1) << chip->current_offset;
 
-        rdev = regulator_register(&ad5398_reg, &client->dev, init_data, chip);
-        if (IS_ERR(rdev)) {
-                ret = PTR_ERR(rdev);
+        chip->rdev = regulator_register(&ad5398_reg, &client->dev,
+                                        init_data, chip);
+        if (IS_ERR(chip->rdev)) {
+                ret = PTR_ERR(chip->rdev);
                 dev_err(&client->dev, "failed to register %s %s\n",
                         id->name, ad5398_reg.name);
                 goto err;
@@ -254,7 +254,7 @@ static int __devexit ad5398_remove(struct i2c_client *client)
 {
         struct ad5398_chip_info *chip = i2c_get_clientdata(client);
 
-        regulator_unregister(&chip->rdev);
+        regulator_unregister(chip->rdev);
         kfree(chip);
         i2c_set_clientdata(client, NULL);
 
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 422a709d271d..cc8b337b9119 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -700,7 +700,7 @@ static void print_constraints(struct regulator_dev *rdev)
             constraints->min_uA != constraints->max_uA) {
                 ret = _regulator_get_current_limit(rdev);
                 if (ret > 0)
-                        count += sprintf(buf + count, "at %d uA ", ret / 1000);
+                        count += sprintf(buf + count, "at %d mA ", ret / 1000);
         }
 
         if (constraints->valid_modes_mask & REGULATOR_MODE_FAST)
@@ -2302,8 +2302,10 @@ struct regulator_dev *regulator_register(struct regulator_desc *regulator_desc,
         dev_set_name(&rdev->dev, "regulator.%d",
                      atomic_inc_return(&regulator_no) - 1);
         ret = device_register(&rdev->dev);
-        if (ret != 0)
+        if (ret != 0) {
+                put_device(&rdev->dev);
                 goto clean;
+        }
 
         dev_set_drvdata(&rdev->dev, rdev);
 
diff --git a/drivers/regulator/isl6271a-regulator.c b/drivers/regulator/isl6271a-regulator.c
index e49d2bd393f2..d61ecb885a8c 100644
--- a/drivers/regulator/isl6271a-regulator.c
+++ b/drivers/regulator/isl6271a-regulator.c
@@ -165,7 +165,7 @@ static int __devinit isl6271a_probe(struct i2c_client *i2c,
         mutex_init(&pmic->mtx);
 
         for (i = 0; i < 3; i++) {
-                pmic->rdev[i] = regulator_register(&isl_rd[0], &i2c->dev,
+                pmic->rdev[i] = regulator_register(&isl_rd[i], &i2c->dev,
                                                 init_data, pmic);
                 if (IS_ERR(pmic->rdev[i])) {
                         dev_err(&i2c->dev, "failed to register %s\n", id->name);
diff --git a/drivers/regulator/max1586.c b/drivers/regulator/max1586.c
index 8867c2710a6d..559cfa271a44 100644
--- a/drivers/regulator/max1586.c
+++ b/drivers/regulator/max1586.c
@@ -121,14 +121,14 @@ static int max1586_v6_set(struct regulator_dev *rdev, int min_uV, int max_uV)
         if (max_uV < MAX1586_V6_MIN_UV || max_uV > MAX1586_V6_MAX_UV)
                 return -EINVAL;
 
-        if (min_uV >= 3000000)
-                selector = 3;
-        if (min_uV < 3000000)
-                selector = 2;
-        if (min_uV < 2500000)
-                selector = 1;
         if (min_uV < 1800000)
                 selector = 0;
+        else if (min_uV < 2500000)
+                selector = 1;
+        else if (min_uV < 3000000)
+                selector = 2;
+        else if (min_uV >= 3000000)
+                selector = 3;
 
         if (max1586_v6_calc_voltage(selector) > max_uV)
                 return -EINVAL;
diff --git a/drivers/regulator/max8649.c b/drivers/regulator/max8649.c
index 4520ace3f7e7..6b60a9c0366b 100644
--- a/drivers/regulator/max8649.c
+++ b/drivers/regulator/max8649.c
@@ -330,7 +330,7 @@ static int __devinit max8649_regulator_probe(struct i2c_client *client,
                 /* set external clock frequency */
                 info->extclk_freq = pdata->extclk_freq;
                 max8649_set_bits(info->i2c, MAX8649_SYNC, MAX8649_EXT_MASK,
-                                 info->extclk_freq);
+                                 info->extclk_freq << 6);
         }
 
         if (pdata->ramp_timing) {
diff --git a/drivers/regulator/max8998.c b/drivers/regulator/max8998.c
index ab67298799f9..a1baf1fbe004 100644
--- a/drivers/regulator/max8998.c
+++ b/drivers/regulator/max8998.c
@@ -549,7 +549,7 @@ static __devinit int max8998_pmic_probe(struct platform_device *pdev)
         if (!max8998)
                 return -ENOMEM;
 
-        size = sizeof(struct regulator_dev *) * (pdata->num_regulators + 1);
+        size = sizeof(struct regulator_dev *) * pdata->num_regulators;
         max8998->rdev = kzalloc(size, GFP_KERNEL);
         if (!max8998->rdev) {
                 kfree(max8998);
@@ -557,7 +557,9 @@ static __devinit int max8998_pmic_probe(struct platform_device *pdev)
         }
 
         rdev = max8998->rdev;
+        max8998->dev = &pdev->dev;
         max8998->iodev = iodev;
+        max8998->num_regulators = pdata->num_regulators;
         platform_set_drvdata(pdev, max8998);
 
         for (i = 0; i < pdata->num_regulators; i++) {
@@ -583,7 +585,7 @@ static __devinit int max8998_pmic_probe(struct platform_device *pdev)
 
         return 0;
 err:
-        for (i = 0; i <= max8998->num_regulators; i++)
+        for (i = 0; i < max8998->num_regulators; i++)
                 if (rdev[i])
                         regulator_unregister(rdev[i]);
 
@@ -599,7 +601,7 @@ static int __devexit max8998_pmic_remove(struct platform_device *pdev)
         struct regulator_dev **rdev = max8998->rdev;
         int i;
 
-        for (i = 0; i <= max8998->num_regulators; i++)
+        for (i = 0; i < max8998->num_regulators; i++)
                 if (rdev[i])
                         regulator_unregister(rdev[i]);
 
diff --git a/drivers/regulator/tps6507x-regulator.c b/drivers/regulator/tps6507x-regulator.c
index c239f42aa4a3..020f5878d7ff 100644
--- a/drivers/regulator/tps6507x-regulator.c
+++ b/drivers/regulator/tps6507x-regulator.c
@@ -626,12 +626,6 @@ fail:
         return error;
 }
 
-/**
- * tps6507x_remove - TPS6507x driver i2c remove handler
- * @client: i2c driver client device structure
- *
- * Unregister TPS driver as an i2c client device driver
- */
 static int __devexit tps6507x_pmic_remove(struct platform_device *pdev)
 {
         struct tps6507x_dev *tps6507x_dev = platform_get_drvdata(pdev);
diff --git a/drivers/regulator/tps6586x-regulator.c b/drivers/regulator/tps6586x-regulator.c
index 8cff1413a147..51237fbb1bbb 100644
--- a/drivers/regulator/tps6586x-regulator.c
+++ b/drivers/regulator/tps6586x-regulator.c
@@ -133,7 +133,7 @@ static int tps6586x_ldo_get_voltage(struct regulator_dev *rdev)
         mask = ((1 << ri->volt_nbits) - 1) << ri->volt_shift;
         val = (val & mask) >> ri->volt_shift;
 
-        if (val > ri->desc.n_voltages)
+        if (val >= ri->desc.n_voltages)
                 BUG();
 
         return ri->voltages[val] * 1000;
@@ -150,7 +150,7 @@ static int tps6586x_dvm_set_voltage(struct regulator_dev *rdev,
         if (ret)
                 return ret;
 
-        return tps6586x_set_bits(parent, ri->go_reg, ri->go_bit);
+        return tps6586x_set_bits(parent, ri->go_reg, 1 << ri->go_bit);
 }
 
 static int tps6586x_regulator_enable(struct regulator_dev *rdev)
diff --git a/drivers/regulator/wm831x-ldo.c b/drivers/regulator/wm831x-ldo.c
index e686cdb61b97..9edf8f692341 100644
--- a/drivers/regulator/wm831x-ldo.c
+++ b/drivers/regulator/wm831x-ldo.c
@@ -215,8 +215,7 @@ static int wm831x_gp_ldo_set_mode(struct regulator_dev *rdev,
 
         case REGULATOR_MODE_IDLE:
                 ret = wm831x_set_bits(wm831x, ctrl_reg,
-                                      WM831X_LDO1_LP_MODE,
-                                      WM831X_LDO1_LP_MODE);
+                                      WM831X_LDO1_LP_MODE, 0);
                 if (ret < 0)
                         return ret;
 
@@ -225,10 +224,12 @@ static int wm831x_gp_ldo_set_mode(struct regulator_dev *rdev,
                                       WM831X_LDO1_ON_MODE);
                 if (ret < 0)
                         return ret;
+                break;
 
         case REGULATOR_MODE_STANDBY:
                 ret = wm831x_set_bits(wm831x, ctrl_reg,
-                                      WM831X_LDO1_LP_MODE, 0);
+                                      WM831X_LDO1_LP_MODE,
+                                      WM831X_LDO1_LP_MODE);
                 if (ret < 0)
                         return ret;
 
diff --git a/drivers/regulator/wm8350-regulator.c b/drivers/regulator/wm8350-regulator.c
index 0e6ed7db9364..fe4b8a8a9dfd 100644
--- a/drivers/regulator/wm8350-regulator.c
+++ b/drivers/regulator/wm8350-regulator.c
@@ -1129,7 +1129,7 @@ static unsigned int wm8350_dcdc_get_mode(struct regulator_dev *rdev)
                         mode = REGULATOR_MODE_NORMAL;
         } else if (!active && !sleep)
                 mode = REGULATOR_MODE_IDLE;
-        else if (!sleep)
+        else if (sleep)
                 mode = REGULATOR_MODE_STANDBY;
 
         return mode;
diff --git a/drivers/rtc/rtc-ab3100.c b/drivers/rtc/rtc-ab3100.c
index d26780ea254b..261a07e0fb24 100644
--- a/drivers/rtc/rtc-ab3100.c
+++ b/drivers/rtc/rtc-ab3100.c
@@ -235,6 +235,7 @@ static int __init ab3100_rtc_probe(struct platform_device *pdev)
                 err = PTR_ERR(rtc);
                 return err;
         }
+        platform_set_drvdata(pdev, rtc);
 
         return 0;
 }
@@ -244,6 +245,7 @@ static int __exit ab3100_rtc_remove(struct platform_device *pdev)
         struct rtc_device *rtc = platform_get_drvdata(pdev);
 
         rtc_device_unregister(rtc);
+        platform_set_drvdata(pdev, NULL);
         return 0;
 }
 
diff --git a/drivers/rtc/rtc-bfin.c b/drivers/rtc/rtc-bfin.c
index 72b2bcc2c224..d4fb82d85e9b 100644
--- a/drivers/rtc/rtc-bfin.c
+++ b/drivers/rtc/rtc-bfin.c
@@ -426,7 +426,7 @@ static int bfin_rtc_suspend(struct platform_device *pdev, pm_message_t state)
                 enable_irq_wake(IRQ_RTC);
                 bfin_rtc_sync_pending(&pdev->dev);
         } else
-                bfin_rtc_int_clear(-1);
+                bfin_rtc_int_clear(0);
 
         return 0;
 }
@@ -435,8 +435,17 @@ static int bfin_rtc_resume(struct platform_device *pdev)
 {
         if (device_may_wakeup(&pdev->dev))
                 disable_irq_wake(IRQ_RTC);
-        else
-                bfin_write_RTC_ISTAT(-1);
+
+        /*
+         * Since only some of the RTC bits are maintained externally in the
+         * Vbat domain, we need to wait for the RTC MMRs to be synced into
+         * the core after waking up.  This happens every RTC 1HZ.  Once that
+         * has happened, we can go ahead and re-enable the important write
+         * complete interrupt event.
+         */
+        while (!(bfin_read_RTC_ISTAT() & RTC_ISTAT_SEC))
+                continue;
+        bfin_rtc_int_set(RTC_ISTAT_WRITE_COMPLETE);
 
         return 0;
 }
diff --git a/drivers/rtc/rtc-m41t80.c b/drivers/rtc/rtc-m41t80.c
index 66377f3e28b8..d60557cae8ef 100644
--- a/drivers/rtc/rtc-m41t80.c
+++ b/drivers/rtc/rtc-m41t80.c
@@ -364,7 +364,7 @@ static int m41t80_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *t)
         t->time.tm_isdst = -1;
         t->enabled = !!(reg[M41T80_REG_ALARM_MON] & M41T80_ALMON_AFE);
         t->pending = !!(reg[M41T80_REG_FLAGS] & M41T80_FLAGS_AF);
-        return rtc_valid_tm(t);
+        return 0;
 }
 
 static struct rtc_class_ops m41t80_rtc_ops = {
diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
index 6c418fe7f288..b7a6690e5b35 100644
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -403,7 +403,7 @@ static int pl031_probe(struct amba_device *adev, struct amba_id *id)
         }
 
         if (request_irq(adev->irq[0], pl031_interrupt,
-                        IRQF_DISABLED | IRQF_SHARED, "rtc-pl031", ldata)) {
+                        IRQF_DISABLED, "rtc-pl031", ldata)) {
                 ret = -EIO;
                 goto out_no_irq;
         }
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index a0d3ec89d412..f57a87f4ae96 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -310,11 +310,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
 
         s3c_rtc_setaie(alrm->enabled);
 
-        if (alrm->enabled)
-                enable_irq_wake(s3c_rtc_alarmno);
-        else
-                disable_irq_wake(s3c_rtc_alarmno);
-
         return 0;
 }
 
@@ -587,6 +582,10 @@ static int s3c_rtc_suspend(struct platform_device *pdev, pm_message_t state)
                 ticnt_en_save &= S3C64XX_RTCCON_TICEN;
         }
         s3c_rtc_enable(pdev, 0);
+
+        if (device_may_wakeup(&pdev->dev))
+                enable_irq_wake(s3c_rtc_alarmno);
+
         return 0;
 }
 
@@ -600,6 +599,10 @@ static int s3c_rtc_resume(struct platform_device *pdev)
                 tmp = readb(s3c_rtc_base + S3C2410_RTCCON);
                 writeb(tmp | ticnt_en_save, s3c_rtc_base + S3C2410_RTCCON);
         }
+
+        if (device_may_wakeup(&pdev->dev))
+                disable_irq_wake(s3c_rtc_alarmno);
+
         return 0;
 }
 #else
diff --git a/drivers/s390/char/tape_block.c b/drivers/s390/char/tape_block.c
index b7de02525ec9..85cf607fc78f 100644
--- a/drivers/s390/char/tape_block.c
+++ b/drivers/s390/char/tape_block.c
@@ -217,8 +217,7 @@ tapeblock_setup_device(struct tape_device * device)
         if (!blkdat->request_queue)
                 return -ENOMEM;
 
-        elevator_exit(blkdat->request_queue->elevator);
-        rc = elevator_init(blkdat->request_queue, "noop");
+        rc = elevator_change(blkdat->request_queue, "noop");
         if (rc)
                 goto cleanup_queue;
 
diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
index 6edf20b62de5..2c7d2d9be4d0 100644
--- a/drivers/s390/net/ctcm_main.c
+++ b/drivers/s390/net/ctcm_main.c
@@ -1154,7 +1154,7 @@ static struct net_device *ctcm_init_netdevice(struct ctcm_priv *priv)
                                 dev_fsm, dev_fsm_len, GFP_KERNEL);
         if (priv->fsm == NULL) {
                 CTCMY_DBF_DEV(SETUP, dev, "init_fsm error");
-                kfree(dev);
+                free_netdev(dev);
                 return NULL;
         }
         fsm_newstate(priv->fsm, DEV_STATE_STOPPED);
@@ -1165,7 +1165,7 @@ static struct net_device *ctcm_init_netdevice(struct ctcm_priv *priv)
                 grp = ctcmpc_init_mpc_group(priv);
                 if (grp == NULL) {
                         MPC_DBF_DEV(SETUP, dev, "init_mpc_group error");
-                        kfree(dev);
+                        free_netdev(dev);
                         return NULL;
                 }
                 tasklet_init(&grp->mpc_tasklet2,
diff --git a/drivers/s390/net/ctcm_mpc.c b/drivers/s390/net/ctcm_mpc.c
index 2861e78773cb..b64881f33f23 100644
--- a/drivers/s390/net/ctcm_mpc.c
+++ b/drivers/s390/net/ctcm_mpc.c
@@ -540,7 +540,7 @@ void ctc_mpc_dealloc_ch(int port_num)
 
         CTCM_DBF_TEXT_(MPC_SETUP, CTC_DBF_DEBUG,
                         "%s: %s: refcount = %d\n",
-                        CTCM_FUNTAIL, dev->name, atomic_read(&dev->refcnt));
+                        CTCM_FUNTAIL, dev->name, netdev_refcnt_read(dev));
 
         fsm_deltimer(&priv->restart_timer);
         grp->channels_terminating = 0;
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 01c3c1f77879..847e8797073c 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -310,6 +310,8 @@ static void qeth_l2_vlan_rx_add_vid(struct net_device *dev, unsigned short vid)
         struct qeth_vlan_vid *id;
 
         QETH_CARD_TEXT_(card, 4, "aid:%d", vid);
+        if (!vid)
+                return;
         if (card->info.type == QETH_CARD_TYPE_OSM) {
                 QETH_CARD_TEXT(card, 3, "aidOSM");
                 return;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 5b79f573bd93..74d1401a5d5e 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1820,7 +1820,7 @@ static void qeth_l3_add_vlan_mc(struct qeth_card *card)
                 return;
 
         vg = card->vlangrp;
-        for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
+        for (i = 0; i < VLAN_N_VID; i++) {
                 struct net_device *netdev = vlan_group_get_device(vg, i);
                 if (netdev == NULL ||
                     !(netdev->flags & IFF_UP))
@@ -1883,7 +1883,7 @@ static void qeth_l3_add_vlan_mc6(struct qeth_card *card)
                 return;
 
         vg = card->vlangrp;
-        for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
+        for (i = 0; i < VLAN_N_VID; i++) {
                 struct net_device *netdev = vlan_group_get_device(vg, i);
                 if (netdev == NULL ||
                     !(netdev->flags & IFF_UP))
@@ -2013,13 +2013,14 @@ static void qeth_l3_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
         qeth_l3_set_multicast_list(card->dev);
 }
 
-static inline __u16 qeth_l3_rebuild_skb(struct qeth_card *card,
-                        struct sk_buff *skb, struct qeth_hdr *hdr)
+static inline int qeth_l3_rebuild_skb(struct qeth_card *card,
+                        struct sk_buff *skb, struct qeth_hdr *hdr,
+                        unsigned short *vlan_id)
 {
-        unsigned short vlan_id = 0;
         __be16 prot;
         struct iphdr *ip_hdr;
         unsigned char tg_addr[MAX_ADDR_LEN];
+        int is_vlan = 0;
 
         if (!(hdr->hdr.l3.flags & QETH_HDR_PASSTHRU)) {
                 prot = htons((hdr->hdr.l3.flags & QETH_HDR_IPV6)? ETH_P_IPV6 :
@@ -2082,8 +2083,9 @@ static inline __u16 qeth_l3_rebuild_skb(struct qeth_card *card,
 
         if (hdr->hdr.l3.ext_flags &
             (QETH_HDR_EXT_VLAN_FRAME | QETH_HDR_EXT_INCLUDE_VLAN_TAG)) {
-                vlan_id = (hdr->hdr.l3.ext_flags & QETH_HDR_EXT_VLAN_FRAME)?
+                *vlan_id = (hdr->hdr.l3.ext_flags & QETH_HDR_EXT_VLAN_FRAME) ?
                  hdr->hdr.l3.vlan_id : *((u16 *)&hdr->hdr.l3.dest_addr[12]);
+                is_vlan = 1;
         }
 
         switch (card->options.checksum_type) {
@@ -2104,7 +2106,7 @@ static inline __u16 qeth_l3_rebuild_skb(struct qeth_card *card,
                         skb->ip_summed = CHECKSUM_NONE;
         }
 
-        return vlan_id;
+        return is_vlan;
 }
 
 static int qeth_l3_process_inbound_buffer(struct qeth_card *card,
@@ -2114,6 +2116,7 @@ static int qeth_l3_process_inbound_buffer(struct qeth_card *card,
         struct sk_buff *skb;
         struct qeth_hdr *hdr;
         __u16 vlan_tag = 0;
+        int is_vlan;
         unsigned int len;
 
         *done = 0;
@@ -2129,16 +2132,12 @@ static int qeth_l3_process_inbound_buffer(struct qeth_card *card,
                 skb->dev = card->dev;
                 switch (hdr->hdr.l3.id) {
                 case QETH_HEADER_TYPE_LAYER3:
-                        vlan_tag = qeth_l3_rebuild_skb(card, skb, hdr);
+                        is_vlan = qeth_l3_rebuild_skb(card, skb, hdr,
+                                                      &vlan_tag);
                         len = skb->len;
-                        if (vlan_tag && !card->options.sniffer)
-                                if (card->vlangrp)
-                                        vlan_gro_receive(&card->napi,
-                                                card->vlangrp, vlan_tag, skb);
-                                else {
-                                        dev_kfree_skb_any(skb);
-                                        continue;
-                                }
+                        if (is_vlan && !card->options.sniffer)
+                                vlan_gro_receive(&card->napi, card->vlangrp,
+                                        vlan_tag, skb);
                         else
                                 napi_gro_receive(&card->napi, skb);
                         break;
@@ -2248,7 +2247,7 @@ static int qeth_l3_verify_vlan_dev(struct net_device *dev,
         if (!vg)
                 return rc;
 
-        for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
+        for (i = 0; i < VLAN_N_VID; i++) {
                 if (vlan_group_get_device(vg, i) == dev) {
                         rc = QETH_VLAN_CARD;
                         break;
diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_iscsi.c
index 7d4d2275573c..7f11f3e48e12 100644
--- a/drivers/scsi/be2iscsi/be_iscsi.c
+++ b/drivers/scsi/be2iscsi/be_iscsi.c
@@ -300,8 +300,7 @@ int beiscsi_get_host_param(struct Scsi_Host *shost,
                            enum iscsi_host_param param, char *buf)
 {
         struct beiscsi_hba *phba = (struct beiscsi_hba *)iscsi_host_priv(shost);
-        int len = 0;
-        int status;
+        int status = 0;
 
         SE_DEBUG(DBG_LVL_8, "In beiscsi_get_host_param, param= %d\n", param);
         switch (param) {
@@ -315,7 +314,7 @@ int beiscsi_get_host_param(struct Scsi_Host *shost,
         default:
                 return iscsi_host_get_param(shost, param, buf);
         }
-        return len;
+        return status;
 }
 
 int beiscsi_get_macaddr(char *buf, struct beiscsi_hba *phba)
diff --git a/drivers/scsi/be2iscsi/be_mgmt.c b/drivers/scsi/be2iscsi/be_mgmt.c
index 26350e470bcc..877324fc594c 100644
--- a/drivers/scsi/be2iscsi/be_mgmt.c
+++ b/drivers/scsi/be2iscsi/be_mgmt.c
@@ -368,7 +368,7 @@ int mgmt_open_connection(struct beiscsi_hba *phba,
         memset(req, 0, sizeof(*req));
         wrb->tag0 |= tag;
 
-        be_wrb_hdr_prepare(wrb, sizeof(*req), true, 1);
+        be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1);
         be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ISCSI,
                            OPCODE_COMMON_ISCSI_TCP_CONNECT_AND_OFFLOAD,
                            sizeof(*req));
diff --git a/drivers/scsi/bnx2i/57xx_iscsi_constants.h b/drivers/scsi/bnx2i/57xx_iscsi_constants.h
index 2fceb19eb27b..1b6f86b2482d 100644
--- a/drivers/scsi/bnx2i/57xx_iscsi_constants.h
+++ b/drivers/scsi/bnx2i/57xx_iscsi_constants.h
@@ -120,6 +120,8 @@
 /* additional LOM specific iSCSI license not installed */
 #define ISCSI_KCQE_COMPLETION_STATUS_LOM_ISCSI_NOT_ENABLED              (0x51)
 
+#define ISCSI_KCQE_COMPLETION_STATUS_CID_BUSY                           (0x80)
+
 /* SQ/RQ/CQ DB structure sizes */
 #define ISCSI_SQ_DB_SIZE    (16)
 #define ISCSI_RQ_DB_SIZE    (16)
diff --git a/drivers/scsi/bnx2i/bnx2i.h b/drivers/scsi/bnx2i/bnx2i.h
index 00c033511cbf..99568cb9ad1c 100644
--- a/drivers/scsi/bnx2i/bnx2i.h
+++ b/drivers/scsi/bnx2i/bnx2i.h
@@ -58,6 +58,8 @@
 #define MAX_PAGES_PER_CTRL_STRUCT_POOL  8
 #define BNX2I_RESERVED_SLOW_PATH_CMD_SLOTS      4
 
+#define BNX2I_5771X_DBELL_PAGE_SIZE     128
+
 /* 5706/08 hardware has limit on maximum buffer size per BD it can handle */
 #define MAX_BD_LENGTH                   65535
 #define BD_SPLIT_SIZE                   32768
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index d23fc256d585..99c71e6d4c14 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -2405,7 +2405,8 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep)
         if (test_bit(BNX2I_NX2_DEV_57710, &ep->hba->cnic_dev_type)) {
                 reg_base = pci_resource_start(ep->hba->pcidev,
                                               BNX2X_DOORBELL_PCI_BAR);
-                reg_off = PAGE_SIZE * (cid_num & 0x1FFFF) + DPM_TRIGER_TYPE;
+                reg_off = BNX2I_5771X_DBELL_PAGE_SIZE * (cid_num & 0x1FFFF) +
+                          DPM_TRIGER_TYPE;
                 ep->qp.ctx_base = ioremap_nocache(reg_base + reg_off, 4);
                 goto arm_cq;
         }
diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
index cd05e049d5f6..d0c82340f0e2 100644
--- a/drivers/scsi/constants.c
+++ b/drivers/scsi/constants.c
@@ -1404,13 +1404,13 @@ void scsi_print_sense(char *name, struct scsi_cmnd *cmd)
 {
         struct scsi_sense_hdr sshdr;
 
-        scmd_printk(KERN_INFO, cmd, "");
+        scmd_printk(KERN_INFO, cmd, " ");
         scsi_decode_sense_buffer(cmd->sense_buffer, SCSI_SENSE_BUFFERSIZE,
                                  &sshdr);
         scsi_show_sense_hdr(&sshdr);
         scsi_decode_sense_extras(cmd->sense_buffer, SCSI_SENSE_BUFFERSIZE,
                                  &sshdr);
-        scmd_printk(KERN_INFO, cmd, "");
+        scmd_printk(KERN_INFO, cmd, " ");
         scsi_show_extd_sense(sshdr.asc, sshdr.ascq);
 }
 EXPORT_SYMBOL(scsi_print_sense);
@@ -1453,7 +1453,7 @@ EXPORT_SYMBOL(scsi_show_result);
 
 void scsi_print_result(struct scsi_cmnd *cmd)
 {
-        scmd_printk(KERN_INFO, cmd, "");
+        scmd_printk(KERN_INFO, cmd, " ");
         scsi_show_result(cmd->result);
 }
 EXPORT_SYMBOL(scsi_print_result);
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 4f5551b5fe53..c5d0606ad097 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -3231,6 +3231,12 @@ static __devinit int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev)
         misc_fw_support = readl(&cfgtable->misc_fw_support);
         use_doorbell = misc_fw_support & MISC_FW_DOORBELL_RESET;
 
+        /* The doorbell reset seems to cause lockups on some Smart
+         * Arrays (e.g. P410, P410i, maybe others).  Until this is
+         * fixed or at least isolated, avoid the doorbell reset.
+         */
+        use_doorbell = 0;
+
         rc = hpsa_controller_hard_reset(pdev, vaddr, use_doorbell);
         if (rc)
                 goto unmap_cfgtable;
diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
index fda4de3440c4..e88bbdde49c5 100644
--- a/drivers/scsi/osd/osd_initiator.c
+++ b/drivers/scsi/osd/osd_initiator.c
@@ -865,7 +865,7 @@ void osd_req_read(struct osd_request *or,
 {
         _osd_req_encode_common(or, OSD_ACT_READ, obj, offset, len);
         WARN_ON(or->in.bio || or->in.total_bytes);
-        WARN_ON(1 == (bio->bi_rw & REQ_WRITE));
+        WARN_ON(bio->bi_rw & REQ_WRITE);
         or->in.bio = bio;
         or->in.total_bytes = len;
 }
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 420238cc794e..114bc5a81171 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1838,26 +1838,33 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
 
         qla24xx_disable_vp(vha);
 
+        vha->flags.delete_progress = 1;
+
         fc_remove_host(vha->host);
 
         scsi_remove_host(vha->host);
 
-        qla2x00_free_fcports(vha);
+        if (vha->timer_active) {
+                qla2x00_vp_stop_timer(vha);
+                DEBUG15(printk(KERN_INFO "scsi(%ld): timer for the vport[%d]"
+                " = %p has stopped\n", vha->host_no, vha->vp_idx, vha));
+        }
 
         qla24xx_deallocate_vp_id(vha);
 
+        /* No pending activities shall be there on the vha now */
+        DEBUG(msleep(random32()%10));  /* Just to see if something falls on
+                                        * the net we have placed below */
+
+        BUG_ON(atomic_read(&vha->vref_count));
+
+        qla2x00_free_fcports(vha);
+
         mutex_lock(&ha->vport_lock);
         ha->cur_vport_count--;
         clear_bit(vha->vp_idx, ha->vp_idx_map);
         mutex_unlock(&ha->vport_lock);
 
-        if (vha->timer_active) {
-                qla2x00_vp_stop_timer(vha);
-                DEBUG15(printk ("scsi(%ld): timer for the vport[%d] = %p "
-                    "has stopped\n",
-                    vha->host_no, vha->vp_idx, vha));
-        }
-
         if (vha->req->id && !ha->flags.cpu_affinity_enabled) {
                 if (qla25xx_delete_req_que(vha, vha->req) != QLA_SUCCESS)
                         qla_printk(KERN_WARNING, ha,
diff --git a/drivers/scsi/qla2xxx/qla_dbg.h b/drivers/scsi/qla2xxx/qla_dbg.h
index 6cfc28a25eb3..b74e6b5743dc 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.h
+++ b/drivers/scsi/qla2xxx/qla_dbg.h
@@ -29,8 +29,6 @@
 /* #define QL_DEBUG_LEVEL_17 */ /* Output EEH trace messages */
 /* #define QL_DEBUG_LEVEL_18 */ /* Output T10 CRC trace messages */
 
-/* #define QL_PRINTK_BUF */ /* Captures printk to buffer */
-
 /*
 * Macros use for debugging the driver.
 */
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 3a432ea0c7a3..d2a4e1530708 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -2641,6 +2641,7 @@ struct qla_hw_data {
 #define MBX_UPDATE_FLASH_ACTIVE 3
 
         struct mutex vport_lock;        /* Virtual port synchronization */
+        spinlock_t vport_slock; /* order is hardware_lock, then vport_slock */
         struct completion mbx_cmd_comp; /* Serialize mbx access */
         struct completion mbx_intr_comp;  /* Used for completion notification */
         struct completion dcbx_comp;    /* For set port config notification */
@@ -2828,6 +2829,7 @@ typedef struct scsi_qla_host {
                 uint32_t        management_server_logged_in :1;
                 uint32_t        process_response_queue  :1;
                 uint32_t        difdix_supported:1;
+                uint32_t        delete_progress:1;
         } flags;
 
         atomic_t        loop_state;
@@ -2922,6 +2924,8 @@ typedef struct scsi_qla_host {
         struct req_que *req;
         int             fw_heartbeat_counter;
         int             seconds_since_last_heartbeat;
+
+        atomic_t        vref_count;
 } scsi_qla_host_t;
 
 /*
@@ -2932,6 +2936,22 @@ typedef struct scsi_qla_host {
          test_bit(LOOP_RESYNC_NEEDED, &ha->dpc_flags) || \
          atomic_read(&ha->loop_state) == LOOP_DOWN)
 
+#define QLA_VHA_MARK_BUSY(__vha, __bail) do {                \
+        atomic_inc(&__vha->vref_count);                      \
+        mb();                                                \
+        if (__vha->flags.delete_progress) {                  \
+                atomic_dec(&__vha->vref_count);              \
+                __bail = 1;                                  \
+        } else {                                             \
+                __bail = 0;                                  \
+        }                                                    \
+} while (0)
+
+#define QLA_VHA_MARK_NOT_BUSY(__vha) do {                    \
+        atomic_dec(&__vha->vref_count);                      \
+} while (0)
+
+
 #define qla_printk(level, ha, format, arg...) \
         dev_printk(level , &((ha)->pdev->dev) , format , ## arg)
 
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index d863ed2619b5..9c383baebe27 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -69,21 +69,29 @@ qla2x00_ctx_sp_free(srb_t *sp)
 {
         struct srb_ctx *ctx = sp->ctx;
         struct srb_iocb *iocb = ctx->u.iocb_cmd;
+        struct scsi_qla_host *vha = sp->fcport->vha;
 
         del_timer_sync(&iocb->timer);
         kfree(iocb);
         kfree(ctx);
         mempool_free(sp, sp->fcport->vha->hw->srb_mempool);
+
+        QLA_VHA_MARK_NOT_BUSY(vha);
 }
 
 inline srb_t *
 qla2x00_get_ctx_sp(scsi_qla_host_t *vha, fc_port_t *fcport, size_t size,
     unsigned long tmo)
 {
-        srb_t *sp;
+        srb_t *sp = NULL;
         struct qla_hw_data *ha = vha->hw;
         struct srb_ctx *ctx;
         struct srb_iocb *iocb;
+        uint8_t bail;
+
+        QLA_VHA_MARK_BUSY(vha, bail);
+        if (bail)
+                return NULL;
 
         sp = mempool_alloc(ha->srb_mempool, GFP_KERNEL);
         if (!sp)
@@ -116,6 +124,8 @@ qla2x00_get_ctx_sp(scsi_qla_host_t *vha, fc_port_t *fcport, size_t size,
         iocb->timer.function = qla2x00_ctx_sp_timeout;
         add_timer(&iocb->timer);
 done:
+        if (!sp)
+                QLA_VHA_MARK_NOT_BUSY(vha);
         return sp;
 }
 
@@ -1777,11 +1787,15 @@ qla2x00_init_rings(scsi_qla_host_t *vha)
                 qla2x00_init_response_q_entries(rsp);
         }
 
+        spin_lock_irqsave(&ha->vport_slock, flags);
         /* Clear RSCN queue. */
         list_for_each_entry(vp, &ha->vp_list, list) {
                 vp->rscn_in_ptr = 0;
                 vp->rscn_out_ptr = 0;
         }
+
+        spin_unlock_irqrestore(&ha->vport_slock, flags);
+
         ha->isp_ops->config_rings(vha);
 
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
@@ -3218,12 +3232,17 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
                 /* Bypass virtual ports of the same host. */
                 found = 0;
                 if (ha->num_vhosts) {
+                        unsigned long flags;
+
+                        spin_lock_irqsave(&ha->vport_slock, flags);
                         list_for_each_entry_safe(vp, tvp, &ha->vp_list, list) {
                                 if (new_fcport->d_id.b24 == vp->d_id.b24) {
                                         found = 1;
                                         break;
                                 }
                         }
+                        spin_unlock_irqrestore(&ha->vport_slock, flags);
+
                         if (found)
                                 continue;
                 }
@@ -3343,6 +3362,7 @@ qla2x00_find_new_loop_id(scsi_qla_host_t *vha, fc_port_t *dev)
         struct qla_hw_data *ha = vha->hw;
         struct scsi_qla_host *vp;
         struct scsi_qla_host *tvp;
+        unsigned long flags = 0;
 
         rval = QLA_SUCCESS;
 
@@ -3367,6 +3387,8 @@ qla2x00_find_new_loop_id(scsi_qla_host_t *vha, fc_port_t *dev)
                 /* Check for loop ID being already in use. */
                 found = 0;
                 fcport = NULL;
+
+                spin_lock_irqsave(&ha->vport_slock, flags);
                 list_for_each_entry_safe(vp, tvp, &ha->vp_list, list) {
                         list_for_each_entry(fcport, &vp->vp_fcports, list) {
                                 if (fcport->loop_id == dev->loop_id &&
@@ -3379,6 +3401,7 @@ qla2x00_find_new_loop_id(scsi_qla_host_t *vha, fc_port_t *dev)
                         if (found)
                                 break;
                 }
+                spin_unlock_irqrestore(&ha->vport_slock, flags);
 
                 /* If not in use then it is free to use. */
                 if (!found) {
@@ -3791,14 +3814,27 @@ void
 qla2x00_update_fcports(scsi_qla_host_t *base_vha)
 {
         fc_port_t *fcport;
-        struct scsi_qla_host *tvp, *vha;
+        struct scsi_qla_host *vha;
+        struct qla_hw_data *ha = base_vha->hw;
+        unsigned long flags;
 
+        spin_lock_irqsave(&ha->vport_slock, flags);
         /* Go with deferred removal of rport references. */
-        list_for_each_entry_safe(vha, tvp, &base_vha->hw->vp_list, list)
-                list_for_each_entry(fcport, &vha->vp_fcports, list)
+        list_for_each_entry(vha, &base_vha->hw->vp_list, list) {
+                atomic_inc(&vha->vref_count);
+                list_for_each_entry(fcport, &vha->vp_fcports, list) {
                         if (fcport && fcport->drport &&
-                            atomic_read(&fcport->state) != FCS_UNCONFIGURED)
+                            atomic_read(&fcport->state) != FCS_UNCONFIGURED) {
+                                spin_unlock_irqrestore(&ha->vport_slock, flags);
+
                                 qla2x00_rport_del(fcport);
+
+                                spin_lock_irqsave(&ha->vport_slock, flags);
+                        }
+                }
+                atomic_dec(&vha->vref_count);
+        }
+        spin_unlock_irqrestore(&ha->vport_slock, flags);
 }
 
 void
@@ -3806,7 +3842,7 @@ qla2x00_abort_isp_cleanup(scsi_qla_host_t *vha)
 {
         struct qla_hw_data *ha = vha->hw;
         struct scsi_qla_host *vp, *base_vha = pci_get_drvdata(ha->pdev);
-        struct scsi_qla_host *tvp;
+        unsigned long flags;
 
         vha->flags.online = 0;
         ha->flags.chip_reset_done = 0;
@@ -3824,8 +3860,18 @@ qla2x00_abort_isp_cleanup(scsi_qla_host_t *vha)
         if (atomic_read(&vha->loop_state) != LOOP_DOWN) {
                 atomic_set(&vha->loop_state, LOOP_DOWN);
                 qla2x00_mark_all_devices_lost(vha, 0);
-                list_for_each_entry_safe(vp, tvp, &base_vha->hw->vp_list, list)
+
+                spin_lock_irqsave(&ha->vport_slock, flags);
+                list_for_each_entry(vp, &base_vha->hw->vp_list, list) {
+                        atomic_inc(&vp->vref_count);
+                        spin_unlock_irqrestore(&ha->vport_slock, flags);
+
                         qla2x00_mark_all_devices_lost(vp, 0);
+
+                        spin_lock_irqsave(&ha->vport_slock, flags);
+                        atomic_dec(&vp->vref_count);
+                }
+                spin_unlock_irqrestore(&ha->vport_slock, flags);
         } else {
                 if (!atomic_read(&vha->loop_down_timer))
                         atomic_set(&vha->loop_down_timer,
@@ -3862,8 +3908,8 @@ qla2x00_abort_isp(scsi_qla_host_t *vha)
         uint8_t        status = 0;
         struct qla_hw_data *ha = vha->hw;
         struct scsi_qla_host *vp;
-        struct scsi_qla_host *tvp;
         struct req_que *req = ha->req_q_map[0];
+        unsigned long flags;
 
         if (vha->flags.online) {
                 qla2x00_abort_isp_cleanup(vha);
@@ -3970,10 +4016,21 @@ qla2x00_abort_isp(scsi_qla_host_t *vha)
                 DEBUG(printk(KERN_INFO
                                 "qla2x00_abort_isp(%ld): succeeded.\n",
                                 vha->host_no));
-                list_for_each_entry_safe(vp, tvp, &ha->vp_list, list) {
-                        if (vp->vp_idx)
+
+                spin_lock_irqsave(&ha->vport_slock, flags);
+                list_for_each_entry(vp, &ha->vp_list, list) {
+                        if (vp->vp_idx) {
+                                atomic_inc(&vp->vref_count);
+                                spin_unlock_irqrestore(&ha->vport_slock, flags);
+
                                 qla2x00_vp_abort_isp(vp);
+
+                                spin_lock_irqsave(&ha->vport_slock, flags);
+                                atomic_dec(&vp->vref_count);
+                        }
                 }
+                spin_unlock_irqrestore(&ha->vport_slock, flags);
+
         } else {
                 qla_printk(KERN_INFO, ha,
                         "qla2x00_abort_isp: **** FAILED ****\n");
@@ -5185,7 +5242,7 @@ qla82xx_restart_isp(scsi_qla_host_t *vha)
         struct req_que *req = ha->req_q_map[0];
         struct rsp_que *rsp = ha->rsp_q_map[0];
         struct scsi_qla_host *vp;
-        struct scsi_qla_host *tvp;
+        unsigned long flags;
 
         status = qla2x00_init_rings(vha);
         if (!status) {
@@ -5272,10 +5329,21 @@ qla82xx_restart_isp(scsi_qla_host_t *vha)
                 DEBUG(printk(KERN_INFO
                         "qla82xx_restart_isp(%ld): succeeded.\n",
                         vha->host_no));
-                list_for_each_entry_safe(vp, tvp, &ha->vp_list, list) {
-                        if (vp->vp_idx)
+
+                spin_lock_irqsave(&ha->vport_slock, flags);
+                list_for_each_entry(vp, &ha->vp_list, list) {
+                        if (vp->vp_idx) {
+                                atomic_inc(&vp->vref_count);
+                                spin_unlock_irqrestore(&ha->vport_slock, flags);
+
                                 qla2x00_vp_abort_isp(vp);
+
+                                spin_lock_irqsave(&ha->vport_slock, flags);
+                                atomic_dec(&vp->vref_count);
+                        }
                 }
+                spin_unlock_irqrestore(&ha->vport_slock, flags);
+
         } else {
                 qla_printk(KERN_INFO, ha,
                         "qla82xx_restart_isp: **** FAILED ****\n");
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 6982ba70e12a..28f65be19dad 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1706,19 +1706,20 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
                                 cp->result = DID_ERROR << 16;
                                 break;
                         }
-                } else if (!lscsi_status) {
+                } else {
                         DEBUG2(qla_printk(KERN_INFO, ha,
                             "scsi(%ld:%d:%d) Dropped frame(s) detected (0x%x "
                             "of 0x%x bytes).\n", vha->host_no, cp->device->id,
                             cp->device->lun, resid, scsi_bufflen(cp)));
 
-                        cp->result = DID_ERROR << 16;
-                        break;
+                        cp->result = DID_ERROR << 16 | lscsi_status;
+                        goto check_scsi_status;
                 }
 
                 cp->result = DID_OK << 16 | lscsi_status;
                 logit = 0;
 
+check_scsi_status:
                 /*
                  * Check to see if SCSI Status is non zero. If so report SCSI
                  * Status.
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 6009b0c69488..a595ec8264f8 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -2913,7 +2913,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
         uint16_t stat = le16_to_cpu(rptid_entry->vp_idx);
         struct qla_hw_data *ha = vha->hw;
         scsi_qla_host_t *vp;
-        scsi_qla_host_t *tvp;
+        unsigned long   flags;
 
         if (rptid_entry->entry_status != 0)
                 return;
@@ -2945,9 +2945,12 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
                         return;
                 }
 
-                list_for_each_entry_safe(vp, tvp, &ha->vp_list, list)
+                spin_lock_irqsave(&ha->vport_slock, flags);
+                list_for_each_entry(vp, &ha->vp_list, list)
                         if (vp_idx == vp->vp_idx)
                                 break;
+                spin_unlock_irqrestore(&ha->vport_slock, flags);
+
                 if (!vp)
                         return;
 
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index 987c5b0ca78e..2b69392a71a1 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -30,6 +30,7 @@ qla24xx_allocate_vp_id(scsi_qla_host_t *vha)
 {
         uint32_t vp_id;
         struct qla_hw_data *ha = vha->hw;
+        unsigned long flags;
 
         /* Find an empty slot and assign an vp_id */
         mutex_lock(&ha->vport_lock);
@@ -44,7 +45,11 @@ qla24xx_allocate_vp_id(scsi_qla_host_t *vha)
         set_bit(vp_id, ha->vp_idx_map);
         ha->num_vhosts++;
         vha->vp_idx = vp_id;
+
+        spin_lock_irqsave(&ha->vport_slock, flags);
         list_add_tail(&vha->list, &ha->vp_list);
+        spin_unlock_irqrestore(&ha->vport_slock, flags);
+
         mutex_unlock(&ha->vport_lock);
         return vp_id;
 }
@@ -54,12 +59,31 @@ qla24xx_deallocate_vp_id(scsi_qla_host_t *vha)
 {
         uint16_t vp_id;
         struct qla_hw_data *ha = vha->hw;
+        unsigned long flags = 0;
 
         mutex_lock(&ha->vport_lock);
+        /*
+         * Wait for all pending activities to finish before removing vport from
+         * the list.
+         * Lock needs to be held for safe removal from the list (it
+         * ensures no active vp_list traversal while the vport is removed
+         * from the queue)
+         */
+        spin_lock_irqsave(&ha->vport_slock, flags);
+        while (atomic_read(&vha->vref_count)) {
+                spin_unlock_irqrestore(&ha->vport_slock, flags);
+
+                msleep(500);
+
+                spin_lock_irqsave(&ha->vport_slock, flags);
+        }
+        list_del(&vha->list);
+        spin_unlock_irqrestore(&ha->vport_slock, flags);
+
         vp_id = vha->vp_idx;
         ha->num_vhosts--;
         clear_bit(vp_id, ha->vp_idx_map);
-        list_del(&vha->list);
+
         mutex_unlock(&ha->vport_lock);
 }
 
@@ -68,12 +92,17 @@ qla24xx_find_vhost_by_name(struct qla_hw_data *ha, uint8_t *port_name)
 {
         scsi_qla_host_t *vha;
         struct scsi_qla_host *tvha;
+        unsigned long flags;
 
+        spin_lock_irqsave(&ha->vport_slock, flags);
         /* Locate matching device in database. */
         list_for_each_entry_safe(vha, tvha, &ha->vp_list, list) {
-                if (!memcmp(port_name, vha->port_name, WWN_SIZE))
+                if (!memcmp(port_name, vha->port_name, WWN_SIZE)) {
+                        spin_unlock_irqrestore(&ha->vport_slock, flags);
                         return vha;
+                }
         }
+        spin_unlock_irqrestore(&ha->vport_slock, flags);
         return NULL;
 }
 
@@ -93,6 +122,12 @@ qla24xx_find_vhost_by_name(struct qla_hw_data *ha, uint8_t *port_name)
 static void
 qla2x00_mark_vp_devices_dead(scsi_qla_host_t *vha)
 {
+        /*
+         * !!! NOTE !!!
+         * This function, if called in contexts other than vp create, disable
+         * or delete, please make sure this is synchronized with the
+         * delete thread.
+         */
         fc_port_t *fcport;
 
         list_for_each_entry(fcport, &vha->vp_fcports, list) {
@@ -100,7 +135,6 @@ qla2x00_mark_vp_devices_dead(scsi_qla_host_t *vha)
                     "loop_id=0x%04x :%x\n",
                     vha->host_no, fcport->loop_id, fcport->vp_idx));
 
-                atomic_set(&fcport->state, FCS_DEVICE_DEAD);
                 qla2x00_mark_device_lost(vha, fcport, 0, 0);
                 atomic_set(&fcport->state, FCS_UNCONFIGURED);
         }
@@ -194,12 +228,17 @@ qla24xx_configure_vp(scsi_qla_host_t *vha)
 void
 qla2x00_alert_all_vps(struct rsp_que *rsp, uint16_t *mb)
 {
-        scsi_qla_host_t *vha, *tvha;
+        scsi_qla_host_t *vha;
         struct qla_hw_data *ha = rsp->hw;
         int i = 0;
+        unsigned long flags;
 
-        list_for_each_entry_safe(vha, tvha, &ha->vp_list, list) {
+        spin_lock_irqsave(&ha->vport_slock, flags);
+        list_for_each_entry(vha, &ha->vp_list, list) {
                 if (vha->vp_idx) {
+                        atomic_inc(&vha->vref_count);
+                        spin_unlock_irqrestore(&ha->vport_slock, flags);
+
                         switch (mb[0]) {
                         case MBA_LIP_OCCURRED:
                         case MBA_LOOP_UP:
@@ -215,9 +254,13 @@ qla2x00_alert_all_vps(struct rsp_que *rsp, uint16_t *mb)
                                 qla2x00_async_event(vha, rsp, mb);
                                 break;
                         }
+
+                        spin_lock_irqsave(&ha->vport_slock, flags);
+                        atomic_dec(&vha->vref_count);
                 }
                 i++;
         }
+        spin_unlock_irqrestore(&ha->vport_slock, flags);
 }
 
 int
@@ -297,7 +340,7 @@ qla2x00_do_dpc_all_vps(scsi_qla_host_t *vha)
         int ret;
         struct qla_hw_data *ha = vha->hw;
         scsi_qla_host_t *vp;
-        struct scsi_qla_host *tvp;
+        unsigned long flags = 0;
 
         if (vha->vp_idx)
                 return;
@@ -309,10 +352,19 @@ qla2x00_do_dpc_all_vps(scsi_qla_host_t *vha)
         if (!(ha->current_topology & ISP_CFG_F))
                 return;
 
-        list_for_each_entry_safe(vp, tvp, &ha->vp_list, list) {
-                if (vp->vp_idx)
+        spin_lock_irqsave(&ha->vport_slock, flags);
+        list_for_each_entry(vp, &ha->vp_list, list) {
+                if (vp->vp_idx) {
+                        atomic_inc(&vp->vref_count);
+                        spin_unlock_irqrestore(&ha->vport_slock, flags);
+
                         ret = qla2x00_do_dpc_vp(vp);
+
+                        spin_lock_irqsave(&ha->vport_slock, flags);
+                        atomic_dec(&vp->vref_count);
+                }
         }
+        spin_unlock_irqrestore(&ha->vport_slock, flags);
 }
 
 int
diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index 915b77a6e193..0a71cc71eab2 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -2672,6 +2672,19 @@ qla82xx_start_scsi(srb_t *sp)
 sufficient_dsds:
                 req_cnt = 1;
 
+                if (req->cnt < (req_cnt + 2)) {
+                        cnt = (uint16_t)RD_REG_DWORD_RELAXED(
+                                &reg->req_q_out[0]);
+                        if (req->ring_index < cnt)
+                                req->cnt = cnt - req->ring_index;
+                        else
+                                req->cnt = req->length -
+                                        (req->ring_index - cnt);
+                }
+
+                if (req->cnt < (req_cnt + 2))
+                        goto queuing_error;
+
                 ctx = sp->ctx = mempool_alloc(ha->ctx_mempool, GFP_ATOMIC);
                 if (!sp->ctx) {
                         DEBUG(printk(KERN_INFO
@@ -3307,16 +3320,19 @@ qla82xx_check_fw_alive(scsi_qla_host_t *vha)
                                 set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
                         }
                         qla2xxx_wake_dpc(vha);
+                        ha->flags.fw_hung = 1;
                         if (ha->flags.mbox_busy) {
-                                ha->flags.fw_hung = 1;
                                 ha->flags.mbox_int = 1;
                                 DEBUG2(qla_printk(KERN_ERR, ha,
-                                    "Due to fw hung, doing premature "
-                                    "completion of mbx command\n"));
-                                complete(&ha->mbx_intr_comp);
+                                        "Due to fw hung, doing premature "
+                                        "completion of mbx command\n"));
+                                if (test_bit(MBX_INTR_WAIT,
+                                        &ha->mbx_cmd_flags))
+                                        complete(&ha->mbx_intr_comp);
                         }
                 }
-        }
+        } else
+                vha->seconds_since_last_heartbeat = 0;
         vha->fw_heartbeat_counter = fw_heartbeat_counter;
 }
 
@@ -3418,13 +3434,15 @@ void qla82xx_watchdog(scsi_qla_host_t *vha)
                                 "%s(): Adapter reset needed!\n", __func__);
                         set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
                         qla2xxx_wake_dpc(vha);
+                        ha->flags.fw_hung = 1;
                         if (ha->flags.mbox_busy) {
-                                ha->flags.fw_hung = 1;
                                 ha->flags.mbox_int = 1;
                                 DEBUG2(qla_printk(KERN_ERR, ha,
-                                    "Need reset, doing premature "
-                                    "completion of mbx command\n"));
-                                complete(&ha->mbx_intr_comp);
+                                        "Need reset, doing premature "
+                                        "completion of mbx command\n"));
+                                if (test_bit(MBX_INTR_WAIT,
+                                        &ha->mbx_cmd_flags))
+                                        complete(&ha->mbx_intr_comp);
                         }
                 } else {
                         qla82xx_check_fw_alive(vha);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 8c80b49ac1c4..1e4bff695254 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2341,16 +2341,28 @@ probe_out:
 static void
 qla2x00_remove_one(struct pci_dev *pdev)
 {
-        scsi_qla_host_t *base_vha, *vha, *temp;
+        scsi_qla_host_t *base_vha, *vha;
         struct qla_hw_data  *ha;
+        unsigned long flags;
 
         base_vha = pci_get_drvdata(pdev);
         ha = base_vha->hw;
 
-        list_for_each_entry_safe(vha, temp, &ha->vp_list, list) {
-                if (vha && vha->fc_vport)
+        spin_lock_irqsave(&ha->vport_slock, flags);
+        list_for_each_entry(vha, &ha->vp_list, list) {
+                atomic_inc(&vha->vref_count);
+
+                if (vha && vha->fc_vport) {
+                        spin_unlock_irqrestore(&ha->vport_slock, flags);
+
                         fc_vport_terminate(vha->fc_vport);
+
+                        spin_lock_irqsave(&ha->vport_slock, flags);
+                }
+
+                atomic_dec(&vha->vref_count);
         }
+        spin_unlock_irqrestore(&ha->vport_slock, flags);
 
         set_bit(UNLOADING, &base_vha->dpc_flags);
 
@@ -2975,10 +2987,17 @@ static struct qla_work_evt *
 qla2x00_alloc_work(struct scsi_qla_host *vha, enum qla_work_type type)
 {
         struct qla_work_evt *e;
+        uint8_t bail;
+
+        QLA_VHA_MARK_BUSY(vha, bail);
+        if (bail)
+                return NULL;
 
         e = kzalloc(sizeof(struct qla_work_evt), GFP_ATOMIC);
-        if (!e)
+        if (!e) {
+                QLA_VHA_MARK_NOT_BUSY(vha);
                 return NULL;
+        }
 
         INIT_LIST_HEAD(&e->list);
         e->type = type;
@@ -3135,6 +3154,9 @@ qla2x00_do_work(struct scsi_qla_host *vha)
                 }
                 if (e->flags & QLA_EVT_FLAG_FREE)
                         kfree(e);
+
+                /* For each work completed decrement vha ref count */
+                QLA_VHA_MARK_NOT_BUSY(vha);
         }
 }
 
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index e75ccb91317d..8edbccb3232d 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,9 +7,9 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.03.03-k0"
+#define QLA2XXX_VERSION      "8.03.04-k0"
 
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    3
-#define QLA_DRIVER_PATCH_VER    3
+#define QLA_DRIVER_PATCH_VER    4
 #define QLA_DRIVER_BETA_VER     0
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 9ade720422c6..ee02d3838a0a 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1011,8 +1011,8 @@ int scsi_init_io(struct scsi_cmnd *cmd, gfp_t gfp_mask)
 
 err_exit:
         scsi_release_buffers(cmd);
-        scsi_put_command(cmd);
         cmd->request->special = NULL;
+        scsi_put_command(cmd);
         return error;
 }
 EXPORT_SYMBOL(scsi_init_io);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 2714becc2eaf..ffa0689ee840 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -870,7 +870,7 @@ static int sd_release(struct gendisk *disk, fmode_t mode)
 
         SCSI_LOG_HLQUEUE(3, sd_printk(KERN_INFO, sdkp, "sd_release\n"));
 
-        if (atomic_dec_return(&sdkp->openers) && sdev->removable) {
+        if (atomic_dec_return(&sdkp->openers) == 0 && sdev->removable) {
                 if (scsi_block_when_processing_errors(sdev))
                         scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW);
         }
@@ -2625,15 +2625,15 @@ module_exit(exit_sd);
 static void sd_print_sense_hdr(struct scsi_disk *sdkp,
                                struct scsi_sense_hdr *sshdr)
 {
-        sd_printk(KERN_INFO, sdkp, "");
+        sd_printk(KERN_INFO, sdkp, " ");
         scsi_show_sense_hdr(sshdr);
-        sd_printk(KERN_INFO, sdkp, "");
+        sd_printk(KERN_INFO, sdkp, " ");
         scsi_show_extd_sense(sshdr->asc, sshdr->ascq);
 }
 
 static void sd_print_result(struct scsi_disk *sdkp, int result)
 {
-        sd_printk(KERN_INFO, sdkp, "");
+        sd_printk(KERN_INFO, sdkp, " ");
         scsi_show_result(result);
 }
 
diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
index a7bc8b7b09ac..2c3e89ddf069 100644
--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
+++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
@@ -72,10 +72,7 @@ static void sym_printl_hex(u_char *p, int n)
 
 static void sym_print_msg(struct sym_ccb *cp, char *label, u_char *msg)
 {
-        if (label)
-                sym_print_addr(cp->cmd, "%s: ", label);
-        else
-                sym_print_addr(cp->cmd, "");
+        sym_print_addr(cp->cmd, "%s: ", label);
 
         spi_print_msg(msg);
         printf("\n");
@@ -4558,7 +4555,8 @@ static void sym_int_sir(struct sym_hcb *np)
                         switch (np->msgin [2]) {
                         case M_X_MODIFY_DP:
                                 if (DEBUG_FLAGS & DEBUG_POINTER)
-                                        sym_print_msg(cp, NULL, np->msgin);
+                                        sym_print_msg(cp, "extended msg ",
+                                                      np->msgin);
                                 tmp = (np->msgin[3]<<24) + (np->msgin[4]<<16) + 
                                       (np->msgin[5]<<8)  + (np->msgin[6]);
                                 sym_modify_dp(np, tp, cp, tmp);
@@ -4585,7 +4583,7 @@ static void sym_int_sir(struct sym_hcb *np)
                  */
                 case M_IGN_RESIDUE:
                         if (DEBUG_FLAGS & DEBUG_POINTER)
-                                sym_print_msg(cp, NULL, np->msgin);
+                                sym_print_msg(cp, "1 or 2 byte ", np->msgin);
                         if (cp->host_flags & HF_SENSE)
                                 OUTL_DSP(np, SCRIPTA_BA(np, clrack));
                         else
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index 50441ffe8e38..2904aa044126 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -472,14 +472,9 @@ pl010_set_termios(struct uart_port *port, struct ktermios *termios,
         spin_unlock_irqrestore(&uap->port.lock, flags);
 }
 
-static void pl010_set_ldisc(struct uart_port *port)
+static void pl010_set_ldisc(struct uart_port *port, int new)
 {
-        int line = port->line;
-
-        if (line >= port->state->port.tty->driver->num)
-                return;
-
-        if (port->state->port.tty->ldisc->ops->num == N_PPS) {
+        if (new == N_PPS) {
                 port->flags |= UPF_HARDPPS_CD;
                 pl010_enable_ms(port);
         } else
diff --git a/drivers/serial/mfd.c b/drivers/serial/mfd.c
index bc9af503907f..5dff45c76d32 100644
--- a/drivers/serial/mfd.c
+++ b/drivers/serial/mfd.c
@@ -27,6 +27,7 @@
 #include <linux/init.h>
 #include <linux/console.h>
 #include <linux/sysrq.h>
+#include <linux/slab.h>
 #include <linux/serial_reg.h>
 #include <linux/circ_buf.h>
 #include <linux/delay.h>
@@ -1423,7 +1424,6 @@ static void hsu_global_init(void)
         }
 
         phsu = hsu;
-
         hsu_debugfs_init(hsu);
         return;
 
@@ -1435,18 +1435,20 @@ err_free_region:
 
 static void serial_hsu_remove(struct pci_dev *pdev)
 {
-        struct hsu_port *hsu;
-        int i;
+        void *priv = pci_get_drvdata(pdev);
+        struct uart_hsu_port *up;
 
-        hsu = pci_get_drvdata(pdev);
-        if (!hsu)
+        if (!priv)
                 return;
 
-        for (i = 0; i < 3; i++)
-                uart_remove_one_port(&serial_hsu_reg, &hsu->port[i].port);
+        /* For port 0/1/2, priv is the address of uart_hsu_port */
+        if (pdev->device != 0x081E) {
+                up = priv;
+                uart_remove_one_port(&serial_hsu_reg, &up->port);
+        }
 
         pci_set_drvdata(pdev, NULL);
-        free_irq(hsu->irq, hsu);
+        free_irq(pdev->irq, priv);
         pci_disable_device(pdev);
 }
 
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 8dedb266f143..c4399e23565a 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -500,6 +500,7 @@ static int __init mpc512x_psc_fifoc_init(void)
         psc_fifoc = of_iomap(np, 0);
         if (!psc_fifoc) {
                 pr_err("%s: Can't map FIFOC\n", __func__);
+                of_node_put(np);
                 return -ENODEV;
         }
 
diff --git a/drivers/serial/mrst_max3110.c b/drivers/serial/mrst_max3110.c
index f6ad1ecbff79..51c15f58e01e 100644
--- a/drivers/serial/mrst_max3110.c
+++ b/drivers/serial/mrst_max3110.c
@@ -29,6 +29,7 @@
 
 #include <linux/module.h>
 #include <linux/ioport.h>
+#include <linux/irq.h>
 #include <linux/init.h>
 #include <linux/console.h>
 #include <linux/sysrq.h>
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index 141c69554bd4..7d475b2a79e8 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -335,8 +335,6 @@ static int serial_probe(struct pcmcia_device *link)
         info->p_dev = link;
         link->priv = info;
 
-        link->resource[0]->flags |= IO_DATA_PATH_WIDTH_8;
-        link->resource[0]->end = 8;
         link->conf.Attributes = CONF_ENABLE_IRQ;
         if (do_sound) {
                 link->conf.Attributes |= CONF_ENABLE_SPKR;
@@ -411,6 +409,27 @@ static int setup_serial(struct pcmcia_device *handle, struct serial_info * info,
 
 /*====================================================================*/
 
+static int pfc_config(struct pcmcia_device *p_dev)
+{
+        unsigned int port = 0;
+        struct serial_info *info = p_dev->priv;
+
+        if ((p_dev->resource[1]->end != 0) &&
+                (resource_size(p_dev->resource[1]) == 8)) {
+                port = p_dev->resource[1]->start;
+                info->slave = 1;
+        } else if ((info->manfid == MANFID_OSITECH) &&
+                (resource_size(p_dev->resource[0]) == 0x40)) {
+                port = p_dev->resource[0]->start + 0x28;
+                info->slave = 1;
+        }
+        if (info->slave)
+                return setup_serial(p_dev, info, port, p_dev->irq);
+
+        dev_warn(&p_dev->dev, "no usable port range found, giving up\n");
+        return -ENODEV;
+}
+
 static int simple_config_check(struct pcmcia_device *p_dev,
                                cistpl_cftable_entry_t *cf,
                                cistpl_cftable_entry_t *dflt,
@@ -461,23 +480,8 @@ static int simple_config(struct pcmcia_device *link)
         struct serial_info *info = link->priv;
         int i = -ENODEV, try;
 
-        /* If the card is already configured, look up the port and irq */
-        if (link->function_config) {
-                unsigned int port = 0;
-                if ((link->resource[1]->end != 0) &&
-                        (resource_size(link->resource[1]) == 8)) {
-                        port = link->resource[1]->end;
-                        info->slave = 1;
-                } else if ((info->manfid == MANFID_OSITECH) &&
-                        (resource_size(link->resource[0]) == 0x40)) {
-                        port = link->resource[0]->start + 0x28;
-                        info->slave = 1;
-                }
-                if (info->slave) {
-                        return setup_serial(link, info, port,
-                                            link->irq);
-                }
-        }
+        link->resource[0]->flags |= IO_DATA_PATH_WIDTH_8;
+        link->resource[0]->end = 8;
 
         /* First pass: look for a config entry that looks normal.
          * Two tries: without IO aliases, then with aliases */
@@ -491,8 +495,7 @@ static int simple_config(struct pcmcia_device *link)
         if (!pcmcia_loop_config(link, simple_config_check_notpicky, NULL))
                 goto found_port;
 
-        printk(KERN_NOTICE
-               "serial_cs: no usable port range found, giving up\n");
+        dev_warn(&link->dev, "no usable port range found, giving up\n");
         return -1;
 
 found_port:
@@ -558,6 +561,7 @@ static int multi_config(struct pcmcia_device *link)
         int i, base2 = 0;
 
         /* First, look for a generic full-sized window */
+        link->resource[0]->flags |= IO_DATA_PATH_WIDTH_8;
         link->resource[0]->end = info->multi * 8;
         if (pcmcia_loop_config(link, multi_config_check, &base2)) {
                 /* If that didn't work, look for two windows */
@@ -565,15 +569,14 @@ static int multi_config(struct pcmcia_device *link)
                 info->multi = 2;
                 if (pcmcia_loop_config(link, multi_config_check_notpicky,
                                        &base2)) {
-                        printk(KERN_NOTICE "serial_cs: no usable port range"
+                        dev_warn(&link->dev, "no usable port range "
                                "found, giving up\n");
                         return -ENODEV;
                 }
         }
 
         if (!link->irq)
-                dev_warn(&link->dev,
-                        "serial_cs: no usable IRQ found, continuing...\n");
+                dev_warn(&link->dev, "no usable IRQ found, continuing...\n");
 
         /*
          * Apply any configuration quirks.
@@ -675,6 +678,7 @@ static int serial_config(struct pcmcia_device * link)
            multifunction cards that ask for appropriate IO port ranges */
         if ((info->multi == 0) &&
             (link->has_func_id) &&
+            (link->socket->pcmcia_pfc == 0) &&
             ((link->func_id == CISTPL_FUNCID_MULTI) ||
              (link->func_id == CISTPL_FUNCID_SERIAL)))
                 pcmcia_loop_config(link, serial_check_for_multi, info);
@@ -685,7 +689,13 @@ static int serial_config(struct pcmcia_device * link)
         if (info->quirk && info->quirk->multi != -1)
                 info->multi = info->quirk->multi;
 
-        if (info->multi > 1)
+        dev_info(&link->dev,
+                "trying to set up [0x%04x:0x%04x] (pfc: %d, multi: %d, quirk: %p)\n",
+                link->manf_id, link->card_id,
+                link->socket->pcmcia_pfc, info->multi, info->quirk);
+        if (link->socket->pcmcia_pfc)
+                i = pfc_config(link);
+        else if (info->multi > 1)
                 i = multi_config(link);
         else
                 i = simple_config(link);
@@ -704,7 +714,7 @@ static int serial_config(struct pcmcia_device * link)
         return 0;
 
 failed:
-        dev_warn(&link->dev, "serial_cs: failed to initialize\n");
+        dev_warn(&link->dev, "failed to initialize\n");
         serial_remove(link);
         return -ENODEV;
 }
diff --git a/drivers/spi/amba-pl022.c b/drivers/spi/amba-pl022.c
index acd35d1ebd12..4c37c4e28647 100644
--- a/drivers/spi/amba-pl022.c
+++ b/drivers/spi/amba-pl022.c
@@ -503,8 +503,9 @@ static void giveback(struct pl022 *pl022)
         msg->state = NULL;
         if (msg->complete)
                 msg->complete(msg->context);
-        /* This message is completed, so let's turn off the clock! */
+        /* This message is completed, so let's turn off the clocks! */
         clk_disable(pl022->clk);
+        amba_pclk_disable(pl022->adev);
 }
 
 /**
@@ -1139,9 +1140,10 @@ static void pump_messages(struct work_struct *work)
         /* Setup the SPI using the per chip configuration */
         pl022->cur_chip = spi_get_ctldata(pl022->cur_msg->spi);
         /*
-         * We enable the clock here, then the clock will be disabled when
+         * We enable the clocks here, then the clocks will be disabled when
          * giveback() is called in each method (poll/interrupt/DMA)
          */
+        amba_pclk_enable(pl022->adev);
         clk_enable(pl022->clk);
         restore_state(pl022);
         flush(pl022);
@@ -1786,11 +1788,9 @@ pl022_probe(struct amba_device *adev, struct amba_id *id)
         }
 
         /* Disable SSP */
-        clk_enable(pl022->clk);
         writew((readw(SSP_CR1(pl022->virtbase)) & (~SSP_CR1_MASK_SSE)),
                SSP_CR1(pl022->virtbase));
         load_ssp_default_config(pl022);
-        clk_disable(pl022->clk);
 
         status = request_irq(adev->irq[0], pl022_interrupt_handler, 0, "pl022",
                              pl022);
@@ -1818,6 +1818,8 @@ pl022_probe(struct amba_device *adev, struct amba_id *id)
                 goto err_spi_register;
         }
         dev_dbg(dev, "probe succeded\n");
+        /* Disable the silicon block pclk and clock it when needed */
+        amba_pclk_disable(adev);
         return 0;
 
  err_spi_register:
@@ -1879,9 +1881,9 @@ static int pl022_suspend(struct amba_device *adev, pm_message_t state)
                 return status;
         }
 
-        clk_enable(pl022->clk);
+        amba_pclk_enable(adev);
         load_ssp_default_config(pl022);
-        clk_disable(pl022->clk);
+        amba_pclk_disable(adev);
         dev_dbg(&adev->dev, "suspended\n");
         return 0;
 }
@@ -1981,7 +1983,7 @@ static int __init pl022_init(void)
         return amba_driver_register(&pl022_driver);
 }
 
-module_init(pl022_init);
+subsys_initcall(pl022_init);
 
 static void __exit pl022_exit(void)
 {
diff --git a/drivers/spi/dw_spi.c b/drivers/spi/dw_spi.c
index d256cb00604c..56247853c298 100644
--- a/drivers/spi/dw_spi.c
+++ b/drivers/spi/dw_spi.c
@@ -181,10 +181,6 @@ static void flush(struct dw_spi *dws)
         wait_till_not_busy(dws);
 }
 
-static void null_cs_control(u32 command)
-{
-}
-
 static int null_writer(struct dw_spi *dws)
 {
         u8 n_bytes = dws->n_bytes;
@@ -322,7 +318,7 @@ static void giveback(struct dw_spi *dws)
                                         struct spi_transfer,
                                         transfer_list);
 
-        if (!last_transfer->cs_change)
+        if (!last_transfer->cs_change && dws->cs_control)
                 dws->cs_control(MRST_SPI_DEASSERT);
 
         msg->state = NULL;
@@ -396,6 +392,11 @@ static irqreturn_t interrupt_transfer(struct dw_spi *dws)
 static irqreturn_t dw_spi_irq(int irq, void *dev_id)
 {
         struct dw_spi *dws = dev_id;
+        u16 irq_status, irq_mask = 0x3f;
+
+        irq_status = dw_readw(dws, isr) & irq_mask;
+        if (!irq_status)
+                return IRQ_NONE;
 
         if (!dws->cur_msg) {
                 spi_mask_intr(dws, SPI_INT_TXEI);
@@ -544,13 +545,13 @@ static void pump_transfers(unsigned long data)
          */
         if (dws->cs_control) {
                 if (dws->rx && dws->tx)
-                        chip->tmode = 0x00;
+                        chip->tmode = SPI_TMOD_TR;
                 else if (dws->rx)
-                        chip->tmode = 0x02;
+                        chip->tmode = SPI_TMOD_RO;
                 else
-                        chip->tmode = 0x01;
+                        chip->tmode = SPI_TMOD_TO;
 
-                cr0 &= ~(0x3 << SPI_MODE_OFFSET);
+                cr0 &= ~SPI_TMOD_MASK;
                 cr0 |= (chip->tmode << SPI_TMOD_OFFSET);
         }
 
@@ -699,9 +700,6 @@ static int dw_spi_setup(struct spi_device *spi)
                 chip = kzalloc(sizeof(struct chip_data), GFP_KERNEL);
                 if (!chip)
                         return -ENOMEM;
-
-                chip->cs_control = null_cs_control;
-                chip->enable_dma = 0;
         }
 
         /*
@@ -883,7 +881,7 @@ int __devinit dw_spi_add_host(struct dw_spi *dws)
         dws->dma_inited = 0;
         dws->dma_addr = (dma_addr_t)(dws->paddr + 0x60);
 
-        ret = request_irq(dws->irq, dw_spi_irq, 0,
+        ret = request_irq(dws->irq, dw_spi_irq, IRQF_SHARED,
                         "dw_spi", dws);
         if (ret < 0) {
                 dev_err(&master->dev, "can not get IRQ\n");
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index a9e5c79ae52a..b5a78a1f4421 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -23,6 +23,7 @@
 #include <linux/init.h>
 #include <linux/cache.h>
 #include <linux/mutex.h>
+#include <linux/of_device.h>
 #include <linux/slab.h>
 #include <linux/mod_devicetable.h>
 #include <linux/spi/spi.h>
@@ -86,6 +87,10 @@ static int spi_match_device(struct device *dev, struct device_driver *drv)
         const struct spi_device *spi = to_spi_device(dev);
         const struct spi_driver *sdrv = to_spi_driver(drv);
 
+        /* Attempt an OF style match */
+        if (of_driver_match_device(dev, drv))
+                return 1;
+
         if (sdrv->id_table)
                 return !!spi_match_id(sdrv->id_table, spi);
 
@@ -554,11 +559,9 @@ done:
 EXPORT_SYMBOL_GPL(spi_register_master);
 
 
-static int __unregister(struct device *dev, void *master_dev)
+static int __unregister(struct device *dev, void *null)
 {
-        /* note: before about 2.6.14-rc1 this would corrupt memory: */
-        if (dev != master_dev)
-                spi_unregister_device(to_spi_device(dev));
+        spi_unregister_device(to_spi_device(dev));
         return 0;
 }
 
@@ -576,8 +579,7 @@ void spi_unregister_master(struct spi_master *master)
 {
         int dummy;
 
-        dummy = device_for_each_child(master->dev.parent, &master->dev,
-                                        __unregister);
+        dummy = device_for_each_child(&master->dev, NULL, __unregister);
         device_unregister(&master->dev);
 }
 EXPORT_SYMBOL_GPL(spi_unregister_master);
diff --git a/drivers/spi/spi_gpio.c b/drivers/spi/spi_gpio.c
index e24a63498acb..63e51b011d50 100644
--- a/drivers/spi/spi_gpio.c
+++ b/drivers/spi/spi_gpio.c
@@ -350,7 +350,7 @@ static int __init spi_gpio_probe(struct platform_device *pdev)
         spi_gpio->bitbang.master = spi_master_get(master);
         spi_gpio->bitbang.chipselect = spi_gpio_chipselect;
 
-        if ((master_flags & (SPI_MASTER_NO_RX | SPI_MASTER_NO_RX)) == 0) {
+        if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) {
                 spi_gpio->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_word_mode0;
                 spi_gpio->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_word_mode1;
                 spi_gpio->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_word_mode2;
diff --git a/drivers/spi/spi_mpc8xxx.c b/drivers/spi/spi_mpc8xxx.c
index d31b57f7baaf..1dd86b835cd8 100644
--- a/drivers/spi/spi_mpc8xxx.c
+++ b/drivers/spi/spi_mpc8xxx.c
@@ -408,11 +408,17 @@ static void mpc8xxx_spi_cpm_bufs_start(struct mpc8xxx_spi *mspi)
 
         xfer_ofs = mspi->xfer_in_progress->len - mspi->count;
 
-        out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
+        if (mspi->rx_dma == mspi->dma_dummy_rx)
+                out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma);
+        else
+                out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
         out_be16(&rx_bd->cbd_datlen, 0);
         out_be16(&rx_bd->cbd_sc, BD_SC_EMPTY | BD_SC_INTRPT | BD_SC_WRAP);
 
-        out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
+        if (mspi->tx_dma == mspi->dma_dummy_tx)
+                out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma);
+        else
+                out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
         out_be16(&tx_bd->cbd_datlen, xfer_len);
         out_be16(&tx_bd->cbd_sc, BD_SC_READY | BD_SC_INTRPT | BD_SC_WRAP |
                                  BD_SC_LAST);
diff --git a/drivers/spi/spi_s3c64xx.c b/drivers/spi/spi_s3c64xx.c
index 97365815a729..c3038da2648a 100644
--- a/drivers/spi/spi_s3c64xx.c
+++ b/drivers/spi/spi_s3c64xx.c
@@ -200,6 +200,9 @@ static void flush_fifo(struct s3c64xx_spi_driver_data *sdd)
                 val = readl(regs + S3C64XX_SPI_STATUS);
         } while (TX_FIFO_LVL(val, sci) && loops--);
 
+        if (loops == 0)
+                dev_warn(&sdd->pdev->dev, "Timed out flushing TX FIFO\n");
+
         /* Flush RxFIFO*/
         loops = msecs_to_loops(1);
         do {
@@ -210,6 +213,9 @@ static void flush_fifo(struct s3c64xx_spi_driver_data *sdd)
                         break;
         } while (loops--);
 
+        if (loops == 0)
+                dev_warn(&sdd->pdev->dev, "Timed out flushing RX FIFO\n");
+
         val = readl(regs + S3C64XX_SPI_CH_CFG);
         val &= ~S3C64XX_SPI_CH_SW_RST;
         writel(val, regs + S3C64XX_SPI_CH_CFG);
@@ -320,16 +326,17 @@ static int wait_for_xfer(struct s3c64xx_spi_driver_data *sdd,
 
         /* millisecs to xfer 'len' bytes @ 'cur_speed' */
         ms = xfer->len * 8 * 1000 / sdd->cur_speed;
-        ms += 5; /* some tolerance */
+        ms += 10; /* some tolerance */
 
         if (dma_mode) {
                 val = msecs_to_jiffies(ms) + 10;
                 val = wait_for_completion_timeout(&sdd->xfer_completion, val);
         } else {
+                u32 status;
                 val = msecs_to_loops(ms);
                 do {
-                        val = readl(regs + S3C64XX_SPI_STATUS);
-                } while (RX_FIFO_LVL(val, sci) < xfer->len && --val);
+                        status = readl(regs + S3C64XX_SPI_STATUS);
+                } while (RX_FIFO_LVL(status, sci) < xfer->len && --val);
         }
 
         if (!val)
@@ -447,8 +454,8 @@ static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)
         writel(val, regs + S3C64XX_SPI_CLK_CFG);
 }
 
-void s3c64xx_spi_dma_rxcb(struct s3c2410_dma_chan *chan, void *buf_id,
-                                int size, enum s3c2410_dma_buffresult res)
+static void s3c64xx_spi_dma_rxcb(struct s3c2410_dma_chan *chan, void *buf_id,
+                                 int size, enum s3c2410_dma_buffresult res)
 {
         struct s3c64xx_spi_driver_data *sdd = buf_id;
         unsigned long flags;
@@ -467,8 +474,8 @@ void s3c64xx_spi_dma_rxcb(struct s3c2410_dma_chan *chan, void *buf_id,
         spin_unlock_irqrestore(&sdd->lock, flags);
 }
 
-void s3c64xx_spi_dma_txcb(struct s3c2410_dma_chan *chan, void *buf_id,
-                                int size, enum s3c2410_dma_buffresult res)
+static void s3c64xx_spi_dma_txcb(struct s3c2410_dma_chan *chan, void *buf_id,
+                                 int size, enum s3c2410_dma_buffresult res)
 {
         struct s3c64xx_spi_driver_data *sdd = buf_id;
         unsigned long flags;
@@ -508,8 +515,9 @@ static int s3c64xx_spi_map_mssg(struct s3c64xx_spi_driver_data *sdd,
         list_for_each_entry(xfer, &msg->transfers, transfer_list) {
 
                 if (xfer->tx_buf != NULL) {
-                        xfer->tx_dma = dma_map_single(dev, xfer->tx_buf,
-                                                xfer->len, DMA_TO_DEVICE);
+                        xfer->tx_dma = dma_map_single(dev,
+                                        (void *)xfer->tx_buf, xfer->len,
+                                        DMA_TO_DEVICE);
                         if (dma_mapping_error(dev, xfer->tx_dma)) {
                                 dev_err(dev, "dma_map_single Tx failed\n");
                                 xfer->tx_dma = XFER_DMAADDR_INVALID;
@@ -919,6 +927,13 @@ static int __init s3c64xx_spi_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
+        sci = pdev->dev.platform_data;
+        if (!sci->src_clk_name) {
+                dev_err(&pdev->dev,
+                        "Board init must call s3c64xx_spi_set_info()\n");
+                return -EINVAL;
+        }
+
         /* Check for availability of necessary resource */
 
         dmatx_res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
@@ -946,8 +961,6 @@ static int __init s3c64xx_spi_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
 
-        sci = pdev->dev.platform_data;
-
         platform_set_drvdata(pdev, master);
 
         sdd = spi_master_get_devdata(master);
@@ -1170,7 +1183,7 @@ static int __init s3c64xx_spi_init(void)
 {
         return platform_driver_probe(&s3c64xx_spi_driver, s3c64xx_spi_probe);
 }
-module_init(s3c64xx_spi_init);
+subsys_initcall(s3c64xx_spi_init);
 
 static void __exit s3c64xx_spi_exit(void)
 {
diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c
index baa8b05b9e8d..6e973a79aa25 100644
--- a/drivers/staging/batman-adv/hard-interface.c
+++ b/drivers/staging/batman-adv/hard-interface.c
@@ -30,7 +30,6 @@
 #include "hash.h"
 
 #include <linux/if_arp.h>
-#include <linux/netfilter_bridge.h>
 
 #define MIN(x, y) ((x) < (y) ? (x) : (y))
 
@@ -431,11 +430,6 @@ out:
         return NOTIFY_DONE;
 }
 
-static int batman_skb_recv_finish(struct sk_buff *skb)
-{
-        return NF_ACCEPT;
-}
-
 /* receive a packet with the batman ethertype coming on a hard
  * interface */
 int batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
@@ -456,13 +450,6 @@ int batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
         if (atomic_read(&module_state) != MODULE_ACTIVE)
                 goto err_free;
 
-        /* if netfilter/ebtables wants to block incoming batman
-         * packets then give them a chance to do so here */
-        ret = NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, dev, NULL,
-                      batman_skb_recv_finish);
-        if (ret != 1)
-                goto err_out;
-
         /* packet should hold at least type and version */
         if (unlikely(skb_headlen(skb) < 2))
                 goto err_free;
diff --git a/drivers/staging/batman-adv/send.c b/drivers/staging/batman-adv/send.c
index 055edee7b4e4..da3c82e47bbd 100644
--- a/drivers/staging/batman-adv/send.c
+++ b/drivers/staging/batman-adv/send.c
@@ -29,7 +29,6 @@
 #include "vis.h"
 #include "aggregation.h"
 
-#include <linux/netfilter_bridge.h>
 
 static void send_outstanding_bcast_packet(struct work_struct *work);
 
@@ -92,12 +91,9 @@ int send_skb_packet(struct sk_buff *skb,
 
         /* dev_queue_xmit() returns a negative result on error.  However on
          * congestion and traffic shaping, it drops and returns NET_XMIT_DROP
-         * (which is > 0). This will not be treated as an error.
-         * Also, if netfilter/ebtables wants to block outgoing batman
-         * packets then giving them a chance to do so here */
+         * (which is > 0). This will not be treated as an error. */
 
-        return NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
-                       dev_queue_xmit);
+        return dev_queue_xmit(skb);
 send_skb_err:
         kfree_skb(skb);
         return NET_XMIT_DROP;
diff --git a/drivers/staging/ti-st/st.h b/drivers/staging/ti-st/st.h
index 9952579425b9..1b3060eb2921 100644
--- a/drivers/staging/ti-st/st.h
+++ b/drivers/staging/ti-st/st.h
@@ -80,5 +80,4 @@ struct st_proto_s {
 extern long st_register(struct st_proto_s *);
 extern long st_unregister(enum proto_type);
 
-extern struct platform_device *st_get_plat_device(void);
 #endif /* ST_H */
diff --git a/drivers/staging/ti-st/st_core.c b/drivers/staging/ti-st/st_core.c
index 063c9b1db1ab..b85d8bfdf600 100644
--- a/drivers/staging/ti-st/st_core.c
+++ b/drivers/staging/ti-st/st_core.c
@@ -38,7 +38,6 @@
 #include "st_ll.h"
 #include "st.h"
 
-#define VERBOSE
 /* strings to be used for rfkill entries and by
  * ST Core to be used for sysfs debug entry
  */
@@ -581,7 +580,7 @@ long st_register(struct st_proto_s *new_proto)
         long err = 0;
         unsigned long flags = 0;
 
-        st_kim_ref(&st_gdata);
+        st_kim_ref(&st_gdata, 0);
         pr_info("%s(%d) ", __func__, new_proto->type);
         if (st_gdata == NULL || new_proto == NULL || new_proto->recv == NULL
             || new_proto->reg_complete_cb == NULL) {
@@ -713,7 +712,7 @@ long st_unregister(enum proto_type type)
 
         pr_debug("%s: %d ", __func__, type);
 
-        st_kim_ref(&st_gdata);
+        st_kim_ref(&st_gdata, 0);
         if (type < ST_BT || type >= ST_MAX) {
                 pr_err(" protocol %d not supported", type);
                 return -EPROTONOSUPPORT;
@@ -767,7 +766,7 @@ long st_write(struct sk_buff *skb)
 #endif
         long len;
 
-        st_kim_ref(&st_gdata);
+        st_kim_ref(&st_gdata, 0);
         if (unlikely(skb == NULL || st_gdata == NULL
                 || st_gdata->tty == NULL)) {
                 pr_err("data/tty unavailable to perform write");
@@ -818,7 +817,7 @@ static int st_tty_open(struct tty_struct *tty)
         struct st_data_s *st_gdata;
         pr_info("%s ", __func__);
 
-        st_kim_ref(&st_gdata);
+        st_kim_ref(&st_gdata, 0);
         st_gdata->tty = tty;
         tty->disc_data = st_gdata;
 
diff --git a/drivers/staging/ti-st/st_core.h b/drivers/staging/ti-st/st_core.h
index e0c32d149f5f..8601320a679e 100644
--- a/drivers/staging/ti-st/st_core.h
+++ b/drivers/staging/ti-st/st_core.h
@@ -117,7 +117,7 @@ int st_core_init(struct st_data_s **);
 void st_core_exit(struct st_data_s *);
 
 /* ask for reference from KIM */
-void st_kim_ref(struct st_data_s **);
+void st_kim_ref(struct st_data_s **, int);
 
 #define GPS_STUB_TEST
 #ifdef GPS_STUB_TEST
diff --git a/drivers/staging/ti-st/st_kim.c b/drivers/staging/ti-st/st_kim.c
index b4a6c7fdc4e6..9e99463f76e8 100644
--- a/drivers/staging/ti-st/st_kim.c
+++ b/drivers/staging/ti-st/st_kim.c
@@ -72,11 +72,26 @@ const unsigned char *protocol_names[] = {
         PROTO_ENTRY(ST_GPS, "GPS"),
 };
 
+#define MAX_ST_DEVICES  3       /* Imagine 1 on each UART for now */
+struct platform_device *st_kim_devices[MAX_ST_DEVICES];
 
 /**********************************************************************/
 /* internal functions */
 
 /**
+ * st_get_plat_device -
+ *      function which returns the reference to the platform device
+ *      requested by id. As of now only 1 such device exists (id=0)
+ *      the context requesting for reference can get the id to be
+ *      requested by a. The protocol driver which is registering or
+ *      b. the tty device which is opened.
+ */
+static struct platform_device *st_get_plat_device(int id)
+{
+        return st_kim_devices[id];
+}
+
+/**
  * validate_firmware_response -
  *      function to return whether the firmware response was proper
  *      in case of error don't complete so that waiting for proper
@@ -353,7 +368,7 @@ void st_kim_chip_toggle(enum proto_type type, enum kim_gpio_state state)
         struct kim_data_s       *kim_gdata;
         pr_info(" %s ", __func__);
 
-        kim_pdev = st_get_plat_device();
+        kim_pdev = st_get_plat_device(0);
         kim_gdata = dev_get_drvdata(&kim_pdev->dev);
 
         if (kim_gdata->gpios[type] == -1) {
@@ -574,12 +589,12 @@ static int kim_toggle_radio(void *data, bool blocked)
  *      This would enable multiple such platform devices to exist
  *      on a given platform
  */
-void st_kim_ref(struct st_data_s **core_data)
+void st_kim_ref(struct st_data_s **core_data, int id)
 {
         struct platform_device  *pdev;
         struct kim_data_s       *kim_gdata;
         /* get kim_gdata reference from platform device */
-        pdev = st_get_plat_device();
+        pdev = st_get_plat_device(id);
         kim_gdata = dev_get_drvdata(&pdev->dev);
         *core_data = kim_gdata->core_data;
 }
@@ -623,6 +638,7 @@ static int kim_probe(struct platform_device *pdev)
         long *gpios = pdev->dev.platform_data;
         struct kim_data_s       *kim_gdata;
 
+        st_kim_devices[pdev->id] = pdev;
         kim_gdata = kzalloc(sizeof(struct kim_data_s), GFP_ATOMIC);
         if (!kim_gdata) {
                 pr_err("no mem to allocate");
diff --git a/drivers/staging/vt6655/wpactl.c b/drivers/staging/vt6655/wpactl.c
index 0142338bcafe..4bdb8362de82 100644
--- a/drivers/staging/vt6655/wpactl.c
+++ b/drivers/staging/vt6655/wpactl.c
@@ -766,9 +766,14 @@ static int wpa_set_associate(PSDevice pDevice,
     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wpa_ie_len = %d\n", param->u.wpa_associate.wpa_ie_len);
 
 
-        if (param->u.wpa_associate.wpa_ie &&
-            copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie, param->u.wpa_associate.wpa_ie_len))
-            return -EINVAL;
+        if (param->u.wpa_associate.wpa_ie_len) {
+                if (!param->u.wpa_associate.wpa_ie)
+                        return -EINVAL;
+                if (param->u.wpa_associate.wpa_ie_len > sizeof(abyWPAIE))
+                        return -EINVAL;
+                if (copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie, param->u.wpa_associate.wpa_ie_len))
+                        return -EFAULT;
+        }
 
         if (param->u.wpa_associate.mode == 1)
             pMgmt->eConfigMode = WMAC_CONFIG_IBSS_STA;
diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index 7e594449600e..9eed5b52d9de 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -91,12 +91,12 @@ config USB_DYNAMIC_MINORS
           If you are unsure about this, say N here.
 
 config USB_SUSPEND
-        bool "USB runtime power management (suspend/resume and wakeup)"
+        bool "USB runtime power management (autosuspend) and wakeup"
         depends on USB && PM_RUNTIME
         help
           If you say Y here, you can use driver calls or the sysfs
-          "power/level" file to suspend or resume individual USB
-          peripherals and to enable or disable autosuspend (see
+          "power/control" file to enable or disable autosuspend for
+          individual USB peripherals (see
           Documentation/usb/power-management.txt for more details).
 
           Also, USB "remote wakeup" signaling is supported, whereby some
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index f06f5dbc8cdc..1e6ccef2cf0c 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -159,9 +159,9 @@ void usb_major_cleanup(void)
 int usb_register_dev(struct usb_interface *intf,
                      struct usb_class_driver *class_driver)
 {
-        int retval = -EINVAL;
+        int retval;
         int minor_base = class_driver->minor_base;
-        int minor = 0;
+        int minor;
         char name[20];
         char *temp;
 
@@ -173,12 +173,17 @@ int usb_register_dev(struct usb_interface *intf,
          */
         minor_base = 0;
 #endif
-        intf->minor = -1;
-
-        dbg ("looking for a minor, starting at %d", minor_base);
 
         if (class_driver->fops == NULL)
-                goto exit;
+                return -EINVAL;
+        if (intf->minor >= 0)
+                return -EADDRINUSE;
+
+        retval = init_usb_class();
+        if (retval)
+                return retval;
+
+        dev_dbg(&intf->dev, "looking for a minor, starting at %d", minor_base);
 
         down_write(&minor_rwsem);
         for (minor = minor_base; minor < MAX_USB_MINORS; ++minor) {
@@ -186,20 +191,12 @@ int usb_register_dev(struct usb_interface *intf,
                         continue;
 
                 usb_minors[minor] = class_driver->fops;
-
-                retval = 0;
+                intf->minor = minor;
                 break;
         }
         up_write(&minor_rwsem);
-
-        if (retval)
-                goto exit;
-
-        retval = init_usb_class();
-        if (retval)
-                goto exit;
-
-        intf->minor = minor;
+        if (intf->minor < 0)
+                return -EXFULL;
 
         /* create a usb class device for this usb interface */
         snprintf(name, sizeof(name), class_driver->name, minor - minor_base);
@@ -213,11 +210,11 @@ int usb_register_dev(struct usb_interface *intf,
                                       "%s", temp);
         if (IS_ERR(intf->usb_dev)) {
                 down_write(&minor_rwsem);
-                usb_minors[intf->minor] = NULL;
+                usb_minors[minor] = NULL;
+                intf->minor = -1;
                 up_write(&minor_rwsem);
                 retval = PTR_ERR(intf->usb_dev);
         }
-exit:
         return retval;
 }
 EXPORT_SYMBOL_GPL(usb_register_dev);
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 844683e50383..9f0ce7de0e36 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1802,6 +1802,7 @@ free_interfaces:
                 intf->dev.groups = usb_interface_groups;
                 intf->dev.dma_mask = dev->dev.dma_mask;
                 INIT_WORK(&intf->reset_ws, __usb_queue_reset_device);
+                intf->minor = -1;
                 device_initialize(&intf->dev);
                 dev_set_name(&intf->dev, "%d-%s:%d.%d",
                         dev->bus->busnum, dev->devpath,
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 58b72d741d93..a1e8d273103f 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -119,6 +119,11 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                         ehci->broken_periodic = 1;
                         ehci_info(ehci, "using broken periodic workaround\n");
                 }
+                if (pdev->device == 0x0806 || pdev->device == 0x0811
+                                || pdev->device == 0x0829) {
+                        ehci_info(ehci, "disable lpm for langwell/penwell\n");
+                        ehci->has_lpm = 0;
+                }
                 break;
         case PCI_VENDOR_ID_TDI:
                 if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {
diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
index 59dc3d351b60..5ab5bb89bae3 100644
--- a/drivers/usb/musb/cppi_dma.c
+++ b/drivers/usb/musb/cppi_dma.c
@@ -322,6 +322,7 @@ cppi_channel_allocate(struct dma_controller *c,
                                 index, transmit ? 'T' : 'R', cppi_ch);
         cppi_ch->hw_ep = ep;
         cppi_ch->channel.status = MUSB_DMA_STATUS_FREE;
+        cppi_ch->channel.max_len = 0x7fffffff;
 
         DBG(4, "Allocate CPPI%d %cX\n", index, transmit ? 'T' : 'R');
         return &cppi_ch->channel;
diff --git a/drivers/usb/musb/musb_debugfs.c b/drivers/usb/musb/musb_debugfs.c
index c79a5e30d437..9e8639d4e862 100644
--- a/drivers/usb/musb/musb_debugfs.c
+++ b/drivers/usb/musb/musb_debugfs.c
@@ -195,15 +195,14 @@ static const struct file_operations musb_regdump_fops = {
 
 static int musb_test_mode_open(struct inode *inode, struct file *file)
 {
-        file->private_data = inode->i_private;
-
         return single_open(file, musb_test_mode_show, inode->i_private);
 }
 
 static ssize_t musb_test_mode_write(struct file *file,
                 const char __user *ubuf, size_t count, loff_t *ppos)
 {
-        struct musb             *musb = file->private_data;
+        struct seq_file         *s = file->private_data;
+        struct musb             *musb = s->private;
         u8                      test = 0;
         char                    buf[18];
 
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 6fca870e957e..d065e23f123e 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -300,6 +300,11 @@ static void txstate(struct musb *musb, struct musb_request *req)
 #ifndef CONFIG_MUSB_PIO_ONLY
         if (is_dma_capable() && musb_ep->dma) {
                 struct dma_controller   *c = musb->dma_controller;
+                size_t request_size;
+
+                /* setup DMA, then program endpoint CSR */
+                request_size = min_t(size_t, request->length - request->actual,
+                                        musb_ep->dma->max_len);
 
                 use_dma = (request->dma != DMA_ADDR_INVALID);
 
@@ -307,11 +312,6 @@ static void txstate(struct musb *musb, struct musb_request *req)
 
 #ifdef CONFIG_USB_INVENTRA_DMA
                 {
-                        size_t request_size;
-
-                        /* setup DMA, then program endpoint CSR */
-                        request_size = min_t(size_t, request->length,
-                                                musb_ep->dma->max_len);
                         if (request_size < musb_ep->packet_sz)
                                 musb_ep->dma->desired_mode = 0;
                         else
@@ -373,8 +373,8 @@ static void txstate(struct musb *musb, struct musb_request *req)
                 use_dma = use_dma && c->channel_program(
                                 musb_ep->dma, musb_ep->packet_sz,
                                 0,
-                                request->dma,
-                                request->length);
+                                request->dma + request->actual,
+                                request_size);
                 if (!use_dma) {
                         c->channel_release(musb_ep->dma);
                         musb_ep->dma = NULL;
@@ -386,8 +386,8 @@ static void txstate(struct musb *musb, struct musb_request *req)
                 use_dma = use_dma && c->channel_program(
                                 musb_ep->dma, musb_ep->packet_sz,
                                 request->zero,
-                                request->dma,
-                                request->length);
+                                request->dma + request->actual,
+                                request_size);
 #endif
         }
 #endif
@@ -501,26 +501,14 @@ void musb_g_tx(struct musb *musb, u8 epnum)
                                 request->zero = 0;
                         }
 
-                        /* ... or if not, then complete it. */
-                        musb_g_giveback(musb_ep, request, 0);
-
-                        /*
-                         * Kickstart next transfer if appropriate;
-                         * the packet that just completed might not
-                         * be transmitted for hours or days.
-                         * REVISIT for double buffering...
-                         * FIXME revisit for stalls too...
-                         */
-                        musb_ep_select(mbase, epnum);
-                        csr = musb_readw(epio, MUSB_TXCSR);
-                        if (csr & MUSB_TXCSR_FIFONOTEMPTY)
-                                return;
-
-                        request = musb_ep->desc ? next_request(musb_ep) : NULL;
-                        if (!request) {
-                                DBG(4, "%s idle now\n",
-                                        musb_ep->end_point.name);
-                                return;
+                        if (request->actual == request->length) {
+                                musb_g_giveback(musb_ep, request, 0);
+                                request = musb_ep->desc ? next_request(musb_ep) : NULL;
+                                if (!request) {
+                                        DBG(4, "%s idle now\n",
+                                                musb_ep->end_point.name);
+                                        return;
+                                }
                         }
                 }
 
@@ -568,11 +556,19 @@ static void rxstate(struct musb *musb, struct musb_request *req)
 {
         const u8                epnum = req->epnum;
         struct usb_request      *request = &req->request;
-        struct musb_ep          *musb_ep = &musb->endpoints[epnum].ep_out;
+        struct musb_ep          *musb_ep;
         void __iomem            *epio = musb->endpoints[epnum].regs;
         unsigned                fifo_count = 0;
-        u16                     len = musb_ep->packet_sz;
+        u16                     len;
         u16                     csr = musb_readw(epio, MUSB_RXCSR);
+        struct musb_hw_ep       *hw_ep = &musb->endpoints[epnum];
+
+        if (hw_ep->is_shared_fifo)
+                musb_ep = &hw_ep->ep_in;
+        else
+                musb_ep = &hw_ep->ep_out;
+
+        len = musb_ep->packet_sz;
 
         /* We shouldn't get here while DMA is active, but we do... */
         if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
@@ -647,8 +643,8 @@ static void rxstate(struct musb *musb, struct musb_request *req)
          */
 
                                 csr |= MUSB_RXCSR_DMAENAB;
-#ifdef USE_MODE1
                                 csr |= MUSB_RXCSR_AUTOCLEAR;
+#ifdef USE_MODE1
                                 /* csr |= MUSB_RXCSR_DMAMODE; */
 
                                 /* this special sequence (enabling and then
@@ -663,10 +659,11 @@ static void rxstate(struct musb *musb, struct musb_request *req)
                                 if (request->actual < request->length) {
                                         int transfer_size = 0;
 #ifdef USE_MODE1
-                                        transfer_size = min(request->length,
+                                        transfer_size = min(request->length - request->actual,
                                                         channel->max_len);
 #else
-                                        transfer_size = len;
+                                        transfer_size = min(request->length - request->actual,
+                                                        (unsigned)len);
 #endif
                                         if (transfer_size <= musb_ep->packet_sz)
                                                 musb_ep->dma->desired_mode = 0;
@@ -740,9 +737,15 @@ void musb_g_rx(struct musb *musb, u8 epnum)
         u16                     csr;
         struct usb_request      *request;
         void __iomem            *mbase = musb->mregs;
-        struct musb_ep          *musb_ep = &musb->endpoints[epnum].ep_out;
+        struct musb_ep          *musb_ep;
         void __iomem            *epio = musb->endpoints[epnum].regs;
         struct dma_channel      *dma;
+        struct musb_hw_ep       *hw_ep = &musb->endpoints[epnum];
+
+        if (hw_ep->is_shared_fifo)
+                musb_ep = &hw_ep->ep_in;
+        else
+                musb_ep = &hw_ep->ep_out;
 
         musb_ep_select(mbase, epnum);
 
@@ -1081,7 +1084,7 @@ struct free_record {
 /*
  * Context: controller locked, IRQs blocked.
  */
-static void musb_ep_restart(struct musb *musb, struct musb_request *req)
+void musb_ep_restart(struct musb *musb, struct musb_request *req)
 {
         DBG(3, "<== %s request %p len %u on hw_ep%d\n",
                 req->tx ? "TX/IN" : "RX/OUT",
diff --git a/drivers/usb/musb/musb_gadget.h b/drivers/usb/musb/musb_gadget.h
index c8b140325d82..572b1da7f2dc 100644
--- a/drivers/usb/musb/musb_gadget.h
+++ b/drivers/usb/musb/musb_gadget.h
@@ -105,4 +105,6 @@ extern void musb_gadget_cleanup(struct musb *);
 
 extern void musb_g_giveback(struct musb_ep *, struct usb_request *, int);
 
+extern void musb_ep_restart(struct musb *, struct musb_request *);
+
 #endif          /* __MUSB_GADGET_H */
diff --git a/drivers/usb/musb/musb_gadget_ep0.c b/drivers/usb/musb/musb_gadget_ep0.c
index 59bef8f3a358..6dd03f4c5f49 100644
--- a/drivers/usb/musb/musb_gadget_ep0.c
+++ b/drivers/usb/musb/musb_gadget_ep0.c
@@ -261,6 +261,7 @@ __acquires(musb->lock)
                                         ctrlrequest->wIndex & 0x0f;
                                 struct musb_ep          *musb_ep;
                                 struct musb_hw_ep       *ep;
+                                struct musb_request     *request;
                                 void __iomem            *regs;
                                 int                     is_in;
                                 u16                     csr;
@@ -302,6 +303,14 @@ __acquires(musb->lock)
                                         musb_writew(regs, MUSB_RXCSR, csr);
                                 }
 
+                                /* Maybe start the first request in the queue */
+                                request = to_musb_request(
+                                                next_request(musb_ep));
+                                if (!musb_ep->busy && request) {
+                                        DBG(3, "restarting the request\n");
+                                        musb_ep_restart(musb, request);
+                                }
+
                                 /* select ep0 again */
                                 musb_ep_select(mbase, 0);
                                 } break;
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 877d20b1dff9..9e65c47cc98b 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -660,6 +660,12 @@ static bool musb_tx_dma_program(struct dma_controller *dma,
 
         qh->segsize = length;
 
+        /*
+         * Ensure the data reaches to main memory before starting
+         * DMA transfer
+         */
+        wmb();
+
         if (!dma->channel_program(channel, pkt_size, mode,
                         urb->transfer_dma + offset, length)) {
                 dma->channel_release(channel);
diff --git a/drivers/usb/otg/twl4030-usb.c b/drivers/usb/otg/twl4030-usb.c
index 05aaac1c3861..0bc97698af15 100644
--- a/drivers/usb/otg/twl4030-usb.c
+++ b/drivers/usb/otg/twl4030-usb.c
@@ -347,11 +347,20 @@ static void twl4030_i2c_access(struct twl4030_usb *twl, int on)
         }
 }
 
-static void twl4030_phy_power(struct twl4030_usb *twl, int on)
+static void __twl4030_phy_power(struct twl4030_usb *twl, int on)
 {
-        u8 pwr;
+        u8 pwr = twl4030_usb_read(twl, PHY_PWR_CTRL);
+
+        if (on)
+                pwr &= ~PHY_PWR_PHYPWD;
+        else
+                pwr |= PHY_PWR_PHYPWD;
 
-        pwr = twl4030_usb_read(twl, PHY_PWR_CTRL);
+        WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);
+}
+
+static void twl4030_phy_power(struct twl4030_usb *twl, int on)
+{
         if (on) {
                 regulator_enable(twl->usb3v1);
                 regulator_enable(twl->usb1v8);
@@ -365,15 +374,13 @@ static void twl4030_phy_power(struct twl4030_usb *twl, int on)
                 twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0,
                                                         VUSB_DEDICATED2);
                 regulator_enable(twl->usb1v5);
-                pwr &= ~PHY_PWR_PHYPWD;
-                WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);
+                __twl4030_phy_power(twl, 1);
                 twl4030_usb_write(twl, PHY_CLK_CTRL,
                                   twl4030_usb_read(twl, PHY_CLK_CTRL) |
                                         (PHY_CLK_CTRL_CLOCKGATING_EN |
                                                 PHY_CLK_CTRL_CLK32K_EN));
-        } else  {
-                pwr |= PHY_PWR_PHYPWD;
-                WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);
+        } else {
+                __twl4030_phy_power(twl, 0);
                 regulator_disable(twl->usb1v5);
                 regulator_disable(twl->usb1v8);
                 regulator_disable(twl->usb3v1);
@@ -387,19 +394,25 @@ static void twl4030_phy_suspend(struct twl4030_usb *twl, int controller_off)
 
         twl4030_phy_power(twl, 0);
         twl->asleep = 1;
+        dev_dbg(twl->dev, "%s\n", __func__);
 }
 
-static void twl4030_phy_resume(struct twl4030_usb *twl)
+static void __twl4030_phy_resume(struct twl4030_usb *twl)
 {
-        if (!twl->asleep)
-                return;
-
         twl4030_phy_power(twl, 1);
         twl4030_i2c_access(twl, 1);
         twl4030_usb_set_mode(twl, twl->usb_mode);
         if (twl->usb_mode == T2_USB_MODE_ULPI)
                 twl4030_i2c_access(twl, 0);
+}
+
+static void twl4030_phy_resume(struct twl4030_usb *twl)
+{
+        if (!twl->asleep)
+                return;
+        __twl4030_phy_resume(twl);
         twl->asleep = 0;
+        dev_dbg(twl->dev, "%s\n", __func__);
 }
 
 static int twl4030_usb_ldo_init(struct twl4030_usb *twl)
@@ -408,8 +421,8 @@ static int twl4030_usb_ldo_init(struct twl4030_usb *twl)
         twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0xC0, PROTECT_KEY);
         twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0x0C, PROTECT_KEY);
 
-        /* put VUSB3V1 LDO in active state */
-        twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB_DEDICATED2);
+        /* Keep VUSB3V1 LDO in sleep state until VBUS/ID change detected*/
+        /*twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB_DEDICATED2);*/
 
         /* input to VUSB3V1 LDO is from VBAT, not VBUS */
         twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0x14, VUSB_DEDICATED1);
@@ -502,6 +515,26 @@ static irqreturn_t twl4030_usb_irq(int irq, void *_twl)
         return IRQ_HANDLED;
 }
 
+static void twl4030_usb_phy_init(struct twl4030_usb *twl)
+{
+        int status;
+
+        status = twl4030_usb_linkstat(twl);
+        if (status >= 0) {
+                if (status == USB_EVENT_NONE) {
+                        __twl4030_phy_power(twl, 0);
+                        twl->asleep = 1;
+                } else {
+                        __twl4030_phy_resume(twl);
+                        twl->asleep = 0;
+                }
+
+                blocking_notifier_call_chain(&twl->otg.notifier, status,
+                                twl->otg.gadget);
+        }
+        sysfs_notify(&twl->dev->kobj, NULL, "vbus");
+}
+
 static int twl4030_set_suspend(struct otg_transceiver *x, int suspend)
 {
         struct twl4030_usb *twl = xceiv_to_twl(x);
@@ -550,7 +583,6 @@ static int __devinit twl4030_usb_probe(struct platform_device *pdev)
         struct twl4030_usb_data *pdata = pdev->dev.platform_data;
         struct twl4030_usb      *twl;
         int                     status, err;
-        u8                      pwr;
 
         if (!pdata) {
                 dev_dbg(&pdev->dev, "platform_data not available\n");
@@ -569,10 +601,7 @@ static int __devinit twl4030_usb_probe(struct platform_device *pdev)
         twl->otg.set_peripheral = twl4030_set_peripheral;
         twl->otg.set_suspend    = twl4030_set_suspend;
         twl->usb_mode           = pdata->usb_mode;
-
-        pwr = twl4030_usb_read(twl, PHY_PWR_CTRL);
-
-        twl->asleep             = (pwr & PHY_PWR_PHYPWD);
+        twl->asleep = 1;
 
         /* init spinlock for workqueue */
         spin_lock_init(&twl->lock);
@@ -610,15 +639,10 @@ static int __devinit twl4030_usb_probe(struct platform_device *pdev)
                 return status;
         }
 
-        /* The IRQ handler just handles changes from the previous states
-         * of the ID and VBUS pins ... in probe() we must initialize that
-         * previous state.  The easy way:  fake an IRQ.
-         *
-         * REVISIT:  a real IRQ might have happened already, if PREEMPT is
-         * enabled.  Else the IRQ may not yet be configured or enabled,
-         * because of scheduling delays.
+        /* Power down phy or make it work according to
+         * current link state.
          */
-        twl4030_usb_irq(twl->irq, twl);
+        twl4030_usb_phy_init(twl);
 
         dev_info(&pdev->dev, "Initialized TWL4030 USB module\n");
         return 0;
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 30922a7e3347..aa665817a272 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -2024,6 +2024,9 @@ static int mos7720_ioctl(struct tty_struct *tty, struct file *file,
 
         case TIOCGICOUNT:
                 cnow = mos7720_port->icount;
+
+                memset(&icount, 0, sizeof(struct serial_icounter_struct));
+
                 icount.cts = cnow.cts;
                 icount.dsr = cnow.dsr;
                 icount.rng = cnow.rng;
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 1c9b6e9b2386..1a42bc213799 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -2285,6 +2285,9 @@ static int mos7840_ioctl(struct tty_struct *tty, struct file *file,
         case TIOCGICOUNT:
                 cnow = mos7840_port->icount;
                 smp_rmb();
+
+                memset(&icount, 0, sizeof(struct serial_icounter_struct));
+
                 icount.cts = cnow.cts;
                 icount.dsr = cnow.dsr;
                 icount.rng = cnow.rng;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 29e850a7a2f9..72ab71fdf053 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -243,7 +243,7 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
         int r, nlogs = 0;
 
         while (datalen > 0) {
-                if (unlikely(headcount >= VHOST_NET_MAX_SG)) {
+                if (unlikely(seg >= UIO_MAXIOV)) {
                         r = -ENOBUFS;
                         goto err;
                 }
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index c579dcc9200c..344019774ddd 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -212,6 +212,45 @@ static int vhost_worker(void *data)
         }
 }
 
+/* Helper to allocate iovec buffers for all vqs. */
+static long vhost_dev_alloc_iovecs(struct vhost_dev *dev)
+{
+        int i;
+        for (i = 0; i < dev->nvqs; ++i) {
+                dev->vqs[i].indirect = kmalloc(sizeof *dev->vqs[i].indirect *
+                                               UIO_MAXIOV, GFP_KERNEL);
+                dev->vqs[i].log = kmalloc(sizeof *dev->vqs[i].log * UIO_MAXIOV,
+                                          GFP_KERNEL);
+                dev->vqs[i].heads = kmalloc(sizeof *dev->vqs[i].heads *
+                                            UIO_MAXIOV, GFP_KERNEL);
+
+                if (!dev->vqs[i].indirect || !dev->vqs[i].log ||
+                        !dev->vqs[i].heads)
+                        goto err_nomem;
+        }
+        return 0;
+err_nomem:
+        for (; i >= 0; --i) {
+                kfree(dev->vqs[i].indirect);
+                kfree(dev->vqs[i].log);
+                kfree(dev->vqs[i].heads);
+        }
+        return -ENOMEM;
+}
+
+static void vhost_dev_free_iovecs(struct vhost_dev *dev)
+{
+        int i;
+        for (i = 0; i < dev->nvqs; ++i) {
+                kfree(dev->vqs[i].indirect);
+                dev->vqs[i].indirect = NULL;
+                kfree(dev->vqs[i].log);
+                dev->vqs[i].log = NULL;
+                kfree(dev->vqs[i].heads);
+                dev->vqs[i].heads = NULL;
+        }
+}
+
 long vhost_dev_init(struct vhost_dev *dev,
                     struct vhost_virtqueue *vqs, int nvqs)
 {
@@ -229,6 +268,9 @@ long vhost_dev_init(struct vhost_dev *dev,
         dev->worker = NULL;
 
         for (i = 0; i < dev->nvqs; ++i) {
+                dev->vqs[i].log = NULL;
+                dev->vqs[i].indirect = NULL;
+                dev->vqs[i].heads = NULL;
                 dev->vqs[i].dev = dev;
                 mutex_init(&dev->vqs[i].mutex);
                 vhost_vq_reset(dev, dev->vqs + i);
@@ -295,6 +337,10 @@ static long vhost_dev_set_owner(struct vhost_dev *dev)
         if (err)
                 goto err_cgroup;
 
+        err = vhost_dev_alloc_iovecs(dev);
+        if (err)
+                goto err_cgroup;
+
         return 0;
 err_cgroup:
         kthread_stop(worker);
@@ -345,6 +391,7 @@ void vhost_dev_cleanup(struct vhost_dev *dev)
                         fput(dev->vqs[i].call);
                 vhost_vq_reset(dev, dev->vqs + i);
         }
+        vhost_dev_free_iovecs(dev);
         if (dev->log_ctx)
                 eventfd_ctx_put(dev->log_ctx);
         dev->log_ctx = NULL;
@@ -858,11 +905,12 @@ int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
                 if (r < 0)
                         return r;
                 len -= l;
-                if (!len)
+                if (!len) {
+                        if (vq->log_ctx)
+                                eventfd_signal(vq->log_ctx, 1);
                         return 0;
+                }
         }
-        if (vq->log_ctx)
-                eventfd_signal(vq->log_ctx, 1);
         /* Length written exceeds what we have stored. This is a bug. */
         BUG();
         return 0;
@@ -946,7 +994,7 @@ static int get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
         }
 
         ret = translate_desc(dev, indirect->addr, indirect->len, vq->indirect,
-                             ARRAY_SIZE(vq->indirect));
+                             UIO_MAXIOV);
         if (unlikely(ret < 0)) {
                 vq_err(vq, "Translation failure %d in indirect.\n", ret);
                 return ret;
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index afd77295971c..edc892989992 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -15,11 +15,6 @@
 
 struct vhost_device;
 
-enum {
-        /* Enough place for all fragments, head, and virtio net header. */
-        VHOST_NET_MAX_SG = MAX_SKB_FRAGS + 2,
-};
-
 struct vhost_work;
 typedef void (*vhost_work_fn_t)(struct vhost_work *work);
 
@@ -93,12 +88,15 @@ struct vhost_virtqueue {
         bool log_used;
         u64 log_addr;
 
-        struct iovec indirect[VHOST_NET_MAX_SG];
-        struct iovec iov[VHOST_NET_MAX_SG];
-        struct iovec hdr[VHOST_NET_MAX_SG];
+        struct iovec iov[UIO_MAXIOV];
+        /* hdr is used to store the virtio header.
+         * Since each iovec has >= 1 byte length, we never need more than
+         * header length entries to store the header. */
+        struct iovec hdr[sizeof(struct virtio_net_hdr_mrg_rxbuf)];
+        struct iovec *indirect;
         size_t vhost_hlen;
         size_t sock_hlen;
-        struct vring_used_elem heads[VHOST_NET_MAX_SG];
+        struct vring_used_elem *heads;
         /* We use a kind of RCU to access private pointer.
          * All readers access it from worker, which makes it possible to
          * flush the vhost_work instead of synchronize_rcu. Therefore readers do
@@ -109,7 +107,7 @@ struct vhost_virtqueue {
         void *private_data;
         /* Log write descriptors */
         void __user *log_base;
-        struct vhost_log log[VHOST_NET_MAX_SG];
+        struct vhost_log *log;
 };
 
 struct vhost_dev {
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 84f842331dfa..7ccc967831f0 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -3508,7 +3508,7 @@ static void fbcon_exit(void)
         softback_buf = 0UL;
 
         for (i = 0; i < FB_MAX; i++) {
-                int pending;
+                int pending = 0;
 
                 mapped = 0;
                 info = registered_fb[i];
@@ -3516,7 +3516,8 @@ static void fbcon_exit(void)
                 if (info == NULL)
                         continue;
 
-                pending = cancel_work_sync(&info->queue);
+                if (info->queue.func)
+                        pending = cancel_work_sync(&info->queue);
                 DPRINTK("fbcon: %s pending work\n", (pending ? "canceled" :
                         "no"));
 
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
index 815f84b07933..70477c2e4b61 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/efifb.c
@@ -13,7 +13,7 @@
 #include <linux/platform_device.h>
 #include <linux/screen_info.h>
 #include <linux/dmi.h>
-
+#include <linux/pci.h>
 #include <video/vga.h>
 
 static struct fb_var_screeninfo efifb_defined __devinitdata = {
@@ -39,17 +39,31 @@ enum {
         M_I20,          /* 20-Inch iMac */
         M_I20_SR,       /* 20-Inch iMac (Santa Rosa) */
         M_I24,          /* 24-Inch iMac */
+        M_I24_8_1,      /* 24-Inch iMac, 8,1th gen */
+        M_I24_10_1,     /* 24-Inch iMac, 10,1th gen */
+        M_I27_11_1,     /* 27-Inch iMac, 11,1th gen */
         M_MINI,         /* Mac Mini */
+        M_MINI_3_1,     /* Mac Mini, 3,1th gen */
+        M_MINI_4_1,     /* Mac Mini, 4,1th gen */
         M_MB,           /* MacBook */
         M_MB_2,         /* MacBook, 2nd rev. */
         M_MB_3,         /* MacBook, 3rd rev. */
+        M_MB_5_1,       /* MacBook, 5th rev. */
+        M_MB_6_1,       /* MacBook, 6th rev. */
+        M_MB_7_1,       /* MacBook, 7th rev. */
         M_MB_SR,        /* MacBook, 2nd gen, (Santa Rosa) */
         M_MBA,          /* MacBook Air */
         M_MBP,          /* MacBook Pro */
         M_MBP_2,        /* MacBook Pro 2nd gen */
+        M_MBP_2_2,      /* MacBook Pro 2,2nd gen */
         M_MBP_SR,       /* MacBook Pro (Santa Rosa) */
         M_MBP_4,        /* MacBook Pro, 4th gen */
         M_MBP_5_1,    /* MacBook Pro, 5,1th gen */
+        M_MBP_5_2,      /* MacBook Pro, 5,2th gen */
+        M_MBP_5_3,      /* MacBook Pro, 5,3rd gen */
+        M_MBP_6_1,      /* MacBook Pro, 6,1th gen */
+        M_MBP_6_2,      /* MacBook Pro, 6,2th gen */
+        M_MBP_7_1,      /* MacBook Pro, 7,1th gen */
         M_UNKNOWN       /* placeholder */
 };
 
@@ -64,14 +78,28 @@ static struct efifb_dmi_info {
         [M_I20] = { "i20", 0x80010000, 1728 * 4, 1680, 1050 }, /* guess */
         [M_I20_SR] = { "imac7", 0x40010000, 1728 * 4, 1680, 1050 },
         [M_I24] = { "i24", 0x80010000, 2048 * 4, 1920, 1200 }, /* guess */
+        [M_I24_8_1] = { "imac8", 0xc0060000, 2048 * 4, 1920, 1200 },
+        [M_I24_10_1] = { "imac10", 0xc0010000, 2048 * 4, 1920, 1080 },
+        [M_I27_11_1] = { "imac11", 0xc0010000, 2560 * 4, 2560, 1440 },
         [M_MINI]= { "mini", 0x80000000, 2048 * 4, 1024, 768 },
+        [M_MINI_3_1] = { "mini31", 0x40010000, 1024 * 4, 1024, 768 },
+        [M_MINI_4_1] = { "mini41", 0xc0010000, 2048 * 4, 1920, 1200 },
         [M_MB] = { "macbook", 0x80000000, 2048 * 4, 1280, 800 },
+        [M_MB_5_1] = { "macbook51", 0x80010000, 2048 * 4, 1280, 800 },
+        [M_MB_6_1] = { "macbook61", 0x80010000, 2048 * 4, 1280, 800 },
+        [M_MB_7_1] = { "macbook71", 0x80010000, 2048 * 4, 1280, 800 },
         [M_MBA] = { "mba", 0x80000000, 2048 * 4, 1280, 800 },
         [M_MBP] = { "mbp", 0x80010000, 1472 * 4, 1440, 900 },
         [M_MBP_2] = { "mbp2", 0, 0, 0, 0 }, /* placeholder */
+        [M_MBP_2_2] = { "mbp22", 0x80010000, 1472 * 4, 1440, 900 },
         [M_MBP_SR] = { "mbp3", 0x80030000, 2048 * 4, 1440, 900 },
         [M_MBP_4] = { "mbp4", 0xc0060000, 2048 * 4, 1920, 1200 },
         [M_MBP_5_1] = { "mbp51", 0xc0010000, 2048 * 4, 1440, 900 },
+        [M_MBP_5_2] = { "mbp52", 0xc0010000, 2048 * 4, 1920, 1200 },
+        [M_MBP_5_3] = { "mbp53", 0xd0010000, 2048 * 4, 1440, 900 },
+        [M_MBP_6_1] = { "mbp61", 0x90030000, 2048 * 4, 1920, 1200 },
+        [M_MBP_6_2] = { "mbp62", 0x90030000, 2048 * 4, 1680, 1050 },
+        [M_MBP_7_1] = { "mbp71", 0xc0010000, 2048 * 4, 1280, 800 },
         [M_UNKNOWN] = { NULL, 0, 0, 0, 0 }
 };
 
@@ -92,7 +120,12 @@ static const struct dmi_system_id dmi_system_table[] __initconst = {
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "iMac6,1", M_I24),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac6,1", M_I24),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac7,1", M_I20_SR),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac8,1", M_I24_8_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac10,1", M_I24_10_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac11,1", M_I27_11_1),
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "Macmini1,1", M_MINI),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "Macmini3,1", M_MINI_3_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "Macmini4,1", M_MINI_4_1),
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBook1,1", M_MB),
         /* At least one of these two will be right; maybe both? */
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBook2,1", M_MB),
@@ -101,14 +134,23 @@ static const struct dmi_system_id dmi_system_table[] __initconst = {
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBook3,1", M_MB),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook3,1", M_MB),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook4,1", M_MB),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook5,1", M_MB_5_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook6,1", M_MB_6_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook7,1", M_MB_7_1),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookAir1,1", M_MBA),
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro1,1", M_MBP),
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro2,1", M_MBP_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro2,2", M_MBP_2_2),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro2,1", M_MBP_2),
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro3,1", M_MBP_SR),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro3,1", M_MBP_SR),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro4,1", M_MBP_4),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,1", M_MBP_5_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,2", M_MBP_5_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,3", M_MBP_5_3),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro6,1", M_MBP_6_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro6,2", M_MBP_6_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro7,1", M_MBP_7_1),
         {},
 };
 
@@ -116,7 +158,7 @@ static int set_system(const struct dmi_system_id *id)
 {
         struct efifb_dmi_info *info = id->driver_data;
         if (info->base == 0)
-                return -ENODEV;
+                return 0;
 
         printk(KERN_INFO "efifb: dmi detected %s - framebuffer at %p "
                          "(%dx%d, stride %d)\n", id->ident,
@@ -124,18 +166,55 @@ static int set_system(const struct dmi_system_id *id)
                          info->stride);
 
         /* Trust the bootloader over the DMI tables */
-        if (screen_info.lfb_base == 0)
+        if (screen_info.lfb_base == 0) {
+#if defined(CONFIG_PCI)
+                struct pci_dev *dev = NULL;
+                int found_bar = 0;
+#endif
                 screen_info.lfb_base = info->base;
-        if (screen_info.lfb_linelength == 0)
-                screen_info.lfb_linelength = info->stride;
-        if (screen_info.lfb_width == 0)
-                screen_info.lfb_width = info->width;
-        if (screen_info.lfb_height == 0)
-                screen_info.lfb_height = info->height;
-        if (screen_info.orig_video_isVGA == 0)
-                screen_info.orig_video_isVGA = VIDEO_TYPE_EFI;
 
-        return 0;
+#if defined(CONFIG_PCI)
+                /* make sure that the address in the table is actually on a
+                 * VGA device's PCI BAR */
+
+                for_each_pci_dev(dev) {
+                        int i;
+                        if ((dev->class >> 8) != PCI_CLASS_DISPLAY_VGA)
+                                continue;
+                        for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+                                resource_size_t start, end;
+
+                                start = pci_resource_start(dev, i);
+                                if (start == 0)
+                                        break;
+                                end = pci_resource_end(dev, i);
+                                if (screen_info.lfb_base >= start &&
+                                                screen_info.lfb_base < end) {
+                                        found_bar = 1;
+                                }
+                        }
+                }
+                if (!found_bar)
+                        screen_info.lfb_base = 0;
+#endif
+        }
+        if (screen_info.lfb_base) {
+                if (screen_info.lfb_linelength == 0)
+                        screen_info.lfb_linelength = info->stride;
+                if (screen_info.lfb_width == 0)
+                        screen_info.lfb_width = info->width;
+                if (screen_info.lfb_height == 0)
+                        screen_info.lfb_height = info->height;
+                if (screen_info.orig_video_isVGA == 0)
+                        screen_info.orig_video_isVGA = VIDEO_TYPE_EFI;
+        } else {
+                screen_info.lfb_linelength = 0;
+                screen_info.lfb_width = 0;
+                screen_info.lfb_height = 0;
+                screen_info.orig_video_isVGA = 0;
+                return 0;
+        }
+        return 1;
 }
 
 static int efifb_setcolreg(unsigned regno, unsigned red, unsigned green,
diff --git a/drivers/video/pxa168fb.c b/drivers/video/pxa168fb.c
index c91a7f70f7b0..a31a77ff6f3d 100644
--- a/drivers/video/pxa168fb.c
+++ b/drivers/video/pxa168fb.c
@@ -298,8 +298,8 @@ static void set_dma_control0(struct pxa168fb_info *fbi)
          * Set bit to enable graphics DMA.
          */
         x = readl(fbi->reg_base + LCD_SPU_DMA_CTRL0);
-        x |= fbi->active ? 0x00000100 : 0;
-        fbi->active = 0;
+        x &= ~CFG_GRA_ENA_MASK;
+        x |= fbi->active ? CFG_GRA_ENA(1) : CFG_GRA_ENA(0);
 
         /*
          * If we are in a pseudo-color mode, we need to enable
@@ -559,7 +559,7 @@ static struct fb_ops pxa168fb_ops = {
         .fb_imageblit   = cfb_imageblit,
 };
 
-static int __init pxa168fb_init_mode(struct fb_info *info,
+static int __devinit pxa168fb_init_mode(struct fb_info *info,
                               struct pxa168fb_mach_info *mi)
 {
         struct pxa168fb_info *fbi = info->par;
@@ -599,7 +599,7 @@ static int __init pxa168fb_init_mode(struct fb_info *info,
         return ret;
 }
 
-static int __init pxa168fb_probe(struct platform_device *pdev)
+static int __devinit pxa168fb_probe(struct platform_device *pdev)
 {
         struct pxa168fb_mach_info *mi;
         struct fb_info *info = 0;
@@ -792,7 +792,7 @@ static struct platform_driver pxa168fb_driver = {
         .probe          = pxa168fb_probe,
 };
 
-static int __devinit pxa168fb_init(void)
+static int __init pxa168fb_init(void)
 {
         return platform_driver_register(&pxa168fb_driver);
 }
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index 559bf1727a2b..b52f8e4ef1fd 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -1701,6 +1701,9 @@ static int	sisfb_ioctl(struct fb_info *info, unsigned int cmd,
                 break;
 
            case FBIOGET_VBLANK:
+
+                memset(&sisvbblank, 0, sizeof(struct fb_vblank));
+
                 sisvbblank.count = 0;
                 sisvbblank.flags = sisfb_setupvbblankflags(ivideo, &sisvbblank.vcount, &sisvbblank.hcount);
 
diff --git a/drivers/video/via/ioctl.c b/drivers/video/via/ioctl.c
index da03c074e32a..4d553d0b8d7a 100644
--- a/drivers/video/via/ioctl.c
+++ b/drivers/video/via/ioctl.c
@@ -25,6 +25,8 @@ int viafb_ioctl_get_viafb_info(u_long arg)
 {
         struct viafb_ioctl_info viainfo;
 
+        memset(&viainfo, 0, sizeof(struct viafb_ioctl_info));
+
         viainfo.viafb_id = VIAID;
         viainfo.vendor_id = PCI_VIA_VENDOR_ID;
 
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index b036677df8c4..24efd8ea41bb 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -213,11 +213,11 @@ config OMAP_WATCHDOG
           here to enable the OMAP1610/OMAP1710/OMAP2420/OMAP3430/OMAP4430 watchdog timer.
 
 config PNX4008_WATCHDOG
-        tristate "PNX4008 Watchdog"
-        depends on ARCH_PNX4008
+        tristate "PNX4008 and LPC32XX Watchdog"
+        depends on ARCH_PNX4008 || ARCH_LPC32XX
         help
           Say Y here if to include support for the watchdog timer
-          in the PNX4008 processor.
+          in the PNX4008 or LPC32XX processor.
           This driver can be built as a module by choosing M. The module
           will be called pnx4008_wdt.
 
diff --git a/drivers/watchdog/sb_wdog.c b/drivers/watchdog/sb_wdog.c
index 88c83aa57303..f31493e65b38 100644
--- a/drivers/watchdog/sb_wdog.c
+++ b/drivers/watchdog/sb_wdog.c
@@ -305,7 +305,7 @@ static int __init sbwdog_init(void)
         if (ret) {
                 printk(KERN_ERR "%s: failed to request irq 1 - %d\n",
                                                 ident.identity, ret);
-                return ret;
+                goto out;
         }
 
         ret = misc_register(&sbwdog_miscdev);
@@ -313,14 +313,20 @@ static int __init sbwdog_init(void)
                 printk(KERN_INFO "%s: timeout is %ld.%ld secs\n",
                                 ident.identity,
                                 timeout / 1000000, (timeout / 100000) % 10);
-        } else
-                free_irq(1, (void *)user_dog);
+                return 0;
+        }
+        free_irq(1, (void *)user_dog);
+out:
+        unregister_reboot_notifier(&sbwdog_notifier);
+
         return ret;
 }
 
 static void __exit sbwdog_exit(void)
 {
         misc_deregister(&sbwdog_miscdev);
+        free_irq(1, (void *)user_dog);
+        unregister_reboot_notifier(&sbwdog_notifier);
 }
 
 module_init(sbwdog_init);
diff --git a/drivers/watchdog/ts72xx_wdt.c b/drivers/watchdog/ts72xx_wdt.c
index 458c499c1223..18cdeb4c4258 100644
--- a/drivers/watchdog/ts72xx_wdt.c
+++ b/drivers/watchdog/ts72xx_wdt.c
@@ -449,6 +449,9 @@ static __devinit int ts72xx_wdt_probe(struct platform_device *pdev)
         wdt->pdev = pdev;
         mutex_init(&wdt->lock);
 
+        /* make sure that the watchdog is disabled */
+        ts72xx_wdt_stop(wdt);
+
         error = misc_register(&ts72xx_wdt_miscdev);
         if (error) {
                 dev_err(&pdev->dev, "failed to register miscdev\n");
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index 29bac5118877..d409495876f1 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -755,7 +755,10 @@ int register_xenstore_notifier(struct notifier_block *nb)
 {
         int ret = 0;
 
-        blocking_notifier_chain_register(&xenstore_chain, nb);
+        if (xenstored_ready > 0)
+                ret = nb->notifier_call(nb, 0, NULL);
+        else
+                blocking_notifier_chain_register(&xenstore_chain, nb);
 
         return ret;
 }
@@ -769,7 +772,7 @@ EXPORT_SYMBOL_GPL(unregister_xenstore_notifier);
 
 void xenbus_probe(struct work_struct *unused)
 {
-        BUG_ON((xenstored_ready <= 0));
+        xenstored_ready = 1;
 
         /* Enumerate devices in xenstore and watch for changes. */
         xenbus_probe_devices(&xenbus_frontend);
@@ -835,8 +838,8 @@ static int __init xenbus_init(void)
                         xen_store_evtchn = xen_start_info->store_evtchn;
                         xen_store_mfn = xen_start_info->store_mfn;
                         xen_store_interface = mfn_to_virt(xen_store_mfn);
+                        xenstored_ready = 1;
                 }
-                xenstored_ready = 1;
         }
 
         /* Initialize the interface to xenstore. */